All Products
Search

This Product

    Container Service for Kubernetes:Use security hardening mode for instance metadata

    Document Center

    Container Service for Kubernetes:Use security hardening mode for instance metadata

    Last Updated:Jul 03, 2026

    You can use the instance metadata service from within an ECS instance to retrieve its metadata, such as instance IDs, VPC information, and network interface information. By default, the instance metadata access mode for nodes in an ACK cluster supports both normal mode and enhanced mode. You can switch to only enhanced mode (IMDSv2) to improve the security of the instance metadata service.

    After you enable enhanced mode, applications on the nodes can no longer use normal mode to access the ECS instance metadata service. For more information about ECS instance metadata access modes, see instance metadata.

    Prerequisites

    • You have an ACK managed cluster or an ACK dedicated cluster that runs Kubernetes version 1.28 or later. To upgrade your cluster, see Manually upgrade a cluster.

    • If your cluster uses any of the components in the following tables, ensure both the components and the cluster meet the minimum version requirements.

      Expand

      ACK managed cluster

      Component

      Minimum component version

      Minimum cluster version

      cloud-controller-manager

      v2.11.3

      1.28

      terway

      v1.9.16

      1.30

      terway-eni

      v1.9.16

      1.30

      terway-eniip

      v1.9.16

      1.30

      terway-eniip

      v1.14.0

      1.31

      terway-controlplane

      v1.9.16

      1.30

      terway-controlplane

      v1.14.0

      1.31

      ack-erdma-controller

      0.2.6

      1.28

      mse-ingress-controller

      1.1.18

      1.28

      alb-ingress-controller

      v2.18.0-aliyun.1

      1.28

      csi-provisioner

      v1.33.3-884df97-aliyun

      1.28

      csi-plugin

      v1.33.3-884df97-aliyun

      1.28

      storage-operator

      v1.32.10

      1.28

      flexvolume

      No supported version is available. You must migrate to csi-plugin. For more information, see Migrate from FlexVolume to CSI.

      kritis-validation-hook

      v0.12.0.0-g1535b25b-aliyun

      1.28

      aliyun-acr-credential-helper

      v25.07.21.1-67f1f51-aliyun

      1.28

      logtail-ds

      v2.1.14.0-aliyun

      1.28

      loongcollector

      3.1.1

      1.28

      metrics-server

      v0.3.9.7-85b3699-aliyun

      1.28

      alicloud-monitor-controller

      v1.8.4

      1.28

      ack-node-problem-detector

      1.2.26

      1.28

      arms-prometheus

      1.1.32

      1.28

      ack-cost-exporter

      1.0.18

      1.28

      ack-sysom-monitor

      1.1.2

      1.28

      arms-cmonitor

      4.1.2

      1.28

      ack-onepilot

      5.0.0

      1.28

      cluster-autoscaler

      v1.3.18-48f43128-aliyun

      1.28

      ack-goatscaler

      v0.4.5-17c5a32-aliyun

      1.28

      migrate-controller

      v1.8.6-17482bb-aliyun

      1.28

      ack-acr-acceleration-p2p

      0.3.10

      1.28

      csi-secrets-store-provider-alibabacloud

      0.5.0

      1.28

      ack-secret-manager

      0.5.12

      1.28

      ack-extend-network-controller

      v0.12.0

      1.28

      ACK dedicated cluster

      Component

      Minimum component version

      Minimum cluster version

      cloud-controller-manager

      v2.11.3

      1.28

      terway

      v1.9.16

      1.30

      terway-eni

      v1.9.16

      1.30

      terway-eniip

      v1.9.16

      1.30

      terway-eniip

      v1.14.0

      1.31

      terway-controlplane

      v1.9.16

      1.30

      terway-controlplane

      v1.14.0

      1.31

      ack-erdma-controller

      0.2.6

      1.28

      mse-ingress-controller

      1.1.18

      1.28

      alb-ingress-controller

      v2.18.0-aliyun.1

      1.28

      csi-provisioner

      v1.33.3-884df97-aliyun

      1.28

      csi-plugin

      v1.33.3-884df97-aliyun

      1.28

      storage-operator

      v1.32.10

      1.28

      flexvolume

      No supported version is available. You must migrate to csi-plugin. For more information, see Migrate from FlexVolume to CSI.

      kritis-validation-hook

      v0.12.0.0-g1535b25b-aliyun

      1.28

      aliyun-acr-credential-helper

      v25.07.21.1-67f1f51-aliyun

      1.28

      logtail-ds

      v2.1.14.0-aliyun

      1.28

      loongcollector

      3.1.1

      1.28

      metrics-server

      v0.3.9.7-85b3699-aliyun

      1.28

      alicloud-monitor-controller

      v1.8.8

      1.28

      ack-node-problem-detector

      1.2.27

      1.28

      arms-prometheus

      1.1.33

      1.28

      ack-cost-exporter

      1.0.21

      1.28

      ack-sysom-monitor

      1.1.2

      1.28

      arms-cmonitor

      4.1.2

      1.28

      ack-onepilot

      5.0.0

      1.28

      cluster-autoscaler

      v1.3.18-48f43128-aliyun

      1.28

      ack-goatscaler

      v0.4.5-17c5a32-aliyun

      1.28

      migrate-controller

      v1.8.6-17482bb-aliyun

      1.28

      ack-acr-acceleration-p2p

      0.3.10

      1.28

      csi-secrets-store-provider-alibabacloud

      0.5.0

      1.28

      ack-secret-manager

      0.5.12

      1.28

      ack-extend-network-controller

      v0.12.0

      1.28

    • If you have deployed applications in your cluster that depend on the instance metadata service, enforcing enhanced mode will cause requests that use normal mode to be rejected. Update your application code. For more information, see instance metadata.

    Procedure

    You can configure this feature only when you create a node pool or during the node pool configuration step of cluster creation. The instance metadata access mode cannot be changed after the node pool is created.

    The following procedure uses the creation of a new node pool as an example. The key settings are the same for the cluster creation process.

    1. Log on to the ACK console. In the left navigation pane, click Clusters.

    2. On the Clusters page, click the name of your cluster. In the left navigation pane, click Nodes > Node Pools.

    3. Click Create a node pool.

      This section describes only the key settings for this feature. For details about all settings, see Create and manage a node pool.

      • Operating system: Ensure that the operating system image supports enhanced mode and that the image version meets the requirements.

        • Public image

          Operating system image

          Minimum version

          Alibaba Cloud Linux 3.2104 LTS 64-bit (Container-optimized)

          20241226

          Alibaba Cloud Linux 3.2104 LTS 64-bit

          20241218

          Alibaba Cloud Linux 4 LTS 64-bit (Container-optimized)

          20251106

          Ubuntu 22.04

          20250722

          ContainerOS 3.6

          20250916

        • Custom image: The cloud-init version in the image must be 23.2.2 or later. To learn how to check and upgrade the cloud-init version, see Install cloud-init.

      • Instance Metadata Access Mode: Select Security Hardening Mode.