Alibaba SLB, ALB and NLB migration, step by step

The tutorial in four moves

1. 01

   1. Write down what each balancer does

   For every load balancer note its type, its listeners and the protocol of each. On Alibaba Cloud, ALB handles HTTP, HTTPS and QUIC, NLB handles TCP, UDP and TCP with SSL, and CLB handles TCP, UDP, HTTP and HTTPS.

2. 02

   2. Run the assessment

   From the folder with the Terraform, run the command shown below. It reads the files and connects to no cloud account. The run in this tutorial found seven resources and seven units.

3. 03

   3. Read three files

   assessment.json for class, target and reason of each unit, migration/technical-sequencing.md for the order, and execution/manual/actions.md for the manual steps with their owners.

4. 04

   4. Change the design where the target differs

   Before anyone applies anything, decide per listener whether the target is the Network Load Balancer or the Application Load Balancer. The section on what to change names the cases.

A CLB with a listener, an ALB and an NLB, assessed

A small Alibaba Cloud estate written for this page and assessed by StackToIT on 4 November 2026. Left: three blocks of the input. Right: the result the run recorded, an excerpt of assessment.json with the values as the run wrote them. assessment.json is written as a single line, so the pane shows selected fields of each unit, indented and nested as in the file, with the values unchanged.

resource "alicloud_slb_load_balancer" "classic" {
  load_balancer_name = "shop-classic"
  load_balancer_spec = "slb.s2.small"
  address_type       = "internet"
}

resource "alicloud_slb_listener" "classic_https" {
  load_balancer_id = alicloud_slb_load_balancer.classic.id
  frontend_port    = 443
  backend_port     = 8080
  protocol         = "https"
  bandwidth        = -1
}

resource "alicloud_alb_load_balancer" "web" {
  load_balancer_name     = "shop-web"
  load_balancer_edition  = "Standard"
  address_type           = "Internet"
  address_allocated_mode = "Fixed"
  vpc_id                 = alicloud_vpc.main.id
  zone_mappings {
    vswitch_id = alicloud_vswitch.app.id
    zone_id    = "eu-central-1a"
  }
  zone_mappings {
    vswitch_id = alicloud_vswitch.app_b.id
    zone_id    = "eu-central-1b"
  }
}

[
  {
    "id": "alicloud_slb_load_balancer.classic",
    "result": {
      "class": "RECONFIGURE",
      "confidence": "MEDIUM",
      "target": {
        "service": "STACKIT Network Load Balancer"
      },
      "reason": "A CLB or NLB load balancer becomes a STACKIT Network Load Balancer. Listeners and backends are rewritten, and the public address changes."
    }
  },
  {
    "id": "alicloud_alb_load_balancer.web",
    "result": {
      "class": "RECONFIGURE",
      "confidence": "MEDIUM",
      "target": {
        "service": "STACKIT Application Load Balancer"
      },
      "reason": "An Application Load Balancer becomes a STACKIT Application Load Balancer. Listeners, rules and certificates are rewritten, and the public address changes."
    }
  },
  {
    "id": "alicloud_nlb_load_balancer.tcp",
    "result": {
      "class": "RECONFIGURE",
      "confidence": "MEDIUM",
      "target": {
        "service": "STACKIT Network Load Balancer"
      },
      "reason": "A CLB or NLB load balancer becomes a STACKIT Network Load Balancer. Listeners and backends are rewritten, and the public address changes."
    }
  },
  {
    "id": "alicloud_slb_listener.classic_https",
    "result": {
      "class": "MANUAL_REVIEW",
      "confidence": "LOW",
      "reason": "alicloud_slb_listener is not in the knowledge base catalogue; an architect has to decide the target. Nothing of this resource is assessed or drafted (unknown source type)."
    }
  }
]

• Balancers are assessed

  The classic load balancer maps to a STACKIT Network Load Balancer, the ALB to an Application Load Balancer and the NLB to a Network Load Balancer, each as RECONFIGURE with confidence MEDIUM.

• The listener is not

  alicloud_slb_listener is not in the catalogue of the run, so it is classed MANUAL_REVIEW and the run states that nothing of it is assessed or drafted. The port, protocol and backend port of the listener are exactly what you have to rebuild.

• The address changes

  The reasons of all three balancers say the public address changes. The classic and network balancers also have listeners and backends rewritten, the ALB listeners, rules and certificates.

Command and output files

The run was made from inside the input folder; the output folder sits next to it, hence ../out. --offline prevents network requests; --no-validate skips the OpenTofu validation of the source, so the demo input itself was not validated by OpenTofu.

# run from inside the demo's input folder; the output folder sits next to it
stacktoit assess . ../out --offline --no-validate

# files to open next
../out/assessment.json
../out/migration/technical-sequencing.md
../out/execution/manual/actions.md

## Wave 1 — 2 unit(s)

| Unit | Class | Target |
|---|---|---|
| `alicloud_slb_load_balancer.classic` | RECONFIGURE / MEDIUM | STACKIT Network Load Balancer |
| `alicloud_vpc.main` | RECONFIGURE / MEDIUM | STACKIT network |

## Wave 2 — 3 unit(s)

| Unit | Class | Target |
|---|---|---|
| `alicloud_slb_listener.classic_https` | MANUAL_REVIEW / LOW | — |
| `alicloud_vswitch.app` | RECONFIGURE / MEDIUM | STACKIT network |
| `alicloud_vswitch.app_b` | RECONFIGURE / MEDIUM | STACKIT network |

## Wave 3 — 2 unit(s)

| Unit | Class | Target |
|---|---|---|
| `alicloud_alb_load_balancer.web` | RECONFIGURE / MEDIUM | STACKIT Application Load Balancer |
| `alicloud_nlb_load_balancer.tcp` | RECONFIGURE / MEDIUM | STACKIT Network Load Balancer |

• Order follows references

  The ALB and NLB sit in wave 3 because they reference the VPC and the two vSwitches. The classic balancer in the demo references neither, so it lands in wave 1.

• Seven manual steps

  The run drafts no STACKIT resource for these seven units: 0 generated, 7 left for the architect. Each is a manual step in execution/manual/actions.md.

How the load balancers map

Classes as the run decided them. The run maps every classic balancer to the Network Load Balancer, whatever its listener protocols are.

What to change before applying

Facts about the target come from the STACKIT pages listed under sources, read on the day this page was written.

• HTTPS on a classic balancer

  The demo listener speaks HTTPS. The STACKIT Network Load Balancer page describes Layer 4 traffic, while TLS offloading, routing by host, path, header or query, cookie persistence and WebSocket support are listed as Application Load Balancer features. Treat a CLB with HTTP or HTTPS listeners as a candidate for the Application Load Balancer, and decide per listener. This is our reading of the two pages, not a statement of the run.

• UDP and TCP with SSL

  On Alibaba Cloud, NLB handles UDP and TCP with SSL. The STACKIT Network Load Balancer page names Layer 4 TCP in one place and TCP and UDP in the listener section, so confirm UDP in the current documentation. The STACKIT page also states that the Network Load Balancer works at Layer 4 only and that encrypting the traffic is up to you, so a TCP/SSL listener needs TLS terminated on the backends or a move to the Application Load Balancer.

• Address and DNS

  The balancer reasons state that the public address changes. Allow lists and DNS records that name the old address change with it. The STACKIT Network Load Balancer uses a user-managed static external IP or an ephemeral one, and the static one is set at creation and cannot be changed.

• Private balancers

  The feature list of the Application Load Balancer includes a private-network-only deployment. The Network Load Balancer page describes public IPs only. The demo NLB sets address_type Intranet, yet the run maps it to the Network Load Balancer and its reason still speaks of a public address, so a private Layer 4 balancer needs a design decision.

• Targets and health checks

  On the STACKIT Network Load Balancer each listener has one target pool, a pool is a group of targets with one target pool port, and active health checks are on by default. The ALB feature list shows TCP health checks everywhere and HTTP health checks in API and SDK, not yet in Terraform and the Portal. Rebuild the backend server groups and their checks by hand from the source listeners.

Questions network teams ask

Sources

• Alibaba Cloud docs: ECS application delivery network design (SLB, ALB, NLB, CLB)
• STACKIT docs: Network Load Balancer, basic concepts
• STACKIT docs: Application Load Balancer, features