Configuring a QUIC Listener for a LoadBalancer Service

In this section, the sample certificate is cert-test. Replace it with the actual one.

1. Log in to the CCE console and click the cluster name to access the cluster console.
2. In the navigation pane, choose Services & Ingresses. In the upper right corner, click Create Service.

   In this example, only the mandatory parameters for configuring QUIC are listed. Retain the default settings for other parameters. For details, see Using the CCE Console (New Version).

3. Configure basic parameters.

   Parameter	Description	Example
   Service Type	Select LoadBalancer.	None
   Service Name	Enter a name, which can be the same as the workload name.	nginx
   Namespace	Select the namespace that the workload belongs to.	default
   Selector	Add the key and value of a pod label. The Service will be associated with the workload pods based on the label and direct traffic to the pods with this label. You can also click Reference Workload Label to use the label of an existing workload. In the dialog box displayed, select a workload and click OK.	app:nginx

   

4. Configure load balancer parameters.

   Parameter	Description	Example Value
   Load Balancer	Select a load balance type and how the load balancer will be created. To enable QUIC on the listener port of a dedicated load balancer, the type of the load balancer must be Application (HTTP/HTTPS) or Network (TCP/UDP/TLS) & Application (HTTP/HTTPS). Use existing: Only the load balancers in the same VPC as the cluster can be selected. If no load balancer is available, click Create Load Balancer to create one on the ELB console. Auto create: The load balancer will be created in the VPC that the cluster belongs to. For details, see Table 1.	An existing Dedicated load balancer of the Network (TCP/UDP/TLS) & Application (HTTP/HTTPS) type

   

5. Configure access parameters.

   Parameter	Description	Example Value
   Service Affinity	Whether to route external traffic to a local node or a cluster-wide endpoint. For details, see Service Affinity (externalTrafficPolicy). Cluster-level: The IP addresses and ports of all nodes in a cluster can access the workload associated with the Service. However, accessing the Service may result in performance deterioration due to route redirection, and the client's source IP address may not be obtainable. Node-level: Only the IP address and port of the node where the workload is located can access the workload associated with the Service. Accessing the Service will not result in a performance deterioration due to route redirection, and the client's source IP address can be obtained.	Cluster-level
   Backend Routing Policy	Global: All ports use the same backend routing policy. For details about the backend routing policy parameters, see Table 1. CAUTION: When multiple ports are added, and some of them use different frontend protocols, the global backend routing policy cannot be applied across all protocols simultaneously. For any protocol to which the policy cannot be applied, CCE automatically falls back to the default configuration. For details about the mapping between the frontend and backend protocols of listeners and backend server groups, see Mapping Between Frontend and Backend Protocols for Load Balancing and Configuration Examples. Custom is recommended. Custom: Each port can have a unique backend routing policy. You can configure the policy in Port > Backend Routing Policy.	Custom
   Port	Protocol: the protocol used by the Service. According to the Kubernetes implementation, if a Service uses a load balancer with a non-UDP protocol, this parameter must be set to TCP and the corresponding listener frontend protocol must be selected. For details, see Protocols for Services. Container Port: the port that the workload listens on. For example, Nginx uses port 80 by default. Service Port: the port used by the Service. Listen on a port: The port ranges from 1 to 65535. Listening ports: not supported by QUIC listeners Frontend Protocol: Set the protocol of the load balancer listener for establishing connections with clients. For a dedicated load balancer, to use QUIC, the type of the load balancer must be Application (HTTP/HTTPS). Backend Routing Policy: If Backend Routing Policy is set to Custom, you can configure backend routing policies for ports that use different protocols. For details about the parameters, see Table 1. NOTE: When a LoadBalancer Service is created, a random node port number (NodePort) is automatically generated.	Protocol: TCP Container Port: 80 Service Port: 443 Frontend Protocol: QUIC

   Table 1 Parameters for configuring the backend routing policy

   Parameter	Description	Example
   Backend Protocol	The service protocol used by the load balancer's backend server group. TCP, HTTP, HTTPS, TLS, QUIC, and UDP are supported. For details about the mapping between the frontend and backend protocols of listeners and backend server groups, see Mapping Between Frontend and Backend Protocols for Load Balancing and Configuration Examples.	HTTP
   Load Balancing Algorithm	Load balancers forward requests from clients to the corresponding backend servers based on the configured traffic routing policies. Weighted round robin: Requests are forwarded to different backend servers in turn based on the server weights you define in the target group. Weighted least connections: Requests are forwarded to the backend server with the smallest connections-to-weight ratio. Source IP hash: Requests from the same source IP address are forwarded to the same backend server by hashing the source IP address.	Weighted round robin

   

6. Configure QUIC listener parameters. Retain the default settings for other parameters.

   Parameter	Description	Constraint	Example Value
   Server Certificate	Select a server certificate. If no certificate is available, create one on the ELB console. For details, see Adding a Certificate.	In this example, set Frontend Protocol to QUIC.	cert-test

   

7. Click Create.

If a Service uses the QUIC protocol, it is important to take note of the following configuration requirements:

• The load balancer must be a dedicated one and the type must be Application or Network & Application.
• The QUIC port in kubernetes.io/elb.protocol-port must match the TCP port in spec.ports. In this example, port 443 is used by the QUIC protocol.

In this example, an existing dedicated load balancer is used. The configuration example is as follows:

apiVersion: v1
kind: Service
metadata:
  annotations:
    kubernetes.io/elb.id: <your_elb_id>    # In this example, an existing dedicated load balancer is used. Replace its ID with the ID of your dedicated load balancer.
    kubernetes.io/elb.class: performance  # A dedicated load balancer
    kubernetes.io/elb.protocol-port: quic:443  # QUIC and port, which must match the TCP port in spec.ports
    kubernetes.io/elb.cert-id: 17e3b4f4bc40471c86741dc3aa211379 # Certificate ID of the ELB service
  labels:
    app: nginx
    name: test
  name: test
  namespace: default
spec:
  ports:
  - name: cce-service-0
    port: 443
    protocol: TCP
    targetPort: 80
  selector:
    app: nginx
    version: v1
  sessionAffinity: None
  type: LoadBalancer