Docs

Volcengine Kubernetes Engine

ALB Ingress

Creating an ALB Ingress through the console

The Application Load Balancer (ALB) Ingress is built on the Volcano Engine ALB. It offers powerful Ingress traffic management, meeting stability and availability demands for large-scale Layer 7 cloud-native application processing.

warning

Before configuring an ALB Ingress, thoroughly read the ALB Ingress considerations topic.

Prerequisites

(Optional) If you want to create an ALB Ingress that uses HTTPS, make sure that a certificate has been created. For details, see Configuring ALB Ingresses over HTTPS.

warning

To use certificates from Certificate Center, log in to the Volcano Engine console with your account, click Service authorization, and on the page that appears, click Authorize now to complete cross-service authorization.

(Optional) To associate with a Standard edition ALB instance, ensure that the alb-ingress-controller add-on has been upgraded to v0.35.0 or later. For details, see Upgrading add-ons.

(Optional) To configure the following features of the ALB instance, upgrade the alb-ingress-controller add-on to v0.31.0 or later. For details, see Upgrading add-ons.

To configure WAF protection for an ALB instance, create a Web Application Firewall instance in advance. For details, see Creating WAF instances.

To configure the log delivery feature for an ALB instance, create a log project and a log topic in advance. For details, see Log projects and Log topics.

To configure an access control list (ACL) for an ALB listener, configure an access policy group in advance. For details, see Access control.

To specify custom configurations for the listener, create them in advance. For details, see Custom configurations.

Procedure

In the left navigation bar, click Cluster.

On the cluster list page, click the target cluster for which you need to configure an Ingress.

In the left navigation bar of the cluster management page, click Services and Ingresses > Ingress. Then click Create Ingress.

Configure the Ingress based on the following instructions.

Basic configuration

Parameter	Description
Name	Specify an Ingress name based on the on-screen prompts. The name must be unique within the same namespace.
Namespace	Select the namespace to which the Ingress belongs. We recommend that you select the namespace created by yourself or the default namespace created by the system. For details about namespaces, see Namespace overview.
Annotation	Click Add annotation to create an annotation, which is a key-value pair. You can also configure specific annotations in the Ingress YAML files to achieve more comprehensive Layer 7 LoadBalancer capabilities and more diverse service routing rules. For details, see Configuring ALB Ingresses by using annotations.

Ingress configuration

Parameter
Description
Ingress type
Specify the type of the Ingress controller. For this example, select Application Load Balancer (ALB).

Load balancer configuration

Parameter	Description
LB-to-pod direct access mode	It is available only to clusters using the VPC-CNI network model. This mode is enabled by default. This mode allows pods to directly serve as the backend of load balancing and supports health checks, eliminating the need for NodePort-based forwarding. warning The number of back-end servers allowed by an ALB load balancer is limited, so you need to plan back-end servers reasonably. For details, see ALB constraints.
Load balancer	Select an existing load balancer or have a new one automatically created. There are two access modes: Public NAT for internet endpoint and Private access. Use existing: Select an existing ALB instance or one that has been created for this cluster. When an ALB instance is reused, the existing listener rules are not overwritten, so ensure that the forwarding rules of the listener do not conflict. Automatically create: Automatically create an ALB instance. You need to configure the following parameters. For detailed parameter descriptions, see Creating ALB instances: Name: set a load balancer name in accordance with the displayed naming rules. Instance version: Select an ALB instance edition. Supported options include Standard edition and Basic version. The features supported by different instance editions vary slightly. For details, see Overview of ALB instance editions. Subnet: Select a private subnet that provides private IP addresses for Load Balancer instances. tip You can select subnets in multiple availability zones to achieve high availability of containerized business applications. After a Load Balancer instance is created, its private IP address cannot be changed. Line type: select the line type for public network services. Different line types vary in performance and billing. Supported line types include BGP (multi-line), BGP convergence, China Mobile, China Telecom, and China Unicom. warning All the line types, except BGP (multi-line), are beta features of Elastic IP Address. To apply for these beta features, contact your account manager. Billing method: select a billing method for the Load Balancer instance. The following billing methods are available: Pay-as-you-go - bandwidth limit: it will be charged based on usage duration with an upper limit on bandwidth. Pay-as-you-go - actual traffic: it will be charged based on the actual amount of traffic flowing to the Internet instead of usage duration. Bandwidth limit: The maximum bandwidth for Internet access measured in mbit/s. The upper limit of bandwidth can be changed anytime as needed. Shared bandwidth package: disabled by default. You can enable Add to shared bandwidth package and select an existing shared bandwidth package if necessary. tip A shared bandwidth package is a reusable cloud resource for sharing bandwidth. Using a single shared bandwidth package to cover multiple public IPs within the same region or for IPv6 Internet bandwidth billing can help you reduce Internet access costs. For details, see What is a shared bandwidth package? IP version: Select a version. Only IPv4 is supported. Delete protection: Select whether to enable deletion protection for the ALB instance. ‌Deletion protection prevents accidental deletion of the ALB instance via the console or OpenAPI. To delete the ALB instance, you must first disable deletion protection on the basic information page of the ALB instance.
Access log transmission to TLS	Configure the log delivery feature of the ALB instance. After this feature is enabled, the logs of the ALB instance can be delivered to TLS, and real-time retrieval and analysis of access logs in the ALB console are supported. Click Edit configuration. In the pop-up dialog box, specify a log project and log topic.
Enable WAF protection	Configure the WAF protection feature for the ALB instance. You can enable domain name protection for the ALB instance by using the WAF service of Volcano Engine. After this feature is enabled, WAF will monitor the traffic passing through the ALB instance and clean attack traffic. This enhances application security.
Backend server group	Configure the scheduling algorithm and health check for back-end server groups that receive forwarded traffic. Scheduling algorithm: They are the rules that the listener follows when forwarding requests. Weighted Round Robin: traffic is forwarded based on weight values. The higher the weight of the back-end server, the more frequently (probabilistically) it is selected as the forwarding destination. Weighted Least Connection: traffic is forwarded first to the backend with the smallest real-time ratio of connections to weight. Source Hashing: traffic is always forwarded to a single back-end server if the hash of the source IP remains unchanged. Health check: optional and can be enabled if needed. If enabled, the following parameters are available: Health check method: The request method for performing health checks on back-end servers. Supported methods include GET and HEAD, with GET used by default. The HEAD method allows the server to return only the headers and thereby reduces back-end overhead. To use the HEAD method, ensure that your server supports this method. To use the GET method, ensure that your server supports this method. Health check domain name: After configuring the health check domain name, ALB will set the domain name in the host field. If no domain name is configured, the host field will be empty, and ALB will not include the host field in the request. Instead, the default domain name is set to the internal network IP of the back-end server group. Health check path: The default health check path is /. To perform a health check using a page other than the default homepage of the application server, you must specify the exact path. Normal status code: Select status codes that indicate the normal status of your server. By default, 2xx and 3xx are selected. Response timeout: the waiting time for a health check response. If the back-end server does not respond correctly within the specified time, it is considered anomalous. Detection interval: the time interval between health check requests. The default interval is 2 seconds, which means the back-end server will be checked every 2 seconds. Warning The time interval of health check needs to be longer than the response timeout. Health threshold: the number of health check requests required to determine that the back-end server is running properly. The default number is 3, which means the back-end server is determined to be "healthy" if all the 3 requests get the responses indicating a normal status. Unhealthy threshold: the number of health check requests to determine that the back-end server is not running properly. The default number is 3, meaning that if a back-end server is abnormal for three consecutive health checks, it is considered unhealthy.

Listener configuration

Parameter	Description
Protocol	Select a protocol that is used for listening to back-end server groups. Supported protocols include HTTP and HTTPS. When the Ingress is created, the ALB instance automatically creates a listener based on your listener configuration, with the default name k8s_<randomly generated string>.
HTTP/2	When Protocol is set to HTTPS, you can configure whether to enable HTTP/2. If this feature is disabled, the listener cannot process HTTP/2 requests from clients.
Port number	The port number that the back-end server group listens on. If you do not specify a port number, the default port number is 80 for HTTP and 443 for HTTPS.
Certificate	When you select HTTPS for Protocol, you need to select a server certificate to support encryption and authentication for data transmission. You need to create a key and bind the server certificate. By default, all the specified domain names use the same key. Select a certificate source from the drop-down menu. You can select All certificates, Application Load Balancer, or Certificate center. Select the corresponding Secret from the Secret drop-down menu. If no Secrets exist, you can click Create Secret to create a Secret. Name: set a secret name in accordance with the displayed naming rules. Secret names must be unique within the same namespace. Namespace: select the namespace of this Ingress. Certificate source: Select the source of the encryption certificate. Supported sources include Application Load Balancer, Certificate center, and TLS certificate. Project: Select the project where the certificate is located when the Certificate source parameter is set to Application Load Balancer or Certificate center. Server certificate: Select the server certificate when the Certificate source parameter is set to Application Load Balancer or Certificate center. Upload certificate: Upload the TLS certificate file when the Certificate source parameter is set to TLS certificate. Upload key: Upload the TLS certificate key when the Certificate source parameter is set to TLS certificate. Apart from the default behavior of binding all domains to the same key for an ALB Ingress, you can click Add certificate to specify a key for a particular domain. If a requested domain matches the specified domain, the key for the specified domain is used. If a requested domain does not match the specified domain, the default key for all domains is used.
Access control	Configure the ACL of the listener. Click Edit configuration. In the pop-up dialog box, enable access control. Control modes: After you enable access control for the listener, you need to specify an access control mode. Valid values: Allowlist: This mode allows access only from IP addresses within the selected policy group. Blocklist: This mode denies access from IP addresses within the selected policy group. Policy groups: Configure policy groups. Description You can select up to five policy groups. Each policy group can include up to 300 IP address entries. Each IP address entry can be an IP address or a CIDR address block. For more information about policy groups, see Access control.
Custom configuration	Implement custom configuration for ALB listeners. Click Edit configuration. In the pop-up box, select an existing custom configuration policy.

Forwarding configuration

Parameter	Description
Forwarding rules	If the target address of a request hits a forwarding rule, the request is forwarded to the corresponding service. Click Add forwarding rule to add one or more forwarding rules. Domain name: When the requested domain name matches the domain name set here, the request is forwarded to the specified service. warning Domain names that end with * are not supported. Path: When the requested path matches the one set here, the request is forwarded to the specified service. You can configure path matching by using a regular expression or non-regular expression. For details, see Regular expression-based path matching. Path matching rule: If the instance version parameter is set to Basic version, you can select the prefix match mode. This allows access to all paths that match the specified prefix. For example, if the mapped URL is /foo, both /foo/v1 and /foo/v2 can access the back-end service. Service: The target service and port to which the request is forwarded. If no service is available, create a service based on the instructions in Services. warning When the network model of the cluster is Flannel, you can select only a NodePort or LoadBalancer service. When the network model of the cluster is VPC-CNI: If the LB-to-pod direct access mode is enabled for the Ingress, you can select a NodePort, LoadBalancer, or ClusterIP service. If the LB-to-pod direct access mode is not enabled for the Ingress, you can select only a NodePort or LoadBalancer service. Traffic speed limit: [Beta · Apply for trial] If you set the Instance version parameter to Basic version, you can specify the Requests per second (QPS) parameter, which is disabled by default. For more configuration, see Configuring forward traffic throttling.
Custom forwarding rules	If you set the Instance version parameter to Standard Edition, you can enable custom forwarding rules. If you enable this option, you can configure custom forwarding rules based on domains, path, and HTTP headers. Forwarding conditions: Configure forwarding conditions, including the domain name, path, and HTTP header. Forwarding actions: Configure the forwarding action. Valid values: Rewrite: Configure the rewriting forwarding path. When a request passes through the ALB instance, the ALB instance can directly modify the request path and request new path content from the back-end server. Forward to: Configure the target service, port, and weight for request forwarding. When a request passes through the ALB instance, the ALB instance can forward it to different back-end services based on weights. Redirect to: Configure the redirection rule, including Protocol, Domain name, Port, URI, and Status code. When a request passes through the ALB instance, the ALB instance can schedule traffic to a new target based on the redirection rule. Back fixed response: You can specify a custom fixed response. You can specify the HTTP status code, Response body type, and Response text parameters of the fixed response. tip For configuration details on custom forwarding rules, see Custom ALB Ingress forwarding rules. You can configure multiple custom forwarding rules. Forwarding rules are prioritized from top to bottom. To adjust the order of forwarding rules, move the pointer over the specified forwarding rule name. When the pointer changes to, hold down the left mouse button and drag up or down to change the priority of the current forwarding rule.

Click Confirm.

Validating results

After the Ingress is configured, you can view its information in the rule list. The information includes the namespace, type, VIP, listener protocol, and forwarding rule of the Ingress.

tip

The VIP provides a private or public IP address for the ALB instance that corresponds to the Ingress. When you configure DNS resolution, you can map a domain name to the IP address for resolution.

Click the name of the target Ingress to go to the Ingress details page. You can view the basic information, forwarding rules, and events of the Ingress.

Last updated: 2026.07.24 14:51:36

Parameter	Description
Ingress type	Specify the type of the Ingress controller. For this example, select Application Load Balancer (ALB).