This topic provides a comprehensive overview of the configuration items required when creating an ACK managed cluster. It covers cluster configuration, node pool configuration, and component configuration. Utilize the page search feature to quickly find specific configuration item details. In the Support Modification column of the tables, denotes that modifications are not supported post-creation, while
signifies that changes are possible. Items that cannot be altered should be noted with particular care.
Cluster configuration
Basic configuration
Configuration item | Description | Support modification |
Cluster Name | The custom name of the cluster. | |
Cluster Specification | Select a cluster type. You can select Professional or Basic. We recommend that you use Container Service for Kubernetes (ACK) Pro clusters in the production environment and test environment. ACK Basic clusters can meet the learning and testing needs of individual users. For a detailed comparison, see Cluster. | Only supports migrating from Basic Edition to Pro Edition |
Region | The region of the cluster. The closer the selected region is to the user and the deployed resources, the lower the network latency and the faster the access speed. | |
Kubernetes Version | The supported Kubernetes versions. We recommend that you use the lastest version. For more information, see Kubernetes versions supported by ACK. | Supports manual cluster upgrade and automatic cluster upgrade |
Automatic Upgrade | Enable the auto update feature for the cluster to ensure periodic automatic updates of control plane components and node pools. ACK automatically updates the cluster within the maintenance window. For more information about the auto update policy and usage method, see Automatically update a cluster. | |
Cluster Maintenance Window | ACK automatically updates the cluster and performs automated O&M operations on managed node pools within the maintenance window. The operations include runtime updates and automatic fixes for CVE vulnerabilities. You can click Set to configure the detailed maintenance policies. |
Network configuration
Configuration item | Description | Support modification |
IPv6 Dual-stack | This feature is in public preview. To use it, submit an application in the Quota Center console. If you enable IPv4/IPv6 dual-stack, a dual-stack cluster is created. Important
| |
VPC | Configure the VPC of the cluster. You can specify a zone to automatically create a VPC. You can also select an existing VPC in the VPC list. | |
Configure SNAT | After you select this check box, ACK performs the following operations on the newly created or selected VPC:
If you do not select this check box, you can manually configure a NAT gateway and configure SNAT rules after creating the cluster to ensure that instances in the VPC can access the Internet. For more information, see Create and manage an Internet NAT gateway. | |
vSwitch | Select an existing vSwitch from the vSwitch list or click Create vSwitch to create a vSwitch. The control plane and the default node pool use the vSwitch that you select. We recommend that you select multiple vSwitches in different zones to ensure high availability. | |
Security Group | When VPC is set to Select Existing VPC, you can select the Select Existing Security Group option. You can select Create Basic Security Group, Create Advanced Security Group, or Select Existing Security Group.
| |
Access to API Server | Create a pay-as-you-go internal-facing Classic Load Balancer (CLB) instance for the API server to serve as the internal endpoint of the API server in the cluster. The API server provides various HTTP REST interfaces for managing resource objects (such as pods and Services), including create, read, update, delete, and watch operations. You can select or clear Expose API server with EIP. The API server provides multiple HTTP-based RESTful APIs, which can be used to create, delete, modify, query, and monitor resources such as pods and Services.
Important
| |
Network Plug-in | Flannel and Terway are supported. For more information about the comparison between Terway and Flannel, see Comparison between Terway and Flannel.
| |
Container CIDR Block | Configure this parameter only if you select Flannel as the network plug-in. The container CIDR block must not overlap with the CIDR block of the VPC, the CIDR blocks of the ACK clusters in the VPC, or the Service CIDR block. The container CIDR block cannot be modified after it is specified. For more information about how to plan CIDR blocks for a cluster, see Network planning of an ACK managed cluster. | |
Number of Pods per Node | Configure this parameter only if you select Flannel as the network plug-in. The maximum number of pods that can be stored on a single node. | |
Pod vSwitch | Configure this parameter only if you select Terway as the network plug-in. The vSwitch that is used to assign IP addresses to pods. Each pod vSwitch corresponds to a vSwitch of a worker node. The vSwitch of the pod and the vSwitch of the worker node must be in the same zone. Important We recommend that you set the subnet mask of the CIDR block of a pod vSwitch to no longer than 19 bits, but the subnet mask must not exceed 25 bits. Otherwise, the cluster network has only a limited number of IP addresses that can be allocated to the pods. As a result, the cluster may not function as expected. | |
Service CIDR | Specify the CIDR block of Services in the cluster. The Service CIDR block must not overlap with the CIDR block of the VPC, the CIDR blocks of the ACK clusters in the VPC, or the pod CIDR block. The Service CIDR block cannot be modified after it is specified. For more information about how to plan CIDR blocks for a cluster, see Network planning of an ACK managed cluster. | |
IPv6 Service CIDR Block | Configure this parameter only if you enable IPv4/IPv6 dual stack. Configure an IPv6 CIDR block for Services. You must specify a Unique Local Unicast Address (ULA) space within the address range For more information about how to plan CIDR blocks for a cluster, see Network planning of an ACK managed cluster. |
Advanced configuration
Expand Advanced Options (optional) to set the cluster service forwarding mode.
Configuration item | Description | Support modification |
Service Forwarding Mode | iptables and IP Virtual Server (IPVS) are supported.
|
Expand Advanced Options (optional) to manage cluster deletion protection, resource group, and additional settings.
Configuration item | Description | Support modification |
Deletion Protection | We recommend that you enable deletion protection in the console or by using API to prevent clusters from being accidentally released. | |
Resource Group | The resource group to which the cluster belongs. Each resource can belong to only one resource group. You can regard a resource group as a project, an application, or an organization based on your business scenarios. | |
Labels | Add a label to the cluster. Labels are used to identify cloud resources. A label is a key-value pair. | |
Time Zone | The time zone of the cluster. By default, the time zone of your browser is selected. | |
Cluster Domain | Configure the cluster domain. The default domain name is | |
Custom Certificate SANs | You can enter custom subject alternative names (SANs) for the API server certificate of the cluster to accept requests from specified IP addresses or domain names. This allows you to control access from clients. For more information, see Customize the SANs of the API server certificate when you create an ACK cluster. | |
Service Account Token Volume Projection | ACK provides service account token volume projection to reduce security risks when pods use service accounts to access the Kubernetes API server. This feature enables kubelet to request and store the token on behalf of a pod. This feature also allows you to configure token properties, such as the audience and validity period. For more information, see Use ServiceAccount token volume projection. | |
Secret Encryption | If you select Select Key for an ACK Pro cluster, you can use a key that is created in the Key Management Service (KMS) console to encrypt Kubernetes Secrets. For more information, see Use KMS to encrypt Kubernetes Secrets. | |
RRSA OIDC | You can enable the RAM Roles for Service Accounts (RRSA) feature for the cluster to implement access control on different pods that are deployed in a cluster. This implements fine-grained API permission control on pods. For more information, see Use RRSA to authorize different pods to access different cloud services. |
Node pool configuration
While certain node pool configuration items are fixed post-creation, new node pools can be established with different settings.
Basic configuration
Configuration item | Description | Support modification | |
Node Pool Name | Specify a node pool name. | ||
Container Runtime | Specify the container runtime based on the Kubernetes version. For more information about how to select a container runtime, see Comparison among Docker, containerd, and Sandboxed-Container.
| ||
Managed node pool related configuration | Managed Node Pool | Managed node pools provided by ACK support auto repair and auto CVE patching. This significantly reduces your O&M workload and improves node security. You can click Set to configure the detailed maintenance policies. | |
Self-healing Rules | This parameter is available after you select Enable for the managed node pool feature. After you select this option, ACK automatically monitors the status of nodes in the node pool. When exceptions occur on a node, ACK automatically runs auto repair tasks on the node. If you select Restart Faulty Node, ACK automatically restarts faulty nodes to resolve node exceptions. In this case, ACK may perform node draining and system disk replacement on faulty nodes. For more information about the conditions that trigger auto repair and auto repair events, see Enable auto repair for nodes. | ||
Automatic Upgrade Rules | This parameter is available after you select Enable for the managed node pool feature. After you select Automatically Update Kubelet and Containerd, the system automatically updates the kubelet when a new version is available. For more information, see Update a node pool. | ||
Automatic CVE (OS) Repair | This parameter is available after you select Enable for the managed node pool feature. You can configure ACK to automatically patch high-risk, medium-risk, and low-risk vulnerabilities. For more information, see Patch OS CVE vulnerabilities for node pools. Some patches take effect only after you restart the ECS instances. After you enable Restart Nodes if Necessary to Patch CVE Vulnerabilities, ACK automatically restarts nodes on demand. If you do not select this option, you must manually restart nodes. | ||
Maintenance Window | This parameter is available after you select Enable for the managed node pool feature. Image updates, runtime updates, and Kubernetes version updates are automatically performed during the maintenance window. Click Set. In the Maintenance Window dialog box, set the Cycle, Started At, and Duration parameters and click OK. |
Instance and image configuration
Configuration item | Description | Support modification | |
Billing Type | The default billing method used when ECS instances are scaled in a node pool. You can select Pay-As-You-Go, Subscription, or Preemptible Instance.
To ensure that all nodes in a node pool use the same billing method, ACK does not allow you to change the billing method of a node pool from pay-as-you-go or subscription to preemptible instances or from preemptible instances to pay-as-you-go or subscription. | ||
Instance-related configuration items | Select the ECS instances used by the worker node pool based on instance types or attributes. You can filter instance families by attributes such as vCPU, memory, instance family, and architecture. For more information about the instance specifications not supported by ACK and how to configure nodes, see ECS specification recommendations for ACK clusters. When the node pool is scaled out, ECS instances of the selected instance types are created. The scaling policy of the node pool determines which instance types are used to create new nodes during scale-out activities. Select multiple instance types to improve the success rate of node pool scale-out operations. If the node pool fails to be scaled out because the instance types are unavailable or the instances are out of stock, you can specify more instance types for the node pool. The ACK console automatically evaluates the scalability of the node pool. You can check the scalability of the node pool when you create the node pool or after you create the node pool. If you select only GPU-accelerated instances, you can select Enable GPU Sharing on demand. For more information, see cGPU overview. | ||
Operating System | Alibaba Cloud Marketplace images is in canary release.
Note For more information about how to upgrade or change the operating system, see Change the operating system. After you change the OS image of the node pool, the change takes effect only on newly added node. The existing nodes in the node pool still use the original OS image. | ||
Security Hardening | Enable security hardening for the cluster. You cannot modify this parameter after the cluster is created.
| ||
Logon Type | If you select MLPS Security Hardening, only the Password option is supported. When Operating System is set to ContainerOS, the valid values are Key Pair and Later. Valid values: Key Pair, Password, and Later.
|
Storage configuration
Configuration item | Description | Support modification | |
System Disk | ESSD AutoPL, Enterprise SSD (ESSD), ESSD Entry, Standard SSD, and Ultra Disk are supported. The types of system disks that you can select vary based on the instance families that you select. Disk types that are not displayed in the drop-down list are not supported by the instance types that you select. You can select More System Disk Types and select a disk type other than the current one in the System Disk section to improve the success rate of system disk creation. The system will attempt to create a system disk based on the specified disk types in sequence. | ||
Data Disk | ESSD AutoPL, Enterprise SSD (ESSD), ESSD Entry, SSD, and Ultra Disk are supported. The data disk types that you can select vary based on the instance families that you select. Disk types that are not displayed in the drop-down list are not supported by the instance types that you select.
Note Up to 64 data disks can be attached to an ECS instance. The number of disks that can be attached to an ECS instance varies based on the instance type. To query the maximum number of data disks supported by each instance type, call the DescribeInstanceTypes operation and query the DiskQuantity parameter in the response. You can configure the Add Data Disk Type parameter. This parameter allows you to configure a different disk type from the system disk, which increases the success rate of scaling. When creating an instance, the system selects the first matching disk type based on the specified order of disk types for the instance creation. |
Instance quantity configuration
Configuration item | Description | Support modification |
Expected Number Of Nodes | The expected number of nodes in the node pool. We recommend that you configure at least two nodes to ensure that cluster components run as expected. You can configure the Expected Nodes parameter to adjust the number of nodes in the node pool. For more information, see Scale a node pool. If you do not want to create nodes in the node pool, set this parameter to 0. You can manually modify this parameter to add nodes later. |
Advanced configuration of the node pool
Expand Advanced Options (optional) to configure scaling policies, ECS tags, taints, and more.
Configuration item | Description | Support modification |
Scaling Policy |
| |
Use Pay-as-you-go Instances When Preemptible Instances Are Insufficient | You must set the Billing Method parameter to Preemptible Instance. After this feature is enabled, if enough preemptible instances cannot be created due to price or inventory constraints, ACK automatically creates pay-as-you-go instances to meet the required number of ECS instances. | |
Enable Supplemental Preemptible Instances | You must set the Billing Method parameter to Preemptible Instance. After this feature is enabled, when a system receives a message that preemptible instances are reclaimed, the node pool with auto scaling enabled attempts to create new instances to replace the reclaimed preemptible ones. | |
ECS Tags | Add tags to the ECS instances that are automatically added during auto scaling. An ECS instance can have up to 20 tags. To increase the quota limit, submit an application in the Quota Center console. The following tags are automatically added to an ECS node by ACK and Auto Scaling. Therefore, you can add at most 17 tags to an ECS node.
Note
| |
Taints | Add taints to nodes. A taint consists of a key, a value, and an effect. A taint key can be prefixed. If you want to specify a prefixed taint key, add a forward slash (/) between the prefix and the remaining content of the key. For more information, see Taints and tolerations. The following limits apply to taints:
| |
Node Labels | Add labels to nodes. A label is a key-value pair. A label key can be prefixed. If you want to specify a prefixed label key, add a forward slash (/) between the prefix and the remaining content of the key. The following limits apply to labels:
| |
Set to Unschedulable | After you select this option, new nodes added to the cluster are set to unschedulable. You can change the status in the node list. This setting takes effect only on nodes newly added to the node pool. It does not take effect on existing nodes. | |
Container Image Acceleration | Only clusters that use containerd versions 1.6.34 and later support this configuration. After you select this option, new nodes automatically detect whether container images support on-demand loading. If supported, container startups will be accelerated by using on-demand loading. | |
[Deprecated] CPU Policy | The CPU management policy for kubelet nodes. We recommend customizing the kubelet parameters of a node pool instead. | |
Custom Node Name | Specify whether to use a custom node name. If you choose to use a custom node name, the name of the node, name of the ECS instance, and hostname of the ECS instance are changed. Note If a Windows instance uses a custom node name, the hostname of the instance is fixed to an IP address. You need to use hyphens ( A custom node name consists of a prefix, an IP substring, and a suffix.
For example, the node IP address is 192.XX.YY.55, the prefix is aliyun.com, and the suffix is test.
| |
Worker RAM Role | ACK managed clusters that run Kubernetes 1.22 or later are supported. You can assign a worker Resource Access Management (RAM) role to a node pool to reduce the potential risk of sharing a worker RAM role among all nodes in the cluster.
| |
Instance Pre-customized Data | To use this feature, submit an application in the Quota Center console. Nodes automatically run predefined scripts before they are added to the cluster. For more information about user-data scripts, see User-data scripts. For example, if you enter
| |
User Data | Nodes automatically run user-data scripts after they are added to the cluster. For more information about user-data scripts, see User-data scripts. For example, if you enter
Note After you create a cluster or add nodes, the execution of the user-data script on a node may fail. We recommend that you log on to a node and run the | |
CloudMonitor Agent | After you install CloudMonitor, you can view the monitoring information about the nodes in the CloudMonitor console. This parameter takes effect only on newly added nodes and does not take effect on existing nodes. If you want to install the CloudMonitor agent on an existing ECS node, go to the CloudMonitor console. | |
Public IP | Specify whether to assign an IPv4 address to each node. If you clear the check box, no public IP address is allocated. If you select the check box, you must configure the Bandwidth Billing Method and Peak Bandwidth parameters. This parameter takes effect only on newly added nodes and does not take effect on existing nodes. If you want to enable an existing node to access the Internet, you must create an EIP and associate the EIP with the node. For more information, see Associate an EIP with an ECS instance. | |
Custom Security Group | You can select Basic Security Group or Advanced Security Group, but you can select only one security group type. You cannot modify the security groups of node pools or change the type of security group. For more information about security groups, see Overview. Important
| |
RDS Whitelist | Add node IP addresses to the whitelist of an ApsaraDB RDS instance. | |
Private Pool Type | Valid values: Open, Do Not Use, and Specified.
For more information, see Private pools. |
Component configuration
By default, ACK pre-installs certain components based on best practices. These can be reviewed, confirmed, or managed through installation, uninstallation, and upgrades post-cluster creation. For more information, see Manage Components.
Basic configuration
Configuration item | Description |
Ingress | Specify whether to install an Ingress controller. We recommend that you install an Ingress controller if you want to expose Services.
|
Service Discovery | NodeLocal DNSCache runs a DNS caching agent to improve the performance and stability of DNS resolution. |
Volume Plug-in | By default, CSI is installed as the volume plug-in. Dynamically Provision Volumes by Using Default NAS File Systems and CNFS, Enable NAS Recycle Bin, and Support Fast Data Restore is selected by default. ACK supports Alibaba Cloud disks, File Storage NAS (NAS) file systems, and Object Storage Service (OSS) buckets. |
Monitor containers | You can select Enable Managed Service for Prometheus to provide basic monitoring and alerting services for the ACK cluster.
|
Cost Suite | Monitors and analyzes the costs and resource usage of the ACK cluster, namespaces, node pools, and workloads. Suggestions on cost savings are provided to improve the overall resource utilization. For more information, see Cost insights. |
Log Service | You can select an existing Simple Log Service (SLS) project or create a project to collect cluster logs. For more information about how to quickly configure SLS when you create an application, see Collect log data from containers by using Simple Log Service.
|
Alerts | Enable the alert management feature. You can specify contacts and contact groups. The default is Default Contact Group. |
Log Collection for Control Plane Components | For more information about how to collect the logs of the control plane components to your projects in SLS, see Collect logs of control plane components in ACK managed clusters. |
Cluster Inspection | Specify whether to enable the cluster inspection feature for intelligent O&M. You can enable this feature to periodically check the resource quotas, resource usage, and component versions of a cluster and identify potential risks in the cluster. |
Advanced configuration
Expand Advanced Options (optional) to select additional components such as application management, log monitoring, storage, network, and security for installation.