All Products
Search

This Product

    Container Service for Kubernetes:Customize ACK Pro control plane parameters

    Document Center

    Container Service for Kubernetes:Customize ACK Pro control plane parameters

    Last Updated:Jun 18, 2026

    Tune kube-apiserver, kube-controller-manager, CCM, and kube-scheduler settings from the ACK console.

    Customize parameters using the steps below, then review available parameters by cluster type.

    Before you begin

    Make sure you have:

    Usage notes

    • Supported cluster types: Only ACK managed Pro, ACK Serverless Pro, ACK Edge Pro, and ACK Lingjun clusters support customizing control plane parameters.

    • Control plane restart: The control plane restarts after parameter changes are saved. Schedule changes during off-peak hours.

    • Parameters overwrite defaults: Custom parameters replace defaults entirely. Verify completeness before saving — incorrect parameters can prevent the control plane from starting.

    • Version constraints: Some parameters require specific cluster versions, as noted in each parameter table. To upgrade, see Manually upgrade a cluster.

    • Console as source of truth: The console shows the current list of customizable parameters. The tables below reflect documented defaults.

    Customize a control plane component parameter

    The steps are identical for all components. This example uses kube-apiserver.

    1. Log on to the Container Service Management Console. In the left navigation pane, click Clusters.

    2. On the Clusters page, click the name of your cluster. In the left navigation pane, click Add-ons.

    3. In the Core Components section, find the target component and click Configuration.

    4. In the Parameters dialog box, enter custom parameters. Verify the configuration, then follow the on-screen prompts to submit.

    Default parameters

    The tables below list customizable parameters by cluster type. For parameter semantics and valid values, see the Kubernetes documentation: kube-apiserver, kube-controller-manager, and kube-scheduler.

    ACK managed cluster Pro Edition

    kube-apiserver

    Parameter Description Valid range / notes
    enableAdmissionPlugins Enables additional admission controller plugins. Default: blank. Requires cluster version 1.28 or later.
    serviceNodePortRange Port range for NodePort services. 10000–65535. Default: blank.
    Important

    This range must not overlap with net.ipv4.ip_local_port_range on cluster nodes. See How do I correctly configure the NodePort range?
    requestTimeout Global timeout for API requests without a specific timeout. Default: blank (uses Kubernetes default).
    defaultNotReadyTolerationSeconds Duration containers can run on a node in NotReady state before eviction. Default: blank.
    defaultUnreachableTolerationSeconds Duration containers can run on a node in Unreachable state before eviction. Default: blank.
    maxMutatingRequestsInflight Maximum concurrent mutating API requests. Excess requests are rejected. 1–1000. Default: blank.
    maxRequestsInflight Maximum concurrent non-mutating API requests. 1–3000. Default: blank.
    featureGates Enables or disables Kubernetes feature gates. Supported values: ServerSideApply , TTLAfterFinished , EphemeralContainers , RemoveSelfLink , HPAScaleToZero . Default: blank.
    Note

    HPAScaleToZero requires cluster version 1.18 or later. RemoveSelfLink cannot be modified in cluster version 1.24 or later.
    oidcIssuerURL URL of the OpenID Connect (OIDC) issuer for external identity provider integration. Default: blank. Requires cluster version 1.18 or later.
    Important

    After setting this parameter, kube-apiserver accesses the specified address. For a public endpoint, enable public network access. If the API server cannot reach the endpoint, run kubectl get endpoints to check backend IP addresses. If multiple IPs are returned, log on to a worker node, access the oidcIssuerURL, and review public network and security group settings. If only one IP is returned, submit a ticket.
    oidcClientId Client ID for the OIDC provider. Default: blank. Requires cluster version 1.18 or later.
    oidcUsernameClaim JWT claim for the OIDC username. Default: sub. Requires cluster version 1.18 or later.
    oidcUsernamePrefix Prefix for OIDC usernames to prevent conflicts. Default: blank. Requires cluster version 1.18 or later.
    oidcGroupsPrefix Prefix for OIDC group names. Default: blank. Requires cluster version 1.18 or later.
    oidcGroupsClaim JWT claim for OIDC user groups. Default: blank. Requires cluster version 1.18 or later.
    oidcRequiredClaim Required key-value pairs in the OIDC ID token. Default: blank. Requires cluster version 1.18 or later.
    oidcCAContent PEM-encoded certificate authority (CA) content for verifying the OIDC provider. Default: blank. Requires cluster version 1.18 or later.
    hostAliases Custom hostname-to-IP mappings for the kube-apiserver pod's /etc/hosts. Default: blank. Requires cluster version 1.26 or later.
    enableTrace Enables distributed tracing for control plane components. Default: blank. Requires cluster version 1.28 or later. See Enable Tracing Analysis for control plane components.
    samplingRatePerMillion Default: blank.

    kube-controller-manager

    Parameter Description Valid range / notes
    horizontalPodAutoscalerSyncPeriod How often the Horizontal Pod Autoscaler (HPA) controller recalculates the desired replica count. Default: blank (uses Kubernetes default).
    horizontalPodAutoscalerTolerance Minimum ratio change before HPA triggers scaling. Prevents thrashing. Default: blank.
    concurrentTTLAfterFinishedSyncs Number of concurrent workers cleaning up TTL-expired finished jobs. Default: blank.
    concurrentHorizontalPodAutoscalerSyncs Number of concurrent HPA sync workers. Default: blank. Requires cluster version 1.26 or later.
    largeClusterSizeThreshold Node count threshold above which the cluster is treated as "large" for eviction. Default: blank.
    unhealthyZoneThreshold Fraction of nodes in a zone that must be unhealthy to trigger reduced eviction rates. Default: blank.
    secondaryNodeEvictionRate Node eviction rate in secondary (reduced) eviction mode. Default: blank.
    nodeEvictionRate Normal node eviction rate. Default: blank.
    terminatedPodGCThreshold Number of terminated pods that triggers garbage collection. Default: blank.
    kubeAPIQPS Maximum queries per second (QPS) from kube-controller-manager to kube-apiserver. 1–1000. Default: blank.
    kubeAPIBurst Maximum request burst from kube-controller-manager to kube-apiserver. 1–1000. Default: blank.
    concurrentCSRSyncs Number of concurrent workers processing CertificateSigningRequest (CSR) objects. Default: blank. Requires cluster version 1.32 or later.
    concurrentNodeTaintSyncs Number of concurrent workers syncing node taint conditions. Default: blank. Requires cluster version 1.32 or later.
    featureGates Enables or disables feature gates for the controller manager. Supported values: TTLAfterFinished. Default: blank.

    cloud-controller-manager (CCM)

    Parameter Description Valid range / notes
    routeTableIDs Comma-separated list of Virtual Private Cloud (VPC) route table IDs for CCM to manage. Default: blank. Set this if your VPC has multiple route tables. Example: vtb-**,vtb***.

    kube-scheduler

    For kube-scheduler parameters, see Customize scheduler parameters.

    ACK serverless cluster Pro Edition

    kube-apiserver

    Parameter Description Valid range / notes
    enableAdmissionPlugins Enables additional admission controller plugins. Default: blank.
    requestTimeout Global timeout for API requests without a specific timeout. Default: blank (uses Kubernetes default).
    defaultNotReadyTolerationSeconds Duration containers can run on a node in NotReady state before eviction. Default: blank.
    defaultUnreachableTolerationSeconds Duration containers can run on a node in Unreachable state before eviction. Default: blank.
    maxMutatingRequestsInflight Maximum concurrent mutating API requests. Excess requests are rejected. 1–1000. Default: blank.
    maxRequestsInflight Maximum concurrent non-mutating API requests. 1–3000. Default: blank.
    featureGates Enables or disables Kubernetes feature gates. Supported values: ServerSideApply , TTLAfterFinished , EphemeralContainers , RemoveSelfLink , HPAScaleToZero . Default: blank.
    Note

    HPAScaleToZero requires cluster version 1.18 or later. RemoveSelfLink cannot be modified in cluster version 1.24 or later.
    oidcIssuerURL URL of the OIDC issuer for external identity provider integration. Default: blank. Requires cluster version 1.18 or later.
    oidcClientId Client ID for the OIDC provider. Default: blank. Requires cluster version 1.18 or later.
    oidcUsernameClaim JWT claim for the OIDC username. Default: sub. Requires cluster version 1.18 or later.
    oidcUsernamePrefix Prefix for OIDC usernames to prevent conflicts. Default: blank. Requires cluster version 1.18 or later.
    oidcGroupsPrefix Prefix for OIDC group names. Default: blank. Requires cluster version 1.18 or later.
    oidcGroupsClaim JWT claim for OIDC user groups. Default: blank. Requires cluster version 1.18 or later.
    oidcRequiredClaim Required key-value pairs in the OIDC ID token. Default: blank. Requires cluster version 1.18 or later.
    oidcCAContent PEM-encoded CA content for verifying the OIDC provider. Default: blank. Requires cluster version 1.18 or later.

    kube-controller-manager

    Parameter Description Valid range / notes
    horizontalPodAutoscalerSyncPeriod How often the HPA controller recalculates the desired replica count. Default: blank (uses Kubernetes default).
    horizontalPodAutoscalerTolerance Minimum ratio change before HPA triggers scaling. Default: blank.
    concurrentTTLAfterFinishedSyncs Number of concurrent workers cleaning up TTL-expired finished jobs. Default: blank.
    kubeAPIQPS Maximum QPS from kube-controller-manager to kube-apiserver. 1–1000. Default: blank.
    kubeAPIBurst Maximum request burst from kube-controller-manager to kube-apiserver. 1–1000. Default: blank.
    featureGates Enables or disables feature gates for the controller manager. Supported values: TTLAfterFinished. Default: blank.

    kube-scheduler

    Kube-scheduler customization is available to allowlisted users. For supported parameters, see Customize scheduler parameters.

    ACK Edge cluster Pro Edition

    kube-apiserver

    Parameter Description Valid range / notes
    enableAdmissionPlugins Enables additional admission controller plugins. Default: blank.
    serviceNodePortRange Port range for NodePort services. 10000–65535. Default: blank.
    Important

    This range must not overlap with net.ipv4.ip_local_port_range on cluster nodes. See How do I correctly configure the NodePort range?
    requestTimeout Global timeout for API requests without a specific timeout. Default: blank (uses Kubernetes default).
    defaultNotReadyTolerationSeconds Duration containers can run on a node in NotReady state before eviction. Default: blank.
    defaultUnreachableTolerationSeconds Duration containers can run on a node in Unreachable state before eviction. Default: blank.
    maxMutatingRequestsInflight Maximum concurrent mutating API requests. Excess requests are rejected. 1–1000. Default: blank.
    maxRequestsInflight Maximum concurrent non-mutating API requests. 1–3000. Default: blank.
    featureGates Enables or disables Kubernetes feature gates. Supported values: ServerSideApply , TTLAfterFinished , EphemeralContainers , RemoveSelfLink , HPAScaleToZero . Default: blank.
    Note

    HPAScaleToZero requires cluster version 1.18 or later. RemoveSelfLink cannot be modified in cluster version 1.24 or later.
    oidcIssuerURL URL of the OIDC issuer for external identity provider integration. Default: blank. Requires cluster version 1.18 or later.
    oidcClientId Client ID for the OIDC provider. Default: blank. Requires cluster version 1.18 or later.
    oidcUsernameClaim JWT claim for the OIDC username. Default: sub. Requires cluster version 1.18 or later.
    oidcUsernamePrefix Prefix for OIDC usernames to prevent conflicts. Default: blank. Requires cluster version 1.18 or later.
    oidcGroupsPrefix Prefix for OIDC group names. Default: blank. Requires cluster version 1.18 or later.
    oidcGroupsClaim JWT claim for OIDC user groups. Default: blank. Requires cluster version 1.18 or later.
    oidcRequiredClaim Required key-value pairs in the OIDC ID token. Default: blank. Requires cluster version 1.18 or later.
    oidcCAContent PEM-encoded CA content for verifying the OIDC provider. Default: blank. Requires cluster version 1.18 or later.

    kube-controller-manager

    Parameter Description Valid range / notes
    horizontalPodAutoscalerSyncPeriod How often the HPA controller recalculates the desired replica count. Default: blank (uses Kubernetes default).
    concurrentTTLAfterFinishedSyncs Number of concurrent workers cleaning up TTL-expired finished jobs. Default: blank.
    largeClusterSizeThreshold Node count threshold above which the cluster is treated as "large" for eviction. Default: blank.
    unhealthyZoneThreshold Fraction of nodes in a zone that must be unhealthy to trigger reduced eviction rates. Default: blank.
    secondaryNodeEvictionRate Node eviction rate in secondary (reduced) eviction mode. Default: blank.
    nodeEvictionRate Normal node eviction rate. Default: blank.
    podEvictionTimeout Grace period before pods on an unresponsive node are evicted. Default: blank.
    kubeAPIQPS Maximum QPS from kube-controller-manager to kube-apiserver. 1–1000. Default: blank.
    kubeAPIBurst Maximum request burst from kube-controller-manager to kube-apiserver. 1–1000. Default: blank.
    featureGates Enables or disables feature gates for the controller manager. Supported values: TTLAfterFinished. Default: blank.

    cloud-controller-manager (CCM)

    Parameter Description Valid range / notes
    routeTableIDs Comma-separated list of VPC route table IDs for CCM to manage. Default: blank. Set this if your VPC has multiple route tables. Example: vtb-,vtb*.

    kube-scheduler

    For kube-scheduler parameters, see Customize scheduler parameters.

    ACK LINGJUN Cluster

    kube-apiserver

    Parameter Description Valid range / notes
    enableAdmissionPlugins Enables additional admission controller plugins. Default: blank.
    serviceNodePortRange Port range for NodePort services. 10000–65535. Default: blank.
    Important

    This range must not overlap with net.ipv4.ip_local_port_range on cluster nodes. See How do I correctly configure the NodePort range?
    requestTimeout Global timeout for API requests without a specific timeout. Default: blank (uses Kubernetes default).
    defaultNotReadyTolerationSeconds Duration containers can run on a node in NotReady state before eviction. Default: blank.
    defaultUnreachableTolerationSeconds Duration containers can run on a node in Unreachable state before eviction. Default: blank.
    maxMutatingRequestsInflight Maximum concurrent mutating API requests. Excess requests are rejected. 1–1000. Default: blank.
    maxRequestsInflight Maximum concurrent non-mutating API requests. 1–3000. Default: blank.
    featureGates Enables or disables Kubernetes feature gates. Supported values: ServerSideApply , TTLAfterFinished , EphemeralContainers , RemoveSelfLink , HPAScaleToZero . Default: blank.
    Note

    HPAScaleToZero requires cluster version 1.18 or later. RemoveSelfLink cannot be modified in cluster version 1.24 or later.
    oidcIssuerURL URL of the OIDC issuer for external identity provider integration. Default: blank. Requires cluster version 1.18 or later.
    oidcClientId Client ID for the OIDC provider. Default: blank. Requires cluster version 1.18 or later.
    oidcUsernameClaim JWT claim for the OIDC username. Default: sub. Requires cluster version 1.18 or later.
    oidcUsernamePrefix Prefix for OIDC usernames to prevent conflicts. Default: blank. Requires cluster version 1.18 or later.
    oidcGroupsPrefix Prefix for OIDC group names. Default: blank. Requires cluster version 1.18 or later.
    oidcGroupsClaim JWT claim for OIDC user groups. Default: blank. Requires cluster version 1.18 or later.
    oidcRequiredClaim Required key-value pairs in the OIDC ID token. Default: blank. Requires cluster version 1.18 or later.
    oidcCAContent PEM-encoded CA content for verifying the OIDC provider. Default: blank. Requires cluster version 1.18 or later.

    kube-controller-manager

    Parameter Description Valid range / notes
    horizontalPodAutoscalerSyncPeriod How often the HPA controller recalculates the desired replica count. Default: blank (uses Kubernetes default).
    horizontalPodAutoscalerTolerance Minimum ratio change before HPA triggers scaling. Default: blank.
    concurrentTTLAfterFinishedSyncs Number of concurrent workers cleaning up TTL-expired finished jobs. Default: blank.
    largeClusterSizeThreshold Node count threshold above which the cluster is treated as "large" for eviction. Default: blank.
    unhealthyZoneThreshold Fraction of nodes in a zone that must be unhealthy to trigger reduced eviction rates. Default: blank.
    secondaryNodeEvictionRate Node eviction rate in secondary (reduced) eviction mode. Default: blank.
    nodeEvictionRate Normal node eviction rate. Default: blank.
    podEvictionTimeout Grace period before pods on an unresponsive node are evicted. Default: blank.
    kubeAPIQPS Maximum QPS from kube-controller-manager to kube-apiserver. 1–1000. Default: blank.
    kubeAPIBurst Maximum request burst from kube-controller-manager to kube-apiserver. 1–1000. Default: blank.
    featureGates Enables or disables feature gates for the controller manager. Supported values: TTLAfterFinished. Default: blank.

    cloud-controller-manager (CCM)

    Parameter Description Valid range / notes
    routeTableIDs Comma-separated list of VPC route table IDs for CCM to manage. Default: blank. Set this if your VPC has multiple route tables. Example: vtb-,vtb*.

    kube-scheduler

    For kube-scheduler parameters, see Customize scheduler parameters.

    Next steps