Container Service for Kubernetes (ACK) integrates Kubernetes networking with Alibaba Cloud network services for stable, high-performance container networks, covering CNI plug-ins, Services, Ingresses, and DNS-based service discovery.
CNI plug-ins
Kubernetes uses CNI plug-ins to enable and standardize container networking:
-
Pods join the container network on creation and leave on deletion.
-
Each pod is assigned a unique IP address.
-
Pods can communicate with endpoints inside and outside the cluster.
CNI plug-ins implement the container network. Your CNI plug-in determines pod IP allocation, overlay network usage, in-cluster traffic forwarding, and pod access control. Well-known open-source CNI plug-ins include Calico, Flannel, and Cilium.
ACK provides two CNI plug-ins—Terway and Flannel—with different feature sets. See Terway vs. Flannel CNI plugins to choose between them when creating a cluster.
You cannot change a cluster's network plug-in after creation.
Terway
Terway is a CNI plug-in developed by Alibaba Cloud. It assigns elastic network interfaces (ENIs) from ECS instances to pods in ACK clusters, connecting pods directly to the Virtual Private Cloud (VPC) without tunneling such as VXLAN, which improves network efficiency. Terway is ideal for large-scale clusters with high network performance and access control requirements.
When creating an ACK cluster with Terway, choose between inclusive ENI and exclusive ENI mode:
-
IP allocation: In exclusive ENI mode, each pod gets a dedicated ENI for optimal network performance. In inclusive ENI mode, pods share ENIs, increasing pod density per node.
-
Network acceleration: Inclusive ENI mode supports DataPath V2 acceleration. When enabled, Terway uses a different forwarding path for faster communication.
-
Access control: Both modes support fixed IP addresses, separate security groups, and vSwitches for pods. Exclusive ENI mode also supports Kubernetes network policies.
Flannel
Flannel is an open-source CNI plug-in that uses network virtualization such as VXLAN to build an overlay network for pods. It is easy to configure but offers weaker network performance due to NAT overhead, and weaker access control than Terway. Flannel supports clusters with up to 1,000 nodes and is suitable for scenarios with low network performance requirements or quick cluster setup.
Services
Pods are ephemeral in Kubernetes—their network resources change when pods are destroyed or replaced. A Service provides a stable entry point to a group of pods with built-in load balancing:
-
A Service selects pods by label and maps its IP address and port to the pods' IP addresses and ports.
-
When backend pods change, the Service automatically updates its forwarding rules.
ACK supports ClusterIP, NodePort, LoadBalancer, Headless, and ExternalName Services for in-cluster, external, and internet access. See Service management.
Ingresses
Unlike Services that provide Layer 4 load balancing, Ingresses manage external access at Layer 7 with a centralized entry point, routing requests to different Services by domain name or path. See Ingress management.
DNS-based service discovery
ACK resolves Service names to cluster IP addresses through DNS, enabling application access by domain name regardless of IP addresses or deployment environments. See DNS-based service discovery.
