Container Service for Kubernetes:ACK managed cluster: Parameters

• Basic Edition: Has a limited quota (each account can create two clusters). For personal learning and testing only.

• Pro Edition: Provides a Service-Level Agreement (SLA) and is suitable for enterprise production and staging environments.

The region where the cluster resources, such as ECS instances and cloud disks, are located. The closer the region is to your users and resource deployment region, the lower the network latency.

You can only create clusters with the three most recent minor versions. We recommend using the latest version. For more information about the versions supported by ACK, see ACK version support overview.

Enable automatic cluster upgrades to keep the cluster control plane and node pools periodically updated.

For more information about the auto-upgrade policy and instructions, see Automatically upgrade clusters.

ACK performs automated O&M tasks, such as automatic cluster upgrades and automatic OS CVE vulnerability fixes, only during the defined maintenance window.

This parameter is required only for Flannel

The address pool that assigns IP addresses to pods. This CIDR block cannot overlap with the VPC's CIDR block, the CIDR blocks used by existing ACK clusters in the VPC, or the Service CIDR.

You only need to configure Flannel.

Defines the maximum number of pods that a single node can accommodate.

This parameter is required only when you select Terway.

Also known as Service CIDR. This is the address pool that assigns IP addresses to services within the cluster. This CIDR block cannot overlap with the VPC's CIDR block, the CIDR blocks used by existing clusters in the VPC, or the Container CIDR Block.

Do not select this option when using a shared VPC

Select this option if nodes need to access the public network (for example, to pull public images or access external services). ACK will automatically configure a NAT Gateway and SNAT rules to ensure that resources within the cluster can access the public network.

• If the VPC does not have a NAT Gateway: ACK automatically creates a NAT Gateway, purchases a new EIP, and configures an SNAT rule for the vSwitch used by the cluster.

• If the VPC already has a NAT Gateway: ACK determines whether to purchase an additional EIP and configure an SNAT rule. If no EIP is available, a new one is automatically purchased. If no VPC-level SNAT rule exists, an SNAT rule is configured for the vSwitch used by the cluster.

If you do not select this option, you can configure the NAT Gateway and SNAT rules yourself after creating the cluster. For more information, see Public NAT Gateway.

Cloud resources and billing: NAT Gateway, EIP

We recommend enabling this feature to prevent accidental deletion of the cluster through the console or OpenAPI.

Assign the cluster to the selected resource group for easier permission management and cost allocation.

A resource can belong to only one resource group.

The time zone used by the cluster. By default, this is the time zone configured in your browser.

The Subject Alternative Name (SAN) field in the API Server certificate includes the cluster-local domain name, private IP address, and public EIP by default. To access the cluster through a proxy server, custom domain, or special network environment, add these access addresses to the SAN field.

To enable this later, see Customize the SAN of the cluster API Server certificate.

In the traditional model, a pod's identity credentials are permanent and shared among multiple pods, which poses a security risk. When enabled, each pod gets its own temporary identity credentials, which support automatic expiration and permission restrictions.

To enable this later, see Use ServiceAccount token volume projection.

This feature is available only for Pro Edition clusters

Use a key created in Alibaba Cloud KMS to provide professional-grade encryption for Secret keys, enhancing data security.

To enable this later, see Use Alibaba Cloud KMS to encrypt Secrets at rest.

Cloud resources and billing: KMS

The cluster will create an OpenID Connect (OIDC) Provider. Using the temporary OIDC token of its ServiceAccount, application pods can call the Alibaba Cloud RAM service and assume a specified RAM role. This allows them to securely obtain temporary authorization to access cloud resources, achieving pod-level least-privilege management.

To enable this later, see Use RRSA to configure RAM permissions for a ServiceAccount and achieve pod-level permission isolation.

Enter a custom name for the node pool.

Enable managed node pools to use the automated O&M capabilities provided by ACK.

If your business is sensitive to changes in underlying nodes and cannot tolerate node restarts or application pod migrations, we do not recommend enabling this feature.

To enable this later, you can edit the node pool to enable it.

ACK automatically monitors node status and performs self-recovery tasks when a node becomes abnormal. If you select Restart Faulty Node, the self-recovery process may involve operations such as draining the node and replacing disks. For information on trigger conditions and related events, see Enable node self-recovery.

Fix OS CVE vulnerabilities in the node pool. You can configure the security vulnerability fix level.

Cloud resources and billing: Security Center

ACK performs automated O&M operations on managed node pools only during the defined maintenance window.

When a node pool scales out, it allocates instances from the configured ECS instance family. To improve the success rate of scale-outs, select multiple instance types across multiple zones to avoid unavailability or stock shortages. The specific instance type for scale-out is determined by the configured Scaling Policy.

To ensure business stability and accurate resource scheduling, do not mix GPU and non-GPU instance types in the same node pool.

You can configure the instance types used for scale-out in the following two ways:

• Specific types: Specify instance types based on dimensions such as vCPU, memory, instance family, and CPU architecture (the instance's CPU architecture must be consistent with the OS image architecture).

  When using Terway, you can view the maximum number of pods per node for the target instance type in the instance type list.

• Generalization configuration: Select a list of instance types to use or exclude based on attributes (such as vCPU and memory) to further improve the scale-out success rate.

You can refer to the elasticity strength recommendations in the console or view the node pool elasticity strength after the node pool is created.

For information about unsupported instance types and node configuration recommendations, see ECS instance type configuration recommendations.

Cloud resources and billing: ECS Instance, GPU-accelerated Instance

The total number of nodes that the node pool should maintain. We recommend configuring at least two nodes to ensure that cluster components run properly. You can adjust the desired node count to scale the node pool in or out. For more information, see Scale a node pool.

If you do not need to create nodes, you can set this to 0 and then manually adjust it or add existing nodes later.

Configure how the node pool selects instances during node scaling.

• Priority-based Policy: Scales based on the priority of the vSwitches configured for the cluster (vSwitch priority decreases from top to bottom). If an instance cannot be created in the zone of a higher-priority vSwitch, the next-priority vSwitch is automatically used.

• Cost Optimization: Scales based on the vCPU unit price from low to high.

  If the node pool uses Preemptible Instance, spot instances are prioritized. You can also configure the Percentage of On-Demand Instances (%). If spot instance types cannot be created due to inventory or other reasons, pay-as-you-go instances are automatically used as a supplement.

• Distribution Balancing: Distributes ECS instances evenly across multiple zones, but only in multi-zone scenarios. If the distribution becomes unbalanced due to insufficient inventory or other reasons, you can perform a rebalancing operation.

This requires the billing method to be set to Spot Instance.

When enabled, if not enough spot instances can be created due to price, inventory, or other reasons, ACK will automatically try to create on-demand instances as a supplement.

Cloud resources and billing: ECS Instance

This requires the billing method to be set to Spot Instance.

Add tags to the ECS instances automatically created by ACK to identify cloud resources. Each ECS instance can be bound with up to 20 tags. To increase this limit, submit a request on the Quota Center platform. Because ACK and Auto Scaling (ESS) occupy some tags, you can specify up to 17 custom tags for an instance.

Newly added nodes will be set as unschedulable by default when they are registered with the cluster. You need to manually adjust the node scheduling status in the node list.

This configuration only takes effect for clusters of versions earlier than 1.34. For more information, see Kubernetes 1.34 version guide.

This feature is only supported for containerd runtimes of version 1.6.34 and later.

Newly added nodes will automatically detect if a container image supports on-demand loading. If it does, it will use on-demand loading by default to accelerate container startup, reducing application startup time. For more information, see Use on-demand loading of container images to accelerate container startup.

By default, node names are automatically generated. If you need a unified naming convention for easier node management and O&M identification, you can enable this configuration. When enabled, the node name, ECS instance name, and hostname will all change.

Method 3 is only applicable to Lingjun node pools, and Lingjun node pools only support Method 3.

Supported only for ACK managed clusters. Can only be specified when creating a new node pool

Specify a Worker RAM role at the node pool level to reduce the security risks associated with all nodes sharing a single Worker RAM role.

• Default Role: Use the default Worker RAM role created for the cluster.

• Custom: Use the specified role as the Worker RAM role. If left empty, the default role will be used. For more information, see Use a custom Worker RAM role.

Only supported for clusters of version 1.28 and later

Configure the metadata access mode for ECS instances. You can access the Metadata Service from within an ECS instance to retrieve instance metadata, including instance ID, VPC information, NIC information, and other instance attributes. For more information, see Instance metadata.

• Normal Mode and Security Hardening Mode: Supports accessing the instance metadata service using both normal and reinforced modes.

• Security Hardening Mode: Only supports accessing the instance metadata service using reinforced mode. For more information, see Use reinforced mode only to access ECS instance metadata.

Before a node joins the cluster, the specified pre-customization User-Data script will be run.

For example, if you specify the pre-customization data as touch /tmp/pre-script, the combined script on the node will be executed in the following order.

#!/bin/bash
# The input instance pre-customization data is executed here
touch /tmp/pre-script

# The ACK node initialization script is executed here

For information on how this configuration takes effect during node initialization, see Node initialization process overview.

Specify a basic or advanced security group for the node pool. ACK does not configure additional access rules for the security group by default. You must manage the security group rules yourself to avoid access issues. For more information, see Configure cluster security groups.

Each ECS instance has a limit on the number of security groups it can join. Ensure you have a sufficient security group quota.

Add the node IP addresses to the whitelist of an RDS instance.

After creating a deployment set in the ECS console, assign it to the node pool. This ensures that the nodes scaled out by the node pool are distributed across different physical servers, improving high availability.

A deployment set supports a maximum of 20 × number of zones nodes by default (the number of zones is determined by the vSwitches). The maximum number of nodes in the node pool will be limited. Ensure that the quota in the deployment set is sufficient.

To enable this later, see Best practices for node pool deployment sets.

The resource pool policy used when adding new nodes (only supported when Instance Configuration Mode is set to Specify Instance Type). Resource pools include private pools generated after Elastic Assurance or Capacity Reservation (Immediate or Timed) services take effect, along with public pools, for node startup selection.

• Private Pool First: Prioritizes the use of the specified private pool. If no private pool is specified or the specified private pool has insufficient capacity, it will automatically match an open-type private pool. If no suitable private pool is found, the instance will be created from the public pool.

• Private Pool Only: You must specify a private pool ID. If the specified private pool has insufficient capacity, the node will fail to start.

• Do Not Use: Do not use a resource pool policy.

This configuration item is deprecated. Switch to using Resource Pool Policy to specify a private pool.

The private pool resources available for the currently selected zone and instance type. Types include the following:

• Open: The instance will automatically match an open-type private capacity pool. If no suitable private pool is found, it will start using public pool resources.

• Do Not Use: The instance will not use any private pool capacity and will start directly using public pool resources.

• Specified: You need to further select a private pool ID to specify that the instance will only start using the capacity of that private pool. If the private pool is unavailable, the instance will fail to start.

Install NodeLocal DNSCache to cache DNS query results on nodes. This improves domain name resolution performance and stability, and accelerates service-to-service calls within the cluster.

Implements persistent data storage based on the CSI storage plugin. You can use Alibaba Cloud cloud disks, NAS, OSS, CPFS, and other persistent volume (PV) resources.

If you choose to create NAS and CNFS by default, ACK will create a General-purpose NAS file system and manage it using Container Network File System (CNFS).

To create CNFS later, see Manage NAS file systems with CNFS.

Cloud resources and billing: NAS

Monitor cluster health, resource usage, application performance, and more through the container cluster monitoring service, and trigger relevant alerts when anomalies occur.

• ACK Cluster Monitoring Pro Edition: Provides a managed container monitoring service with a built-in Grafana dashboard. Data is stored for 90 days by default.

  For billing rules, see Container monitoring billing. To report custom metrics or adjust the basic storage duration, additional fees will be incurred. For more information, see Prometheus instance billing.

• ACK Cluster Monitoring Basic Edition: Provides a free, unmanaged container monitoring service with a built-in basic monitoring dashboard. Data is stored for 7 days by default.

  The component is single-replica by default, occupying 3 cores and 4 GB of memory, and requires self-maintenance. To report custom metrics, additional fees will be incurred. For more information, see Prometheus instance billing.

• Disable: Does not enable the container monitoring service. You will not be able to monitor the running status of the container service or create related alerts.

To enable this later, see Connect to and configure Alibaba Cloud Prometheus monitoring.

Cloud resources and billing: Prometheus

Provides cost and resource usage analysis for clusters, namespaces, node pools, and workloads to improve cluster resource utilization and save costs.

To enable this later, see Cost Insight.

Use an existing SLS Project or create a new one to collect cluster application logs.

This will also enable the cluster API Server audit feature to collect requests to the Kubernetes API and their results.

To enable this later, see Collect container logs from an ACK cluster and Use the cluster API Server audit feature.

• Create Ingress Dashboard: Create an Ingress Dashboard in the SLS console to collect Nginx Ingress access logs. For more information, see Nginx Ingress access log analysis and monitoring.

• Install node-problem-detector and create an event center: Add an event center in the SLS console to collect all Kubernetes events in the cluster in real time. For more information, see Create and use the K8s event center.

Cloud resources and billing: SLS

Enable Container Service Alert Management. Based on SLS, Managed Service for Prometheus, and Cloud Monitor data sources, it sends alert notifications to alert contact groups when cluster anomalies occur.

Collect control plane component logs into an SLS Project for in-depth troubleshooting and root cause analysis.

To enable this later, see Collect control plane component logs for an ACK managed cluster.

Cloud resources and billing: SLS

Enable the cluster inspection feature of artificial intelligence for IT operations to periodically scan cluster quotas, resource usage, component versions, and more. This ensures that the cluster configuration follows best practices and exposes potential risks in advance.