DocsICP FilingConsole
Documentation
Home Page Container Service for Kubernetes ACK Edge Clusters User Guide Cluster management Create a cluster

Create an ACK Edge cluster

Updated at:
Copy as MD
Product
My Favorites

This topic explains how to create an ACK Edge cluster in the console to achieve integrated cloud-edge collaborative management.ACK Edge cluster in the console.

Prerequisites

Limits

Item

Limit

Links for increasing quota limits/references

Costs

Your account must have a balance of at least CNY 100 and have completed real-name verification. Otherwise, you cannot create pay-as-you-go ECS instances and SLB instances.

Billing overview

Networks

ACK clusters support only VPCs.

What is VPC

Cloud resources

ECS

The pay-as-you-go and subscription billing methods are supported. After an ECS instance is created, you can change its billing method from pay-as-you-go to subscription in the ECS console.

Change the billing method of an ECS instance from pay-as-you-go to subscription

VPC route entries

By default, you can add at most 200 route entries to the VPC of an ACK cluster that runs Flannel. VPCs of ACK clusters that run Terway do not have this limit. If you want to add more route entries to the VPC of your ACK cluster, request a quota increase for the VPC.

Quota Center

Security groups

By default, you can create at most 100 security groups with each account.

Security groups

SLB instances

By default, you can create at most 60 pay-as-you-go SLB instances with each account.

Quota Center

EIP

By default, you can create at most 20 EIPs with each account.

Quota Center

Step 1: Log on to the console

  1. Log on to the ACK console. In the left navigation pane, click Clusters.

  2. At the top left of the page, select the resource group and region of the target resource. image

  3. On the Clusters page, click Create Kubernetes Cluster.

  4. On the Create Kubernetes Cluster page, click the ACK Edge tab.

Step 2: Configure the cluster

On the ACK Edge Cluster page, configure cluster settings.

Basic settings

Parameter

Description

Cluster Name

Enter a custom name for the cluster.

Cluster Specification

  • Basic Edition: Has a limited quota (each account can create two clusters). For personal learning and testing only.

  • Pro Edition: Provides a Service-Level Agreement (SLA) and is suitable for enterprise production and staging environments.

For a comparison of the two editions, see Cluster management.

Region

The region where the cluster resources, such as ECS instances and cloud disks, are located. The closer the region is to your users and resource deployment region, the lower the network latency.

Kubernetes Version

You can only create clusters with the three most recent minor versions. We recommend using the latest version. For more information about the versions supported by ACK, see ACK version support overview.

Maintenance Window

ACK performs automated O&M operations on managed node pools, such as automatic OS CVE vulnerability fixes, during the maintenance window. You can click Set to configure the specific maintenance policy.

Network settings

VPC

The virtual private cloud (VPC) for the cluster. For high availability, select two or more different zones.

  • Automatic creation: ACK creates a corresponding vSwitch in each selected zone.

  • Use existing: Select a vSwitch to specify the zone for the cluster. You can create a new vSwitch or use an existing one.

We recommend using standard private CIDR blocks for the cluster VPC, such as 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. If you have special requirements, go to Quota Center to apply for permission to use a public CIDR block to create a cluster.

Cloud resources and billing: imageVPC

Configure SNAT for VPC

Do not select this option when using a shared VPC

Select this option if nodes need to access the public network (for example, to pull public images or access external services). ACK will automatically configure a NAT Gateway and SNAT rules to ensure that resources within the cluster can access the public network.

  • If the VPC does not have a NAT Gateway: ACK automatically creates a NAT Gateway, purchases a new EIP, and configures an SNAT rule for the vSwitch used by the cluster.

  • If the VPC already has a NAT Gateway: ACK determines whether to purchase an additional EIP and configure an SNAT rule. If no EIP is available, a new one is automatically purchased. If no VPC-level SNAT rule exists, an SNAT rule is configured for the vSwitch used by the cluster.

If you do not select this option, you can configure the NAT Gateway and SNAT rules yourself after creating the cluster. For more information, see Public NAT Gateway.

Cloud resources and billing: imageNAT Gateway, imageEIP

vSwitch

Select an existing vSwitch from the list based on the zone, or click Create vSwitch to create a new one. The cluster control plane and the default node pool will use the vSwitch specified here. We recommend selecting vSwitches in multiple different zones to ensure high availability for the cluster.

Security Group

When using an existing VPC, you can choose to Select Existing Security Group

This security group is applied to the cluster control plane, the default node pool, and any node pools that do not have a custom security group specified.

Compared to basic security groups, advanced security groups can contain more private IP addresses but do not support intra-group connectivity. For more information, see Security group classification.

  • Automatic creation: All outbound traffic is allowed by default. Inbound traffic is allowed based on the recommended configuration. If you modify the rules later, ensure that the 100.64.0.0/10 CIDR block is allowed for inbound traffic.

    This CIDR block is used to access other Alibaba Cloud services for operations such as pulling images and querying basic ECS information.

  • Use existing: ACK does not configure additional access rules for the security group by default. You must manage the security group rules yourself to avoid access issues. For more information, see Configure cluster security groups.

Access to API Server

ACK automatically creates a pay-as-you-go private-facing Classic Load Balancer (CLB) instance as the internal endpoint for the API Server. This CLB instance cannot be reused or deleted. If deleted, the API Server will become inaccessible and cannot be recovered.

To use an existing CLB instance, submit a ticket. After you select Use Existing Gateway for VPC, you can set SLB Source to Use Existing Gateway.

You can choose to enable Expose API server with EIP.

  • Open: Binds an EIP to the API Server's private-facing CLB instance, allowing you to access and manage the cluster from the public network.

    This does not mean that resources within the cluster can access the public network. To allow cluster resources to access the public network, you must select Configure SNAT for VPC.

  • Not open: You can only connect to and operate the cluster using the kubeconfig file from within the VPC.

To enable this later, see Access the API server over the internet.
Starting from December 1, 2024, new CLB instances will no longer support the Subscription billing method and will incur an instance fee. For more information, see [Service Notice] Announcement on Discontinuing Subscription Billing for New Cluster API Server CLB Instances and Billing item adjustment for Classic Load Balancer (CLB).

Cloud resources and billing: imageCLB, imageEIP

Warning

  • Edge nodes communicate with the cloud API server over the internet and require an EIP. Select Expose API server with EIP. If not selected during creation, bind an EIP to the API server later. See Access the API server of an ACK cluster from the internet.

  • ACK Edge clusters do not support changing or unbinding an EIP.

Network Plug-in

Select and configure a network plug-in. Flannel and Terway-edge are supported. See Network management and How to choose a network plug-in.

  • Flannel: A stable CNI plug-in that uses VXLAN overlay networking. Based on the open-source Flannel project.

  • Terway-edge: A network plug-in developed by Alibaba Cloud Container Service.

    • In the cloud: assigns Alibaba Cloud elastic network interfaces to containers.

    • On the edge: assigns container IP addresses from a pre-configured CIDR block and forwards traffic using host routes.

Pod vSwitch

Required only for Terway-edge. Specify vSwitches for assigning pod IP addresses in the cloud node pool. Each Pod vSwitch must be in the same zone as the corresponding worker node vSwitch.

Edge Container CIDR Block

The IP address pool for containers.

  • With Flannel, both cloud and edge containers are assigned IP addresses from this CIDR block.

  • With Terway-edge, only edge containers are assigned IP addresses from this CIDR block.

Number of Pods per Node

Defines the maximum number of pods that a single node can accommodate.

Service CIDR

Also known as Service CIDR. This is the address pool that assigns IP addresses to services within the cluster. This CIDR block cannot overlap with the VPC's CIDR block, the CIDR blocks used by existing clusters in the VPC, or the Container CIDR Block.

Advanced settings

Click Advanced Options (Optional) to configure the service forwarding mode.

Parameter

Description

Forwarding Mode

Select the kube-proxy proxy mode, which determines how cluster services distribute requests to backend pods.

  • iptables: Uses Linux firewall rules for traffic forwarding. It is stable but has limited performance. As the number of services increases, the number of firewall rules grows, slowing down request processing. Suitable for clusters with a small number of services.

  • IPVS: A high-performance traffic distribution solution. It uses a hash table to quickly locate target pods, resulting in lower latency when handling many service requests. Suitable for large-scale production clusters or scenarios with high network performance requirements.

    Starting from Kubernetes 1.35, the ipvs mode of kube-proxy is marked as deprecated and is planned to be removed in a future version.

  • nftables: A modern replacement for iptables that provides a more efficient rule model. Its near-O(1) rule mapping lookup makes data plane latency independent of cluster size. Control plane updates use incremental synchronization, optimizing the efficiency of rule changes. As the mainstream development direction for the Linux kernel networking framework, it is the recommended mode by the kube-proxy community. Suitable for medium to large-scale clusters or scenarios that require better performance and maintainability than iptables.

    When using the nftables service forwarding mode, the Linux kernel version of the nodes in the cluster must be 5.13 or later. Otherwise, nodes will fail to be added.

Click Advanced Options (Optional) for more settings.

Expand to view advanced settings

Parameter

Description

Cluster Deletion Protection

We recommend enabling this feature to prevent accidental deletion of the cluster through the console or OpenAPI.

Resource Group

Assign the cluster to the selected resource group for easier permission management and cost allocation.

A resource can belong to only one resource group.

Label

Bind key-value tags to the cluster to identify cloud resources.

Secret Encryption

Select Select Key to encrypt Kubernetes Secrets with an Alibaba Cloud KMS key. See Encrypt Secrets at rest by using Alibaba Cloud KMS.

RRSA OIDC

The cluster will create an OpenID Connect (OIDC) Provider. Using the temporary OIDC token of its ServiceAccount, application pods can call the Alibaba Cloud RAM service and assume a specified RAM role. This allows them to securely obtain temporary authorization to access cloud resources, achieving pod-level least-privilege management.

To enable this later, see Use RRSA to configure RAM permissions for a ServiceAccount and achieve pod-level permission isolation.

Step 3: Configure cloud node pool

Important

The cloud node pool requires at least two worker nodes for control plane components.

Basic node pool settings

Parameter

Description

Node Pool Name

Enter a custom name for the node pool.

Container Runtime

Select a Container Runtime based on the Kubernetes Version.

  • containerd (recommended): supports all cluster versions.

  • docker: supports Kubernetes 1.22 and earlier versions.

Managed node pool settings

Managed Node Pool

Enable managed node pools to use the automated O&M capabilities provided by ACK.

If your business is sensitive to changes in underlying nodes and cannot tolerate node restarts or application pod migrations, we do not recommend enabling this feature.
To enable this later, you can edit the node pool to enable it.

Auto Repair

ACK automatically monitors node status and performs self-recovery tasks when a node becomes abnormal. If you select Restart Faulty Node, the self-recovery process may involve operations such as draining the node and replacing disks. For information on trigger conditions and related events, see Enable node self-recovery.

Auto Update Rule

When a new kubelet version is available, ACK automatically performs an upgrade. For more information, see Upgrade a node pool.

Auto CVE Patching

Fix OS CVE vulnerabilities in the node pool. You can configure the security vulnerability fix level.

Cloud resources and billing: imageSecurity Center

Maintenance Window

ACK performs automated O&M operations on managed node pools only during the defined maintenance window.

Instance and image settings

Parameter

Description

Billing Method

The default billing method for nodes scaled out by the node pool.

  • Pay-As-You-Go: Can be enabled and released on demand.

  • Subscription: Requires configuring the Duration and Auto Renewal.

  • Preemptible Instance: Currently only supports spot instances with a protection period. You must also configure the Instance Price Cap.

    When the real-time price of the specified instance type is lower than the maximum bid for a single instance, the instance will be created successfully. After the protection period (1 hour), the system checks the real-time price and inventory of the instance type every 5 minutes. If the market price is higher than your bid or the inventory is insufficient, the spot instance will be released. For usage recommendations, see Best practices for spot instance node pools.

To ensure node pool uniformity, you cannot change a Pay-As-You-Go or Subscription node pool to a Preemptible Instance node pool, or vice versa.

Instance settings

When a node pool scales out, it allocates instances from the configured ECS instance family. To improve the success rate of scale-outs, select multiple instance types across multiple zones to avoid unavailability or stock shortages. The specific instance type for scale-out is determined by the configured Scaling Policy.

To ensure business stability and accurate resource scheduling, do not mix GPU and non-GPU instance types in the same node pool.

You can configure the instance types used for scale-out in the following two ways:

  • Specific types: Specify instance types based on dimensions such as vCPU, memory, instance family, and CPU architecture (the instance's CPU architecture must be consistent with the OS image architecture).

    When using Terway, you can view the maximum number of pods per node for the target instance type in the instance type list.

  • Generalization configuration: Select a list of instance types to use or exclude based on attributes (such as vCPU and memory) to further improve the scale-out success rate.

You can refer to the elasticity strength recommendations in the console or view the node pool elasticity strength after the node pool is created.

For information about unsupported instance types and node configuration recommendations, see ECS instance type configuration recommendations.

Cloud resources and billing: imageECS Instance, imageGPU-accelerated Instance

Note

Enhanced features of ACK Edge clusters, such as logging, monitoring, and reverse tunneling, require cloud-deployed components. Create at least one ECS worker node.

Operating System

Marketplace Image is in phased release.
To upgrade or change the OS later, see Change the operating system.

Security Hardening

When creating a node, ACK applies the selected security baseline policy.

  • Disable: No security hardening is performed on the ECS instance.

  • MLPS Security Hardening: Alibaba Cloud provides baseline check standards and scanning tools for the Alibaba Cloud Linux MLPS 2.0 Level 3 edition image that meet classified protection compliance requirements. While ensuring native image compatibility and performance, it has been adapted for MLPS 2.0 compliance, meeting the requirements of GB/T 22239-2019 Information Security Technology - Basic Requirements for Classified Protection of Cybersecurity. For more information, see Instructions for using ACK MLPS 2.0 security hardening.

    However, in this mode, the root user cannot log on remotely via SSH. You can connect to the instance via VNC in the ECS console and create a regular user that supports SSH logon.

  • OS Security Hardening: Only supports Alibaba Cloud Linux 2 or Alibaba Cloud Linux 3.

Logon Type

  • Key Pair: Alibaba Cloud SSH key pairs are a secure and convenient logon authentication method, consisting of a public key and a private key. They are only supported for Linux instances.

    Configure both the Username (root or ecs-user) and the required Key Pair.

  • Password: Configure the Username (root or ecs-user) and a password.

Storage settings

Parameter

Description

System Disk

Select a cloud disk type based on your business needs, including ESSD AutoPL, enterprise SSD (ESSD), ESSD Entry, and previous-generation cloud disks (standard SSD and ultra disk). Configure the capacity and IOPS.

The available system disk types depend on the selected instance family. Disk types that are not displayed are not supported.

Custom performance and encryption for ESSDs

  • You can customize the performance level (PL). The larger the disk capacity, the higher the PL you can select (PL2 is available for capacities of 460 GiB or more, and PL3 for 1260 GiB or more). For more information, see ESSDs.

  • Among system disks, only ESSDs support Encrypted. When you select a key, Alibaba Cloud uses the default service key (Default Service CMK) for encryption. You can also select a custom key (Bring-Your-Own-Key, or BYOK) that you have created in KMS.

You can select More Disk Categories to configure disk types different from the System Disk to improve the success rate of scale-outs. When creating a node, ACK selects the first matching type in the specified order of disk types.

Cloud resources and billing: imageECS Elastic Block Storage

Data Disk

Select a cloud disk type based on your business needs, including ESSD AutoPL, enterprise SSD (ESSD), ESSD Entry, and previous-generation cloud disks (standard SSD and ultra disk). Configure the capacity and IOPS.

The available data disk types depend on the selected instance family. Disk types that are not displayed are not supported.

ESSD AutoPL support

  • Provisioned performance: You can flexibly configure the provisioned performance of the cloud disk without changing its storage capacity, decoupling disk capacity from performance.

  • Performance burst: When your business faces sudden data read/write pressure, the cloud disk temporarily increases its performance to handle peak demand until the business stabilizes.

ESSD support

You can customize the performance level (PL). The larger the disk capacity, the higher the PL you can select (PL2 is available for capacities of 460 GiB or more, and PL3 for 1260 GiB or more). For more information, see ESSDs.

  • When you attach a data disk, all cloud disk types support Encrypted. When you select a key, Alibaba Cloud uses the default service key (Default Service CMK) for encryption. You can also select a custom key (Bring-Your-Own-Key, or BYOK) that you have created in KMS.

  • During node creation, the last data disk is automatically formatted, and /var/lib/container is mounted to it. /var/lib/kubelet and /var/lib/containerd are mounted to /var/lib/container.

    To customize the mount directory, adjust the data disk's initialization configuration. You can select at most one data disk as the directory for the container runtime. For more information, see Can I customize the mount directory for data disks in an ACK node pool?

  • In scenarios that require container image acceleration or rapid loading of large models, you can also create data disks from snapshots to improve system response speed and processing capabilities.

You can select Add Data Disk Type to configure disk types different from the Data Disk to improve the success rate of scale-outs. When creating a node, ACK selects the first matching type in the specified order of disk types.

An ECS instance can have up to 64 data disks attached. The specific limit varies by instance type. You can call the DescribeInstanceTypes operation to query the cloud disk quantity limit (DiskQuantity) for the corresponding instance type.

Cloud resources and billing: imageECS Elastic Block Storage

Elastic Ephemeral Disk

This is a whitelisted feature. Submit a ticket to apply

Elastic ephemeral disks provide high-performance, cost-effective temporary data storage for ECS instances. They are suitable for storing temporary data (such as intermediate results of temporary computations, cached data, and temporary files) and for high-performance computing (HPC) scenarios with high IOPS and throughput requirements.

This feature is only available in some regions and for some ECS instance types. For more information, see Region limits and Instance type limits.

You can choose whether to initialize the elastic ephemeral disk and customize its mount directory.

Cloud resources and billing: imageECS Elastic Block Storage

Instance quantity

Parameter

Description

Expected Number of Nodes

Total node count the node pool maintains. Adjust to scale in or out. At least two cloud nodes are recommended.

Advanced node pool settings

Expand Advanced Options (Optional) to configure the node scaling policy.

Parameter

Description

Scaling Policy

Configure how the node pool selects instances during node scaling.

  • Priority-based Policy: Scales based on the priority of the vSwitches configured for the cluster (vSwitch priority decreases from top to bottom). If an instance cannot be created in the zone of a higher-priority vSwitch, the next-priority vSwitch is automatically used.

  • Cost Optimization: Scales based on the vCPU unit price from low to high.

    If the node pool uses Preemptible Instance, spot instances are prioritized. You can also configure the Percentage of On-Demand Instances (%). If spot instance types cannot be created due to inventory or other reasons, pay-as-you-go instances are automatically used as a supplement.

  • Distribution Balancing: Distributes ECS instances evenly across multiple zones, but only in multi-zone scenarios. If the distribution becomes unbalanced due to insufficient inventory or other reasons, you can perform a rebalancing operation.

Use Pay-as-you-go Instances When Spot Instances Are Insufficient

This requires the billing method to be set to Spot Instance.

When enabled, if not enough spot instances can be created due to price, inventory, or other reasons, ACK will automatically try to create on-demand instances as a supplement.

Cloud resources and billing: imageECS Instance

Enable Supplemental Spot Instance

This requires the billing method to be set to Spot Instance.

When enabled, upon receiving a system message that a spot instance is about to be reclaimed (5 minutes before reclamation), ACK will attempt to scale out a new instance as compensation.

  • Compensation successful: ACK drains the old node and removes it from the cluster.

  • Compensation failed: ACK does not drain the old node. The instance will still be reclaimed and released after 5 minutes. When inventory is restored or price conditions are met, ACK will automatically purchase an instance to maintain the desired number of nodes. For more information, see Best practices for spot instance node pools.

The proactive release of spot instances can cause business disruptions. To improve the compensation success rate, we recommend also enabling Use Pay-as-you-go Instances When Spot Instances Are Insufficient.

Cloud resources and billing: imageECS Instance

Expand Advanced Options (Optional) to configure ECS tags, taints, and other settings.

View advanced options

Parameter

Description

ECS Tags

Add tags to the ECS instances automatically created by ACK to identify cloud resources. Each ECS instance can be bound with up to 20 tags. To increase this limit, submit a request on the Quota Center platform. Because ACK and Auto Scaling (ESS) occupy some tags, you can specify up to 17 custom tags for an instance.

Expand to see tag usage details

  • ACK occupies two ECS tags by default.

    • ack.aliyun.com:<your_cluster_id>

    • ack.alibabacloud.com/nodepool-id:<your_nodepool_id>

  • ESS occupies one ECS tag by default: acs:autoscaling:scalingGroupId:<your_nodepool_scaling_group_id>.

  • After enabling node autoscaling, Auto Scaling will occupy two additional ECS tags by default, so the node pool will occupy two more ECS tags: k8s.io/cluster-autoscaler:true and k8s.aliyun.com:true.

  • After enabling node autoscaling, the component records the node's labels and taints through ECS tags to pre-check the scheduling behavior of scaled-out nodes.

    • Each label of the node is converted to k8s.io/cluster-autoscaler/node-template/label/<label_key>:<label_value>.

    • Each taint of the node is converted to k8s.io/cluster-autoscaler/node-template/taint/<taint_key>/<taint_value>:<taint_effect>.

Taints

Add key-value taints to the node. A valid taint key consists of an optional prefix and a name. If a prefix is present, it is separated from the name by a forward slash (/).

Expand to see detailed instructions

  • Key: The name must be 1 to 63 characters long, start and end with an alphanumeric character [a-z0-9A-Z], and can contain letters, numbers, hyphens (-), underscores (_), and periods (.).

    If you specify a prefix, it must be a DNS subdomain, which is a series of DNS labels separated by periods (.), not exceeding 253 characters, and ending with a forward slash (/).

  • Value: The taint value can be empty, up to 63 characters long, must start and end with an alphanumeric character [a-z0-9A-Z], and can contain letters, numbers, hyphens (-), underscores (_), and periods (.).

  • Effect:

    • NoSchedule: No new pods that do not tolerate this taint will be scheduled to the node, but running pods are not affected.

    • NoExecute: Not only will no new pods that do not tolerate this taint be scheduled to the node, but any running pods on the node that do not tolerate this taint will be evicted.

    • PreferNoSchedule: ACK will try to avoid scheduling pods to nodes with taints they do not tolerate, but it is not enforced.

Node Labels

Add key-value labels to the node. A valid Key consists of an optional prefix and a name. If a prefix is present, the prefix and name are separated by a forward slash (/).

Expand to see detailed instructions

  • Key: The name must be 1 to 63 characters long, start and end with an alphanumeric character [a-z0-9A-Z], and can contain letters, numbers, hyphens (-), underscores (_), and periods (.).

    If you specify a prefix, it must be a DNS subdomain, which is a series of DNS labels separated by periods (.), not exceeding 253 characters, and ending with a forward slash (/).

    The following prefixes are reserved by Kubernetes core components and cannot be specified

    • kubernetes.io/

    • k8s.io/

    • prefixes ending with kubernetes.io/ and k8s.io/. For example, test.kubernetes.io/.

      The following are exceptions:

      • kubelet.kubernetes.io/

      • node.kubernetes.io

      • prefixes ending with kubelet.kubernetes.io/.

      • prefixes ending with node.kubernetes.io.

  • Value: Can be empty, up to 63 characters long, must start and end with an alphanumeric character [a-z0-9A-Z], and can contain letters, numbers, hyphens (-), underscores (_), and periods (.).

Set to Unschedulable

Newly added nodes will be set as unschedulable by default when they are registered with the cluster. You need to manually adjust the node scheduling status in the node list.

This configuration only takes effect for clusters of versions earlier than 1.34. For more information, see Kubernetes 1.34 version guide.

CPU Policy

Specify the kubelet's CPU management policy for the node.

  • None: The default policy.

  • Static: Allows pods with certain resource characteristics on the node to be granted enhanced CPU affinity and exclusivity.

We recommend using custom kubelet configurations for node pools.

Custom Node Name

By default, node names are automatically generated. If you need a unified naming convention for easier node management and O&M identification, you can enable this configuration. When enabled, the node name, ECS instance name, and hostname will all change.

Method 3 is only applicable to Lingjun node pools, and Lingjun node pools only support Method 3.

Method 1: Full IP address + prefix/suffix

  • Description: The node name consists of a prefix, the node's IP address, and a suffix. When enabled, the node name, ECS instance name, and ECS instance hostname will also change.

  • Example: The node's IP address is 192.XX.YY.55, the specified prefix is aliyun.com, and the suffix is test.

    • Linux node: The node name, ECS instance name, and ECS instance hostname are all aliyun.com192.XX.YY.55test.

    • Windows node: Its hostname is fixed to the IP address, using - to replace the . in the IP address, and does not include the prefix and suffix.

      Therefore, the ECS instance hostname is 192-XX-YY-55, and the node name and ECS instance name are both aliyun.com192.XX.YY.55test.

Method 2: Specified number of IP address digits + prefix/suffix

Whitelisting

  • Description: The node name consists of a prefix, a specified number of digits from the node's IP address, and a suffix. When enabled, the node name, ECS instance name, and ECS instance hostname will change accordingly.

  • Example: The node's IP address is 192.XX.YY.55, the prefix is aliyun.com, the suffix is test, and the number of IP address digits to truncate is 6. The resulting node name is aliyun.com0YY055test.

    Important

    When the custom node name format depends on truncating part of the IP address, if the VPC CIDR block is large and the number of truncated IP digits (lenOfIP) is insufficient, it may cause node name conflicts, leading to node scale-out failures in node instant scaling scenarios.

    Set the number of IP address digits to truncate based on the following recommendations for your VPC CIDR block:

    • For large-scale CIDR blocks such as 10.0.0.0/8 and 172.16.0.0/12, we recommend setting lenOfIP to at least 9.

    • For the 192.168.0.0/16 CIDR block, we recommend setting lenOfIP to at least 6.

Method 3: Sync instance hostname (only supported for Lingjun node pools)

Whitelisted feature, not applicable to non-Lingjun node pools

  • Description: Directly syncs the hostname of a Lingjun node to its NodeName.

  • Example: If the instance hostname is test, the node's NodeName will be test.

Method 4: Incremental ID + prefix/suffix (only supported for ECS node pools)

Whitelist Feature. After enabling this method, you cannot enable node scaling (i.e., Scaling Mode set to Auto) at the same time. Node pools with autoscaling already enabled cannot be switched to this method.

  • Description: The node name consists of a prefix, an incremental ID, and a suffix, in the format auto_increment,name_prefix(AUTO_INCREMENT)[begin_number,bits]name_suffix (no space between [begin_number,bits]). The parameters are described below. For more information about the rules, see Fixed increment sorting.

    • beginNumber: The starting number, with a value range of [0, 999999]. The specified starting value takes effect on the first scale-out. If not set, it defaults to 0. For subsequent scale-outs, the starting value increments from the maximum existing number in the scaling group.

    • bits: The number of digits for the number, with a value range of [1, 6]. If the number of digits in beginNumber exceeds the value of bits, bits defaults to 6. If beginNumber or bits is not set, they default to 0 and 6, respectively. We recommend setting bits to at least 3 to avoid reaching the numbering limit. If the limit is reached and you still need to scale out, the scale-out will fail and stop. You will need to reset the naming rule.

    The system increments sequentially by default. However, if a scaled-out ECS instance fails to start, it will be removed and a new one will be scaled out, which may result in non-consecutive numbers.

  • Example: The naming format is auto_increment,start(AUTO_INCREMENT)[1,3]end, beginNumber is 1, and bits is 3. The node names are generated in sequence:

    • 1st instance: start001end

    • 2nd instance: start002end

    • ...

Pre-defined Custom Data

Before a node joins the cluster, the specified pre-customization User-Data script will be run.

For example, if you specify the pre-customization data as touch /tmp/pre-script, the combined script on the node will be executed in the following order.

#!/bin/bash
# The input instance pre-customization data is executed here
touch /tmp/pre-script

# The ACK node initialization script is executed here
For information on how this configuration takes effect during node initialization, see Node initialization process overview.

User Data

After a node joins the cluster, the specified instance User-Data script will be run.

For example, if you specify the instance user data as touch /tmp/post-script, the combined script on the node will be executed in the following order.

#!/bin/bash
# The ACK node initialization script is executed here

# The input instance user data is executed here
touch /tmp/post-script
For information on how this configuration takes effect during node initialization, see Node initialization process overview.
Successful cluster creation or node scale-out does not guarantee that the instance user data script executed successfully. You can log on to the node and run grep cloud-init /var/log/messages to view the execution logs.

CloudMonitor Agent

You can view and monitor the running status of nodes and applications in the Cloud Monitor console.

This configuration only applies to new nodes in the node pool, not existing ones.

To enable it for existing nodes, install it through the Cloud Monitor console.

Cloud resources and billing: imageCloud Monitor

Public IP

ACK will assign an IPv4 public IP address to the node.

This configuration only applies to new nodes in the node pool, not existing ones. If existing nodes need to access the public network, you need to configure and bind an EIP. For more information, see Associate an EIP with a cloud resource.

Cloud resources and billing: imageECS public network

Custom Security Group

Specify a basic or advanced security group for the node pool. ACK does not configure additional access rules for the security group by default. You must manage the security group rules yourself to avoid access issues. For more information, see Configure cluster security groups.

Each ECS instance has a limit on the number of security groups it can join. Ensure you have a sufficient security group quota.

RDS Whitelist

Add the node IP addresses to the whitelist of an RDS instance.

[Deprecated] Private pool type

This configuration item is deprecated. Switch to using Resource Pool Policy to specify a private pool.

The private pool resources available for the currently selected zone and instance type. Types include the following:

  • Open: The instance will automatically match an open-type private capacity pool. If no suitable private pool is found, it will start using public pool resources.

  • Do Not Use: The instance will not use any private pool capacity and will start directly using public pool resources.

  • Specified: You need to further select a private pool ID to specify that the instance will only start using the capacity of that private pool. If the private pool is unavailable, the instance will fail to start.

Step 4: Component configuration

Click Next: Component Configuration to configure cluster components.

Parameter

Description

Cloud-edge Communication Component

Raven creates a public network tunnel for cross-region cloud-edge communication, enabling edge node monitoring and O&M. Not required if your cluster uses Express Connect. See Raven: A Cross-Region O&M Communication Component.

CloudMonitor Agent

You can view and monitor the running status of nodes and applications in the Cloud Monitor console.

This configuration only applies to new nodes in the node pool, not existing ones.

To enable it for existing nodes, install it through the Cloud Monitor console.

Cloud resources and billing: imageCloud Monitor

Log Service

Use an existing SLS Project or create a new one to collect cluster application logs.

This will also enable the cluster API Server audit feature to collect requests to the Kubernetes API and their results.

To enable this later, see Collect container logs from an ACK cluster and Use the cluster API Server audit feature.

Cloud resources and billing: imageSLS

Step 5: Confirm configuration and billing

On the Confirm Configuration page, confirm the cluster configuration, including feature configurations, resource billing, and cloud product dependency checks. Then, read the Terms of Service.

An ACK Edge cluster incurs cluster management fees (for the Pro edition only) and cloud resource costs. View the cost summary at the bottom of the creation page, or see Billing for ACK Edge clusters.

You can also click Equivalent Code in the upper-right corner of the Confirm Configuration page to generate Terraform or SDK example parameters for the current cluster configuration.

Billing

See Billing for ACK Edge clusters.

Previous：Cluster managementNext：Delete an ACK Edge cluster