Help Center/ Cloud Container Engine/ User Guide/ Networking/ Ingresses/ LoadBalancer Ingresses/ Protocol and Listening Configuration/ Configuring a QUIC Listener for a LoadBalancer Ingress
Updated on 2026-06-16 GMT+08:00
View PDF
Share

Configuring a QUIC Listener for a LoadBalancer Ingress

QUIC is a high-performance, UDP-based transport protocol designed for low latency and to eliminate head-of-line blocking. Its strong performance helps reduce network lag and video stuttering, enhances overall network experience, and ensures secure data transmission. CCE supports QUIC for LoadBalancer Services. This section describes how to enable QUIC and access a Service using an Nginx application.

Prerequisites

  • A CCE standard or Turbo cluster is available, and the cluster version meets the following requirements:
    • v1.28: v1.28.15-r80 or later
    • v1.29: v1.29.15-r40 or later
    • v1.30: v1.30.14-r40 or later
    • v1.31: v1.31.14-r0 or later
    • v1.32: v1.32.9-r0 or later
    • v1.33: v1.33.7-r0 or later
    • v1.34: v1.34.2-r0 or later
    • Other clusters of later versions
  • An available workload has been deployed in the cluster for external access. If no workload is available, deploy a workload by referring to Creating a Deployment, Creating a StatefulSet, or Creating a DaemonSet.
  • A Service for external access has been configured for the workload. Services Supported by LoadBalancer Ingresses lists the Service types supported by LoadBalancer ingresses.
  • You can obtain a trusted certificate from a certificate provider. For details, see Purchasing an SSL Certificate.

Notes and Constraints

  • QUIC listeners can be added only to dedicated load balancers of the application or network & application load balancing type.
  • QUIC listeners can only be associated with HTTP/HTTPS backend server groups.
  • The backend server group associated with a QUIC listener does not support the source IP hash algorithm.
  • QUIC listeners do not support the following HTTP headers:
    • X-Forwarded-For-Port: Rewrite this header to transfer the client port.
    • X-Real-IP: Rewrite this header to transfer the client IP address.
  • QUIC listeners cannot route requests based on CIDR blocks.
  • QUIC listeners do not support two-way authentication.
  • QUIC listeners do not support security policies.
  • When a QUIC listener is used and rate limiting in advanced forwarding actions is configured, perSourceIpQps cannot be configured.

Configuring a QUIC Listener

You can configure a QUIC listener for an ingress using either the CCE console or kubectl.

  1. Log in to the CCE console and click the cluster name to access the cluster console.
  2. Choose Services and Ingresses in the navigation pane, click the Ingresses tab, and click Create Ingress in the upper right corner.
  3. Configure ingress parameters.

    This example explains only key parameters for configuring a QUIC listener. You can configure other parameters as required. For details, see Creating a LoadBalancer Ingress on the Console.

    Table 1 Key parameters

    Parameter

    Description

    Example Value

    Name

    Enter an ingress name.

    ingress-test

    Load Balancer

    Select a load balancer to be associated with the ingress or create a load balancer. In this example, only dedicated load balancers are supported.

    Dedicated

    Listener
    • Frontend Protocol: Select QUIC for the ingress.
    • External Port: Select the port of the load balancer listener. The default port for QUIC is 443.
    • Server Certificate: Use a certificate created on ELB.

      If no certificate is available, go to the ELB console and create one. For details, see Adding a Certificate.

    • Backend Protocol: Select HTTP.
    • Frontend Protocol: QUIC
    • External Port: 443
    • Server Certificate: cert-test
    • Backend Protocol:

      HTTP

    Forwarding Policy
    • Domain Name: Enter an actual domain name to be accessed. If it is left blank, the ingress can be accessed through an IP address. The domain name must be registered and filed. Once used by a forwarding policy, only that domain name will be accepted for access.
    • Path Matching Rule: Choose Prefix match, Exact match, or RegEx match.
    • Path: comes from a backend application for external access. It must work in the backend application. Otherwise, forwarding will not take effect.
    • Destination Service: Select an existing Service. Only Services that meet the requirements are automatically displayed in the Service list. If no Service meets the requirements, create one by following the operations provided in Services Supported by Ingresses.
    • Destination Service Port: Select the access port of the destination Service.
    • (Optional) Set ELB: Set the health check protocol to gRPC. Click Customize, enable health check, and select gRPC.
    • Domain Name: You do not need to configure this parameter.
    • Path Matching: Prefix match
    • Path: /
    • Destination Service: nginx
    • Destination Service Port: 80
    Figure 1 Configuring a QUIC listener

  4. Click Create.
  1. Use kubectl to access the cluster. For details, see Accessing a Cluster Using kubectl.
  2. Create a YAML file named ingress-test.yaml. You can use another file name. 

    vi ingress-test.yaml

    An example YAML file of an ingress associated with an existing load balancer is as follows:

    apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: ingress-test
  namespace: default
  annotations:
    kubernetes.io/elb.port: '443'
    kubernetes.io/elb.id: <your_elb_id>    # In this example, an existing dedicated load balancer is used. Replace its ID with the ID of your dedicated load balancer.
    kubernetes.io/elb.class: performance
    kubernetes.io/elb.protocol: QUIC  # Set the frontend protocol of the load balancer listener to QUIC.
    kubernetes.io/elb.tls-certificate-ids: 058cc023690d48a3867ad69dbe9cd6e5 # A server certificate
    kubernetes.io/elb.pool-protocol: https # Interconnected HTTPS backend service
spec:
  rules:
    - host: ''
      http:
        paths:
          - path: '/'
            backend:
              service:
                name: <your_service_name>  # Replace it with your target Service name.
                port:
                  number: 80
            property:
              ingress.beta.kubernetes.io/url-match-mode: STARTS_WITH
            pathType: ImplementationSpecific
  ingressClassName: cce

    Table 2 Key parameters

    Parameter

    Type

    Description

    kubernetes.io/elb.protocol

    String

    Frontend protocol of the load balancer listener. When configuring the QUIC frontend, set it to QUIC.

    kubernetes.io/elb.tls-certificate-ids

    String

    ELB certificate IDs, which are separated by comma (,). The list length is greater than or equal to 1. The first ID in the list is the server certificate, and the other IDs are SNI certificates in which a domain name must be contained.

    If an SNI certificate cannot be found based on the domain name requested by the client, the server certificate will be returned by default.

    To obtain the certificate, log in to the CCE console, choose Service List > Networking > Elastic Load Balance, and choose Certificates in the navigation pane. In the certificate list, copy the ID under the target certificate name.

    kubernetes.io/elb.pool-protocol

    String

    Protocol used by the backend service. If the frontend protocol of the listener is QUIC, the backend protocol can only be HTTP or HTTPS. If this field is not specified, HTTP is used by default.

  3. Create the ingress. 

    kubectl create -f ingress-test.yaml

    If information similar to the following is displayed, the ingress has been created:

    ingress.networking.k8s.io/ingress-test created

  4. Check the created ingress. 

    kubectl get ingress

    If information similar to the following is displayed, the ingress has been created:

    NAME          CLASS    HOSTS     ADDRESS          PORTS   AGE
ingress-test  cce      *         121.**.**.**     80,443  10s

Parent Topic: Protocol and Listening Configuration