Container Service for Kubernetes (ACK) is a managed service that helps you manage your containers to ensure high performance. It is also one of the first publicly offered services in the world to pass the Certified Kubernetes Conformance Program.
ACK cluster types
ACK provides three types of clusters: ACK dedicated cluster, ACK managed cluster, and serverless Kubernetes (ASK) cluster.
Item | ACK dedicated cluster | ACK managed cluster | Serverless Kubernetes |
Node management | You are required to create and manage the control planes and worker nodes. | You are required to create only worker nodes. ACK creates and manages the control plane. | You are not required to create and manage the control plane or worker nodes. |
You have full and fine-grained control over the cluster but you have to plan and manage the cluster and update nodes on your own. | ACK manages the control plane for you, providing a simple, cost-effective, and highly available solution. | ASK manages your cluster for you, allowing you to launch applications on ASK without needing to set up the cluster. | |
Billing methods | You are not charged for cluster management, but you are charged for the resources used to create the control planes, worker nodes, and other infrastructure resources. |
| You are charged based on the amount of resources consumed and the usage duration (in seconds). |
Usage scenarios | All scenarios where Kubernetes is used | All scenarios where Kubernetes is used | Batch tasks, scale-out for handling unexpected workloads, and CI/CD testing |
User profile |
|
|
|
ACK cluster architecture
ACK managed clusters are reliable, secure, and highly available. ACK manages the Kubernetes control planes of your clusters to ensure high performance. The ACK-managed Kubernetes control plane consists of at least two kube-apiserver, a kube-controller-manager, an ack-scheduler, and three etcd components. ACK scales the kube-apiserver and etcd components across regions to ensure high availability. ACK actively monitors the status of the control plane, installs vulnerability patches, and offers a service-level agreement (SLA) for the control plane.
Features
Cluster management
Cluster creation: You can create various types of clusters based on your business requirements. ACK allows you to customize cluster configurations and select from a rich variety of Elastic Compute Service (ECS) instance types to use as worker nodes. For more information, see Create an ACK Pro cluster, Create an ACK managed cluster, and Create an ACK dedicated cluster.
Cluster update: You can easily update your clusters with a few clicks. ACK provides a simple and centralized method to update your system components. For more information, see Update the Kubernetes version of an ACK cluster.
Elastic scaling: You can vertically scale your clusters directly in the console to respond to unexpected business fluctuations. You can also configure service-level affinity rules and horizontal scaling settings for your business.
Multi-cluster management: ACK allows you to register third-party and self-managed Kubernetes clusters and implement centralized management of all your resources.
Permission management: ACK integrates Resource Access Management (RAM) and role-based access control (RBAC) for permission management.
Node pool
ACK enables full lifecycle management for node pools and allows you to customize the configurations of each node pool in a cluster. For example, you can configure the vSwitches, container runtime, node OS, and security groups for a node pool based on your requirements. For more information, see Node pool overview.
Application management
Application creation: You can create various types of applications from images or templates. ACK allows you to customize application configurations, such as environment variables, health checks, disk mounting, and logging.
Lifecycle management: You can use ACK to manage applications throughout the entire lifecycle. For example, you can view, update, replace, and delete applications, roll back application versions, view application events, perform rolling updates, and use triggers to redeploy applications.
Pod scheduling: ACK supports pod scheduling based on pod affinity, node affinity, and pod anti-affinity.
Pod scaling: You can manually scale pods or automate pod scaling by using the Horizontal Pod Autoscaler (HPA).
Application release: ACK supports canary releases and blue-green deployments. You can use these features to better manage the application release lifecycle.
App catalog: App catalog is a feature that ACK provides to facilitate application deployment and cloud service integration.
Application center: The application center provides a centralized management panel that you can use to deploy your applications and monitor the topology of your applications. You can use the application center to implement unified version management and rollback in continuous deployment scenarios.
Application backup and recovery: You can back up applications and restore applications from backup data. For more information, see Back up and restore applications.
Storage volumes
Supported volume plug-ins: FlexVolume and Container Storage Interface (CSI). For more information, see CSI overview and FlexVolume overview.
Operations on volumes and persistent volume claims (PVCs):
You can create volumes of the Elastic Block Storage (EBS), Apsara File Storage NAS (NAS), Object Storage Service (OSS), and Cloud Paralleled File System (CPFS) types.
You can bind a volume to a PVC.
You can dynamically create and migrate volumes.
You can view and update volumes and PVCs by running scripts.
Networking
You can set up container networks based on the Flannel or Terway plug-in. For more information, see Overview.
You can specify CIDR blocks for Services and pods.
You can use the NetworkPolicy feature of Kubernetes to control access to specific applications. For more information, see Use network policies.
You can use Ingresses for traffic routing.
You can implement DNS-based service discovery. For more information, see DNS overview.
O&M and security
Monitoring: ACK integrates Prometheus monitoring for your clusters, nodes, applications, and pods.
Logging: ACK integrates Log Service for log collection and storage for your clusters and containers.
Alerting: ACK enables alerting based on cluster events and container metrics. For more information, see Alert management.
Cost analysis: ACK visualizes the resource usage and cost distribution of your clusters, providing you with easily understandable resource utilization metrics.
Security center: ACK actively inspects your applications for security risks, and provides security policies for runtime monitoring and alerting.
Sandboxed-Container: Sandboxed-Container is a container runtime developed by ACK for enhancing container security. You can use Sandboxed-Container to run an application in a sandboxed and lightweight VM, which has a dedicated kernel. Sandboxed-Container is suitable for isolating untrusted applications, unhealthy applications, low-performance applications, and workloads among users.
TEE-based confidential computing: ACK provides a cloud-native, all-in-one solution for confidential computing based on Intel Software Guard Extensions (Intel SGX). This solution ensures data security, integrity, and confidentiality when you develop, manage, and deliver trusted applications and confidential computing tasks. The confidential computing capabilities provided by ACK allow you to isolate sensitive data and code by using a trusted execution environment.
Service architecture
The following figure shows the architecture of the ACK product portfolio.
Container Registry provides secure hosting and lifecycle management for cloud-native assets. Container Registry is seamlessly integrated with ACK to provide an all-in-one solution for image distribution in cloud-native scenarios.
Alibaba Cloud Service Mesh (ASM) is a managed service mesh platform for the unified traffic management of applications that use the microservices architecture. ASM is compatible with open source Istio and supports multi-cluster traffic management. ASM also allows you to centrally manage the communication among containerized applications and applications that run on VMs.
ASK clusters run elastic and serverless computing tasks. You can create containerized applications without the need to manage or maintain clusters.
ACK@Edge is a Kubernetes-based edge computing solution that is developed by ACK for coordinating application delivery and O&M among the cloud, edge, and terminal. This service enhances node autonomy at the edge.
Alibaba Cloud Distributed Cloud Container Platform (ACK One) is an enterprise-class cloud-native container platform that is developed by ACK to meet container management requirements in hybrid cloud, multi-cluster, distributed computing, and disaster recovery scenarios. You can register third-party and self-managed Kubernetes clusters that are deployed in all regions or on all types of infrastructure with ACK One. ACK One is compatible with the APIs of open source Kubernetes. This allows you to centrally manage and maintain computing resources, networks, storage, security, monitoring data, logs, jobs, applications, and traffic.
The cloud-native AI suite is used to orchestrate and manage AI-related tasks and to schedule and maintain various heterogeneous resources in containerized environments. The component set can significantly accelerate the delivery of AI projects and improve resource utilization for clusters that consist of heterogeneous resources, such as GPUs and NPUs. ACK provides multiple components, extensions, and customizable configurations to support cloud-native AI capabilities.
Services that work with ACK
The following figure describes the Alibaba Cloud services that can be integrated with ACK. 
The following table provides details about the cloud services listed in the preceding figure.
Category | Description |
Computing | ECS: provides ECS instances that act as worker nodes. |
Elastic Container Instance: provides elastic container instances for ASK clusters. | |
Auto Scaling: automates the scaling of node pools. | |
Networking | Virtual Private Cloud (VPC): provides private networks in the cloud. |
Server Load Balancer (SLB): exposes the Kubernetes API server and applications. | |
NAT Gateway: provides IP address translation services for the cluster so that node pools in the cluster can access the Internet. | |
Elastic IP Address (EIP): provides public IP addresses for individual nodes to communicate with the Internet. | |
Alibaba Cloud DNS PrivateZone: provides DNS resolution services for internal domain names of ASK clusters. | |
Storage | EBS: provides data disks that you can mount to worker nodes to expand storage. |
NAS: provides file storage for your workloads. | |
OSS: provides shared storage for your workloads. | |
Security | RAM: a permission management service that can work with RBAC. |
Security Center: detects security risks for containers. | |
Key Management Service (KMS): provides encryption for Secrets in your ACK clusters. | |
Observability | Prometheus Service: provides Prometheus monitoring services for your ACK clusters and monitors the topology of your clusters. |
Log Service: collects and stores ACK cluster logs. | |
Cloud-native assets | Container Registry: hosts container images. |
Other services | Resource Orchestration Service (ROS): uses templates to facilitate resource orchestration. |
Use ACK
Click the following button to start using ACK.