All Products
Search

This Product

    Container Service for Kubernetes:Create an ACK dedicated cluster

    Document Center

    Container Service for Kubernetes:Create an ACK dedicated cluster

    Last Updated:Aug 28, 2026

    An ACK dedicated cluster runs at least three master nodes for high availability plus your required worker nodes. Create one from the console, an API, Terraform, an SDK, or the CLI, and gain fine-grained control over the cluster infrastructure in return for planning, maintaining, and upgrading it yourself.

    Important

    Container Service for Kubernetes no longer supports creating ACK dedicated clusters as of August 21, 2024. We recommend using ACK Pro clusters in production environments for higher reliability, security, and scheduling efficiency.

    Preparations

    Before you create a cluster, make sure that you have activated Container Service for Kubernetes (ACK), granted the ACK system service role to your Alibaba Cloud account or RAM user, and activated related cloud products such as VPC, Server Load Balancer (SLB), and NAT Gateway. ACK requires these permissions to call related services and perform cluster operations. For more information, see Quickly create an ACK managed cluster.

    Note

    The cluster creation process involves purchasing pay-as-you-go resources such as Server Load Balancer (SLB) instances. Make sure that your account has a sufficient balance to prevent service interruptions due to overdue payments.

    Create a cluster

    You can create an ACK cluster by using the console, API, SDK, Terraform, or CLI.

    Console

    Step 1: Log on to ACK console

    1. Log on to the ACK console. In the left navigation pane, click Clusters.

    2. At the top left of the page, select the resource group and region of the target resource. image

    3. On the Clusters page, click Create Kubernetes Cluster.

    Step 2: Configure cluster

    On the ACK Dedicated Cluster tab, configure the basic information, network, and advanced options for the cluster.

    Basic information

    Parameter

    Description

    Cluster Name

    Enter a custom name for the cluster.

    Region

    The region where the cluster resources, such as ECS instances and cloud disks, are located. The closer the region is to your users and resource deployment region, the lower the network latency.

    Kubernetes Version

    You can only create clusters with the three most recent minor versions. We recommend using the latest version. For more information about the versions supported by ACK, see ACK version support overview.
    Network configuration

    Parameter

    Description

    IPv6 Dual-stack
    This feature is only available for Kubernetes 1.22 and later and only supports Terway. It cannot be used with the elastic Remote Direct Memory Access (eRDMA) feature

    The cluster supports both IPv4 and IPv6 protocols. However, communication between worker nodes and the control plane still uses IPv4 addresses. Make sure that:

    • The cluster VPC supports IPv6 dual-stack.

    • When using Terway in shared ENI mode, the node's instance type must support IPv6 and have the same number of supported IPv4 and IPv6 addresses.

    VPC

    The virtual private cloud (VPC) for the cluster. For high availability, select two or more different zones.

    • Automatic creation: ACK creates a corresponding vSwitch in each selected zone.

    • Use existing: Select a vSwitch to specify the zone for the cluster. You can create a new vSwitch or use an existing one.

    We recommend using standard private CIDR blocks for the cluster VPC, such as 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. If you have special requirements, go to Quota Center to apply for permission to use a public CIDR block to create a cluster.

    Cloud resources and billing: imageVPC

    Configure SNAT for VPC
    Do not select this option when using a shared VPC

    Select this option if nodes need to access the public network (for example, to pull public images or access external services). ACK will automatically configure a NAT Gateway and SNAT rules to ensure that resources within the cluster can access the public network.

    • If the VPC does not have a NAT Gateway: ACK automatically creates a NAT Gateway, purchases a new EIP, and configures an SNAT rule for the vSwitch used by the cluster.

    • If the VPC already has a NAT Gateway: ACK determines whether to purchase an additional EIP and configure an SNAT rule. If no EIP is available, a new one is automatically purchased. If no VPC-level SNAT rule exists, an SNAT rule is configured for the vSwitch used by the cluster.

    If you do not select this option, you can configure the NAT Gateway and SNAT rules yourself after creating the cluster. For more information, see Public NAT Gateway.

    Cloud resources and billing: imageNAT Gateway, imageEIP

    vSwitch

    Select an existing vSwitch from the list based on the zone, or click Create vSwitch to create a new one. The cluster control plane and the default node pool will use the vSwitch specified here. We recommend selecting vSwitches in multiple different zones to ensure high availability for the cluster.

    Security Group
    When using an existing VPC, you can choose to Select Existing Security Group

    This security group is applied to the cluster control plane, the default node pool, and any node pools that do not have a custom security group specified.

    Compared to basic security groups, advanced security groups can contain more private IP addresses but do not support intra-group connectivity. For more information, see Security group classification.

    • Automatic creation: All outbound traffic is allowed by default. Inbound traffic is allowed based on the recommended configuration. If you modify the rules later, ensure that the 100.64.0.0/10 CIDR block is allowed for inbound traffic.

      This CIDR block is used to access other Alibaba Cloud services for operations such as pulling images and querying basic ECS information.

    • Use existing: ACK does not configure additional access rules for the security group by default. You must manage the security group rules yourself to avoid access issues. For more information, see Configure cluster security groups.

    Access to API Server

    ACK automatically creates a pay-as-you-go private-facing Classic Load Balancer (CLB) instance as the internal endpoint for the API Server. This CLB instance cannot be reused or deleted. If deleted, the API Server will become inaccessible and cannot be recovered.

    To use an existing CLB instance, submit a ticket. After you select Use Existing Gateway for VPC, you can set SLB Source to Use Existing Gateway.

    You can choose to enable Expose API server with EIP.

    • Open: Binds an EIP to the API Server's private-facing CLB instance, allowing you to access and manage the cluster from the public network.

      This does not mean that resources within the cluster can access the public network. To allow cluster resources to access the public network, you must select Configure SNAT for VPC.

    • Not open: You can only connect to and operate the cluster using the kubeconfig file from within the VPC.

    To enable this later, see Access the API server over the internet.
    Starting from December 1, 2024, new CLB instances will incur an instance fee. For more information, see Billing item adjustment for Classic Load Balancer (CLB).

    Cloud resources and billing: imageCLB, imageEIP

    Network Plug-in

    The network plugin is the foundation for network communication between pods in a cluster.

    For a detailed comparison of the two plugins, see Comparison of Terway and Flannel.

    • Flannel: A lightweight, open source network plugin. In ACK, it uses a VPC-native mode that is deeply integrated with Alibaba Cloud VPC. It manages VPC route tables directly to enable communication between pods.

      • Scenarios: Simple to configure and consumes few resources. Suitable for scenarios with a small number of nodes (limited by VPC route table quotas), where simplified network configuration is needed, and custom control over the container network is not required.

    • Terway: A high-performance network plugin developed by Alibaba Cloud. It uses elastic network interfaces (ENIs) to enable communication between pods.

      • Scenarios: Provides capabilities such as eBPF-based network acceleration, NetworkPolicy, and pod-level vSwitches and security groups. Suitable for high-performance computing (HPC), gaming, and microservice scenarios that have high requirements for node scale, network performance, and security.

      • Pod quantity limit: Each pod occupies a secondary IP address of an ENI. The number of IPs that can be assigned to a single ENI is limited by the instance type. Therefore, the number of pods that can run on a node is limited by the node's ENI and secondary IP quotas.

        When using a shared VPC, only Terway is supported.

      Terway also provides the following capabilities.

      For more information, see Use the Terway network plugin.

      • DataPath V2

        Can only be configured when creating a cluster

        Enable DataPath V2 acceleration mode. Terway will use eBPF technology to optimize traffic forwarding paths, providing lower latency and higher throughput for network-intensive applications.

        This feature is only supported on Alibaba Cloud Linux 3 (all versions), ContainerOS, and Ubuntu with Linux kernel version 5.10 or later. For more information, see Network acceleration.

      • NetworkPolicy Support

        This feature is in public preview. Submit an application in Quota Center console

        Supports native Kubernetes NetworkPolicy to act as a "firewall" between pods. You can define fine-grained access control rules to enhance cluster security.

      • Support for ENI Trunking

        Allows you to configure independent IPs, vSwitches, and security groups for pods. This is suitable for special business scenarios that require fixed IPs or independent network policy management for specific pods. For more information, see Configure a fixed IP address, an independent virtual switch, and a security group for a pod.

    Container CIDR Block
    This parameter is required only for Flannel

    The address pool that assigns IP addresses to pods. This CIDR block cannot overlap with the VPC's CIDR block, the CIDR blocks used by existing ACK clusters in the VPC, or the Service CIDR.

    Number of Pods per Node
    You only need to configure Flannel.

    Defines the maximum number of pods that a single node can accommodate.

    Pod vSwitch
    This parameter is required only when you select Terway.

    The vSwitch that assigns IP addresses to pods. Each pod vSwitch corresponds to a worker node's vSwitch. The pod vSwitch and the worker node's vSwitch must be in the same zone.

    Important

    The subnet mask for the pod vSwitch should not exceed 19, and the maximum is 25. Otherwise, the number of available pod IP addresses in the cluster network will be very limited, which will affect the normal use of the cluster.

    Service CIDR

    Also known as Service CIDR. This is the address pool that assigns IP addresses to services within the cluster. This CIDR block cannot overlap with the VPC's CIDR block, the CIDR blocks used by existing clusters in the VPC, or the Container CIDR Block.

    IPv6 Service CIDR Block
    Requires IPv6 Dual-Stack to be enabled

    Configure an IPv6 address range for the service CIDR block. You must use a Unique Local Address (ULA) (within the fc00::/7 range). The address prefix length must be between /112 and /120. We recommend that the number of available addresses is consistent with the Service CIDR.
    Advanced configuration

    Expand Advanced Options (Optional) to configure the service forwarding mode for the cluster.

    Parameter

    Description

    Forwarding Mode

    Select the kube-proxy proxy mode, which determines how cluster services distribute requests to backend pods.

    • iptables: Uses Linux firewall rules for traffic forwarding. It is stable but has limited performance. As the number of services increases, the number of firewall rules grows, slowing down request processing. Suitable for clusters with a small number of services.

    • IPVS: A high-performance traffic distribution solution. It uses a hash table to quickly locate target pods, resulting in lower latency when handling many service requests. Suitable for large-scale production clusters or scenarios with high network performance requirements.

      Starting from Kubernetes 1.35, the ipvs mode of kube-proxy is marked as deprecated and is planned to be removed in a future version.

    • nftables: A modern replacement for iptables that provides a more efficient rule model. Its near-O(1) rule mapping lookup makes data plane latency independent of cluster size. Control plane updates use incremental synchronization, optimizing the efficiency of rule changes. As the mainstream development direction for the Linux kernel networking framework, it is the recommended mode by the kube-proxy community. Suitable for medium to large-scale clusters or scenarios that require better performance and maintainability than iptables.

      When using the nftables service forwarding mode, the Linux kernel version of the nodes in the cluster must be 5.13 or later. Otherwise, nodes will fail to be added.

    Expand Advanced Options (Optional) to configure cluster deletion protection, the Resource Group, and other settings.

    Advanced options

    Parameter

    Description

    Cluster Deletion Protection

    We recommend enabling this feature to prevent accidental deletion of the cluster through the console or OpenAPI.

    Resource Group

    Assign the cluster to the selected resource group for easier permission management and cost allocation.

    A resource can belong to only one resource group.

    Label

    Bind key-value tags to the cluster to identify cloud resources.

    Time Zone

    The time zone used by the cluster. By default, this is the time zone configured in your browser.

    Cluster Domain

    The top-level domain (standard suffix) used by services within the cluster. The default is cluster.local. You can also use a custom domain. When using a custom local domain, see What do I need to know when configuring a cluster-local domain name (ClusterDomain)?.

    For example, a service named my-service in the default namespace has the DNS name my-service.default.svc.cluster.local.

    Custom Certificate SANs

    The Subject Alternative Name (SAN) field in the API Server certificate includes the cluster-local domain name, private IP address, and public EIP by default. To access the cluster through a proxy server, custom domain, or special network environment, add these access addresses to the SAN field.

    To enable this later, see Customize the SAN of the cluster API Server certificate.

    Service Account Token Volume Projection

    In the traditional model, a pod's identity credentials are permanent and shared among multiple pods, which poses a security risk. When enabled, each pod gets its own temporary identity credentials, which support automatic expiration and permission restrictions.

    To enable this later, see Use ServiceAccount token volume projection.

    Node Port Range

    The range of available ports when creating a NodePort service.

    Cluster CA

    When enabled, you can add a CA certificate to the cluster to enhance the security of information exchange between the server and client.

    Step 3: Configure master nodes

    Click Next: Master Configuration to configure the master nodes.

    Parameter

    Description

    Master Nodes

    Specify the number of master nodes to deploy in the zone.

    Billing Method

    Supports Pay-As-You-Go and Subscription billing methods. If you select Subscription, you must set the Validity Period and specify whether to enable Auto Renewal.

    Instance Type

    Select the instance family for the master nodes. For configuration recommendations, see Select master node instance types.

    System Disk

    Select a cloud disk type based on your business needs, including ESSD AutoPL, enterprise SSD (ESSD), ESSD Entry, and previous-generation cloud disks (standard SSD and ultra disk). Configure the capacity and IOPS.

    The available system disk types depend on the selected instance family. Disk types that are not displayed are not supported.

    Custom performance and encryption for ESSDs

    • You can customize the performance level (PL). The larger the disk capacity, the higher the PL you can select (PL2 is available for capacities of 460 GiB or more, and PL3 for 1260 GiB or more). For more information, see ESSDs.

    • Among system disks, only ESSDs support Encrypted. When you select a key, Alibaba Cloud uses the default service key (Default Service CMK) for encryption. You can also select a custom key (Bring-Your-Own-Key, or BYOK) that you have created in KMS.

    You can select More Disk Categories to configure disk types different from the System Disk to improve the success rate of scale-outs. When creating a node, ACK selects the first matching type in the specified order of disk types.

    Cloud resources and billing: imageECS Elastic Block Storage

    Deployment Set

    After creating a deployment set in the ECS console, assign it to the node pool. This ensures that the nodes scaled out by the node pool are distributed across different physical servers, improving high availability.

    A deployment set supports a maximum of 20 × number of zones nodes by default (the number of zones is determined by the vSwitches). The maximum number of nodes in the node pool will be limited. Ensure that the quota in the deployment set is sufficient.

    To enable this later, see Best practices for node pool deployment sets.
    Advanced options

    Parameter

    Description

    Instance Metadata Access Mode
    Only supported for clusters of version 1.28 and later

    Configure the metadata access mode for ECS instances. You can access the Metadata Service from within an ECS instance to retrieve instance metadata, including instance ID, VPC information, NIC information, and other instance attributes. For more information, see Instance metadata.

    • Normal Mode and Security Hardening Mode: Supports accessing the instance metadata service using both normal and reinforced modes.

    • Security Hardening Mode: Only supports accessing the instance metadata service using reinforced mode. For more information, see Use reinforced mode only to access ECS instance metadata.

    Step 4: Configure the node pool

    Click Next: Node Pool Configuration and configure the basic and advanced options for the node pool.

    Basic node pool configuration

    Parameter

    Description

    Node Pool Name

    Enter a custom name for the node pool.

    Container Runtime

    For information on how to choose, see Comparison of containerd, sandboxed containers, and Docker runtimes.

    • containerd (Recommended): The community standard, supporting version 1.20 and later.

    • Sandboxed Container: Provides a strongly isolated environment based on lightweight virtualization technology. For usage procedures and limits, see Create and manage a sandboxed container node pool.

    • Docker (Discontinued): Only supports version 1.22 and earlier. Creation is no longer supported.
    Instance and image configuration

    Parameter

    Description

    Billing Method

    The default billing method for nodes scaled out by the node pool.

    • Pay-As-You-Go: Can be enabled and released on demand.

    • Subscription: Requires configuring the Duration and Auto Renewal.

    • Preemptible Instance: Currently only supports spot instances with a protection period. You must also configure the Instance Price Cap.

      When the real-time price of the specified instance type is lower than the maximum bid for a single instance, the instance will be created successfully. After the protection period (1 hour), the system checks the real-time price and inventory of the instance type every 5 minutes. If the market price is higher than your bid or the inventory is insufficient, the spot instance will be released. For usage recommendations, see Best practices for spot instance node pools.

    To ensure node pool uniformity, you cannot change a Pay-As-You-Go or Subscription node pool to a Preemptible Instance node pool, or vice versa.

    Instance configuration

    When a node pool scales out, it allocates instances from the configured ECS instance family. To improve the success rate of scale-outs, select multiple instance types across multiple zones to avoid unavailability or stock shortages. The specific instance type for scale-out is determined by the configured Scaling Policy.

    To ensure business stability and accurate resource scheduling, do not mix GPU and non-GPU instance types in the same node pool.

    You can configure the instance types used for scale-out in the following two ways:

    • Specific types: Specify instance types based on dimensions such as vCPU, memory, instance family, and CPU architecture (the instance's CPU architecture must be consistent with the OS image architecture).

      When using Terway, you can view the maximum number of pods per node for the target instance type in the instance type list.

    • Generalization configuration: Select a list of instance types to use or exclude based on attributes (such as vCPU and memory) to further improve the scale-out success rate.

    You can refer to the elasticity strength recommendations in the console or view the node pool elasticity strength after the node pool is created.

    For information about unsupported instance types and node configuration recommendations, see ECS instance type configuration recommendations.

    Cloud resources and billing: imageECS Instance, imageGPU-accelerated Instance

    Operating System
    Marketplace Image is in phased release.
    To upgrade or change the OS later, see Change the operating system.

    Security Hardening

    When creating a node, ACK applies the selected security baseline policy.

    • Disable: No security hardening is performed on the ECS instance.

    • MLPS Security Hardening: Alibaba Cloud provides baseline check standards and scanning tools for the Alibaba Cloud Linux MLPS 2.0 Level 3 edition image that meet classified protection compliance requirements. While ensuring native image compatibility and performance, it has been adapted for MLPS 2.0 compliance, meeting the requirements of GB/T 22239-2019 Information Security Technology - Basic Requirements for Classified Protection of Cybersecurity. For more information, see Instructions for using ACK MLPS 2.0 security hardening.

      However, in this mode, the root user cannot log on remotely via SSH. You can connect to the instance via VNC in the ECS console and create a regular user that supports SSH logon.

    • OS Security Hardening: Only supports Alibaba Cloud Linux 2 or Alibaba Cloud Linux 3.

    Logon Type

    • Key Pair: Alibaba Cloud SSH key pairs are a secure and convenient logon authentication method, consisting of a public key and a private key. They are only supported for Linux instances.

      Configure both the Username (root or ecs-user) and the required Key Pair.

    • Password: Configure the Username (root or ecs-user) and a password.
    Storage configuration

    Parameter

    Description

    System Disk

    Select a cloud disk type based on your business needs, including ESSD AutoPL, enterprise SSD (ESSD), ESSD Entry, and previous-generation cloud disks (standard SSD and ultra disk). Configure the capacity and IOPS.

    The available system disk types depend on the selected instance family. Disk types that are not displayed are not supported.

    Custom performance and encryption for ESSDs

    • You can customize the performance level (PL). The larger the disk capacity, the higher the PL you can select (PL2 is available for capacities of 460 GiB or more, and PL3 for 1260 GiB or more). For more information, see ESSDs.

    • Among system disks, only ESSDs support Encrypted. When you select a key, Alibaba Cloud uses the default service key (Default Service CMK) for encryption. You can also select a custom key (Bring-Your-Own-Key, or BYOK) that you have created in KMS.

    You can select More Disk Categories to configure disk types different from the System Disk to improve the success rate of scale-outs. When creating a node, ACK selects the first matching type in the specified order of disk types.

    Cloud resources and billing: imageECS Elastic Block Storage

    Data Disk

    Select a cloud disk type based on your business needs, including ESSD AutoPL, enterprise SSD (ESSD), ESSD Entry, and previous-generation cloud disks (standard SSD and ultra disk). Configure the capacity and IOPS.

    The available data disk types depend on the selected instance family. Disk types that are not displayed are not supported.

    ESSD AutoPL support

    • Provisioned performance: You can flexibly configure the provisioned performance of the cloud disk without changing its storage capacity, decoupling disk capacity from performance.

    • Performance burst: When your business faces sudden data read/write pressure, the cloud disk temporarily increases its performance to handle peak demand until the business stabilizes.

    ESSD support

    You can customize the performance level (PL). The larger the disk capacity, the higher the PL you can select (PL2 is available for capacities of 460 GiB or more, and PL3 for 1260 GiB or more). For more information, see ESSDs.

    • When you attach a data disk, all cloud disk types support Encrypted. When you select a key, Alibaba Cloud uses the default service key (Default Service CMK) for encryption. You can also select a custom key (Bring-Your-Own-Key, or BYOK) that you have created in KMS.

    • During node creation, the last data disk is automatically formatted, and /var/lib/container is mounted to it. /var/lib/kubelet and /var/lib/containerd are mounted to /var/lib/container.

      To customize the mount directory, adjust the data disk's initialization configuration. You can select at most one data disk as the directory for the container runtime. For more information, see Can I customize the mount directory for data disks in an ACK node pool?

    • In scenarios that require container image acceleration or rapid loading of large models, you can also create data disks from snapshots to improve system response speed and processing capabilities.

    You can select Add Data Disk Type to configure disk types different from the Data Disk to improve the success rate of scale-outs. When creating a node, ACK selects the first matching type in the specified order of disk types.

    An ECS instance can have up to 64 data disks attached. The specific limit varies by instance type. You can call the DescribeInstanceTypes operation to query the cloud disk quantity limit (DiskQuantity) for the corresponding instance type.

    Cloud resources and billing: imageECS Elastic Block Storage

    Instance quantity

    Parameter

    Description

    Expected Number of Nodes

    The total number of nodes that the node pool should maintain. We recommend configuring at least two nodes to ensure that cluster components run properly. You can adjust the desired node count to scale the node pool in or out. For more information, see Scale a node pool.

    If you do not need to create nodes, you can set this to 0 and then manually adjust it or add existing nodes later.
    Advanced configuration

    Expand Advanced Options (Optional) to configure the node scaling policy.

    Parameter

    Description

    Scaling Policy

    Configure how the node pool selects instances during node scaling.

    • Priority-based Policy: Scales based on the priority of the vSwitches configured for the cluster (vSwitch priority decreases from top to bottom). If an instance cannot be created in the zone of a higher-priority vSwitch, the next-priority vSwitch is automatically used.

    • Cost Optimization: Scales based on the vCPU unit price from low to high.

      If the node pool uses Preemptible Instance, spot instances are prioritized. You can also configure the Percentage of On-Demand Instances (%). If spot instance types cannot be created due to inventory or other reasons, pay-as-you-go instances are automatically used as a supplement.

    • Distribution Balancing: Distributes ECS instances evenly across multiple zones, but only in multi-zone scenarios. If the distribution becomes unbalanced due to insufficient inventory or other reasons, you can perform a rebalancing operation.

    Use Pay-as-you-go Instances When Spot Instances Are Insufficient
    This requires the billing method to be set to Spot Instance.

    When enabled, if not enough spot instances can be created due to price, inventory, or other reasons, ACK will automatically try to create on-demand instances as a supplement.

    Cloud resources and billing: imageECS Instance

    Enable Supplemental Spot Instance
    This requires the billing method to be set to Spot Instance.

    When enabled, upon receiving a system message that a spot instance is about to be reclaimed (5 minutes before reclamation), ACK will attempt to scale out a new instance as compensation.

    • Compensation successful: ACK drains the old node and removes it from the cluster.

    • Compensation failed: ACK does not drain the old node. The instance will still be reclaimed and released after 5 minutes. When inventory is restored or price conditions are met, ACK will automatically purchase an instance to maintain the desired number of nodes. For more information, see Best practices for spot instance node pools.

    The proactive release of spot instances can cause business disruptions. To improve the compensation success rate, we recommend also enabling Use Pay-as-you-go Instances When Spot Instances Are Insufficient.

    Cloud resources and billing: imageECS Instance

    Expand Advanced Options (Optional) to configure ECS tags, taints, and other information.

    Parameter

    Description

    ECS Tags

    Add tags to the ECS instances automatically created by ACK to identify cloud resources. Each ECS instance can be bound with up to 20 tags. To increase this limit, submit a request on the Quota Center platform. Because ACK and Auto Scaling (ESS) occupy some tags, you can specify up to 17 custom tags for an instance.

    Expand to see tag usage details

    • ACK occupies two ECS tags by default.

      • ack.aliyun.com:<your_cluster_id>

      • ack.alibabacloud.com/nodepool-id:<your_nodepool_id>

    • ESS occupies one ECS tag by default: acs:autoscaling:scalingGroupId:<your_nodepool_scaling_group_id>.

    • After enabling node autoscaling, Auto Scaling will occupy two additional ECS tags by default, so the node pool will occupy two more ECS tags: k8s.io/cluster-autoscaler:true and k8s.aliyun.com:true.

    • After enabling node autoscaling, the component records the node's labels and taints through ECS tags to pre-check the scheduling behavior of scaled-out nodes.

      • Each label of the node is converted to k8s.io/cluster-autoscaler/node-template/label/<label_key>:<label_value>.

      • Each taint of the node is converted to k8s.io/cluster-autoscaler/node-template/taint/<taint_key>/<taint_value>:<taint_effect>.

    Taints

    Add key-value taints to the node. A valid taint key consists of an optional prefix and a name. If a prefix is present, it is separated from the name by a forward slash (/).

    Expand to see detailed instructions

    • Key: The name must be 1 to 63 characters long, start and end with an alphanumeric character [a-z0-9A-Z], and can contain letters, numbers, hyphens (-), underscores (_), and periods (.).

      If you specify a prefix, it must be a DNS subdomain, which is a series of DNS labels separated by periods (.), not exceeding 253 characters, and ending with a forward slash (/).

    • Value: The taint value can be empty, up to 63 characters long, must start and end with an alphanumeric character [a-z0-9A-Z], and can contain letters, numbers, hyphens (-), underscores (_), and periods (.).

    • Effect:

      • NoSchedule: No new pods that do not tolerate this taint will be scheduled to the node, but running pods are not affected.

      • NoExecute: Not only will no new pods that do not tolerate this taint be scheduled to the node, but any running pods on the node that do not tolerate this taint will be evicted.

      • PreferNoSchedule: ACK will try to avoid scheduling pods to nodes with taints they do not tolerate, but it is not enforced.

    Node Labels

    Add key-value labels to the node. A valid Key consists of an optional prefix and a name. If a prefix is present, the prefix and name are separated by a forward slash (/).

    Expand to see detailed instructions

    • Key: The name must be 1 to 63 characters long, start and end with an alphanumeric character [a-z0-9A-Z], and can contain letters, numbers, hyphens (-), underscores (_), and periods (.).

      If you specify a prefix, it must be a DNS subdomain, which is a series of DNS labels separated by periods (.), not exceeding 253 characters, and ending with a forward slash (/).

      The following prefixes are reserved by Kubernetes core components and cannot be specified

      • kubernetes.io/

      • k8s.io/

      • prefixes ending with kubernetes.io/ and k8s.io/. For example, test.kubernetes.io/.

        The following are exceptions:

        • kubelet.kubernetes.io/

        • node.kubernetes.io

        • prefixes ending with kubelet.kubernetes.io/.

        • prefixes ending with node.kubernetes.io.

    • Value: Can be empty, up to 63 characters long, must start and end with an alphanumeric character [a-z0-9A-Z], and can contain letters, numbers, hyphens (-), underscores (_), and periods (.).

    Set to Unschedulable

    Newly added nodes will be set as unschedulable by default when they are registered with the cluster. You need to manually adjust the node scheduling status in the node list.

    This configuration only takes effect for clusters of versions earlier than 1.34. For more information, see Kubernetes 1.34 version guide.

    CPU Policy

    Specify the kubelet's CPU management policy for the node.

    • None: The default policy.

    • Static: Allows pods with certain resource characteristics on the node to be granted enhanced CPU affinity and exclusivity.

    We recommend using custom kubelet configurations for node pools.

    Custom Node Name

    By default, node names are automatically generated. If you need a unified naming convention for easier node management and O&M identification, you can enable this configuration. When enabled, the node name, ECS instance name, and hostname will all change.

    Method 3 is only applicable to Lingjun node pools, and Lingjun node pools only support Method 3.

    Method 1: Full IP address + prefix/suffix

    • Description: The node name consists of a prefix, the node's IP address, and a suffix. When enabled, the node name, ECS instance name, and ECS instance hostname will also change.

    • Example: The node's IP address is 192.XX.YY.55, the specified prefix is aliyun.com, and the suffix is test.

      • Linux node: The node name, ECS instance name, and ECS instance hostname are all aliyun.com192.XX.YY.55test.

      • Windows node: Its hostname is fixed to the IP address, using - to replace the . in the IP address, and does not include the prefix and suffix.

        Therefore, the ECS instance hostname is 192-XX-YY-55, and the node name and ECS instance name are both aliyun.com192.XX.YY.55test.

    Method 2: Specified number of IP address digits + prefix/suffix

    Whitelisting

    • Description: The node name consists of a prefix, a specified number of digits from the node's IP address, and a suffix. When enabled, the node name, ECS instance name, and ECS instance hostname will change accordingly.

    • Example: The node's IP address is 192.XX.YY.55, the prefix is aliyun.com, the suffix is test, and the number of IP address digits to truncate is 6. The resulting node name is aliyun.com0YY055test.

      Important

      When the custom node name format depends on truncating part of the IP address, if the VPC CIDR block is large and the number of truncated IP digits (lenOfIP) is insufficient, it may cause node name conflicts, leading to node scale-out failures in node instant scaling scenarios.

      Set the number of IP address digits to truncate based on the following recommendations for your VPC CIDR block:

      • For large-scale CIDR blocks such as 10.0.0.0/8 and 172.16.0.0/12, we recommend setting lenOfIP to at least 9.

      • For the 192.168.0.0/16 CIDR block, we recommend setting lenOfIP to at least 6.

    Method 3: Sync instance hostname (only supported for Lingjun node pools)

    Whitelisted feature, not applicable to non-Lingjun node pools

    • Description: Directly syncs the hostname of a Lingjun node to its NodeName.

    • Example: If the instance hostname is test, the node's NodeName will be test.

    Method 4: Incremental ID + prefix/suffix (only supported for ECS node pools)

    Whitelist Feature. After enabling this method, you cannot enable node scaling (i.e., Scaling Mode set to Auto) at the same time. Node pools with autoscaling already enabled cannot be switched to this method.

    • Description: The node name consists of a prefix, an incremental ID, and a suffix, in the format auto_increment,name_prefix(AUTO_INCREMENT)[begin_number,bits]name_suffix (no space between [begin_number,bits]). The parameters are described below. For more information about the rules, see Fixed increment sorting.

      • beginNumber: The starting number, with a value range of [0, 999999]. The specified starting value takes effect on the first scale-out. If not set, it defaults to 0. For subsequent scale-outs, the starting value increments from the maximum existing number in the scaling group.

      • bits: The number of digits for the number, with a value range of [1, 6]. If the number of digits in beginNumber exceeds the value of bits, bits defaults to 6. If beginNumber or bits is not set, they default to 0 and 6, respectively. We recommend setting bits to at least 3 to avoid reaching the numbering limit. If the limit is reached and you still need to scale out, the scale-out will fail and stop. You will need to reset the naming rule.

      The system increments sequentially by default. However, if a scaled-out ECS instance fails to start, it will be removed and a new one will be scaled out, which may result in non-consecutive numbers.

    • Example: The naming format is auto_increment,start(AUTO_INCREMENT)[1,3]end, beginNumber is 1, and bits is 3. The node names are generated in sequence:

      • 1st instance: start001end

      • 2nd instance: start002end

      • ...

    Instance Metadata Access Mode
    Only supported for clusters of version 1.28 and later

    Configure the metadata access mode for ECS instances. You can access the Metadata Service from within an ECS instance to retrieve instance metadata, including instance ID, VPC information, NIC information, and other instance attributes. For more information, see Instance metadata.

    • Normal Mode and Security Hardening Mode: Supports accessing the instance metadata service using both normal and reinforced modes.

    • Security Hardening Mode: Only supports accessing the instance metadata service using reinforced mode. For more information, see Use reinforced mode only to access ECS instance metadata.

    Pre-defined Custom Data

    Before a node joins the cluster, the specified pre-customization User-Data script will be run.

    For example, if you specify the pre-customization data as touch /tmp/pre-script, the combined script on the node will be executed in the following order.

    #!/bin/bash
# The input instance pre-customization data is executed here
touch /tmp/pre-script

# The ACK node initialization script is executed here
    For information on how this configuration takes effect during node initialization, see Node initialization process overview.

    User Data

    After a node joins the cluster, the specified instance User-Data script will be run.

    For example, if you specify the instance user data as touch /tmp/post-script, the combined script on the node will be executed in the following order.

    #!/bin/bash
# The ACK node initialization script is executed here

# The input instance user data is executed here
touch /tmp/post-script
    For information on how this configuration takes effect during node initialization, see Node initialization process overview.
    Successful cluster creation or node scale-out does not guarantee that the instance user data script executed successfully. You can log on to the node and run grep cloud-init /var/log/messages to view the execution logs.

    CloudMonitor Agent

    You can view and monitor the running status of nodes and applications in the Cloud Monitor console.

    This configuration only applies to new nodes in the node pool, not existing ones.

    To enable it for existing nodes, install it through the Cloud Monitor console.

    Cloud resources and billing: imageCloud Monitor

    Public IP

    ACK will assign an IPv4 public IP address to the node.

    This configuration only applies to new nodes in the node pool, not existing ones. If existing nodes need to access the public network, you need to configure and bind an EIP. For more information, see Associate an EIP with a cloud resource.

    Cloud resources and billing: imageECS public network

    Custom Security Group

    Specify a basic or advanced security group for the node pool. ACK does not configure additional access rules for the security group by default. You must manage the security group rules yourself to avoid access issues. For more information, see Configure cluster security groups.

    Each ECS instance has a limit on the number of security groups it can join. Ensure you have a sufficient security group quota.

    RDS Whitelist

    Add the node IP addresses to the whitelist of an RDS instance.

    Step 5: Configure components

    Click Next: Component Configurations to configure the components.

    Parameter

    Description

    Ingress

    Ingress manages how external traffic accesses services within the cluster. It needs to be installed if you want to expose applications or APIs in the cluster to the public network.

    Three types of instances are currently available to serve as the cluster's Ingress gateway.

    ALB Ingress

    Directs traffic to be handled by Alibaba Cloud Application Load Balancer (ALB). It features rich routing policies, deep integration with cloud products like WAF, and supports elastic scaling. It is suitable for large-scale, high-traffic production businesses or scenarios with enterprise-level reliability requirements.

    You can create a new ALB instance or use an existing ALB instance in the current VPC that is not associated with another cluster (only when using an existing VPC).

    To enable this later, see Create and use an ALB Ingress to expose a service.

    Cloud resources and billing: imageALB Billing overview

    Nginx Ingress

    Compatible with the community version of Nginx Ingress Controller and has been optimized.

    You can create a new CLB instance or use an existing CLB instance in the current VPC that is not associated with another cluster.

    To enable this later, see Create and use an Nginx Ingress to expose a service.

    Cloud resources and billing: imageCLB

    MSE Ingress

    Implemented based on MSE Cloud-native Gateway, it provides advanced capabilities such as service administration, authentication, and phased release. It is suitable for scenarios that require fine-grained control over microservice traffic.

    You can create a new MSE Cloud-native Gateway instance or use an existing instance in the current VPC that is not associated with another cluster (only when using an existing VPC).

    To enable this later, see Access container services through an MSE Ingress.

    Cloud resources and billing: imageBilling overview of regular instances

    For a detailed comparison of the three, see Ingress management.

    Service Discovery

    Install NodeLocal DNSCache to cache DNS query results on nodes. This improves domain name resolution performance and stability, and accelerates service-to-service calls within the cluster.

    Volume Plug-in

    Implements persistent data storage based on the CSI storage plugin. You can use Alibaba Cloud cloud disks, NAS, OSS, CPFS, and other persistent volume (PV) resources.

    If you choose to create NAS and CNFS by default, ACK will create a General-purpose NAS file system and manage it using Container Network File System (CNFS).

    To create CNFS later, see Manage NAS file systems with CNFS.

    Cloud resources and billing: imageNAS

    Container Monitoring

    You can use Alibaba Cloud Prometheus to view pre-configured monitoring dashboards and performance metrics for the cluster. For more information, see Alibaba Cloud Prometheus monitoring.

    Log Service

    Use an existing SLS Project or create a new one to collect cluster application logs.

    This will also enable the cluster API Server audit feature to collect requests to the Kubernetes API and their results.

    To enable this later, see Collect container logs from an ACK cluster and Use the cluster API Server audit feature.

    Cloud resources and billing: imageSLS

    Cluster Inspections

    Enable the cluster inspection feature of artificial intelligence for IT operations to periodically scan cluster quotas, resource usage, component versions, and more. This ensures that the cluster configuration follows best practices and exposes potential risks in advance.

    Step 6: Confirm configuration and billing

    Click Next: Confirm.

    On the Confirm page, review the cluster configuration, resource billing, and the cloud service dependency check. Then, read the terms of service.

    A fee overview for the cluster appears at the bottom of the creation page. For more details on the billing for ACK and other cloud services, see Billing overview and Cloud service resource fees.

    Note

    Creating a cluster that contains multiple nodes takes about 10 minutes.

    You can also click Equivalent Code in the upper-right corner of the Confirm Configuration page to generate Terraform or SDK example parameters for the current cluster configuration.

    API

    API Explorer

    CreateCluster

    Sample request

    This is a sample request to create an ACK dedicated cluster. For a complete list of parameters, see CreateCluster.

    POST /clusters 
<Common request headers>
{
    "cluster_type": "Kubernetes",    // The type of the cluster. To create an ACK dedicated cluster, you must set this parameter to `Kubernetes`. #required
    "name": "ACK-dedicated-cluster-example",
    "region_id": "cn-hongkong",      // The ID of the region for the cluster. This example uses `cn-hongkong`, which indicates the China (Hong Kong) region. #required
    "kubernetes_version": "1.32.1-aliyun.1",    // The Kubernetes version for the cluster. The latest version is recommended. 
    "snat_entry": true,                         // Whether to create an SNAT entry for the VPC to enable public network access.
    "endpoint_public_access": false,            // Whether to enable public network access to the API server.
    "cloud_monitor_flags": false,               // Whether to install the CloudMonitor agent on cluster nodes.
    "deletion_protection": false,               // Whether to enable cluster deletion protection.
    "proxy_mode": "ipvs",                       // The kube-proxy proxy mode. The `ipvs` mode provides high performance.
    "timezone": "Asia/Shanghai",
    "tags": [],
    "addons": [                                 // The components to install in the cluster.
        {
            "name": "terway-eniip",             // The network plugin for the cluster. This parameter cannot be modified after the cluster is created.
            "config": "{\"IPVlan\":\"false\",\"NetworkPolicy\":\"false\",\"ENITrunking\":\"false\"}"
        },
        {
            "name": "csi-plugin"
        },
        {
            "name": "csi-provisioner"
        },
        {
            "name": "storage-operator",
            "config": "{\"CnfsOssEnable\":\"false\",\"CnfsNasEnable\":\"false\"}"
        },
        {
            "name": "nginx-ingress-controller",
            "disabled": true
        }
    ],
    "node_port_range": "30000-32767",
    "pod_vswitch_ids": [                         // The vSwitches for pods. Required for Terway-based clusters, as each pod receives a dedicated IP address from a vSwitch.
        "vsw-j6cwz95vspl56gl******",
        "vsw-j6c1tgut51ude2v******"
    ],
    "login_password": "******",
    "charge_type": "PostPaid",
    "master_instance_charge_type": "PostPaid",
    "cpu_policy": "none",
    "service_account_issuer": "https://kubernetes.default.svc",
    "api_audiences": "https://kubernetes.default.svc",
    "master_count": 3,                         // The number of master nodes. Three master nodes are recommended for a high-availability cluster.
    "master_vswitch_ids": [                    // The vSwitches for the master nodes.
        "vsw-j6cwz95vspl56gl******",
        "vsw-j6c1tgut51ude2v******",
        "vsw-j6c1tgut51ude2v******"
    ],
    "master_instance_types": [                 // The instance types for the master nodes.
        "ecs.u1-c1m2.xlarge",
        "ecs.c7.xlarge",
        "ecs.c7.xlarge"
    ],
    "master_system_disk_category": "cloud_essd",      // The system disk type for the master nodes. This example uses ESSD.
    "master_system_disk_size": 120,                   // The size of the system disk, in GiB.
    "master_system_disk_performance_level": "PL1",    // The performance level of the ESSD system disk. `PL1` provides up to 50,000 IOPS per disk.
    "vpcid": "vpc-j6c6njo385se80n******",             // The ID of the VPC for the cluster. This must be determined during network planning and cannot be modified after the cluster is created. #required
    "worker_vswitch_ids": [
        "vsw-j6cwz95vspl56gl******",
        "vsw-j6c1tgut51ude2v******"
    ],
    "is_enterprise_security_group": true,
    "ip_stack": "ipv4",
    "service_cidr": "172.16.xx.xx/16",
    "nodepools": [                                                 
        {
            "nodepool_info": {
                "name": "default-nodepool"
            },
            "scaling_group": {
                "system_disk_category": "cloud_essd",
                "system_disk_size": 120,
                "system_disk_performance_level": "PL0",
                "system_disk_encrypted": false,
                "data_disks": [         
                    {
                        "category": "cloud_auto",
                        "size": 200,
                        "encrypted": "false",
                        "bursting_enabled": false
                    }
                ],
                "tags": [],
                "soc_enabled": false,
                "security_hardening_os": false,
                "vswitch_ids": [
                    "vsw-j6cwz95vspl56gl******",
                    "vsw-j6c1tgut51ude2v******"
                ],
                "instance_types": [
                    "ecs.g6.xlarge"
                ],
                "instance_patterns": [],
                "login_password": "******",
                "instance_charge_type": "PostPaid",
                "security_group_ids": [],
                "platform": "AliyunLinux",
                "image_id": "aliyun_3_x64_20G_alibase_20241218.vhd",
                "image_type": "AliyunLinux3",
                "desired_size": 3,               // The desired number of nodes in the node pool.
                "multi_az_policy": "BALANCE"
            },
            "kubernetes_config": {
                "cpu_policy": "none",
                "cms_enabled": false,
                "unschedulable": false,
                "runtime": "containerd",        // The container runtime. This parameter cannot be modified after the cluster is created.
                "runtime_version": "1.6.36"
            }
        }
    ]
}

    Key parameters

    When using the CreateCluster API to create an ACK dedicated cluster, note the following parameters:

    Parameter

    Description

    Sample configuration

    cluster_type

    The type of the cluster. To create an ACK dedicated cluster, you must set this parameter to Kubernetes.

    "cluster_type": "Kubernetes"

    Terraform

    For more information, see Create an ACK dedicated cluster by using Terraform.

    SDK

    For examples, see Use the Java SDK.

    CLI

    For details, see Create an ACK cluster using the CLI.

    Related operations

    • View basic cluster information

      On the Clusters page, find the target cluster and click Details in the Actions column. Then, click the Basic Information and Connection Information tabs to view this information.

      • API server public endpoint: The public-facing address and port of the Kubernetes API server. Use this endpoint to manage the cluster from your local terminal with tools like kubectl.

        Bind EIP and Unbind EIP:

        • Bind EIP: Bind an existing EIP or create and bind a new one.

          Binding an EIP causes the API server to briefly restart. Do not perform operations on the cluster during this time.

        • Unbind EIP: After you unbind the EIP, the API server is no longer publicly accessible.

          Unbinding an EIP causes the API server to briefly restart. Do not perform operations on the cluster during this time.

      • API server internal endpoint: The internal address and port of the Kubernetes API server. This endpoint is accessible only from within the cluster's VPC. The IP address is for an internal-facing Server Load Balancer (SLB) instance.

    • View cluster logs

      In the Actions column, select More > Operations > View Logs to view the cluster's logs on the Log Center page.

    • View node information

      To view node information, obtain the cluster's kubeconfig file and use kubectl to connect to the cluster, and then run kubectl get node.

    Quotas and limits

    If you have a large cluster or your account contains many resources, you must be aware of the quotas and limits for using ACK clusters. For more information, see Quotas and limits.

    • Limits: These include ACK configuration limits (such as account balance) and single-cluster capacity limits (the maximum capacity of different Kubernetes resources within a single cluster).

    • Quota limits and quota increase requests: This includes quota limits for ACK clusters and the cloud products on which ACK depends, such as ECS and VPC. To request a quota increase, follow the instructions in the relevant documentation.