All Products
Search

This Product

    Container Service for Kubernetes:What is ACK Serverless?

    Document Center

    Container Service for Kubernetes:What is ACK Serverless?

    Last Updated:Aug 29, 2023

    This topic introduces ACK Serverless clusters and describes the benefits, use scenarios, and key features of ACK Serverless clusters. This topic also compares ACK Serverless clusters with Container Service for Kubernetes (ACK) clusters.

    Introduction

    ACK Serverless is a ACK Serverless service provided by Alibaba Cloud. ACK Serverless clusters allow you to deploy containerized applications without the need to purchase nodes. You do not need to perform capacity planning or O&M tasks on the nodes. You are charged based on the CPU and memory resources that are configured for your applications. ACK Serverless clusters are compatible with Kubernetes and make it easy to get started with Kubernetes. You can focus on the design and development of your applications instead of the underlying infrastructure.

    Each pod in an ACK Serverless cluster runs in a secure and isolated container runtime that is built on an elastic container instance. The underlying computing resources of each elastic container instance are isolated by lightweight virtual sandboxes. Elastic container instances do not affect each other.

    ACK Serverless clusters are classified into ACK Serverless Basic clusters and ACK Serverless Pro clusters. ACK Serverless Pro clusters are developed based on ACK Serverless Basic clusters and provide higher reliability and security in large-scale production environments for enterprise users. ACK Serverless Pro clusters are also covered by SLAs that include compensation clauses. For more information about ACK Serverless Pro clusters, see ACK Serverless Pro cluster overview.

    Benefits

    Benefit

    Description

    Out-of-the-box

    You can quickly create ACK Serverless clusters and deploy applications in ACK Serverless clusters without the need to manage Kubernetes nodes and servers.

    Ultralarge capacity

    You can create more than 20,000 pods in an ACK Serverless cluster without the need to add additional configurations or design the size of the cluster.

    Second-level scaling

    You can create thousands of pods within a short period of time to handle traffic spikes.

    Predictive scaling

    ACK Serverless can predict resource demand based on historical data and then scale resources promptly during peak hours.

    Compatibility with cloud-native services

    ACK Serverless is fully compatible with Kubernetes and supports Kubernetes-native applications and ecosystems. You can seamlessly migrate Kubernetes applications to ACK Serverless.

    Security isolation

    You can deploy pods on elastic container instances. Instances on which pods are deployed are isolated from each other by using the lightweight virtual sandbox technology.

    Cost savings

    Pods are created on demand. You are charged based on the resources used by your applications. The serverless architecture helps avoid resource waste and reduce O&M costs.

    Service integration

    You can seamlessly integrate containerized applications with the fundamental services of Alibaba Cloud. Containers can communicate with applications deployed on virtual machines.

    ACK Serverless Pro clusters

    Compared with ACK Serverless Basic clusters, ACK Serverless Pro clusters are more reliable, ensure higher service uptime, and allow you to deploy more pods. You can seamlessly upgrade ACK Serverless Basic clusters to ACK Serverless Pro clusters.

    Comparison between ACK Serverless and ACK

    The following figure compares an ACK cluster with an ACK Serverless cluster.

    与容器对比

    Use scenarios

    Scenario

    Description

    Application hosting

    In ACK Serverless clusters, you do not need to manage or maintain nodes, or perform cluster sizing. This reduces the costs of infrastructure management and O&M.

    Traffic spikes

    For workloads that periodically fluctuate, such as online education and e-commerce applications, ACK Serverless clusters can automatically scale resources based on workload requirements. This prevents resource waste, reduces computing costs, and ensures a smooth user experience when traffic spikes occur. For more information, see Auto scaling overview.

    Data computing

    To meet the computing requirements of applications such as Spark, ACK Serverless clusters can start a large number of pods within a short period of time to process tasks. When the tasks are terminated, the pods are automatically released to stop billing. This greatly reduces the computing costs. For more information, see Use ACK Serverless to create Spark tasks.

    CI/CD

    You can use ACK Serverless clusters to build continuous integration (CI) environments by using tools such as Jenkins or GitLab-Runner. You can set up an application delivery pipeline that covers stages such as source code compilation, image building and pushing, and application deployment. The continuous integration tasks are isolated from each other for enhanced security. You do not need to maintain specific resource pools. This reduces computing costs. For more information, see Elastic and cost-effective CI/CD based on ACK Serverless.

    CronJobs

    You can run CronJobs in ACK Serverless clusters. Billing automatically stops when the jobs are terminated. You do not need to maintain specific resource pools. This avoids resource waste. For more information, see CronHPA.

    Key features

    ACK Serverless is fully compatible with Kubernetes and supports all features of Kubernetes. In addition to these features, you also need to take note of the following features when you deploy applications in ACK Serverless clusters.

    ECI Profile

    ACK Serverless deploys pods on elastic container instances and allows you to configure the Elastic Container Instance profile to control the behavior of a cluster and the pods in the cluster in a fine-grained manner. The Elastic Container Instance profile is a ConfigMap named eci-profile that belongs to the kube-system namespace. The following table describes the parameters included in the Elastic Container Instance profile.

    Parameter

    Description

    vpcId

    The unique identifier of the virtual private cloud (VPC) in which the pod is deployed.

    securityGroupId

    The unique identifier of the security group of the VPC.

    vSwitchIds

    The unique identifier of the vSwitch in the VPC. Multiple vSwitch IDs are separated by commas (,). Virtual nodes are generated based on vSwitches.

    selectors

    The pod selector. The pod selector can select pods based on namespaces or labels, and automatically add annotations or labels.

    enableClusterIp

    Specifies whether to use the ClusterIP. Default value: true.

    enableLogController

    Specifies whether to enable the Alibaba Cloud log controller. Default value: false.

    enablePVCController

    Specifies whether to enable the persistent volume claim (PVC) controller. Default value: false.

    enablePrivateZone

    Specifies whether to enable the service discovery feature of PrivateZone. Default value: false.

    featureGates

    Specifies whether to enable feature gates.

    For more information, see Elastic Container Instance overview.

    Virtual nodes

    You do not need to manage nodes when you use ACK Serverless clusters. To ensure compatibility with Kubernetes, ACK Serverless allows you to view the virtual nodes in an ACK Serverless cluster. Virtual nodes provide large amounts of compute resources to allow ACK Serverless clusters to scale on demand and handle traffic spikes. Virtual nodes are created based on the vSwitch IDs specified in the eci-profile ConfigMap. Virtual nodes do not occupy compute resources.ask

    Pod configurations

    When you create pods in an ACK Serverless cluster, you can customize the pods by adding annotations to the pods. The following table describes the annotations that you can add.

    Important

    • The annotations described in the following table are applicable only to the pods that are scheduled to virtual nodes. These pods run on elastic container instances. The annotations cannot be added to the pods that are scheduled to regular nodes.

    • Add annotations to the metadata field of the pods. For example, when you configure a Deployment, add annotations in the spec.template.metadata field.

    • Pod annotations have a higher priority than the settings that correspond to the same feature in the Elastic Container Instance profile.

    Annotation

    Example

    Description

    References

    k8s.aliyun.com/eci-security-group

    sg-bp1dktddjsg5nktv****

    The security group ID.

    Configure a security group

    k8s.aliyun.com/eci-vswitch

    vsw-bp1xpiowfm5vo8o3c****

    The IDs of the vSwitches. You can specify multiple vSwitches across zones.

    Specify multiple zones to create an elastic container instance-based pod

    k8s.aliyun.com/eci-schedule-strategy

    vSwitchOrdered

    The multi-zone scheduling policy. Valid values:

    • vSwitchOrdered: Resources in the specified zones are scheduled in the order in which the vSwitches are specified.

    • vSwitchRandom: Resources in the specified zones are scheduled in a random manner.

    k8s.aliyun.com/eci-ram-role-name

    AliyunECIContainerGroupRole

    The Resource Access Management (RAM) role that Elastic Container Instance assumes to access other Alibaba Cloud services.

    Configure RAM roles

    k8s.aliyun.com/eci-use-specs

    2-4Gi,4-8Gi,ecs.c6.xlarge

    The specifications of elastic container instances. You can specify multiple specifications, such as the number of vCores and the memory size. You can also specify an ECS instance type.

    Specify multiple instance specifications to create an elastic container instance

    k8s.aliyun.com/eci-spot-strategy

    SpotAsPriceGo

    The bidding policy of the preemptible instance. Valid values:

    • SpotAsPriceGo: The instance is billed at the market price at the time of purchase.

    • SpotWithPriceLimit: You must specify the highest price that you want to pay for the preemptible instance.

    Create a preemptible instance

    k8s.aliyun.com/eci-spot-price-limit

    0.5

    The highest price of the preemptible instance.

    Note

    This parameter is valid only when k8s.aliyun.com/eci-spot-strategy is set to SpotWithPriceLimit.

    k8s.aliyun.com/eci-cpu-option-core

    2

    The number of physical CPU cores.

    Custom CPU options

    k8s.aliyun.com/eci-cpu-option-ht

    1

    The number of threads per core.

    k8s.aliyun.com/eci-reschedule-enable

    "true"

    Specifies whether to enable rescheduling for elastic container instances.

    Configure rescheduling for elastic container instances

    k8s.aliyun.com/pod-fail-on-create-err

    "true"

    Specifies whether to set the status of the elastic container instances to Failed if pods fail to be created on the elastic container instances.

    Set the status of pods that fail to be created to Failed

    k8s.aliyun.com/eci-image-snapshot-id

    imc-2zebxkiifuyzzlhl****

    Specifies the ID of the image cache.

    Note

    To use an image cache to create an elastic container instance, you can specify the image cache that you want to use or enable automatic matching for image caches. We recommend that you enable automatic matching for image caches.

    Use image caches to accelerate the creation of pods

    k8s.aliyun.com/eci-image-cache

    "true"

    Specifies whether to enable automatic matching for image caches.

    Note

    To use an image cache to create an elastic container instance, you can specify the image cache that you want to use or enable automatic matching for image caches. We recommend that you enable automatic matching for image caches.

    k8s.aliyun.com/acr-instance-id

    cri-j36zhodptmyq****

    Specifies the ID of the Container Registry Enterprise Edition instance.

    You can specify a Container Registry Enterprise Edition instance that resides in a region different from the region of the elastic container instance. To do this, you must add the region name of the Container Registry Enterprise Edition instance before the ID of the Container Registry Enterprise Edition instance. Example: "cn-beijng:cri-j36zhodptmyq****".

    Pull images from a Container Registry Enterprise Edition instance without using passwords

    k8s.aliyun.com/eci-eip-instanceid

    eip-bp1q5n8cq4p7f6dzu****

    The ID of the elastic IP address (EIP).

    Associate an EIP with an elastic container instance

    k8s.aliyun.com/eci-with-eip

    "true"

    Specifies whether to automatically create an EIP and associate the EIP with the pod.

    k8s.aliyun.com/eip-bandwidth

    5

    The bandwidth value for the EIP.

    k8s.aliyun.com/eip-common-bandwidth-package-id

    cbwp-2zeukbj916scmj51m****

    Specifies the ID of the EIP bandwidth plan.

    k8s.aliyun.com/eip-isp

    BGP

    Specifies the line type for the EIP. This annotation is applicable only to pay-as-you-go EIPs. Valid values:

    • BGP: BGP (Multi-ISP) lines

    • BGP_PRO: BGP (Multi-ISP) Pro lines

    k8s.aliyun.com/eip-internet-charge-type

    PayByBandwidth

    Specifies the metering method of the EIP. Valid values:

    • PayByBandwidth: pay-by-bandwidth

    • PayByTraffic: pay-by-data-transfer

    k8s.aliyun.com/eci-enable-ipv6

    "true"

    Specifies whether to assign an IPv6 address to the instance.

    Assign an IPv6 address to an elastic container instance

    k8s.aliyun.com/eci-ipv6-bandwidth-enable

    "true"

    Specifies whether to enable Internet access to the pod over IPv6 addresses.

    k8s.aliyun.com/eci-ipv6-bandwidth

    100M

    Specifies the maximum public bandwidth of the IPv6 address.

    kubernetes.io/ingress-bandwidth

    40M

    Specifies the inbound bandwidth.

    Limit the bandwidth of an elastic container instance

    kubernetes.io/egress-bandwidth

    20M

    Specifies the outbound bandwidth.

    k8s.aliyun.com/eci-extra-ephemeral-storage

    50Gi

    The temporary storage capacity.

    Customize the temporary storage capacity

    k8s.aliyun.com/eci-eviction-enable

    "true"

    Specifies whether to automatically evict pods that do not have sufficient temporary storage space from elastic container instances.

    Automatically evict pods that do not have sufficient temporary storage space from elastic container instances

    k8s.aliyun.com/eci-core-pattern

    /pod/data/dump/core

    Specifies the directory in which core dump files are stored.

    View core dump files

    k8s.aliyun.com/eci-ntp-server

    100.100.*.*

    The IP address of the Network Time Protocol (NTP) server.

    Configure the NTP service for pods

    k8s.aliyun.com/plain-http-registry

    "harbor***.pre.com,192.168.XX.XX:5000,reg***.test.com:80"

    The IP address of the self-managed image repository.

    When you create an elastic container instance by using an image in a self-managed image repository that uses the HTTP protocol, you must specify this parameter. This allows Elastic Container Instance to pull the image over HTTP. This avoids image pull failures due to the use of different protocols.

    Use self-managed image repositories

    k8s.aliyun.com/insecure-registry

    "harbor***.pre.com,192.168.XX.XX:5000,reg***.test.com:80"

    The domain name of the self-managed image repository.

    When you create an elastic container instance by using an image in a self-managed image repository that uses a self-signed certificate, you must add this annotation to the instance to skip the certificate authentication. This avoids image pull failures due to certificate authentication failures.

    For more information, see Annotations supported by Elastic Container Instance.

    Network Management

    By default, Elastic Container Instance-based pods use the host network mode. Each pod must be assigned an elastic network interface (ENI) by the vSwitch. This enables communications with the Elastic Compute Service (ECS) instances and ApsaraDB RDS instances in the VPC where the cluster is deployed.

    Item

    Description

    Service

    • You can create ClusterIP and LoadBalancer Services.

    • You cannot create NodePort Services because ACK Serverless clusters do not support node-relevant features.

    Ingress

    • SLB Ingress: supports Layer 7 traffic forwarding based on Server Load Balancer (SLB) instances without controllers. For more information, see Ingress demo.

    • NGINX Ingress: allows you to create NGINX Ingresses after nginx-ingress-controller is deployed. For more information, see ingress-nginx demo.

    Service discovery

    To use the service discovery feature within a cluster, enable PrivateZone or CoreDNS when you create the cluster. You can also use the Elastic Container Instance profile to enable PrivateZone or install the CoreDNS component from the Add-ons page of the ACK console after the cluster is created.

    EIPs

    You can associate EIPs with Elastic Container Instance-based pods. You can automatically create an EIP for an Elastic Container Instance-based pod or associate an existing EIP with an Elastic Container Instance-based pod.

    Storage management

    You can mount Elastic Block Storage (EBS) or Apsara File Storage NAS (NAS) file systems to pods.

    Item

    Description

    EBS (disks)

    • To mount a disk by using FlexVolume, you do not need to install FlexVolume. You can mount a disk by specifying the disk ID. For more information, see disk-flexvolume-static.yaml demo. You can also dynamically provision disks as volumes. For more information, see disk-flexvolume-dynamic.yaml demo.

    • To dynamically provision disks by creating persistent volumes (PVs) and PVCs, you must first install disk-controller. For more information, see disk-pvc-dynamic.yaml demo.

    NAS

    • To use NFS volumes, you can mount NAS file systems by using NFS. For more information, see nas-nfsvolume.yaml demo.

    • To statically provision NAS file systems as volumes by using FlexVolume, you can directly specify the mount target without the need to install FlexVolume. For more information, see nas-flexvolume.yaml demo.

    • To statically provision NAS file systems as volumes by creating PVs and PVCs, you must first install disk-controller. For more information, see nas-pvc.yaml demo.

    Observability

    Item

    Description

    Logs

    You can modify the eci-profile ConfigMap to enable Log Service for an ACK Serverless cluster. Then, the ACK Serverless cluster can collect pod logs. For more information, see Use Log Service to collect application logs.

    Monitoring

    You can install the arms-prometheus component to enable cluster monitoring for an ACK Serverless cluster. For more information, see Enable Managed Service for Prometheus.

    Image management

    Auto scaling

    ACK Serverless clusters do not contain real nodes. You do not need to be concerned about node capacity planning or cluster expansion by using cluster-autoscaler. You only need to scale applications to meet your business requirements. We recommend that you configure Horizontal Pod Autoscaler (HPA) or CronHPA policies to adjust the number of pods on demand. For more information, see Auto scaling overview.

    Authorization

    If your application pods need to access Alibaba Cloud services, you can configure RAM Roles for Service Accounts (RRSA) to complete authorization.

    Cluster management

    Item

    Description

    Intelligent O&M

    You can use the intelligent O&M feature to periodically check the health status of ACK Serverless clusters, or run prechecks on clusters to be upgraded or migrated.

    Updates

    You can upgrade ACK Serverless clusters without service interruptions.

    ACK Serverless Pro

    ACK Serverless Pro clusters are more reliable, ensure higher service uptime, and allow you to create more pods.

    Migration

    You can update trial ACK Serverless clusters or ACK Serverless Basic clusters to ACK Serverless Pro clusters for higher service availability.

    Component management

    ACK Serverless provides a variety of components and extended cluster features. You can deploy, update, or uninstall components on demand. For more information, see Manage components.

    Managed components

    To simplify cluster O&M and allow you to focus on application development, ACK Serverless clusters provide managed system components. The managed system components include kube-scheduler, cloud-controller-manager, kube-controller-manager, and kube-apiserver. ACK Serverless clusters will provide managed storage, networks, and monitoring components in the future.

    Important

    Managed components can create objects such as ClusterRoles, ClusterRoleBindings, ServiceAccounts, Services, and ConfigMaps. However, the objects created by managed components are not deployed on elastic container instances that run in ACK Serverless clusters. To ensure cluster stability, we recommend that you do not modify the objects created by managed components.

    Managed components are deployed and maintained by ACK Serverless clusters. You can use the ACK API to interact with the managed components. Managed components provide the following benefits:

    • Save the costs of elastic container instances.

    • Provide automated deployment and maintenance.

    • Use high availability (99.95%) architectures.

    Application management

    You can install Helm charts from the Marketplace page in the ACK console and then manage them on the Helm page. For more information, see Use Helm to simplify application deployment.

    Billing rules

    ACK Serverless clusters are classified into ACK Serverless Basic clusters and ACK Serverless Pro clusters. The billable items and billing rules vary based on the type of ACK Serverless clusters. For more information, see Billing of ACK Serverless clusters.

    Limits

    ACK Serverless clusters have the following limits:

    • ACK Serverless clusters do not support DaemonSets. You can replace DaemonSets with sidecar containers.

    • You cannot specify HostPath or HostNetwork in pod manifests.

    • ACK Serverless clusters do not support privileged containers. You can use a security context to add capabilities to a pod.

    • ACK Serverless clusters do not support NodePort Services.

    • ACK Serverless clusters cannot retrieve ECS metadata.

    • ACK Serverless clusters do not support the China East Finance, China South Finance, or Alibaba Gov Cloud regions.

    Contact Us

    If you have questions about ASK clusters, join the DingTalk group 31544226.