Container Service for Kubernetes:Description of configuration items for ACK managed clusters

The custom name of the cluster.

This feature is in public preview. To use it, submit an application in the Quota Center console.

If you enable IPv4/IPv6 dual-stack, a dual-stack cluster is created.

Configure the VPC of the cluster. You can specify a zone to automatically create a VPC. You can also select an existing VPC in the VPC list.

When VPC is set to Select Existing VPC, you can select the Select Existing Security Group option.

You can select Create Basic Security Group, Create Advanced Security Group, or Select Existing Security Group.

• By default, automatically created security groups allow all outbound traffic. When you modify the security group for business purposes, make sure that traffic destined for 100.64.0.0/10 is allowed. This CIDR block is used to access other Alibaba Cloud services to pull images and query basic ECS information.

• If you select an existing security group, the system does not automatically configure security group rules. This may cause errors when you access the nodes in the cluster. You must manually configure security group rules. For more information, see Configure security groups for clusters.

Flannel and Terway are supported. For more information about the comparison between Terway and Flannel, see Comparison between Terway and Flannel.

• Flannel is an open source network plug-in provided by the community. Flannel uses the Virtual Private Cloud (VPC) of Alibaba Cloud in ACK. Packets are forwarded based on the VPC route table. Flannel is suitable for scenarios that require smaller nodes, simplified network configuration, and no requirements for custom control over the container network.

• Terway is a network plug-in developed by Alibaba Cloud. The plug-in builds networks based on elastic network interfaces (ENIs). Terway supports the use of extended Berkeley Packet Filter (eBPF) to accelerate network traffic. Terway also supports network policies and pod-level switches and security groups. Terway is suitable for scenarios such as high-performance computing, gaming, and microservices that require large nodes, and high network performance and security.

  Note

  • If you select Terway, a secondary IP address of the ENI is assigned to each pod. An ENI can allocate multiple IP addresses (depending on the instance specifications). The number of pods that can be deployed on a node depends on the number of ENIs that are attached to the node and the maximum number of secondary IP addresses that are provided by these ENIs.

  • If you select a shared VPC for a cluster, you must select Terway as the network plug-in.

  • If you select Flannel, ALB Ingress only supports forwarding requests to NodePort and LoadBalancer Services, and does not support ClusterIP Services.

  When you set the Network Plug-in parameter to Terway, you can configure the following parameters:

  • DataPathV2

    You can enable the DataPath V2 acceleration mode only when you create a cluster. After you enable the DataPath V2 acceleration mode for Terway in inclusive ENI mode, Terway adopts a different traffic forwarding path to accelerate network communication. For more information, see Network acceleration.

    Note

    If this feature is enabled, the container with Terway policies is expected to consume an additional 0.5 cores and 512 MB of resources on each worker node, and this consumption will increase as the cluster size grows. In the default configuration of Terway, the CPU limit for the container is set to 1 core, and no restrictions are specified on memory.

  • Support for NetworkPolicy

    If you select this check box, Kubernetes-native NetworkPolicies are supported.

    The feature of managing NetworkPolicies by using the console is in public preview. If you want to use the feature, log on to the Quota Center console and submit an application.

  • Support for ENI Trunking

    The Terway Trunk ENI feature allows you to specify a static IP address, a separate vSwitch, and a separate security group for each pod. This allows you to manage and isolate user traffic, configure network policies, and manage IP addresses in a fine-grained manner. For more information, see Configure static IP addresses, separate vSwitches, and separate security groups for a pod.

    Note

    • You can select the Support for ENI Trunking option for an ACK managed cluster without the need to submit an application. If you want to enable the Trunk ENI feature in an ACK dedicated cluster, log on to the Quota Center console and submit an application.

    • By default, the Trunk ENI feature is enabled for newly created ACK managed clusters that run Kubernetes 1.31 or later versions.

Configure this parameter only if you enable IPv4/IPv6 dual stack.

Configure an IPv6 CIDR block for Services. You must specify a Unique Local Unicast Address (ULA) space within the address range fc00::/7. The prefix must be 112 bits to 120 bits in length. We recommend that you specify an IPv6 CIDR block that has the same number of IP addresses as the Service CIDR block.

For more information about how to plan CIDR blocks for a cluster, see Network planning of an ACK managed cluster.

iptables and IP Virtual Server (IPVS) are supported.

• iptables is a mature and stable kube-proxy mode. In this mode, service discovery and load balancing for Kubernetes Services are configured by using iptables rules. The performance of this mode depends on the size of the Kubernetes cluster. This mode is suitable for Kubernetes clusters that manage a small number of Services.

• IPVS is a high-performance kube-proxy mode. In this mode, service discovery and load balancing for Kubernetes Services are configured by the IPVS module of Linux. This mode is suitable for clusters that manage a large number of Services. We recommend that you use this mode in scenarios where high-performance load balancing is required.

Add a label to the cluster. Labels are used to identify cloud resources. A label is a key-value pair.

Configure the cluster domain. The default domain name is cluster.local. You can enter a custom domain name. The cluster domain is the top-level domain name (standard suffix) used by all Services in the cluster. For example, the DNS name of the Service named my-service in the default namespace is my-service.default.svc.cluster.local. For more information about the usage notes for specifying a custom domain name, see What do I need to take note of when I configure the domain name of a cluster?

Specify the container runtime based on the Kubernetes version. For more information about how to select a container runtime, see Comparison among Docker, containerd, and Sandboxed-Container.

• containerd: containerd is recommended for all Kubernetes versions.

• Sandboxed-Container: supports Kubernetes 1.31 and earlier.

• Docker (deprecated): supports Kubernetes 1.22 and earlier.

The default billing method used when ECS instances are scaled in a node pool. You can select Pay-As-You-Go, Subscription, or Preemptible Instance.

• If you select the Subscription billing method, you must configure the Duration parameter and choose whether to enable Auto Renewal.

• Preemptible Instance: ACK supports only Preemptible Instance with a protection period. You must also configure the Upper Price Limit of Current Instance Spec parameter.

  If the real-time market price of an instance type that you select is lower than the value of this parameter, a preemptible instance of this instance type is created. After the protection period (1 hour) ends, the system checks the spot price and resource availability of the instance type every 5 minutes. If the real-time market price exceeds your bid price or if the resource inventory is insufficient, the preemptible instance is released. For more information, see Best practices for preemptible instance-based node pools.

To ensure that all nodes in a node pool use the same billing method, ACK does not allow you to change the billing method of a node pool from pay-as-you-go or subscription to preemptible instances or from preemptible instances to pay-as-you-go or subscription.

Enable security hardening for the cluster. You cannot modify this parameter after the cluster is created.

• Disable: disables security hardening for ECS instances.

• MLPS Security Hardening: Alibaba Cloud provides baselines and the baseline check feature to help you check the compliance of Alibaba Cloud Linux 2 images and Alibaba Cloud Linux 3 images with the level 3 standards of Multi-Level Protection Scheme (MLPS) 2.0. MLPS Security Hardening enhances the security of OS images to meet the requirements of GB/T 22239-2019 Information Security Technology - Baseline for Classified Protection of Cybersecurity without compromising the compatibility and performance of the OS images. For more information, see ACK security hardening based on MLPS.

  Important

  After you enable MLPS Security Hardening, remote logons through SSH are prohibited for root users. You can use Virtual Network Computing (VNC) to log on to the OS from the ECS console and create regular users that are allowed to log on through SSH. For more information, see Connect to an instance by using VNC.

• OS Security Hardening: You can enable Alibaba Cloud Linux Security Hardening only when the system image is an Alibaba Cloud Linux 2 or Alibaba Cloud Linux 3 image.

If you select MLPS Security Hardening, only the Password option is supported. When Operating System is set to ContainerOS, the valid values are Key Pair and Later.

Valid values: Key Pair, Password, and Later.

• Configure the logon type when you create the node pool:

  • Key Pair: Alibaba Cloud SSH key pairs provide a secure and convenient method to log on to ECS instances. An SSH key pair consists of a public key and a private key. SSH key pairs support only Linux instances.

    Configure the Username (select root or ecs-user as the username) and the Key Pair parameters.

  • Password: The password must be 8 to 30 characters in length, and can contain letters, digits, and special characters.

    Configure the Username (select root or ecs-user as the username) and the Password parameters.

• Later: Bind a key pair or reset the password after the instance is created. For more information, see Bind an SSH key pair to an instance and Reset the logon password of an instance.

ESSD AutoPL, Enterprise SSD (ESSD), ESSD Entry, Standard SSD, and Ultra Disk are supported. The types of system disks that you can select vary based on the instance families that you select. Disk types that are not displayed in the drop-down list are not supported by the instance types that you select.

You can select More System Disk Types and select a disk type other than the current one in the System Disk section to improve the success rate of system disk creation. The system will attempt to create a system disk based on the specified disk types in sequence.

ESSD AutoPL, Enterprise SSD (ESSD), ESSD Entry, SSD, and Ultra Disk are supported. The data disk types that you can select vary based on the instance families that you select. Disk types that are not displayed in the drop-down list are not supported by the instance types that you select.

• You can select Encryption for all disk types when you specify the type of data disk. By default, the default service CMK is used to encrypt the data disk. You can also use an existing CMK generated by using BYOK in KMS.

• You can also use snapshots to create data disks in scenarios where container image acceleration and fast loading of large language models (LLMs) are required. This improves the system response speed and enhances the processing capability.

• Make sure that a data disk is mounted to /var/lib/container on each node, and /var/lib/kubelet and /var/lib/containerd are mounted to the /var/lib/container. For other data disks on the node, you can perform the initialization operation and customize their mount directories. For more information, see Can I mount a data disk to a custom directory in an ACK node pool?

You can configure the Add Data Disk Type parameter. This parameter allows you to configure a different disk type from the system disk, which increases the success rate of scaling. When creating an instance, the system selects the first matching disk type based on the specified order of disk types for the instance creation.

Add taints to nodes. A taint consists of a key, a value, and an effect. A taint key can be prefixed. If you want to specify a prefixed taint key, add a forward slash (/) between the prefix and the remaining content of the key. For more information, see Taints and tolerations. The following limits apply to taints:

• Key: A key must be 1 to 63 characters in length, and can contain letters, digits, hyphens (-), underscores (_), and periods (.). A key must start and end with a letter or digit.

  If you want to specify a prefixed key, the prefix must be a subdomain name. A subdomain name consists of DNS labels that are separated by periods (.), and cannot exceed 253 characters in length. It must end with a forward slash (/). For more information about subdomain names, see DNS subdomain names.

• Value: A value cannot exceed 63 characters in length, and can contain letters, digits, hyphens (-), underscores (_), and periods (.). A value must start and end with a letter or digit. You can also leave a value empty.

• You can specify the following effects for a taint: NoSchedule, NoExecute, and PreferNoSchedule.

  • NoSchedule: If a node has a taint whose effect is NoSchedule, the system does not schedule pods to the node.

  • NoExecute: Pods that do not tolerate this taint are evicted after this taint is added to a node. Pods that tolerate this taint are not evicted after this taint is added to a node.

  • PreferNoSchedule: The system attempts to avoid scheduling pods to nodes with taints that are not tolerated by the pods.

A custom node name consists of a prefix, an IP substring, and a suffix.

• A custom node name must be 2 to 64 characters in length. The name must start and end with a lowercase letter or digit.

• The prefix and suffix can contain letters, digits, hyphens (-), and periods (.). The prefix and suffix must start with a letter and cannot end with a hyphen (-) or period (.). The prefix and suffix cannot contain consecutive hyphens (-) or periods (.).

• The prefix is required due to ECS limits and the suffix is optional.

For example, the node IP address is 192.XX.YY.55, the prefix is aliyun.com, and the suffix is test.

• If the node is a Linux node, the node name, ECS instance name, and ECS instance hostname are aliyun.com192.XX.YY.55test.

• If the node is a Windows node, the ECS instance hostname is 192-XX-YY-55 and the node name and ECS instance name are aliyun.com192.XX.YY.55test.

Nodes automatically run user-data scripts after they are added to the cluster. For more information about user-data scripts, see User-data scripts.

For example, if you enter echo "hello world", a node runs the following script:

#!/bin/bash
[Node initialization script]
echo "hello world"

After you install CloudMonitor, you can view the monitoring information about the nodes in the CloudMonitor console.

This parameter takes effect only on newly added nodes and does not take effect on existing nodes. If you want to install the CloudMonitor agent on an existing ECS node, go to the CloudMonitor console.

Specify whether to assign an IPv4 address to each node. If you clear the check box, no public IP address is allocated. If you select the check box, you must configure the Bandwidth Billing Method and Peak Bandwidth parameters.

This parameter takes effect only on newly added nodes and does not take effect on existing nodes. If you want to enable an existing node to access the Internet, you must create an EIP and associate the EIP with the node. For more information, see Associate an EIP with an ECS instance.

Specify whether to install an Ingress controller. We recommend that you install an Ingress controller if you want to expose Services.

• Nginx Ingress: For more information about NGINX Ingresses, see Create an NGINX Ingress.

• ALB Ingress: For more information about the options for installing ALB Ingresses, see Manage the ALB Ingress controller. For more information about how to use ALB Ingresses, see Create an ALB Ingress.

• MSE Ingress: For more information about how to use MSE Ingresses to expose Services in ACK clusters, see Use MSE Ingresses to access applications in ACK clusters.