All Products
Search
Document Center

Container Service for Kubernetes:Deploy the cloud-native AI suite

Last Updated:Aug 27, 2026

The cloud-native AI suite can be installed on ACK Pro, ACK Serverless Pro, and ACK Edge Pro clusters running Kubernetes 1.18 or later. This topic explains how to install the suite and configure the cloud-native AI operations and developer consoles.

Prerequisites

Ensure that you have:

Deploy the suite

  1. Log on to the ACK console. In the left navigation pane, click Clusters.

  2. On the Clusters page, click your cluster name. In the left-side pane, choose Applications > Cloud-native AI Suite.

  3. On the Cloud-native AI Suite page, click Deploy.

  4. On the deployment page, select the components to install. See Component reference for details and compatibility.

    If you select Kube Queue, Console, and Kubeflow Pipelines together, Arena is required.
  5. Click Deploy Cloud-native AI Suite. The system runs an environment and dependency check, then deploys the selected components.

Component reference

The following table lists all components, their namespaces, and supported cluster types.

Configuration Component Namespace ACK Pro ACK Serverless Pro ACK Edge Pro
Elasticity ack-alibaba-cloud-metrics-adapter kube-system Yes No Yes
Acceleration (Fluid data acceleration) ack-fluid fluid-system Yes Yes Yes
Scheduling (batch task scheduling, GPU sharing, topology-aware GPU scheduling, and NPU scheduling) ack-ai-installer kube-system Yes No Yes
Kube Queue ack-kube-queue kube-queue Yes Yes Yes
Arena (CLI) ack-arena kube-system Yes Yes Yes
Console (Platform for AI) ack-pai pai-system Yes No Yes
Console (AI Dashboard) ack-ai-dashboard kube-ai Yes No Yes
Console (AI Developer Console) ack-ai-dev-console kube-ai Yes No Yes
Console Data Storage ack-mysql kube-ai Yes No Yes
Workflow (Kubeflow Pipelines) ack-ai-pipeline kube-ai Yes No Yes
Monitoring ack-arena-exporter kube-ai Yes No Yes

ack-pai integrates algorithms and engines optimized by Platform for AI (PAI), including Data Science Workshop (DSW), Deep Learning Containers (DLC), and Elastic Algorithm Service (EAS), to improve elasticity and efficiency for AI development, training, and inference.

To configure custom parameters for Scheduling components, click Advanced on the deployment page.

If you selected Arena, configure the Arena client separately after installation.

See Fluid data acceleration, ack-ai-installer, ack-kube-queue, and ack-ai-pipeline.

Configure the AI console

Starting January 22, 2025, the AI console (AI Dashboard and AI Developer Console) is available only to whitelisted users. Existing deployments are unaffected. Non-whitelisted users can install and configure the AI console through the open-source community. See data-on-ack.

Authorize the AI console

  1. In the Ecosystem Tools section, select Console. A Note dialog box appears.

    • If the authorization status shows Authorized, skip to Select an access method.

    • If the status shows Unauthorized in red and OK is unavailable, complete the authorization below.

  2. Create a custom policy in Resource Access Management (RAM).

    1. Log on to the RAM console. In the left navigation pane, choose Permissions > Policies.

    2. Click Create Policy.

    3. On the JSON tab, enter the following policy and click OK. Name the policy k8sWorkerRolePolicy-{ClusterID}.

       {
          "Version": "1",
          "Statement": [
              {
                  "Effect": "Allow",
                  "Action": [
                      "cs:*",
                      "log:GetProject",
                      "log:GetLogStore",
                      "log:GetConfig",
                      "log:GetMachineGroup",
                      "log:GetAppliedMachineGroups",
                      "log:GetAppliedConfigs",
                      "log:GetIndex",
                      "log:GetSavedSearch",
                      "log:GetDashboard",
                      "log:GetJob",
                      "ecs:DescribeInstances",
                      "ecs:DescribeSpotPriceHistory",
                      "ecs:DescribePrice",
                      "eci:DescribeContainerGroups",
                      "eci:DescribeContainerGroupPrice",
                      "log:GetLogStoreLogs",
                      "ims:CreateApplication",
                      "ims:UpdateApplication",
                      "ims:GetApplication",
                      "ims:ListApplications",
                      "ims:DeleteApplication",
                      "ims:CreateAppSecret",
                      "ims:GetAppSecret",
                      "ims:ListAppSecretIds",
                      "ims:ListUsers"
                  ],
                  "Resource": "*"
              }
          ]
      }

  3. Attach the custom policy to the cluster RAM role.

    1. In the RAM console, in the left navigation pane, choose Identities > Roles.

    2. Search for KubernetesWorkerRole-{ClusterID} and click Grant Permission in the Actions column.

    3. In the Grant Permission panel, search for k8sWorkerRolePolicy-{ClusterID}.

    4. Select the policy and click Grant permissions.

  4. Return to the Note dialog box and click Authorization Check. The status changes to Authorized and OK becomes available.

Select an access method

In the Note dialog box, select an access method and click OK.

Access method Recommended use Notes
Private IP Production Accesses the console over the internal network
Internal Domain Production Uses a private domain name
Public Domain Testing only Map the public domain to the NGINX Ingress SLB public IP in your local hosts file

See Access the AI operations console.

Configure console data storage

After you select Console under Interaction Mode, the Console Data Storage option appears. Choose a storage method.

Pre-installed MySQL (testing only)

If you do not select ApsaraDB RDS, the cluster uses a built-in MySQL database by default.

Important

This option is recommended for testing only. If the cluster fails or storage is lost, data may be lost.

Deployment creates a 120 GB disk as a PersistentVolumeClaim (PVC) using the StorageClass. ACK does not manage the disk lifecycle. Delete the disk manually when no longer needed.

ApsaraDB RDS (production)

Use ApsaraDB RDS for production workloads.

If a connection error occurs, see Troubleshoot instance connection failures.
To change the storage method, uninstall and reinstall the suite. Delete the Secret kubeai-rds in the kube-ai namespace before reinstalling, if it exists.
  1. Purchase an ApsaraDB RDS instance and create a database and an account. See Quick start for ApsaraDB RDS and Billing overview.

  2. Click Deploy Cloud-native AI Suite at the bottom of the deployment page.

  3. In the ACK console, click the cluster name. In the left navigation pane, choose Configurations > Secrets.

  4. From the Namespace drop-down list, select kube-ai.

  5. Click Create from YAML.

  6. Enter the following YAML template to create a Secret named kubeai-rds, then click Create.

    Parameter Description
    MYSQL_HOST The ApsaraDB RDS connection endpoint
    MYSQL_DB_NAME The database name
    MYSQL_USER The database account username
    MYSQL_PASSWORD The database account password
       apiVersion: v1
       kind: Secret
       metadata:
         name: kubeai-rds
         namespace: kube-ai
       type: Opaque
       stringData:
         MYSQL_HOST: "Your RDS endpoint"
         MYSQL_DB_NAME: "Database name"
         MYSQL_USER: "Database username"
         MYSQL_PASSWORD: "Database password"

Configure workflow data storage

If you select Kubeflow Pipelines as the workflow engine, the Workflow Data Storage option appears. Choose a storage method.

Pre-installed MinIO (testing only)

If you do not select OSS, the cluster uses a built-in MinIO instance by default.

Important

This option is recommended for testing only. If the cluster fails or storage is lost, data may be lost.

Deployment creates a 20 GB disk as a PVC using the StorageClass. ACK does not manage the disk lifecycle. Delete the disk manually when no longer needed.

Object Storage Service (testing and production)

Use Object Storage Service (OSS) for persistent, scalable workflow data storage.

  1. If the kube-ai namespace does not exist, create it:

    The kube-ai namespace is created automatically during suite deployment. Verify it exists before creating.
       kubectl create ns kube-ai
  2. In the ACK console, click the cluster name. In the left navigation pane, choose Configurations > Secrets.

  3. From the Namespace drop-down list, select kube-ai.

  4. Click Create from YAML.

  5. Enter the following YAML to create a Secret named kubeai-oss, then click Create.

    Parameter Description
    ENDPOINT The OSS endpoint for your region. See OSS regions and endpoints
    ACCESS_KEY_ID The AccessKey ID of a RAM user with AliyunOSSFullAccess permission. See Create an AccessKey pair
    ACCESS_KEY_SECRET The AccessKey secret of the RAM user
       apiVersion: v1
       kind: Secret
       metadata:
         name: kubeai-oss
         namespace: kube-ai
       type: Opaque
       stringData:
         ENDPOINT: "https://oss-cn-beijing.aliyuncs.com"
         ACCESS_KEY_ID: "****"
         ACCESS_KEY_SECRET: "****"
  6. After creating the Secret, verify that a bucket named mlpipeline-<clusterid> appears in the OSS console. See Billing overview for OSS billing.

  7. Return to the deployment page and install Kubeflow Pipelines.

Verify the deployment

After deployment, verify that the components are running:

  1. In the ACK console, click the cluster name. In the left-side pane, choose Applications > Cloud-native AI Suite. The component list shows all installed components with their versions.

  2. Confirm that each component shows a successful deployment status. You can Deploy or Uninstall individual components. If a newer version is available, you can also Upgrade.

  3. If you installed the AI consoles, click AI Dashboard or AI Developer Console in the upper-left corner of the Cloud-native AI Suite page to verify access.