Server Load Balancer:Best practice for migrating from a self-managed NGINX Ingress to an ALB Ingress

Migration process

Resolve a domain name to an NGINX Ingress and an ALB Ingress and gradually adjust the weights of the Ingresses. This ensures transparent migration for your business. The following figure shows the procedure for migrating traffic by using Alibaba Cloud DNS. For more information about each step, see Migration example.

Migration example

This example demonstrates the migration process.

A company installed the NGINX Ingress controller in an ACK cluster and configured an Internet-facing LoadBalancer Service for the controller. The controller is automatically associated with an Internet-facing Classic Load Balancer (CLB) instance. The company configured a DNS record to map the domain name www.example.net to the CLB instance. Requests destined for the domain name are resolved to the CLB instance, which forwards the requests to backend pods.

Step 1: Configure an ALB Ingress

As businesses develop, the performance of NGINX Ingresses cannot meet business requirements. NGINX Ingresses also generate high O&M costs. The company wants to migrate network traffic from the NGINX Ingress to an ALB Ingress. During the migration process, the company uses the migration tool provided by ACK to convert NGINX Ingress configurations to ALB Ingress configurations, and add the ALB Ingress to the DNS resolution configurations. In the DNS resolution configurations, the ALB Ingress has a lower priority than the NGINX Ingress.

Step 2: Gradually migrate traffic to the ALB Ingress

After the company runs tests and verifies that the ALB Ingress can forward traffic as expected, the company increases the weight of the DNS record for the ALB Ingress to allow more traffic to the ALB Ingress.

Step 3: Delete resources related to the NGINX Ingress

After all traffic is migrated to the ALB Ingress, the company deletes DNS configurations related to the NGINX Ingress, releases resources related to the NGINX Ingress, and uninstalls the NGINX Ingress controller. After the company completes Step 1 to Step 3, all network traffic is migrated from the NGINX Ingress to the ALB Ingress. The migration process is transparent to users.

Prerequisites

A kubectl client is connected to the ACK cluster. For more information, see Obtain the kubeconfig file of a cluster and use kubectl to connect to the cluster.

Step 1: Configure an ALB Ingress

1. Log on to the ACK console and install the ALB Ingress controller in the cluster that you want to migrate. For more information, see Manage the ALB Ingress controller. Set Gateway Source to None because the migration tool automatically converts the AlbConfig, IngressClass, and Ingress.

   Important

   To allow access from the ALB Ingress to an ACK dedicated cluster, grant access permissions to the ALB Ingress controller before you deploy Services. For more information, see Authorize an ACK dedicated cluster to access the ALB Ingress controller.

2. Create a YAML file named ingress2albconfig.yaml and copy the following content to the file:

   apiVersion: batch/v1
   kind: Job
   metadata:
     name: ingress2albconfig
     namespace: default
   spec:
     template:
       spec:
         containers:
         - name: ingress2albconfig
           image: registry.cn-hangzhou.aliyuncs.com/acs/ingress2albconfig:latest
           command: ["/bin/ingress2albconfig", "print"]
         restartPolicy: Never
         serviceAccount: ingress2albconfig
         serviceAccountName: ingress2albconfig
     backoffLimit: 4
   ---
   apiVersion: rbac.authorization.k8s.io/v1
   kind: ClusterRole
   metadata:
     name: system:ingress2albconfig
   rules:
   - apiGroups:
     - networking.k8s.io
     resources:
     - ingresses
     - ingressclasses
     verbs:
     - get
     - list
     - watch
     - update
     - create
     - patch
   ---
   apiVersion: v1
   kind: ServiceAccount
   metadata:
     name: ingress2albconfig
     namespace: default
   ---
   kind: ClusterRoleBinding
   apiVersion: rbac.authorization.k8s.io/v1
   metadata:
     name: system:ingress2albconfig
   roleRef:
     apiGroup: rbac.authorization.k8s.io
     kind: ClusterRole
     name: system:ingress2albconfig
   subjects:
     - kind: ServiceAccount
       name: ingress2albconfig
       namespace: default

3. Run the following code to run the Job. The Job automatically converts the configurations of the NGINX Ingress controller to AlbConfig, IngressClass, and Ingress configurations and outputs the configurations. You can view the configurations in the logs.

   kubectl apply -f ingress2albconfig.yaml

   Expected output:

   job.batch/ingress2albconfig created
   clusterrole.rbac.authorization.k8s.io/system:ingress2albconfig created
   serviceaccount/ingress2albconfig created
   clusterrolebinding.rbac.authorization.k8s.io/system:ingress2albconfig created

4. View the pod to which the Job belongs.

   kubectl get pod -l job-name=ingress2albconfig

   Expected output:

   NAME                READY   STATUS      RESTARTS   AGE
   ingress2albconfig-vw***   0/1     Completed   0          16m

5. View the logs of the pod.

   kubectl logs ingress2albconfig-vw*** # Replace it with the Pod name obtained in the last step.

   The following code shows the expected output. After you use the kubectl to deploy the resources to the cluster, the ALB Ingress is configured.

   apiVersion: alibabacloud.com/v1
   kind: AlbConfig
   metadata:
     creationTimestamp: null
     name: from_nginx
   spec:
     config:
       accessLogConfig: {}
       edition: Standard
       name: from_nginx
       tags:
       - key: converted/ingress2albconfig
         value: "true"
       zoneMappings:
       - vSwitchId: vsw-xxx # Replace it with the ID of the vSwitch in the VPC.
       - vSwitchId: vsw-xxx # Replace it with the ID of the vSwitch in the VPC.
     listeners:
     - port: 80
       protocol: HTTP
   ---
   apiVersion: networking.k8s.io/v1
   kind: IngressClass
   metadata:
     creationTimestamp: null
     name: from_nginx
   spec:
     controller: ingress.k8s.alibabacloud/alb
     parameters:
       apiGroup: alibabacloud.com
       kind: AlbConfig
       name: from_nginx
       scope: null
   ---
   apiVersion: networking.k8s.io/v1
   kind: Ingress
   metadata:
     annotations:
       alb.ingress.kubernetes.io/listen-ports: '[{"HTTP":80}]'
     creationTimestamp: null
     name: from_ingress1
     namespace: default
   spec:
     ingressClassName: from_nginx
     rules:
     - http:
         paths:
         - backend:
             service:
               name: nginx-svc-g1msr
               port:
                 number: 80
           path: /
           pathType: Prefix
   status:
     loadBalancer: {}

Step 2: Gradually migrate traffic to the ALB Ingress

Step 3: Delete resources related to the NGINX Ingress

After you close all persistent connections on the NGINX Ingress and no traffic is forwarded to the NGINX Ingress, you can release redundant resources after a period of observation.

1. Log on to the Alibaba Cloud DNS console and delete all DNS records that are related to the NGINX Ingress.

2. Uninstall the NGINX Ingress controller.

   1. Log on to the ACK console. In the left-side navigation pane, click Clusters.

   2. On the Clusters page, find the cluster that you want to manage, and click the cluster name. In the left-side navigation pane, choose Network > Ingresses.

   3. Find the NGINX Ingress and choose > Delete in the Actions column. In the message that appears, click OK.

   4. In the left-side navigation pane, choose Operations > Add-ons. Click the Networking tab, find the Nginx Ingress Controller card, and then click Uninstall.

   5. In the message that appears, click OK.

      Note

      The CLB instance that is associated with the NGINX Ingress controller is released along with the NGINX Ingress controller. You are no longer charged for the released resources.

References

• ALB supports multiple configuration methods. For more information, see Use AlbConfig to configure ALB instances.

• For more information about how to enable HTTPS for the ALB Ingress, see Configure certificates for encrypted communication over HTTPS.

• For more information about the annotations supported by the ALB Ingress, see ALB Ingress GlobalConfiguration dictionary.