Docs

Volcengine Kubernetes Engine

Customize ALB Ingress forwarding rules

Configuring forward traffic throttling

ALB Ingresses allow you to configure the throttling feature. When requests pass through ALB instances, the ALB instances can perform QoS throttling on specific access requests.

warning

Before configuring an ALB Ingress, thoroughly read the Considerations for using ALB Ingresses topic.

Prerequisites

The cluster has been connected. For details, see Connecting to clusters.

An ALB instance has been created. For details, see Creating ALB Ingresses via kubectl.

The alb-ingress-controller add-on has been installed and upgraded to v0.35.0 or later. For details, see Upgrading add-ons.

Usage limits

You need to configure the Speed limit forwarding action together with the Forward to forwarding action. For more limits and considerations, see Creating forwarding rules (Standard edition) and Creating forwarding rules (Basic edition).

Procedure

Configure by using the console

You can configure traffic throttling in an ALB Ingress by using the console. The configuration slightly varies based on whether the ALB Ingress uses a Standard edition ALB instance or a Basic edition ALB instance.

Standard edition ALB

Basic edition ALB

In the left navigation bar, click Cluster.

On the cluster list page, click the target cluster for which you need to configure an Ingress.

In the left navigation bar of the cluster management page, click Services and Ingresses > Ingress. On the page that appears, click Create Ingress.

Select Application Load Balancer (ALB) for Ingress type.

In the Forwarding configuration section, select the Enable check box to configure custom forwarding rules.

Parameter	Description
Forwarding conditions	Configure forwarding conditions, including the domain name, path, and HTTP header. Forwarding conditions can be configured individually or in combination. When multiple forwarding conditions are configured, the logical relationship between these forwarding conditions is AND. For example, if you configure both a domain name and a path in a forwarding rule, then only requests that match the specified domain name and path will match this forwarding rule. Multiple values can be configured within the same forwarding condition, and these values have a logical relationship of OR. For example, if you configure multiple values for a domain name condition, requests that match any of the values are a match for the rule.
Forwarding actions	Configure a forwarding action. Specify the forwarding action speed limit and set the QPS value for throttling. Specify the forwarding action Forward to, and specify an existing service by its name, port number, and weight. tip If you specify the speed limit action, you must also configure the Forward to action to specify the forwarding paths that require traffic throttling.

Click Confirm.

Configure by using kubectl

ALB Ingresses allow you to configure forward traffic throttling by using annotations. The configuration slightly varies based on whether the ALB Ingress uses a Standard edition ALB instance or a Basic edition ALB instance.

Standard edition ALB

Basic edition ALB

The following content provides sample configurations and annotation descriptions for an ALB Ingress that uses a Standard ALB instance.{service-name}} field in the annotation must match the name of the back-end service configured in spec.rules. For example, in this case, the correct annotation is ingress.vke.volcengine.com/loadbalancer-actions.service-demo.

The following table describes fields in the ingress.vke.volcengine.com/loadbalancer-actions.{{service-name}} annotation.

Parameter	Type	Description	default value
type	String	The action type of the custom forwarding rule. When you configure forward traffic throttling, you need to set the value to TrafficLimit.	No
trafficLimitConfig.qps	Integer	The requests per second for the forwarding rule. The value range is 100 to 400,000.	No

Validating results

Viewing configuration

tip

The details pages of forwarding rules differ between Standard edition ALB instances and Basic edition ALB instances. This topic provides an example of viewing the details page of a forwarding rule for a Standard edition ALB instance.

Click Instance in the left navigation bar. In the instance list, find the target ALB instance and click Listener in the Actions column.

On the listener details page, find the target listener. In the Actions column, click Edit forwarding rules to view the existing forwarding rules of the listener. You can view the newly added throttling rule.

For a forwarding rule, click to view rule details. The rule details should be consistent with the configured ones.

Verify access

tip

Before verification, make sure that you have deployed applications and services in the cluster. In this example, an Nginx image is used and the service path is /. For deployment steps, see Using ALB Ingresses for service deployment.

You can use multiple tools to validate the throttling feature. This topic takes Apache Bench (ab) as an example for reference purposes only.

(Optional) Configure the mapping relationship between the domain name and the IP address in your local environment for DNS resolution. In this example, 14.***.***.*** is the public IP address of the ALB instance.

echo "14.***.***.*** example.com" >> /etc/hosts

Run the ab stress test command and set the total number of requests and the concurrency level so that they exceed the throttling threshold. -n indicates the total number of requests, and -c indicates the number of concurrent requests.

ab -n 2000 -c 200 http://example.com/

The expected result is as follows: The Requests per second parameter in the test report indicates the actual QPS, which is consistent with the expected value.

...
Server Software: nginx/1.25.3
Server Hostname: example.com
Server Port: 80

Document Path: /
Document Length: 615 bytes

Concurrency Level: 200
Time taken for tests: 20.012 seconds # The stress test duration is about 20 seconds.
Complete requests: 2000 # The total number of requests.
Failed requests: 1002 # Requests that exceed the rate limit are rejected (429 error).
(Connect: 0, Receive: 0, Length: 0, Exceptions: 0)
Non-2xx responses: 1002 # The number of requests with the 429 status code.
Total transferred: 1674306 bytes
HTML transferred: 1230000 bytes
Requests per second: 99.94 [sec] (mean) # The actual QPS, which is close to the configured throttling value (100).
Time per request: 2001.183 [ms] (mean) # The average duration per request, which can increase due to queuing.
Time per request: 10.006 [ms] (mean, across all concurrent requests)
Transfer rate: 81.70 [Kbytes/sec] received

Connection Times (ms)
min mean[+/-sd] median max
Connect: 0 1 2.3 0 20
Processing: 2 1980 345.2 2000 2500
Waiting: 2 1970 340.1 1990 2480
Total: 2 1981 345.0 2000 2520
...

Last updated: 2026.07.24 14:51:38

Parameters	Type	Description	Default value
host	String	The domain name that the rule applies to.	No
path	String	The path the rule applies to.	No
trafficLimitQps	Integer	The requests per second for the forwarding rule. The value range is 100 to 100,000. tip If you do not specify a value, no traffic limit is applied.	No