Container Service for Kubernetes:Usage notes of the NGINX Ingress controller

You can modify system settings and tune NGINX parameters to optimize the performance of the NGINX Ingress controller:

• Modify system settings: By default, some common settings of the operating systems provided by Alibaba Cloud are optimized. You can also modify other system settings, such as the backlog queue and the maximum range of ports that are available. After you modify the system settings, the NGINX Ingress controller can process a large number of concurrent connections. This also prevents connection failures due to insufficient ports.

• Tune NGINX parameters:

  • Maximum number of connections that each worker process can handle: You can modify the maximum number of connections to each worker to ensure that the NGINX Ingress controller can process a large number of concurrent connections.

  • Keepalive requests: The NGINX Ingress controller sends requests to backend pods through keepalive connections. You can increase the maximum number of requests that can be processed on each keepalive connection. This way, keepalive connections can be persisted longer to process more requests.

  • Keepalive timeout: Make sure that the timeout period of keepalive connections to the backend pods is not shorter than the timeout period of connections to the NGINX Ingress controller. By default, the timeout period of connections to the NGINX Ingress controller is 900 seconds for ACK clusters.

Add the following configuration to the pod template:

apiVersion: apps/v1
kind: Deployment
spec:
  template:
    spec:
      containers:
      - name: app
        lifecycle:
          # Configure a PreStop hook to keep the pod running for 30 seconds before it is terminated. 
          # You can specify the sleep command in the pod template. 
          preStop:
            exec:
              command:
              - sleep
              - 30

The NGINX Ingress controller provides the Ingress dashboard based on Simple Log Service and Managed Service for Prometheus, which helps you gain better insights into the traffic to your service.

• Log Service:

  • If you select Enable Log Service and Create Ingress Dashboard when you create a cluster, log on to the ACK console, choose Network > Ingresses, and then you can view the Ingress dashboard provided by ACK based on Simple Log Service in the Ingress Overview section. You can also choose Operations > Log Center to view the log of the NGINX Ingress controller. For more information, see Analyze and monitor the access log of nginx-ingress.

  • If you do not select Enable Log Service or Create Ingress Dashboard when you create a cluster, you can manually configure components and rules for log collection. For more information, see Analyze and monitor the access log of nginx-ingress. For more information about how to monitor the NGINX Ingress controller, see Ingress dashboard monitoring.

• Managed Service for Prometheus: You can enable Managed Service for Prometheus when you create a cluster. You can also choose Operations > Prometheus Monitoring to enable and access Managed Service for Prometheus after you create a cluster. For more information, see Use Managed Service for Prometheus to monitor an ACK cluster.

  Note

  If you use Managed Service for Prometheus, add the host field to the Ingresses that are created in the cluster. Otherwise, some Ingress metrics are not displayed by default. You can also add --metrics-per-host=false to the startup parameter of the controller in the Deployment of the NGINX Ingress controller to resolve the issue.

To block malicious requests, you can log on to the Web Application Firewall (WAF) console or Application Load Balancer (ALB) console and enable WAF or transparent WAF for the CLB instance that is used by the NGINX Ingress controller. To enable WAF or transparent WAF on HTTPS ports, you must configure the required certificate in the console. The following issues may occur when you configure the certificate:

• Transport Layer Security (TLS) requests are blocked by WAF or transparent WAF. Therefore, the certificate that is configured in the Secret of the cluster is not exposed to the Internet.

• When you use the IP address of the CLB instance or the cluster IP address of the LoadBalancer Service to access port 443 from within the cluster, traffic may fail to pass through WAF or transparent WAF. As a result, an error occurs when the system returns the certificate.

• When WAF or transparent WAF is enabled, the NGINX Ingress controller cannot preserve client IP addresses by default. You can add the following content to the ConfigMap of the NGINX Ingress controller to enable the realip module of NGINX and use the X-Forwarded-For header to preserve client IP addresses. If you install the NGINX Ingress controller from the Add-ons page, the ConfigMap is named nginx-configuration and belongs to the kube-system namespace by default.

  use-forwarded-headers: "true" # Use this option if the version of the NGINX Ingress controller is 0.30.0 or earlier. 
  enable-real-ip: "true" # Use this option if the version of the NGINX Ingress controller is 0.44.0 or later. 
  proxy-real-ip-cidr: <The back-to-origin CIDR block that you obtain from WAF>

By default, the NGINX Ingress controller connects to backend Services over HTTP. The NGINX Ingress controller supports the following protocols for connecting to backend Services: WebSocket, HTTPS, and gRPC. For more information about the protocols that are supported by the NGINX Ingress controller, see Backend Protocol.

• WebSocket: The NGINX Ingress controller supports the WebSocket by default. You do not need to configure the NGINX Ingress controller to distribute WebSocket requests. If you want to keep WebSocket connections alive, you can adjust the timeout period of connections to backend Services by using annotations. This prevents service interruptions that are caused by connection timeouts. For more information, see Custom timeouts.

• HTTPS: You can add the annotation nginx.ingress.kubernetes.io/backend-protocol:"HTTPS" in the Ingress if you want to access HTTPS Services through the NGINX Ingress controller.

• gRPC: gRPC services can be accessed only through TLS ports. Make sure that TLS-encrypted connections are used when you access gRPC services through the NGINX Ingress controller. For more information about how to configure gRPC, see Deploy gRPC services on the backend of the NGINX Ingress controller.