Help Center/ Cloud Container Engine/ User Guide/ Networking/ Ingresses/ LoadBalancer Ingresses/ Routing and Forwarding Policies/ Configuring Forwarding Rule Priorities for a LoadBalancer Ingress with a Redirect Listener

Updated on 2026-09-21 GMT+08:00

Configuring Forwarding Rule Priorities for a LoadBalancer Ingress with a Redirect Listener

When multiple ingresses share the same load balancer, particularly in HTTP-to-HTTPS redirection scenarios, the execution order of forwarding rules is critical. Incorrect priorities can cause redirection logic to interfere with normal ingress traffic, or cause ingresses to be unexpectedly intercepted by the redirection rule. This section describes how to configure forwarding rule priorities for a LoadBalancer ingress with a redirect listener.

Constraints

This feature is available only for dedicated load balancers.
The priority configuration for HTTP-to-HTTPS redirection rules is supported only in clusters v1.30.14-r100, v1.31.14-r60, v1.32.13-r30, v1.33.12-r10, v1.34.8-r10, v1.35.5-r10, v1.36.2-r0, or later.

Default Priority Rules

When configuring forwarding rule priorities for a LoadBalancer ingress, use the kubernetes.io/elb.ingress-order annotation to sort forwarding rules across different ingresses. The rules are as follows:

The kubernetes.io/elb.ingress-order value ranges from 1 to 1000. A smaller value indicates a higher priority.
Ingresses with the kubernetes.io/elb.ingress-order annotation take priority over those without it.

In the default scenario, ingress priorities are ordered as follows (highest to lowest):

kubernetes.io/elb.ingress-order configured with a small value
kubernetes.io/elb.ingress-order configured with a large value
kubernetes.io/elb.ingress-order not configured

For more information about ingress-order, see Configuring Forwarding Rule Priorities for LoadBalancer Ingresses.

If the ingress-order annotation is not configured, the HTTP-to-HTTPS redirection rule has the highest priority by default. For details, see Example 2: Not Configuring ingress-order in Redirect Scenarios.

Scenario-specific Examples

Example 1: Configuring ingress-order in Redirect Scenarios

Consider four ingresses (ingress-a, ingress-b, ingress-c, and ingress-d) sharing a dedicated load balancer.

Ingress	ingress-order Value	Port	Rule	Description
ingress-a	1	80	Rule A (host: a.com, path: /A)	HTTP forwarding on port 80
ingress-b	2	80 -> 443	Rule B (host: b.com, path: /B)	Redirecting HTTP/80 to HTTPS/443
ingress-c	3	443	Rule C (host: c.com, path: /C)	HTTPS forwarding on port 443
ingress-d	Not configured	80	Rule D (host: d.com, path: /D)	HTTP forwarding on port 80

YAML Examples

ingress-a

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ingress-a
  namespace: default
  annotations:
    kubernetes.io/elb.port: '80'    # Port on the associated load balancer
    kubernetes.io/elb.id: fef427e4-6d2c-4c63-bf26-270daa******    # ID of the existing load balancer
    kubernetes.io/elb.class: performance    # Type of the existing load balancer, which must be performance
    kubernetes.io/elb.ingress-order: '1'    # Priority of forwarding rules across different ingresses
spec:
  rules:
    - host: 'a.com'
      http:
        paths:
          - path: /A  # Define forwarding rule A.
            backend:  # The backend Service associated with the rule. The value provided is only an example and can be modified as needed.
              service:
                name: service1 
                port:
                  number: 80
            property:
              ingress.beta.kubernetes.io/url-match-mode: STARTS_WITH
            pathType: ImplementationSpecific
  ingressClassName: cce

ingress-b

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ingress-b
  namespace: default
  annotations:
    kubernetes.io/elb.id: fef427e4-6d2c-4c63-bf26-270daa******    # ID of the existing load balancer
    kubernetes.io/elb.class: performance    # Type of the existing load balancer, which must be performance
    kubernetes.io/elb.listen-ports: '[{"HTTP":80},{"HTTPS":443}]'   # Multi-port configuration
    kubernetes.io/elb.port: '80'             # Port on the associated load balancer
    kubernetes.io/elb.ssl-redirect: 'true'   # Enable HTTP-to-HTTPS redirection.
    kubernetes.io/elb.tls-certificate-ids: fd12a22d3ea64ae697066b78d9******,e981aee11f074c8d89c8eaa023******
    kubernetes.io/elb.tls-ciphers-policy: tls-1-0-inherit
    kubernetes.io/elb.ingress-order: '2'    # Priority of forwarding rules across different ingresses
spec:
  rules:
    - host: 'b.com'
      http:
        paths:
          - path: /B  # Define forwarding rule B.
            backend:  # The backend Service associated with the rule. The value provided is only an example and can be modified as needed.
              service:
                name: service1 
                port:
                  number: 80
            property:
              ingress.beta.kubernetes.io/url-match-mode: STARTS_WITH
            pathType: ImplementationSpecific
  ingressClassName: cce

ingress-c

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ingress-c
  namespace: default
  annotations:
    kubernetes.io/elb.id: fef427e4-6d2c-4c63-bf26-270daa******    # ID of the existing load balancer
    kubernetes.io/elb.class: performance    # Type of the existing load balancer, which must be performance
    kubernetes.io/elb.port: '443'      # Port on the associated load balancer
    kubernetes.io/elb.tls-certificate-ids: fd12a22d3ea64ae697066b78d9******,e981aee11f074c8d89c8eaa023******
    kubernetes.io/elb.tls-ciphers-policy: tls-1-0-inherit
    kubernetes.io/elb.ingress-order: '3'    # Priority of forwarding rules across different ingresses
spec:
  rules:
    - host: 'c.com'
      http:
        paths:
          - path: /C  # Define forwarding rule C.
            backend:  # The backend Service associated with the rule. The value provided is only an example and can be modified as needed.
              service:
                name: service1 
                port:
                  number: 80
            property:
              ingress.beta.kubernetes.io/url-match-mode: STARTS_WITH
            pathType: ImplementationSpecific
  ingressClassName: cce

ingress-d

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ingress-d
  namespace: default
  annotations:
    kubernetes.io/elb.id: fef427e4-6d2c-4c63-bf26-270daa******    # ID of the existing load balancer
    kubernetes.io/elb.class: performance    # Type of the existing load balancer, which must be performance
    kubernetes.io/elb.port: '80'        # Port on the associated load balancer
spec:
  rules:
    - host: 'd.com'
      http:
        paths:
          - path: /D  # Define forwarding rule D.
            backend:  # The backend Service associated with the rule. The value provided is only an example and can be modified as needed.
              service:
                name: service1 
                port:
                  number: 80
            property:
              ingress.beta.kubernetes.io/url-match-mode: STARTS_WITH
            pathType: ImplementationSpecific
  ingressClassName: cce

The following figure shows a successful creation.

Check the priorities of the forwarding rules on ELB listener port 80. The forwarding order is as follows.

Forwarding Rule Priority	Rule	Ingress	Description	ingress-order
1	Rule A (host: a.com, path: /A)	ingress-a	HTTP forwarding on port 80	1
2	Rule B (host: b.com, path: /B)	ingress-b	Redirecting HTTP/80 to HTTPS/443	2
3	Rule D (host: d.com, path: /D)	ingress-d	HTTP forwarding on port 80	Not configured

Check the priorities of the forwarding rules on ELB listener port 443. The forwarding order is as follows.

Forwarding Rule Priority	Rule	Ingress	Description	ingress-order
1	Rule B (host: b.com, path: /B)	ingress-b	Redirecting HTTP/80 to HTTPS/443	2
2	Rule C (host: c.com, path: /C)	ingress-c	HTTPS forwarding on port 443	3

To adjust the priority of a redirection rule, do as follows:

Move ingress-a on port 80 behind ingress-b.

Update the YAML file of ingress-a and change the kubernetes.io/elb.ingress-order value from 1 to 3.

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ingress-a
  namespace: default
  annotations:
    kubernetes.io/elb.port: '80'    # Port on the associated load balancer
    kubernetes.io/elb.id: fef427e4-6d2c-4c63-bf26-270daa******    # ID of the existing load balancer
    kubernetes.io/elb.class: performance    # Type of the existing load balancer, which must be performance
    kubernetes.io/elb.ingress-order: '3'    # Changed from 1 to 3.
spec:
  rules:
    - host: 'a.com'
      http:
        paths:
          - path: /A  # Define forwarding rule A.
            backend:  # The backend Service associated with the rule. The value provided is only an example and can be modified as needed.
              service:
                name: service1 
                port:
                  number: 80
            property:
              ingress.beta.kubernetes.io/url-match-mode: STARTS_WITH
            pathType: ImplementationSpecific
  ingressClassName: cce

Check the priorities of the forwarding rules on ELB listener port 80.

Forwarding Rule Priority	Rule	Ingress	Description	ingress-order
1	Rule B (host: b.com, path: /B)	ingress-b	Redirecting HTTP/80 to HTTPS/443	2
2	Rule A (host: a.com, path: /A)	ingress-a	HTTP forwarding on port 80	3
3	Rule D (host: d.com, path: /D)	ingress-d	HTTP forwarding on port 80	Not configured

Move ingress-c on port 443 ahead of ingress-b.

Update the YAML file of ingress-c and change the kubernetes.io/elb.ingress-order value from 3 to 1.

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ingress-c
  namespace: default
  annotations:
    kubernetes.io/elb.port: '443'    # Port on the associated load balancer
    kubernetes.io/elb.id: fef427e4-6d2c-4c63-bf26-270daa******    # ID of the existing load balancer
    kubernetes.io/elb.class: performance    # Type of the existing load balancer, which must be performance
    kubernetes.io/elb.ingress-order: '1'    # Priority of forwarding rules across different ingresses
    kubernetes.io/elb.tls-certificate-ids: fd12a22d3ea64ae697066b78d9******,e981aee11f074c8d89c8eaa023******    
spec:
  rules:
    - host: 'c.com'
      http:
        paths:
          - path: /C  # Define forwarding rule C.
            backend:  # The backend Service associated with the rule. The value provided is only an example and can be modified as needed.
              service:
                name: service1 
                port:
                  number: 80
            property:
              ingress.beta.kubernetes.io/url-match-mode: STARTS_WITH
            pathType: ImplementationSpecific
  ingressClassName: cce

Check the priorities of the forwarding rules on ELB listener port 443.

Forwarding Rule Priority	Rule	Ingress	Description	ingress-order
1	Rule C (host: c.com, path: /C)	ingress-c	HTTPS forwarding on port 443	1
2	Rule B (host: b.com, path: /B)	ingress-b	Redirecting HTTP/80 to HTTPS/443	2

Example 2: Not Configuring ingress-order in Redirect Scenarios

Consider three ingresses (ingress-a, ingress-b, and ingress-c) sharing a dedicated load balancer.

Ingress	ingress-order Value	Port	Rule	Description
ingress-a	Not configured	80 -> 443	Rule A (host: a.com, path: /A)	Redirecting HTTP/80 to HTTPS/443
ingress-b	1	80	Rule B (host: b.com, path: /B)	HTTP forwarding on port 80
ingress-c	2	80	Rule C (host: c.com, path: /C)	HTTP forwarding on port 80

YAML Examples

ingress-a

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ingress-a
  namespace: default
  annotations:
    kubernetes.io/elb.id: fef427e4-6d2c-4c63-bf26-270daa******    # ID of the existing load balancer
    kubernetes.io/elb.class: performance    # Type of the existing load balancer, which must be performance
    kubernetes.io/elb.listen-ports: '[{"HTTP":80},{"HTTPS":443}]'   # Multi-port configuration
    kubernetes.io/elb.port: '80'           # Port on the associated load balancer
    kubernetes.io/elb.ssl-redirect: 'true'
    kubernetes.io/elb.tls-certificate-ids: fd12a22d3ea64ae697066b78d9*****,e981aee11f074c8d89c8eaa023******
    kubernetes.io/elb.tls-ciphers-policy: tls-1-0-inherit
spec:
  rules:
    - host: 'a.com'
      http:
        paths:
          - path: /A  # Define forwarding rule A.
            backend:  # The backend Service associated with the rule. The value provided is only an example and can be modified as needed.
              service:
                name: service1 
                port:
                  number: 80
            property:
              ingress.beta.kubernetes.io/url-match-mode: STARTS_WITH
            pathType: ImplementationSpecific
  ingressClassName: cce

ingress-b

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ingress-b
  namespace: default
  annotations:
    kubernetes.io/elb.id: fef427e4-6d2c-4c63-bf26-270daa******    # ID of the existing load balancer
    kubernetes.io/elb.class: performance    # Type of the existing load balancer, which must be performance
    kubernetes.io/elb.port: '80'            # Port on the associated load balancer
    kubernetes.io/elb.ingress-order: '1'    # Priority of forwarding rules across different ingresses
spec:
  rules:
    - host: 'b.com'
      http:
        paths:
          - path: /B  # Define forwarding rule B.
            backend:  # The backend Service associated with the rule. The value provided is only an example and can be modified as needed.
              service:
                name: service1 
                port:
                  number: 80
            property:
              ingress.beta.kubernetes.io/url-match-mode: STARTS_WITH
            pathType: ImplementationSpecific
  ingressClassName: cce

ingress-c

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ingress-c
  namespace: default
  annotations:
    kubernetes.io/elb.id: fef427e4-6d2c-4c63-bf26-270daa******    # ID of the existing load balancer
    kubernetes.io/elb.class: performance    # Type of the existing load balancer, which must be performance
    kubernetes.io/elb.port: '80'            # Port on the associated load balancer
    kubernetes.io/elb.ingress-order: '2'    # Priority of forwarding rules across different ingresses
spec:
  rules:
    - host: 'c.com'
      http:
        paths:
          - path: /C  # Define forwarding rule C.
            backend:  # The backend Service associated with the rule. The value provided is only an example and can be modified as needed.
              service:
                name: service1 
                port:
                  number: 80
            property:
              ingress.beta.kubernetes.io/url-match-mode: STARTS_WITH
            pathType: ImplementationSpecific
  ingressClassName: cce

The following figure shows a successful creation.

Click to enlarge

Check the priorities of the forwarding rules on ELB listener port 80.

Forwarding Rule Priority	Rule	Ingress	Description	ingress-order
1	Rule A (host: a.com, path: /A)	ingress-a	Redirecting HTTP/80 to HTTPS/443	Not configured
2	Rule B (host: b.com, path: /B)	ingress-b	HTTP forwarding on port 80	1
3	Rule C (host: c.com, path: /C)	ingress-c	HTTP forwarding on port 80	2

Click to enlarge

Parent Topic: Routing and Forwarding Policies

Previous topic: Configuring Forwarding Rule Priorities for LoadBalancer Ingresses

Next topic: Configuring a Custom Header Forwarding Policy for a LoadBalancer Ingress