容器计算服务 ACS：ALB Ingress服务高级用法

基于域名转发请求

通过创建一个简单的Ingress，根据指定的正常域名或空域名转发请求，示例如下。

基于URL路径转发请求

三种匹配方式的示例如下：

配置健康检查

ALB Ingress支持配置健康检查，可以通过设置以下注解来实现。

配置健康检查的YAML示例如下所示：

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: cafe-ingress
  annotations:
    alb.ingress.kubernetes.io/healthcheck-enabled: "true"
    alb.ingress.kubernetes.io/healthcheck-path: "/"
    alb.ingress.kubernetes.io/healthcheck-protocol: "HTTP"
    alb.ingress.kubernetes.io/healthcheck-method: "HEAD"
    alb.ingress.kubernetes.io/healthcheck-httpcode: "http_2xx"
    alb.ingress.kubernetes.io/healthcheck-timeout-seconds: "5"
    alb.ingress.kubernetes.io/healthcheck-interval-seconds: "2"
    alb.ingress.kubernetes.io/healthy-threshold-count: "3"
    alb.ingress.kubernetes.io/unhealthy-threshold-count: "3"
spec:
  ingressClassName: alb
  rules:
  - http:
      paths:
      # 配置Context Path
      - path: /tea
        backend:
          service:
            name: tea-svc
            port:
              number: 80
      # 配置Context Path
      - path: /coffee
        backend:
          service:
            name: coffee-svc
            port:
              number: 80

配置HTTP重定向至HTTPS

ALB Ingress通过设置注解alb.ingress.kubernetes.io/ssl-redirect: "true"，可以将HTTP请求重定向到HTTPS 443端口。

配置示例如下：

apiVersion: v1
kind: Service
metadata:
  name: demo-service-ssl
  namespace: default
spec:
  ports:
    - name: port1
      port: 80
      protocol: TCP
      targetPort: 8080
  selector:
    app: demo-ssl
  sessionAffinity: None
  type: ClusterIP
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: demo-ssl
  namespace: default
spec:
  replicas: 1
  selector:
    matchLabels:
      app: demo-ssl
  template:
    metadata:
      labels:
        app: demo-ssl
    spec:
      containers:
        - image: registry.cn-hangzhou.aliyuncs.com/alb-sample/cafe:v1
          imagePullPolicy: IfNotPresent
          name: demo-ssl
          ports:
            - containerPort: 8080
              protocol: TCP
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    alb.ingress.kubernetes.io/ssl-redirect: "true"
  name: demo-ssl
  namespace: default
spec:
  ingressClassName: alb
  tls:
  - hosts:
    - ssl.alb.ingress.top
  rules:
    - host: ssl.alb.ingress.top
      http:
        paths:
          - backend:
              service:
                name: demo-service-ssl
                port: 
                  number: 80
            path: /
            pathType: Prefix

支持后端HTTPS和gRPC协议

当前ALB后端协议支持HTTPS和gRPC协议，通过ALB Ingress只需要在注解中配置alb.ingress.kubernetes.io/backend-protocol: "grpc"或alb.ingress.kubernetes.io/backend-protocol: "https"即可。使用Ingress转发gRPC服务需要对应域名拥有SSL证书，使用TLS协议进行通信。配置gRPC协议的示例如下：

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    alb.ingress.kubernetes.io/backend-protocol: "grpc"
  name: lxd-grpc-ingress
spec:
  ingressClassName: alb
  tls:
  - hosts:
    - demo.alb.ingress.top
  rules:
  - host: demo.alb.ingress.top
    http:
      paths:  
      - path: /
        pathType: Prefix
        backend:
          service:
            name: grpc-demo-svc
            port:
              number: 9080

配置正则表达

自定义转发条件中配置，需要用户自己在path路径上编写正则表达式。配置示例如下：

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
   alb.ingress.kubernetes.io/use-regex: "true" # 允许path字段使用正则表达式。
   alb.ingress.kubernetes.io/conditions.service-a: | # 该注解中的服务为集群中已存在的服务，且服务名称必须和rule字段backend下的服务名称保持一致。
     [{
       "type": "Path",
       "pathConfig": {
           "values": [
              "~*^/pathvalue1", # 正则表达式前需要添加~*作为正则标志，~*后的内容为实际生效的正则表达式。
              "/pathvalue2" # 精确匹配前无需添加~*。
           ]
       }
      }]
  name: ingress-example
spec:
  ingressClassName: alb
  rules:
   - http:
      paths:
      - path: /test
        pathType: Prefix
        backend:
          service:
            name: service-a
            port:
              number: 88

支持Rewrite重写

当前ALB支持Rewrite重写，通过ALB Ingress只需要在注解中配置alb.ingress.kubernetes.io/rewrite-target: /path/${2} 即可。规则如下：

• 在rewrite-target注解中，${number}类型的变量需要在路径为Prefix类型的path上配置。

• path默认无法配置正则符号，例如*、?等，您需要通过配置rewrite-target注解使用正则符号。

• path必须以 / 开头。

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    alb.ingress.kubernetes.io/use-regex: "true" # 允许path字段使用正则表达式。
    alb.ingress.kubernetes.io/rewrite-target: /path/${2} # 该注解支持正则表达式替换。
  name: rewrite-ingress
spec:
  ingressClassName: alb
  rules:
  - host: demo.alb.ingress.top
    http:
      paths:
      - path: /something(/|$)(.*)
        pathType: Prefix
        backend:
          service:
            name: rewrite-svc
            port:
              number: 9080

配置自定义监听端口

当前支持Ingress配置自定义监听端口。通过该方式，可以将服务同时暴露80端口和443端口，配置示例如下：

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: cafe-ingress
  annotations:
   alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80},{"HTTPS": 443}]'
spec:
  ingressClassName: alb
  tls:
  - hosts:
    - demo.alb.ingress.top
  rules:
  - host: demo.alb.ingress.top
    http:
      paths:
      - path: /tea
        pathType: ImplementationSpecific
        backend:
          service:
            name: tea-svc
            port:
              number: 80

配置转发规则优先级

如果您不想修改Ingress的namespace/name字段，可以配置以下Ingress注解定义ALB转发规则优先级：

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: cafe-ingress
  annotations:
   alb.ingress.kubernetes.io/order: "2"
spec:
  ingressClassName: alb
  rules:
  - host: demo.alb.ingress.top
    http:
      paths:
      - path: /tea
        pathType: ImplementationSpecific
        backend:
          service:
            name: tea-svc
            port:
              number: 80

通过注解实现灰度发布

ALB提供复杂路由处理能力，支持基于Header、Cookie以及权重的灰度发布功能。灰度发布功能可以通过设置注解来实现，为了启用灰度发布功能，需要设置注解alb.ingress.kubernetes.io/canary: "true"，通过不同注解可以实现不同的灰度发布功能：

• alb.ingress.kubernetes.io/canary-by-header和alb.ingress.kubernetes.io/canary-by-header-value：匹配的Request Header的值，该规则允许您自定义Request Header的值，但必须与alb.ingress.kubernetes.io/canary-by-header一起使用。

  • 当请求中的header和header-value与设置的值匹配时，请求流量会被分配到灰度服务入口。

  • 对于其他header值，将会忽略header，并通过灰度优先级将请求流量分配到其他规则设置的灰度服务。

  当请求Header为location: hz时将访问灰度服务；其他Header将根据灰度权重将流量分配给灰度服务。配置示例如下：

  apiVersion: networking.k8s.io/v1
  kind: Ingress
  metadata:
    annotations:
      alb.ingress.kubernetes.io/order: "1"
      alb.ingress.kubernetes.io/canary: "true"
      alb.ingress.kubernetes.io/canary-by-header: "location"
      alb.ingress.kubernetes.io/canary-by-header-value: "hz"
    name: demo-canary
    namespace: default
  spec:
    ingressClassName: alb
    rules:
      - http:
          paths:
            - backend:
                service:
                  name: demo-service-hello
                  port: 
                    number: 80
              path: /hello
              pathType: ImplementationSpecific

• alb.ingress.kubernetes.io/canary-by-cookie：基于Cookie的流量切分。

  • 当配置的cookie值为always时，请求流量将被分配到灰度服务入口。

  • 当配置的cookie值为never时，请求流量将不会分配到灰度服务入口。

  说明

  基于Cookie的灰度不支持设置自定义，只有always和never。

  请求的Cookie为demo=always时将访问灰度服务。配置示例如下：

  apiVersion: networking.k8s.io/v1
  kind: Ingress
  metadata:
    annotations:
      alb.ingress.kubernetes.io/order: "2"
      alb.ingress.kubernetes.io/canary: "true"
      alb.ingress.kubernetes.io/canary-by-cookie: "demo"
    name: demo-canary-cookie
    namespace: default
  spec:
    ingressClassName: alb
    rules:
      - http:
          paths:
            - backend:
                service:
                  name: demo-service-hello
                  port: 
                    number: 80
              path: /hello
              pathType: ImplementationSpecific

• alb.ingress.kubernetes.io/canary-weight：设置请求到指定服务的百分比（值为0~100的整数）。

  配置灰度服务的权重为50%，示例如下：

  apiVersion: networking.k8s.io/v1
  kind: Ingress
  metadata:
    annotations:
      alb.ingress.kubernetes.io/order: "3"
      alb.ingress.kubernetes.io/canary: "true"
      alb.ingress.kubernetes.io/canary-weight: "50"
    name: demo-canary-weight
    namespace: default
  spec:
    ingressClassName: alb
    rules:
      - http:
          paths:
            - backend:
                service:
                  name: demo-service-hello
                  port: 
                    number: 80
              path: /hello
              pathType: ImplementationSpecific

通过注解实现会话保持

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: cafe-ingress-v3
  annotations:
    alb.ingress.kubernetes.io/sticky-session: "true"
    alb.ingress.kubernetes.io/sticky-session-type: "Insert"
    alb.ingress.kubernetes.io/cookie-timeout: "1800"
spec:
  ingressClassName: alb
  rules:
  - http:
      paths:
      #配置Context Path。
      - path: /tea2
        backend:
          service:
            name: tea-svc
            port: 
             number: 80
      # 配置Context Path。
       - path: /coffee2
         backend:
           service:
              name: coffee-svc
              port: 
               number: 80

指定服务器组负载均衡算法

ALB Ingress支持通过设置Ingress注解alb.ingress.kubernetes.io/backend-scheduler指定服务器组负载均衡算法。配置示例如下（目前集群版本默认高于1.19）：

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: cafe-ingress
  annotations:
    alb.ingress.kubernetes.io/backend-scheduler: "uch" # 此处的uch可按需配置为wrr、sch和wlc。
    alb.ingress.kubernetes.io/backend-scheduler-uch-value: "test" # 仅负载均衡算法为uch时，需要配置此参数。当调度算法为wrr、sch或wlc均无需配置此参数。
  name: cafe-ingress
spec:
  ingressClassName: alb
  rules:
  - host: demo.alb.ingress.top
    http:
      paths:
      - path: /tea
        pathType: ImplementationSpecific
        backend:
          service:
            name: tea-svc
            port:
              number: 80

跨域配置

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: alb-ingress
  annotations:
    alb.ingress.kubernetes.io/enable-cors: "true"
    alb.ingress.kubernetes.io/cors-expose-headers: ""
    alb.ingress.kubernetes.io/cors-allow-methods: "GET,POST"
    alb.ingress.kubernetes.io/cors-allow-credentials: "true"
    alb.ingress.kubernetes.io/cors-max-age: "600"

spec:
  ingressClassName: alb
  rules:
  - host: demo.alb.ingress.top
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: cloud-nodeport
            port:
              number: 80

后端长连接

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: alb-ingress
  annotations:
    alb.ingress.kubernetes.io/backend-keepalive: "true"
spec:
  ingressClassName: alb
  rules:
  - host: demo.alb.ingress.top
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: cloud-nodeport
            port:
              number: 80

支持QPS限速

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: cafe-ingress
  annotations:
    alb.ingress.kubernetes.io/traffic-limit-qps: "50"
spec:
  ingressClassName: alb
  rules:
   - host: demo.alb.ingress.top
     http:
      paths:
      - path: /tea
        pathType: ImplementationSpecific
        backend:
          service:
            name: tea-svc
            port:
              number: 80
      - path: /coffee
        pathType: ImplementationSpecific
        backend:
          service:
            name: coffee-svc
            port:
              number: 80