Connect to the API server of an ACK cluster over the Internet or internal network. In addition to the console, use command-line tools to interact with the API server, including kubectl, Workbench, and CloudShell.API server of an ACK cluster over the Internet or internal network, and manage API server access with kubeconfig files.
1. Configure the network mode and network ACLs for access to an ACK cluster
Connect to the API server of an ACK cluster over the Internet or an internal network and configure network access control lists (ACLs) for the API server.
-
Connection over an internal network: When you create an ACK cluster, ACK creates an internal-facing Classic Load Balancer (CLB) instance with an internal endpoint for the API server. Resources in the same virtual private cloud (VPC) can communicate with each other.
-
Connection over the Internet: Associate an elastic IP address (EIP) with the internal-facing CLB instance created for the API server to enable Internet access to the cluster. See Control public access to the API server of a cluster.
To prevent unauthorized access to the API server of an ACK cluster, we recommend that you configure network ACLs for the listener port 6443 of the CLB instance created for the API server. You can configure network ACLs as whitelists or blacklists to limit access to the API server. See Configure network ACLs for the API server of an ACK cluster.
2. Manage kubeconfig files
Obtain the kubeconfig file before connecting to a cluster. The kubeconfig file stores credentials for authenticating access over the Internet or an internal network. ACK issues kubeconfig files for Alibaba Cloud accounts, Resource Access Management (RAM) users, or RAM roles. To reduce security risks, we recommend that you use temporary kubeconfig files and carefully configure their validity periods. See Kubeconfig file management.
3. Select cluster connection methods
Select a connection method based on factors such as whether the cluster has Internet access.
Before a RAM user connects to an ACK cluster, grant cluster operation permissions in addition to the required Container Service system permissions. See Authorization.
-
Log on to the Container Service console.
When you use a RAM user to access the console, you must configure the required cloud service permissions. See Required permissions for the ACK console.
-
Use kubectl, or the web-based tools Workbench and CloudShell provided by Alibaba Cloud.
Tool
Description
Local installation①
Access over an internal network
Access over the Internet
References
The Kubernetes command-line tool.
Required①
Supported
Supported
Obtain the kubeconfig file of a cluster and use kubectl to connect to the cluster
A web-based tool for connecting to Elastic Compute Service (ECS) instances without additional software.
Not required
Supported
Supported
Use kubectl on Workbench or Cloud Shell to connect to ACK clusters
A web-based shell that creates a Linux VM pre-installed with various programming languages and command-line tools.
Not required
Not supported
Supported
①: Workbench and CloudShell run in a browser. kubectl requires local installation but is pre-installed on ACK worker nodes.
References
If applications in an ACK cluster need to access external resources over the Internet, such as pulling images or updating dependency libraries, see Enable an existing ACK cluster to access the Internet.