System node pool - Container Service for Kubernetes - Alibaba Cloud Documentation Center

In an ACK Auto Mode cluster, a dedicated, fully managed system node pool isolates critical system components from business workloads through labels, taints, and scheduling policies. Enabled by default, it prevents resource contention and improves cluster reliability and security.

How it works

The following figure shows how a system node pool isolates system components from business workloads.

The default name of a system node pool is ack-system. The following table describes the labels, taints, and scheduling policies that enforce this isolation:

Mechanism	Configuration	Purpose
Node label	`alibabacloud.com/system-nodepool=true`	Identifies a node as part of the system node pool so that scheduling policies can match the node.
Taint	`CriticalAddonsOnly=true:NoSchedule`	Prevents business pods that have no matching toleration from being scheduled to the system node pool.
Node affinity	`requiredDuringSchedulingIgnoredDuringExecution`: requires the `alibabacloud.com/system-nodepool=true` label	Forces system component pods to be scheduled to nodes that carry the system node pool label.
Toleration	`CriticalAddonsOnly=true:NoSchedule`	Allows system component pods to be scheduled to the system node pool.

These mechanisms work together to produce the following scheduling results:

System components are scheduled to the system node pool: Node affinity forces the scheduling, and a toleration allows the pods to pass the taint check.
Business pods are scheduled to regular node pools: They have no toleration for the CriticalAddonsOnly taint, so they cannot be scheduled to the system node pool.

Key features and benefits

Strict isolation: System components are scheduled only to the system node pool and are strictly isolated from regular node pools. This prevents resource contention and interference between system components and business workloads, and improves overall cluster stability and performance.
ACK-managed operations: ACK creates, upgrades, and scales the system node pool without manual intervention.
ACK provides the system node pool capability but does not cover the charges for the resources that the system node pool uses.

Usage notes

The following limits and notes apply to the system node pool:

Business pods: Not scheduled to the system node pool by default. Do not schedule business pods to the system node pool, as this may compromise system component stability. For more information, see Can business pods be scheduled to the system node pool.

Warning

Do not delete the system node pool unless you have a specific reason. Deleting the system node pool evicts system component pods. Regular node pools do not have the system node pool label, so they cannot meet the node affinity requirement and system components cannot be rescheduled. This may cause cluster features to malfunction.

If you must delete the system node pool, first create a replacement node pool that meets the following scheduling requirements:

labels:
  alibabacloud.com/system-nodepool: "true"
taints:
  - key: CriticalAddonsOnly
    value: "true"
    effect: NoSchedule

After you create the replacement node pool, verify that it carries the alibabacloud.com/system-nodepool=true label and the CriticalAddonsOnly=true:NoSchedule taint before you delete the system node pool.

How system components are scheduled

Add-ons are cluster extensions that ACK schedules to the system node pool. Scheduling is automatic or manual.

Automatic scheduling

When a system component is upgraded, it is automatically scheduled to the system node pool.
System components installed from the ACK console or by calling API operations are scheduled to the system node pool by default.
Add-ons deployed as DaemonSets and control-plane-managed add-ons are not rescheduled to the system node pool. They continue to use their existing deployment policies.

Manual scheduling

Manually change the general configuration of a component to schedule it to the system node pool. Use the following node affinity and toleration settings:

Mechanism	Configuration	Purpose
Node affinity	Required/Preferred: Required. Key: `alibabacloud.com/system-nodepool`. Operator: `In`. Value: `true`	Matches the system node pool label.
Toleration	Key: `CriticalAddonsOnly`. Operator: `Equal`. Value: `true`. Effect: `NoSchedule`	Allows pods to be scheduled to the system node pool.

If you manually specify node affinity or toleration settings, system components are scheduled based on your settings.

Check whether the system node pool is enabled

To check whether the system node pool is enabled for a cluster, open the node pool list of the cluster in the ACK console. If the list contains the ack-system node pool, the system node pool is enabled.

FAQ

Which add-ons run in the system node pool?

ACK schedules add-ons to the system node pool by default, including but not limited to the following:

CoreDNS
csi-plugin
csi-provisioner
metrics-server
ack-cost-exporter
loongcollector

Can I delete the system node pool?

Deleting the system node pool is not recommended because it can cause cluster features to malfunction. If you must delete it, first create a replacement node pool. For the replacement procedure, see Usage notes.

Can business pods be scheduled to the system node pool?

No, not by default. Business pods lack a toleration for the CriticalAddonsOnly taint, preventing them from being scheduled to the system node pool. While you can manually add this toleration to a business pod if absolutely necessary, doing so is strongly discouraged. Scheduling business workloads to the system node pool breaks resource isolation and may compromise core add-on stability.