All Products
Search
Document Center

Container Service for Kubernetes:Discontinuation of Ingress and Argo testing domains in ACK

Last Updated:Jan 13, 2026

For security and compliance reasons, Alibaba Cloud Container Service for Kubernetes (ACK) will stop resolving the {Cluster ID}.alicontainer testing domains for Ingress instances in existing clusters. To avoid service disruptions, migrate any services using these testing domain name to your own domains as soon as possible.

Change details and impact scope

Starting May 5, 2026, ACK will gradually stop resolving domains in the format {Cluster ID}.{region}.alicontainer.com. You must configure your own custom domains to continue using the Ingress service.

This change impacts the following cluster types:

  • ACK managed clusters, ACK dedicated clusters, ACK Edge clusters, ACK Lingjun clusters, and ACK Serverless clusters: Ingress rules that use an alicontainer.com domain will become unresolvable, making the associated backend services inaccessible via that domain.

  • Distributed Cloud Container Platform for Kubernetes (ACK One) (GitOps): For ACK One fleet clusters using the default Argo CD domain, the domain will become unresolvable.

  • ACK One (workflow clusters): For workflow clusters using the default ArgoServer domain, the domain will become unresolvable.

As of July 15, 2024, ACK already stopped providing alicontainer.com testing domains for newly created clusters. Clusters created after this date are not affected by this change. For details, see [Product Change] Discontinuation of Ingress testing domains for new clusters.

How to check for impacted services

ACK managed, dedicated, Edge, Lingjun, and Serverless clusters

Run the following command to check if any Ingress resources in your cluster use an alicontainer.com domain:

kubectl get ingress -A -o yaml |grep "alicontainer.com"

ACK One GitOps

  1. Check your DNS configuration for any custom domains that have a CNAME record pointing to argocd.<ackone fleet id>.<region>.alicontainer.com.

  2. Check if the argocd-cm ConfigMap in Argo CD is configured with an alicontainer.com URL:

    kubectl -nargocd get cm argocd-cm -ojsonpath='{.data.url}' |grep "alicontainer.com"

ACK One workflow clusters

Check your DNS configuration and client applications for any systems that submit workflows by directly using or creating a CNAME record to the argo.<argo cluster id>.<region>.alicontainer.com endpoint.

Solutions

Migrate Ingress domains for ACK managed, dedicated, Edge, Lingjun, and Serverless clusters

To migrate services that use an alicontainer.com domain while remaining publicly accessible, follow these steps:

  1. Prepare your own domain and create an A record that points to the external IP address of the nginx-ingress-lb Service in the kube-system namespace. For instructions, see Configure domain name resolution.

  2. Update all affected Ingress resources to include a new routing rule that uses your own domain.

  3. Test the service connectivity using the new domain and switch all client traffic to it.

  4. After verification, remove the old routing rules associated with the alicontainer.com domain from your Ingress resources.

Migrate ACK One GitOps domains

Scenario 1: You use a custom domain with a CNAME record pointing to alicontainer.com

If your custom domain name has a CNAME record pointing to argocd.<ackone fleet id>.<region>.alicontainer.com, migrate it as follows:

  1. Get the LoadBalancer IP address of the argocd-server service.

    kubectl get svc -n argocd argocd-server -o jsonpath='{.status.loadBalancer.ingress[0].ip}'
  2. In your DNS provider, change the DNS record for your custom domain from a CNAME record to an A record that points to the IP address obtained in the previous step.

Scenario 2: You directly use the alicontainer.com domain

To determine if this scenario applies to you, check the URL in the argocd-cm ConfigMap of the fleet.

kubectl -nargocd get cm argocd-cm -ojsonpath='{.data.url}' |grep "alicontainer.com"

If argocd-cm ConfigMap contains alicontainer.com, follow these steps to change data.url to the LoadBalancer IP address of argocd-server to complete the migration.

  1. Get the LoadBalancer IP address of the argocd-server Service.

    kubectl get svc -n argocd argocd-server -o jsonpath='{.status.loadBalancer.ingress[0].ip}'
  2. Patch the argocd-cm ConfigMap to replace the data.url field with the IP address obtained in the previous step, and restart argocd-server for the configuration to take effect..

    Remember to replace ${LB_IP} with the actual IP address.

    # Patch the ConfigMap with the new URL
    kubectl patch cm -n argocd argocd-cm --type=merge -p '{"data":{"url":"https://${LB IP}"}}'
    
    # Restart the argocd-server to apply the changes
    kubectl -n argocd rollout restart deployment argocd-server

Migrate ACK One workflow domains

  • If you do not need a custom domain: Update your client configurations to use the external IP address of the argo-server Service directly.

  • If you need to continue using a domain:

    1. Prepare your own custom domain.

    2. At your DNS provider, create an A record for the domain that points to the external IP address of the argo-server Service in the cluster's namespace.

    3. Update all client configurations to use the new custom domain endpoint.

Contact us

If you have any questions or suggestions, join our DingTalk group to contact us.