Container Service for Kubernetes:Create an ACK dedicated cluster

The custom name of the cluster.

If you enable IPv4/IPv6 dual-stack, a dual-stack cluster is created.

Configure the VPC of the cluster. You can specify a Zone to automatically create a VPC. You can also select an existing VPC in the VPC list.

When VPC is set to Use Existing, you can select the Select Existing Security Group option.

You can select Create Basic Security Group, Create Advanced Security Group, or Select Existing Security Group.

• By default, automatically created security groups allow all outbound traffic. When you modify the security group for business purposes, make sure that inbound traffic from the 100.64.0.0/10 CIDR block is allowed. This CIDR block is used to access other Alibaba Cloud services to pull images and query basic ECS information.

• If you select an existing security group, the system does not automatically configure security group rules. This may cause errors when you access the nodes in the cluster. You must manually configure security group rules. For more information, see Configure security groups for clusters.

The container network plugin is the foundation for network communication between pods in a cluster.

For a detailed comparison of the two plugins, see Comparison of the Terway and Flannel container network plugins.

• Flannel: A lightweight, open source network plugin. In ACK, it uses a VPC-native mode that is deeply integrated with Alibaba Cloud VPC. It enables pod-to-pod communication by directly managing VPC route tables.

  • Scenarios: Flannel is simple to configure and consumes few resources. It is suitable for scenarios with a small number of nodes (limited by VPC route table quotas), simplified network configuration requirements, and no need for custom control over the container network.

• Terway: A high-performance network plugin developed by Alibaba Cloud. It enables pod-to-pod communication based on Elastic Network Interfaces (ENIs).

  • Scenarios: Terway provides features such as eBPF-based network acceleration, NetworkPolicy, and pod-level vSwitches and security groups. It is suitable for scenarios with high requirements for node scale, network performance, and security, such as high-performance computing (HPC), games, and microservices.

  • Pod quantity limit: Each pod occupies a secondary IP address of an ENI. The number of IP addresses that can be assigned to a single ENI is limited and depends on the instance type. Therefore, the number of pods that can run on a node is limited by the ENI and secondary IP address quotas of the node.

    When you use a shared VPC, only Terway is supported.

  Terway also provides the following features.

  For more information about these features, see Use the Terway network plugin.

  • DataPathV2

    This can be configured only when you create a cluster.

    Enable DataPathv2 acceleration mode. Terway will use eBPF technology to optimize traffic forwarding paths, providing lower latency and higher throughput for network-intensive applications.

    This feature is supported only on Alibaba Cloud Linux 3 (all versions), ContainerOS, and Ubuntu, and requires Linux kernel version 5.10 or later. For more information, see Network acceleration.

  • NetworkPolicy Support

    This feature is in public preview. To use it, apply on the Quota Center console page.

    Supports native Kubernetes NetworkPolicy to act as a firewall between pods. Customize fine-grained access control rules to improve cluster security.

  • Trunk ENI Support

    Allows you to configure independent IP addresses, vSwitches, and security groups for pods. This is suitable for special business scenarios that require fixed IP addresses or independent network policy management for specific pods. For more information, see Configure a fixed IP address, an independent vSwitch, and a security group for a pod.

Configure this parameter only if you enable IPv4/IPv6 dual stack.

Configure an IPv6 CIDR block for Services. You must specify a Unique Local Unicast Address (ULA) space within the address range fc00::/7. The prefix must be 112 bits to 120 bits in length. We recommend that you specify an IPv6 CIDR block that has the same number of available IP addresses as the Service CIDR block.

For more information about how to plan CIDR blocks for a cluster, see Network planning of an ACK managed cluster.

iptables and IPVS are supported.

• iptables is a mature and stable kube-proxy mode. In this mode, service discovery and load balancing for Kubernetes Services are configured using iptables rules. The performance of this mode depends on the size of the Kubernetes cluster. This mode is suitable for Kubernetes clusters that manage a small number of Services.

• IPVS is a high-performance kube-proxy mode. In this mode, service discovery and load balancing for Kubernetes Services are configured by the IPVS module of Linux. This mode is suitable for clusters that manage many Services. We recommend that you use this mode in scenarios where high-performance load balancing is required.

Specify the Container Runtime based on the Kubernetes version. For more information about how to select a container runtime, see Comparison among containerd, Sandboxed-Container, and Docker.

• containerd (recommended): supports all Kubernetes versions.

• Sandboxed-Container: supports Kubernetes 1.31 and earlier.

• Docker (deprecated): supports Kubernetes 1.22 and earlier.

The default billing method used when ECS instances are scaled in a node pool. You can select Pay-As-You-Go, Subscription, or Spot Instance.

• If you select the Subscription billing method, you must configure the Duration parameter and choose whether to enable Auto Renewal.

• Spot Instance: Currently, only Spot Instances with a protection period are supported. You must also configure the Maximum Price Per Instance.

  If the real-time market price of an instance type that you select is lower than the value of this parameter, a spot instance of this instance type is created. After the protection period (1 hour) ends, the system checks the spot price and resource availability of the instance type every 5 minutes. If the real-time market price exceeds your bid price or if the resource inventory is insufficient, the spot instance is released. For more information, see Best practices for preemptible instance-based node pools.

To ensure that all nodes in a node pool use the same billing method, ACK does not allow you to change the billing method of a node pool from Pay-as-you-go or Subscription to Spot Instances or from Spot Instances to Pay-as-you-go or Subscription.

Enable security hardening for the cluster. You cannot modify this parameter after the cluster is created.

• Disable: disables security hardening for ECS instances.

• MLPS Security Hardening: Alibaba Cloud provides baselines and the baseline check feature to help you check the compliance of Alibaba Cloud Linux 2 images and Alibaba Cloud Linux 3 images with the level 3 standards of MLPS 2.0. MLPS Security Hardening enhances the security of OS images to meet the requirements of GB/T 22239-2019 Information Security Technology - Baseline for Classified Protection of Cybersecurity without compromising the compatibility and performance of the OS images. For more information, see ACK security hardening based on MLPS.

  Important

  After you enable MLPS Security Hardening, remote logons through SSH are prohibited for root users. You can use Virtual Network Computing (VNC) to log on to the OS from the ECS console and create regular users that are allowed to log on through SSH. For more information, see Connect to an instance using VNC.

• OS Security Hardening: You can enable Alibaba Cloud OS Security Hardening only when the system image is an Alibaba Cloud Linux 2 or Alibaba Cloud Linux 3 image.

ESSD AutoPL, ESSD, ESSD Entry, Standard SSD, and Ultra Disk are supported. The types of system disks that you can select vary based on the instance family that you select. Disk types that are not displayed in the drop-down list are not supported by the instance types that you select.

You can select Configure More System Disk Types to configure a disk type different from the System Disk to improve the scale-out success rate. When an instance is created, the system selects the first matching disk type based on the specified order of disk types to create the instance.

ESSD AutoPL, ESSD, ESSD Entry, and previous-generation disks (Standard SSD and Ultra Disk) are supported. The data disk types that you can select vary based on the instance family that you select. Disk types that are not displayed in the drop-down list are not supported by the instance types that you select.

• You can select Encryption for all disk types when you specify the type of data disk. By default, the Default Service CMK is used to encrypt the data disk. You can also use an existing CMK generated using BYOK in KMS.

• You can also use snapshots to create data disks in scenarios where container image acceleration and fast loading of large language models (LLMs) are required. This improves the system response speed and enhances the processing capability.

• During node creation, the last data disk will be automatically formatted. The system will mount /var/lib/container to this disk, while mounting /var/lib/kubelet and /var/lib/containerd to /var/lib/container. To custom mount points, modify the initialization configuration of the data disk. Only one data disk can be selected as the container runtime directory. For usage instructions, see Can I mount a data disk to a custom directory in an ACK node pool?

You can select Configure More Data Disk Types to configure a disk type different from the Data Disk to improve the scale-out success rate. When an instance is created, the system selects the first matching disk type based on the specified order of disk types to create the instance.

Add taints to nodes. A Taint consists of a Key, a Value, and an Effect. A taint key can be prefixed. If you want to specify a prefixed taint key, add a forward slash (/) between the prefix and the remaining content of the key. For more information, see Taints and tolerations. The following limits apply to taints:

• Key: A key must be 1 to 63 characters in length, and can contain letters, digits, hyphens (-), underscores (_), and periods (.). A key must start and end with a letter or digit.[a-z0-9A-Z]

  If you want to specify a prefixed key, the prefix must be a DNS subdomain name. A subdomain name consists of DNS labels that are separated by periods (.), and cannot exceed 253 characters in length. It must end with a forward slash (/). For more information about DNS subdomain names, see DNS subdomain names.

• Value: A value cannot exceed 63 characters in length, and can contain letters, digits, hyphens (-), underscores (_), and periods (.). A value must start and end with a letter or digit. You can also leave a value empty.[a-z0-9A-Z]

• You can specify the following Effects for a taint: NoSchedule, NoExecute, and PreferNoSchedule.

  • NoSchedule: If a node has a taint whose Effect is NoSchedule, the system does not schedule pods to the node.

  • NoExecute: Pods that do not tolerate this taint are evicted after this taint is added to a node. Pods that tolerate this taint are not evicted after this taint is added to a node.

  • PreferNoSchedule: The system attempts to avoid scheduling pods to nodes with taints that are not tolerated by the pods.

Nodes automatically run user-data scripts after they are added to the cluster. For more information about user-data scripts, see User-data scripts.

For example, if you enter echo "hello world", a node runs the following script:

#!/bin/bash
[Node initialization script]
echo "hello world"

After you install CloudMonitor, you can view the monitoring information about the nodes in the CloudMonitor console.

This parameter takes effect only on newly added nodes and does not take effect on existing nodes. If you want to install the CloudMonitor agent on an existing ECS node, go to the CloudMonitor console.

Specify whether to assign an IPv4 address to each node. If you clear the check box, no public IP address is allocated. If you select the check box, you must configure the Bandwidth Billing Method and Peak Bandwidth parameters.

This parameter takes effect only on newly added nodes and does not take effect on existing nodes. If you want to enable an existing node to access the Internet, you must create an EIP and associate the EIP with the node. For more information, see Associate an EIP with an ECS instance.