ALB Ingress服务高级用法

索引

基于域名转发请求

通过创建一个简单的Ingress，根据指定的正常域名或空域名转发请求，示例如下。

基于URL路径转发请求

三种匹配方式的示例如下：

配置健康检查

ALB Ingress支持配置健康检查，可以通过设置以下注解来实现。

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: cafe-ingress
  annotations:
    alb.ingress.kubernetes.io/healthcheck-enabled: "true"
    alb.ingress.kubernetes.io/healthcheck-path: "/"
    alb.ingress.kubernetes.io/healthcheck-protocol: "HTTP"
    alb.ingress.kubernetes.io/healthcheck-httpversion: "HTTP1.1"
    alb.ingress.kubernetes.io/healthcheck-method: "HEAD"
    alb.ingress.kubernetes.io/healthcheck-code: "http_2xx"
    alb.ingress.kubernetes.io/healthcheck-timeout-seconds: "5"
    alb.ingress.kubernetes.io/healthcheck-interval-seconds: "2"
    alb.ingress.kubernetes.io/healthy-threshold-count: "3"
    alb.ingress.kubernetes.io/unhealthy-threshold-count: "3"
spec:
  ingressClassName: alb
  rules:
  - http:
      paths:
      # 配置Context Path
      - path: /tea
        backend:
          service:
            name: tea-svc
            port:
              number: 80
      # 配置Context Path
      - path: /coffee
        backend:
          service:
            name: coffee-svc
            port:
              number: 80

apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: cafe-ingress
  annotations:
    alb.ingress.kubernetes.io/healthcheck-enabled: "true"
    alb.ingress.kubernetes.io/healthcheck-path: "/"
    alb.ingress.kubernetes.io/healthcheck-protocol: "HTTP"
    alb.ingress.kubernetes.io/healthcheck-method: "HEAD"
    alb.ingress.kubernetes.io/healthcheck-httpcode: "http_2xx"
    alb.ingress.kubernetes.io/healthcheck-timeout-seconds: "5"
    alb.ingress.kubernetes.io/healthcheck-interval-seconds: "2"
    alb.ingress.kubernetes.io/healthy-threshold-count: "3"
    alb.ingress.kubernetes.io/unhealthy-threshold-count: "3"
spec:
  ingressClassName: alb
  rules:
  - http:
      paths:
      # 配置Context Path。
      - path: /tea
        backend:
          serviceName: tea-svc
          servicePort: 80
      # 配置Context Path。
      - path: /coffee
        backend:
          serviceName: coffee-svc
          servicePort: 80

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: cafe-ingress
  annotations:
    alb.ingress.kubernetes.io/healthcheck-enabled: "true"
    alb.ingress.kubernetes.io/healthcheck-path: "/"
    alb.ingress.kubernetes.io/healthcheck-protocol: "HTTP"
    alb.ingress.kubernetes.io/healthcheck-httpversion: "HTTP1.1"
    alb.ingress.kubernetes.io/healthcheck-method: "HEAD"
    alb.ingress.kubernetes.io/healthcheck-code: "http_2xx"
    alb.ingress.kubernetes.io/healthcheck-timeout-seconds: "5"
    alb.ingress.kubernetes.io/healthcheck-interval-seconds: "2"
    alb.ingress.kubernetes.io/healthy-threshold-count: "3"
    alb.ingress.kubernetes.io/unhealthy-threshold-count: "3"
spec:
... ...

配置HTTP重定向至HTTPS

ALB Ingress通过配置以下注解，实现将 HTTP 请求重定向至 HTTPS 443 端口。

apiVersion: v1
kind: Service
metadata:
  name: demo-service-ssl
  namespace: default
spec:
  ports:
    - name: port1
      port: 80
      protocol: TCP
      targetPort: 8080
  selector:
    app: demo-ssl
  sessionAffinity: None
  type: NodePort
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: demo-ssl
  namespace: default
spec:
  replicas: 1
  selector:
    matchLabels:
      app: demo-ssl
  template:
    metadata:
      labels:
        app: demo-ssl
    spec:
      containers:
        - image: registry.cn-hangzhou.aliyuncs.com/alb-sample/cafe:v1
          imagePullPolicy: IfNotPresent
          name: demo-ssl
          ports:
            - containerPort: 8080
              protocol: TCP
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    alb.ingress.kubernetes.io/ssl-redirect: "true"
  name: demo-ssl
  namespace: default
spec:
  ingressClassName: alb
  tls:
  - hosts:
    - ssl.alb.ingress.top
  rules:
    - host: ssl.alb.ingress.top
      http:
        paths:
          - backend:
              service:
                name: demo-service-ssl
                port: 
                  number: 80
            path: /
            pathType: Prefix

apiVersion: v1
kind: Service
metadata:
  name: demo-service-ssl
  namespace: default
spec:
  ports:
    - name: port1
      port: 80
      protocol: TCP
      targetPort: 8080
  selector:
    app: demo-ssl
  sessionAffinity: None
  type: NodePort
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: demo-ssl
  namespace: default
spec:
  replicas: 1
  selector:
    matchLabels:
      app: demo-ssl
  template:
    metadata:
      labels:
        app: demo-ssl
    spec:
      containers:
        - image: registry.cn-hangzhou.aliyuncs.com/alb-sample/cafe:v1
          imagePullPolicy: IfNotPresent
          name: demo-ssl
          ports:
            - containerPort: 8080
              protocol: TCP
---
apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  annotations:
    alb.ingress.kubernetes.io/ssl-redirect: "true"
  name: demo-ssl
  namespace: default
spec:
  ingressClassName: alb
  tls:
  - hosts:
    - ssl.alb.ingress.top
  rules:
    - host: ssl.alb.ingress.top
      http:
        paths:
          - backend:
              serviceName: demo-service-ssl
              servicePort: 80
            path: /
            pathType: Prefix

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    alb.ingress.kubernetes.io/ssl-redirect: "true"
  name: demo-ssl
 ... ...

支持后端HTTPS和gRPC协议

当前 ALB 支持 HTTPS 和 gRPC 作为后端协议，您只需在 Ingress 中添加以下注解。

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    alb.ingress.kubernetes.io/backend-protocol: "grpc"
  name: demo-alb-ingress
spec:
  ingressClassName: alb
  tls:
  - hosts:
    - demo.alb.ingress.top
  rules:
  - host: demo.alb.ingress.top
    http:
      paths:  
      - path: /
        pathType: Prefix
        backend:
          service:
            name: grpc-demo-svc
            port:
              number: 9080

apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  annotations:
    alb.ingress.kubernetes.io/backend-protocol: "grpc"
  name: demo-alb-ingress
spec:
  ingressClassName: alb
  tls:
  - hosts:
    - demo.alb.ingress.top
  rules:
    - host: demo.alb.ingress.top
      http:
        paths:
          - backend:
              serviceName: grpc-demo-svc
              servicePort: 9080
            path: /
            pathType: Prefix

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    alb.ingress.kubernetes.io/backend-protocol: "grpc"
  name: demo-alb-ingress
... ...

配置正则表达式

使用注解alb.ingress.kubernetes.io/use-regex："true"启用正则模式，并在自定义转发条件或转发动作中配置相应的正则表达式。

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
   alb.ingress.kubernetes.io/use-regex: "true"  ## 允许使用正则表达式。
   alb.ingress.kubernetes.io/conditions.<YOUR-SVC-NAME>: | ## <YOUR-SVC-NAME>需替换为实际的 Service 名称，必须与下面 backend.service.name一致。
     [{
       "type": "Path",
       "pathConfig": {
           "values": [
              "~*/pathvalue1", ## 正则表达式前需要添加~*或~作为正则标志。~*或~后的内容为实际生效的正则表达式。~*表示区分大小写的正则匹配，~表示不区分大小写的正则匹配。
              "/pathvalue2"    ## 精确匹配前无需添加~*。
           ]
       }
      }]
  name: ingress-example
spec:
  ingressClassName: alb
  rules:
   - http:
      paths:
      - path: /test-path-for-alb
        pathType: Prefix
        backend:
          service:
            name: <YOUR-SVC-NAME> ## 此处<YOUR-SVC-NAME>需和注解中的自定义转发条件注明的服务名称保持一致，用于表示对应关系。
            port:
              number: 88

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
   alb.ingress.kubernetes.io/use-regex: "true"  ## 允许使用正则表达式。
   alb.ingress.kubernetes.io/conditions.<YOUR-SVC-NAME>: | ## <YOUR-SVC-NAME>需替换为实际的 Service 名称，必须与下面 backend.service.name一致。
     [{
       "type": "Path",         ## 支持Host
       "pathConfig": {
           "values": [
              "~*/pathvalue1", ## 正则表达式前需要添加~*或~作为正则标志。~*或~后的内容为实际生效的正则表达式。~*表示区分大小写的正则匹配，~表示不区分大小写的正则匹配。
              "/pathvalue2"    ## 精确匹配前无需添加~*。
           ]
       }
      }]
... ...

正则匹配规则说明：

配置重写

ALB Ingress支持重写（Rewrite）功能，在接收到客户端请求后，修改请求中的Path部分，再发送给后端Service。重写通过以下两个Annotation实现：

• alb.ingress.kubernetes.io/rewrite-target: /<path>/${number}：启用重写，并指定重写后的路径。

  重要

  • 使用${number}格式表示从原路径中通过正则表达式获取的变量，可以配置为${1}、${2}、${3}中的一个或多个，最多可从原路径中获取三个变量。

  • Ingress的pathType需设置为Prefix

• alb.ingress.kubernetes.io/use-regex：是否在path中使用正则表达式，配置rewrite-target后默认开启。

  • "true"：使用正则表达式。

  • "false"：不使用正则表达式。如果path中有特殊符号（“%#;!()[]^,”\"），Ingress资源会创建失败。

配置示例

示例场景一：移除前缀

下方的YAML示例中path: /something(/|$)(.*)通过正则表达式将客户端请求的路径分为了三个部分：

• /something：匹配需要剥离的前缀。

• (/|$)：第一捕获组，匹配/something后的/或$（路径结尾）。

• (.*)：第二捕获组，匹配/something/后的全部内容，在重写后的路径中通过${2}使用。

alb.ingress.kubernetes.io/rewrite-target注解中配置的重写路径为/（路径标准前缀）+${2}（第二捕获组的内容），路径的重写效果如下：

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: rewrite-ingress
  annotations:
    alb.ingress.kubernetes.io/use-regex: "true" # 允许path字段使用正则表达式。
    alb.ingress.kubernetes.io/rewrite-target: /${2} # 该注解支持正则表达式替换。
spec:
  ingressClassName: alb
  rules:
  - host: demo.alb.ingress.top
    http:
      paths:
      - path: /something(/|$)(.*)
        pathType: Prefix
        backend:
          service:
            name: rewrite-svc
            port:
              number: 9080

示例场景二：捕获并重新排列多个部分

下方示例捕获路径/items/(.*)/(.*)/(.*)中的多个部分并进行重新排列，并且在用户无感的情况下更改了URL的格式（改为类POST形式）。重写路径为/（路径标准前缀）+${2}（第二捕获组的内容）+?code=+${3}（第三捕获组的内容），路径的重写效果如下：

示例中明确要求路径中有四个分段，使用这种方式要求客户端使用的路径为固定格式。

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: rewrite-ingress
  annotations:
    alb.ingress.kubernetes.io/use-regex: "true" # 允许path字段使用正则表达式。
    alb.ingress.kubernetes.io/rewrite-target: /${2}?code=${3} # 该注解支持正则表达式替换。
spec:
  ingressClassName: alb
  rules:
  - host: demo.alb.ingress.top
    http:
      paths:
      - path: /items/(.*)/(.*)/(.*)
        pathType: Prefix
        backend:
          service:
            name: rewrite-svc
            port:
              number: 9080

示例场景三：将多个路径重写到单一路径

下方示例通过同时对多个路径（/app-a(/|$)(.*)和/app-b(/|$)(.*)）进行正则匹配，将多个路径重写到一个单一路径。重写路径为/app-c/+${2}（第二捕获组的内容），路径的重写效果如下：

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: rewrite-ingress
  annotations:
    alb.ingress.kubernetes.io/use-regex: "true" # 允许path字段使用正则表达式。
    alb.ingress.kubernetes.io/rewrite-target: /app-c/${2} # 该注解支持正则表达式替换。
spec:
  ingressClassName: alb
  rules:
  - host: demo.alb.ingress.top
    http:
      paths:
      - path: /app-a(/|$)(.*)
        pathType: Prefix
        backend:
          service:
            name: rewrite-svc
            port:
              number: 9080
      - path: /app-b(/|$)(.*)
        pathType: Prefix
        backend:
          service:
            name: rewrite-svc
            port:
              number: 9080

示例场景四：重写域名

alb.ingress.kubernetes.io/rewrite-target 注解仅支持更改路径，如需更改URL中的其他部分，例如域名与参数，请使用自定义转发规则。

验证重写规则匹配

使用sed命令可以提前测试客户端使用的特定路径是否匹配path中配置的正则表达式，并查看重写后的新路径。

以示例场景二：捕获并重新排列多个部分中的捕获路径/items/(.*)/(.*)/(.*)和重写规则/${2}?code=${3}为例：

1. 将下方的示例命令保存到path2.txt：

   /items/electronics/computers/554
   /items/produce/fruits/12
   /items/headphones/5
   /drinks/41

2. 查看路径是否匹配，以及重写后的路径：

   下方命令中对示例中的path正则表达式（/items/(.*)/(.*)/(.*)）和重写后的路径（/${2}?code=${3}）进行了改写，在sed命令中特殊字符/前需要使用转义字符\，捕获组内容的写法由${2}改为\2。

   sed -E 's#\/items\/(.*)\/(.*)\/(.*)#Matched: [&]  --->  Rewritten: [/\2?code=\3]#' path2.txt

   预期输出如下，前两条路径匹配重写规则，会被重写到新的路径；后两条路径不匹配，不会被重写。

   Matched: [/items/electronics/computers/554]  --->  Rewritten: [/computers?code=554]
   Matched: [/items/produce/fruits/12]  --->  Rewritten: [/fruits?code=12]
   /items/headphones/5
   /drinks/41

配置自定义监听端口

ALB Ingress 支持通过注解自定义监听端口，可实现服务同时暴露 80（HTTP）和 443（HTTPS）端口。

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: cafe-ingress
  annotations:
   alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80},{"HTTPS": 443}]'
spec:
  ingressClassName: alb
  tls:
  - hosts:
    - demo.alb.ingress.top
  rules:
  - host: demo.alb.ingress.top
    http:
      paths:
      - path: /tea
        pathType: ImplementationSpecific
        backend:
          service:
            name: tea-svc
            port:
              number: 80

apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  annotations:
    alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80},{"HTTPS": 443}]'
  name: cafe-ingress
spec:
  ingressClassName: alb
  tls:
  - hosts:
    - demo.alb.ingress.top
  rules:
    - host: demo.alb.ingress.top
      http:
        paths:
          - backend:
              serviceName: tea-svc
              servicePort: 80
            path: /tea
            pathType: ImplementationSpecific

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: cafe-ingress
  annotations:
   alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80},{"HTTPS": 443}]'
... ...

配置转发规则优先级

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: cafe-ingress
  annotations:
   alb.ingress.kubernetes.io/order: "2"
spec:
  ingressClassName: alb
  rules:
  - host: demo.alb.ingress.top
    http:
      paths:
      - path: /tea
        pathType: ImplementationSpecific
        backend:
          service:
            name: tea-svc
            port:
              number: 80

apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  annotations:
    alb.ingress.kubernetes.io/order: "2" 
  name: cafe-ingress
spec:
  ingressClassName: alb
  rules:
    - host: demo.alb.ingress.top
      http:
        paths:
          - backend:
              serviceName: tea-svc
              servicePort: 80
            path: /tea
            pathType: ImplementationSpecific

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: cafe-ingress
  annotations:
   alb.ingress.kubernetes.io/order: "2"
spec:
... ...

通过注解实现灰度发布

ALB支持复杂路由处理，具备基于 Header、Cookie 及权重的灰度发布能力。可通过配置以下相关注解灵活实现各类灰度发布策略。关于灰度发布最佳实践，请参见通过ALB Ingress实现灰度发布。

• 基于指定Header实现灰度流量分配

  参数	描述	YAML示例
  alb.ingress.kubernetes.io/canary-by-header	该规则允许自定义请求的 Header 及其对应值，需同时配置两个注解。 当请求中的header和header-value与设置的值匹配时，请求流量会被分配到灰度服务入口。 其他不匹配的请求会根据灰度优先级分配到后续规则对应的灰度服务。	apiVersion: networking.k8s.io/v1 kind: Ingress metadata: annotations: alb.ingress.kubernetes.io/order: "1" alb.ingress.kubernetes.io/canary: "true" alb.ingress.kubernetes.io/canary-by-header: "location" alb.ingress.kubernetes.io/canary-by-header-value: "hz" name: demo-canary spec: ... ...
  alb.ingress.kubernetes.io/canary-by-header-value

  当请求中的 Header 包含 location: hz 时，流量将被路由到灰度服务；其余请求则会根据灰度权重策略分配到对应的灰度服务。配置示例如下。

  展开查看完整YAML示例

  1.19及之后版本集群

  apiVersion: networking.k8s.io/v1
  kind: Ingress
  metadata:
    annotations:
      alb.ingress.kubernetes.io/order: "1"
      alb.ingress.kubernetes.io/canary: "true"
      alb.ingress.kubernetes.io/canary-by-header: "location"
      alb.ingress.kubernetes.io/canary-by-header-value: "hz"
    name: demo-canary
    namespace: default
  spec:
    ingressClassName: alb
    rules:
      - http:
          paths:
            - backend:
                service:
                  name: demo-service-hello
                  port: 
                    number: 80
              path: /hello
              pathType: ImplementationSpecific

  1.19版本之前集群

  apiVersion: networking.k8s.io/v1beta1
  kind: Ingress
  metadata:
    annotations:
      alb.ingress.kubernetes.io/order: "1"
      alb.ingress.kubernetes.io/canary: "true"
      alb.ingress.kubernetes.io/canary-by-header: "location"
      alb.ingress.kubernetes.io/canary-by-header-value: "hz"
    name: demo-canary
    namespace: default
  spec:
    ingressClassName: alb
    rules:
      - http:
          paths:
            - backend:
                serviceName: demo-service-hello
                servicePort: 80
              path: /hello
              pathType: ImplementationSpecific

• 基于指定Cookie实现灰度流量分配

  参数	Cookie取值	YAML示例
  alb.ingress.kubernetes.io/canary-by-cookie	always：请求流量将全部分配到灰度服务入口 never：请求流量不会分配到灰度服务入口 基于Cookie的灰度不支持设置自定义，只有always和never。	apiVersion: networking.k8s.io/v1 kind: Ingress metadata: annotations: alb.ingress.kubernetes.io/order: "2" alb.ingress.kubernetes.io/canary: "true" alb.ingress.kubernetes.io/canary-by-cookie: "demo" name: demo-canary-cookie ... ...

  请求头中有 Cookie: demo=always，则流量路由到灰度服务；如果请求头中有 Cookie: demo=never，则流量不会路由到灰度服务。配置示例如下。

  展开查看完整实例YAML

  1.19及之后版本集群

  apiVersion: networking.k8s.io/v1
  kind: Ingress
  metadata:
    annotations:
      alb.ingress.kubernetes.io/order: "2"
      alb.ingress.kubernetes.io/canary: "true"
      alb.ingress.kubernetes.io/canary-by-cookie: "demo"
    name: demo-canary-cookie
    namespace: default
  spec:
    ingressClassName: alb
    rules:
      - http:
          paths:
            - backend:
                service:
                  name: demo-service-hello
                  port: 
                    number: 80
              path: /hello
              pathType: ImplementationSpecific

  1.19版本之前集群

  apiVersion: networking.k8s.io/v1beta1
  kind: Ingress
  metadata:
    annotations:
      alb.ingress.kubernetes.io/order: "2"
      alb.ingress.kubernetes.io/canary: "true"
      alb.ingress.kubernetes.io/canary-by-cookie: "demo"
    name: demo-canary-cookie
    namespace: default
  spec:
    ingressClassName: alb
    rules:
      - http:
          paths:
            - backend:
                serviceName: demo-service-hello
                servicePort: 80
              path: /hello
              pathType: ImplementationSpecific

• 按权重进行流量分配

  参数	描述	YAML示例
  alb.ingress.kubernetes.io/canary-weight	设置请求到指定服务的百分比。取值范围：0~100的整数。	apiVersion: networking.k8s.io/v1 kind: Ingress metadata: annotations: alb.ingress.kubernetes.io/order: "3" alb.ingress.kubernetes.io/canary: "true" alb.ingress.kubernetes.io/canary-weight: "50" name: demo-canary-weight

  配置灰度服务的权重为50%，示例如下：

  展开查看完整YAML示例

  1.19及之后版本集群

  apiVersion: networking.k8s.io/v1
  kind: Ingress
  metadata:
    annotations:
      alb.ingress.kubernetes.io/order: "3"
      alb.ingress.kubernetes.io/canary: "true"
      alb.ingress.kubernetes.io/canary-weight: "50"
    name: demo-canary-weight
    namespace: default
  spec:
    ingressClassName: alb
    rules:
      - http:
          paths:
            - backend:
                service:
                  name: demo-service-hello
                  port: 
                    number: 80
              path: /hello
              pathType: ImplementationSpecific

  1.19版本之前集群

  apiVersion: networking.k8s.io/v1beta1
  kind: Ingress
  metadata:
    annotations:
      alb.ingress.kubernetes.io/order: "3"
      alb.ingress.kubernetes.io/canary: "true"
      alb.ingress.kubernetes.io/canary-weight: "50"
    name: demo-canary-weight
    namespace: default
  spec:
    ingressClassName: alb
    rules:
      - http:
          paths:
            - backend:
                serviceName: demo-service-hello
                servicePort: 80
              path: /hello
              pathType: ImplementationSpecific

通过注解实现会话保持

ALB Ingress支持通过以下注解实现会话保持。

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: cafe-ingress-v3
  annotations:
    alb.ingress.kubernetes.io/sticky-session: "true"
    alb.ingress.kubernetes.io/sticky-session-type: "Insert"   # 支持自定义cookie时，植入cookie类型需为Server。
    alb.ingress.kubernetes.io/cookie-timeout: "1800"
    alb.ingress.kubernetes.io/cookie: "test"
spec:
  ingressClassName: alb
  rules:
  - http:
      paths:
      - backend:
          service:
            name: tea-svc
            port:
              number: 80
        path: /tea2
        pathType: ImplementationSpecific
      - backend:
          service:
            name: coffee-svc
            port:
              number: 80
        path: /coffee2
        pathType: ImplementationSpecific

apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  name: cafe-ingress-v3
  annotations:
    alb.ingress.kubernetes.io/sticky-session: "true"
    alb.ingress.kubernetes.io/sticky-session-type: "Insert"  # 支持自定义cookie时，植入cookie类型需为Server。
    alb.ingress.kubernetes.io/cookie-timeout: "1800"
    alb.ingress.kubernetes.io/cookie: "test"
spec:
  ingressClassName: alb
  rules:
  - http:
      paths:
      #配置Context Path。
      - path: /tea2
        pathType: ImplementationSpecific
        backend:
          serviceName: tea-svc
          servicePort: 80
      #配置Context Path。
      - path: /coffee2
        pathType: ImplementationSpecific
        backend:
          serviceName: coffee-svc
          servicePort: 80

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: cafe-ingress-v3
  annotations:
    alb.ingress.kubernetes.io/sticky-session: "true"
    alb.ingress.kubernetes.io/sticky-session-type: "Insert"   # 支持自定义cookie时，植入cookie类型需为Server。
    alb.ingress.kubernetes.io/cookie-timeout: "1800"
    alb.ingress.kubernetes.io/cookie: "test"
spec:
... ...

指定服务器组负载均衡算法

ALB Ingress 可通过以下注解指定服务器组的负载均衡算法，具体取值及说明见下表。

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: cafe-ingress
  annotations:
    alb.ingress.kubernetes.io/backend-scheduler: "uch" # 此处的uch可按需配置为wrr、sch和wlc。
    alb.ingress.kubernetes.io/backend-scheduler-uch-value: "test" # 仅负载均衡算法为uch时，需要配置此参数。当调度算法为wrr、sch或wlc均无需配置此参数。
spec:
  ingressClassName: alb
  rules:
  - host: demo.alb.ingress.top
    http:
      paths:
      - path: /tea
        pathType: ImplementationSpecific
        backend:
          service:
            name: tea-svc
            port:
              number: 80

apiVersion: networking.k8s.io/v1beta1
kind: Ingress
metadata:
  annotations:
    alb.ingress.kubernetes.io/backend-scheduler: "uch" # 此处的uch也可按需配置为wrr、sch和wlc。
    alb.ingress.kubernetes.io/backend-scheduler-uch-value: "test" # 仅负载均衡算法为uch时，需要配置此参数。当调度算法为wrr、sch或wlc均无需配置此参数。
  name: cafe-ingress
spec:
  ingressClassName: alb
  rules:
    - host: demo.alb.ingress.top
      http:
        paths:
          - backend:
              serviceName: tea-svc
              servicePort: 80
            path: /tea
            pathType: ImplementationSpecific

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: cafe-ingress
  annotations:
    alb.ingress.kubernetes.io/backend-scheduler: "uch" # 此处的uch可按需配置为wrr、sch和wlc。
    alb.ingress.kubernetes.io/backend-scheduler-uch-value: "test" # 仅负载均衡算法为uch时，需要配置此参数。当调度算法为wrr、sch或wlc均无需配置此参数。
spec:
... ... 

跨域配置

ALB Ingress 支持通过以下注解参数控制跨域行为。可指定允许访问的站点、请求方法、请求和响应头、凭证携带及预检（OPTIONS）缓存时间，满足不同安全和业务场景下的跨域访问需求。

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: alb-ingress
  annotations:
    alb.ingress.kubernetes.io/enable-cors: "true"
    alb.ingress.kubernetes.io/cors-expose-headers: ""
    alb.ingress.kubernetes.io/cors-allow-methods: "GET,POST"
    alb.ingress.kubernetes.io/cors-allow-credentials: "true"
    alb.ingress.kubernetes.io/cors-max-age: "600"
    alb.ingress.kubernetes.io/cors-allow-origin: "允许跨域的域名"
spec:
  ingressClassName: alb
  rules:
  - host: demo.alb.ingress.top
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: cloud-nodeport
            port:
              number: 80

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: alb-ingress
  annotations:
    alb.ingress.kubernetes.io/enable-cors: "true"
    alb.ingress.kubernetes.io/cors-expose-headers: ""
    alb.ingress.kubernetes.io/cors-allow-methods: "GET,POST"
    alb.ingress.kubernetes.io/cors-allow-credentials: "true"
    alb.ingress.kubernetes.io/cors-max-age: "600"
    alb.ingress.kubernetes.io/cors-allow-origin: "允许跨域的域名"
spec:
... ...

后端长连接

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: alb-ingress
  annotations:
    alb.ingress.kubernetes.io/backend-keepalive: "true"
spec:
  ingressClassName: alb
  rules:
  - host: demo.alb.ingress.top
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: cloud-nodeport
            port:
              number: 80

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: alb-ingress
  annotations:
    alb.ingress.kubernetes.io/backend-keepalive: "true"
spec:

服务器组支持IPv6挂载

在为服务器组启用IPv6挂载后，如需同时将IPv4和IPv6类型的Pod挂载至服务器组，需确保集群已启用双栈能力，更多详情请参见创建ACK托管集群。

apiVersion: v1
kind: Service
metadata:
  name: tea-svc
  annotations:
spec:
  # 配置双栈时ipFamilies需要配置为IPv4或IPv6,ipFamilyPolicy需要配置为RequireDualStack或PreferDualStack。
  ipFamilyPolicy: RequireDualStack
  ipFamilies:
  - IPv4
  - IPv6
  ports:
  - port: 80
    targetPort: 80
    protocol: TCP
  selector:
    app: tea
  type: NodePort
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: tea
spec:
  replicas: 2
  selector:
    matchLabels:
      app: tea
  template:
    metadata:
      labels:
        app: tea
    spec:
      containers:
      - name: tea
        image: registry.cn-hangzhou.aliyuncs.com/acs-sample/nginxdemos:latest
        ports:
        - containerPort: 80
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: cafe-ingress
  annotations:
    alb.ingress.kubernetes.io/enable-ipv6: "true"
spec:
  ingressClassName: alb
  rules:
   - host: demo.alb.ingress.top
     http:
      paths:
      - path: /tea
        pathType: Prefix
        backend:
          service:
            name: tea-svc
            port:
              number: 80

Service 和 ALB Ingress 需按双栈要求进行配置。创建支持双栈的 ALB 实例后，服务器组可同时挂载 IPv4 和 IPv6 类型的后端服务器。

apiVersion: v1
kind: Service
metadata:
  name: tea-svc
  annotations:
spec:
  # 配置双栈时ipFamilies需要配置为IPv4或IPv6,ipFamilyPolicy需要配置为RequireDualStack或PreferDualStack。
  ipFamilyPolicy: RequireDualStack
  ipFamilies:
  - IPv4
  - IPv6
... ...

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: cafe-ingress
  annotations:
    alb.ingress.kubernetes.io/enable-ipv6: "true"
spec:
... ...

支持QPS限速

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: cafe-ingress
  annotations:
    alb.ingress.kubernetes.io/traffic-limit-qps: "50"
spec:
  ingressClassName: alb
  rules:
   - host: demo.alb.ingress.top
     http:
      paths:
      - path: /tea
        pathType: ImplementationSpecific
        backend:
          service:
            name: tea-svc
            port:
              number: 80
      - path: /coffee
        pathType: ImplementationSpecific
        backend:
          service:
            name: coffee-svc
            port:
              number: 80

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: cafe-ingress
  annotations:
    alb.ingress.kubernetes.io/traffic-limit-qps: "50"
spec:
... ...

后端慢启动

在新增Pod加入Service后端后，如果ALB Ingress立即将流量分配至新增Pod，可能会导致瞬时的CPU或内存高压，导致访问异常。通过使用慢启动，ALB Ingress可以逐步将流量转移至新增Pod，缓解突发流量造成的影响。配置示例如下：

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    alb.ingress.kubernetes.io/slow-start-enabled: "true"
    alb.ingress.kubernetes.io/slow-start-duration: "100"
  name: alb-ingress
spec:
  ingressClassName: alb
  rules:
  - host: alb.ingress.alibaba.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: tea-svc
            port:
              number: 80

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    alb.ingress.kubernetes.io/slow-start-enabled: "true"
    alb.ingress.kubernetes.io/slow-start-duration: "100"
  name: alb-ingress
... ...

连接优雅中断

当Pod进入Terminating状态时，ALB Ingress会将其从后端服务器组中移除，ALB与该Pod已建立的连接不会立即中断，客户端访问时仍持续有请求转发至这些后端服务器，可能会导致Pod内的业务长期无法下线或出现请求错误。为了避免该问题，可以使用ALB的连接优雅中断功能，当Pod被移除或健康检查异常时，ALB Ingress会保持一定时间内的正常传输，并在到达中断时间后主动断开连接，保障业务平稳下线。更多详情，请参见通过ALB连接优雅中断实现业务平稳下线。

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    alb.ingress.kubernetes.io/connection-drain-enabled: "true"
    alb.ingress.kubernetes.io/connection-drain-timeout: "199"
  name: alb-ingress
spec:
  ingressClassName: alb
  rules:
  - host: alb.ingress.alibaba.com
    http:
      paths:
      - path: /test
        pathType: Prefix
        backend:
          service:
            name: tea-svc
            port:
              number: 80

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  annotations:
    alb.ingress.kubernetes.io/connection-drain-enabled: "true"
    alb.ingress.kubernetes.io/connection-drain-timeout: "199"
  name: alb-ingress
... ...

关闭跨可用区（AZ）

默认情况下，ALB启用跨可用区（AZ）的负载均衡，这意味着在同一地域的不同可用区之间，流量会被均匀分配至后端服务。如果关闭了ALB服务器组的跨AZ负载均衡，则流量将仅在同一地域内的同一可用区的后端服务之间分配。

您可参照下方的示例配置关闭跨AZ：

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: alb-ingress
  namespace: default
  annotations:
    alb.ingress.kubernetes.io/cross-zone-enabled: "false"
spec:
  ingressClassName: alb
  rules:
  - host: alb.ingress.alibaba.com
    http:
      paths:
      - path: /test
        pathType: Prefix
        backend:
          service:
            name: tea-svc
            port:
              number: 80

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: alb-ingress
  namespace: default
  annotations:
    alb.ingress.kubernetes.io/cross-zone-enabled: "false"
... ...