For security and compliance reasons, Alibaba Cloud Container Service for Kubernetes (ACK) will stop resolving the {Cluster ID}.alicontainer testing domains for Ingress instances in existing clusters. To avoid service disruptions, migrate any services using these testing domain name to your own domains as soon as possible.
Change details and impact scope
Starting May 5, 2026, ACK will gradually stop resolving domains in the format {Cluster ID}.{region}.alicontainer.com. You must configure your own custom domains to continue using the Ingress service.
This change impacts the following cluster types:
ACK managed clusters, ACK dedicated clusters, ACK Edge clusters, ACK Lingjun clusters, and ACK Serverless clusters: Ingress rules that use an
alicontainer.comdomain will become unresolvable, making the associated backend services inaccessible via that domain.Distributed Cloud Container Platform for Kubernetes (ACK One) (GitOps): For ACK One fleet clusters using the default Argo CD domain, the domain will become unresolvable.
ACK One (workflow clusters): For workflow clusters using the default ArgoServer domain, the domain will become unresolvable.
As of July 15, 2024, ACK already stopped providing alicontainer.com testing domains for newly created clusters. Clusters created after this date are not affected by this change. For details, see [Product Change] Discontinuation of Ingress testing domains for new clusters.How to check for impacted services
ACK managed, dedicated, Edge, Lingjun, and Serverless clusters
Run the following command to check if any Ingress resources in your cluster use an alicontainer.com domain:
kubectl get ingress -A -o yaml |grep "alicontainer.com"ACK One GitOps
Check your DNS configuration for any custom domains that have a CNAME record pointing to
argocd.<ackone fleet id>.<region>.alicontainer.com.Check if the
argocd-cmConfigMap in Argo CD is configured with analicontainer.comURL:kubectl -nargocd get cm argocd-cm -ojsonpath='{.data.url}' |grep "alicontainer.com"
ACK One workflow clusters
Check your DNS configuration and client applications for any systems that submit workflows by directly using or creating a CNAME record to the argo.<argo cluster id>.<region>.alicontainer.com endpoint.
Solutions
Migrate Ingress domains for ACK managed, dedicated, Edge, Lingjun, and Serverless clusters
To migrate services that use an alicontainer.com domain while remaining publicly accessible, follow these steps:
Prepare your own domain and create an A record that points to the external IP address of the
nginx-ingress-lbService in thekube-systemnamespace. For instructions, see Configure domain name resolution.Update all affected Ingress resources to include a new routing rule that uses your own domain.
Test the service connectivity using the new domain and switch all client traffic to it.
After verification, remove the old routing rules associated with the
alicontainer.comdomain from your Ingress resources.
Migrate ACK One GitOps domains
Scenario 1: You use a custom domain with a CNAME record pointing to alicontainer.com
If your custom domain name has a CNAME record pointing to argocd.<ackone fleet id>.<region>.alicontainer.com, migrate it as follows:
Get the LoadBalancer IP address of the
argocd-serverservice.kubectl get svc -n argocd argocd-server -o jsonpath='{.status.loadBalancer.ingress[0].ip}'In your DNS provider, change the DNS record for your custom domain from a CNAME record to an A record that points to the IP address obtained in the previous step.
Scenario 2: You directly use the alicontainer.com domain
To determine if this scenario applies to you, check the URL in the argocd-cm ConfigMap of the fleet.
kubectl -nargocd get cm argocd-cm -ojsonpath='{.data.url}' |grep "alicontainer.com"If argocd-cm ConfigMap contains alicontainer.com, follow these steps to change data.url to the LoadBalancer IP address of argocd-server to complete the migration.
Get the LoadBalancer IP address of the
argocd-serverService.kubectl get svc -n argocd argocd-server -o jsonpath='{.status.loadBalancer.ingress[0].ip}'Patch the
argocd-cmConfigMap to replace thedata.urlfield with the IP address obtained in the previous step, and restartargocd-serverfor the configuration to take effect..Remember to replace
${LB_IP}with the actual IP address.# Patch the ConfigMap with the new URL kubectl patch cm -n argocd argocd-cm --type=merge -p '{"data":{"url":"https://${LB IP}"}}' # Restart the argocd-server to apply the changes kubectl -n argocd rollout restart deployment argocd-server
Migrate ACK One workflow domains
If you do not need a custom domain: Update your client configurations to use the external IP address of the
argo-serverService directly.If you need to continue using a domain:
Prepare your own custom domain.
At your DNS provider, create an A record for the domain that points to the external IP address of the
argo-serverService in the cluster's namespace.Update all client configurations to use the new custom domain endpoint.
Contact us
If you have any questions or suggestions, join our DingTalk group to contact us.