DocsICP FilingConsole
Documentation
Home Page Container Service for Kubernetes ACK Managed and Dedicated Clusters User Guide Clusters Auto Mode Create an ACK Auto Mode cluster

Create an ACK Auto Mode cluster

Updated at:
Copy as MD
Product
My Favorites

When you create an ACK managed cluster, you can enable Auto Mode to launch a best-practice Kubernetes cluster with minimal planning. ACK then provisions and manages a system node pool to run system components and an auto-mode node pool to run your workloads, and handles the entire node lifecycle.

Before you enable Auto Mode, read Auto mode to understand its features and use cases.

Preparation

Planning and design

Before you create a cluster, plan and design the cluster configuration based on your business needs to ensure that the cluster runs stably, efficiently, and securely.

  • Region: The closer the selected region is to your users and deployed resources, the lower the network latency and the faster the access speed.

  • Zone: We recommend that you configure multiple zones to ensure high availability (HA) for the cluster.

  • Network address planning: Plan the VPC CIDR blocks (VPC's own CIDR block and vSwitch CIDR blocks) and Kubernetes CIDR blocks (pod address range and service address range) based on your business scenario and cluster size. This defines the IP address range for the entire cluster and the number of available IP addresses for pods and nodes.

  • Public network access: Determine whether cluster nodes need to access the public network. Public network access is required to pull public images.

Activation and authorization

Before you create a cluster, activate the service and authorize the account:

  • Activate ACK: For first-time use, log on to the ACK activation page and complete the activation as prompted.

  • Role authorization: Go to the RAM Quick Authorization page, and authorize the Alibaba Cloud account to create the default Container Service roles, so that ACK can properly invoke the related cloud service resources.

  • Activate cluster-related cloud products: Activate the cloud products on which ACK clusters depend, including Virtual Private Cloud (VPC) and Server Load Balancer (SLB).

    • When you create a cluster, you purchase pay-as-you-go resources such as CLB instances. Make sure that your account balance is sufficient to avoid service outages caused by overdue payments.

    • Only Alibaba Cloud accounts can activate cloud products. To authorize RAM users to manage activated cloud products, see Grant cluster and cloud resource access with RAM.

Procedure

  1. Log on to the ACK console. In the left navigation pane, click Clusters.

  2. At the top left of the page, select the resource group and region of the target resource. image

  3. On the Clusters page, click Create Kubernetes Cluster. On the ACK Managed Cluster page, enable Auto Mode.

    After you enable Auto Mode, the page displays three core capabilities: Fully managed operations (fully managed cluster control plane, automatic version upgrades, maintenance-free nodes, and automatic self-healing), Automatic node scaling (on-demand elastic scaling, automatic instance type selection, and optimized resource costs), and Highly optimized node OS (a container-optimized OS with fast startup, an immutable file system, and secure-by-default best practices).

  4. Follow the on-screen instructions to configure the cluster. After you review the configuration and read the service agreement, click Create Kubernetes Cluster.

    For detailed information about each configuration item, see Cluster configuration.

    Auto Mode is supported only on ACK Managed Pro clusters, and incurs fees for both cluster management and related cloud services. View the cluster cost overview at the bottom of the creation page. For billing details, see Billing overview and Cloud resource costs.

    Click Console-to-Code in the top-right corner of the page to generate sample Terraform or SDK parameters for the current cluster configuration.

  • After the cluster is created, a system node pool and an auto-mode node pool are automatically created. The auto-mode node pool scales dynamically based on workload requirements. over node lifecycle management, including operating system upgrades, software upgrades, and security vulnerability fixes.

  • After creation, ACK installs add-ons based on your configuration. These add-ons may consume computing resources in the cluster. The auto-mode node pool scales out to add the required nodes.

What to do next

Deploy a workload and implement load balancing

Appendix

Shared responsibility model

ACK Auto Mode provides automated, intelligent Kubernetes cluster operations and reduces the operational effort required. However, in some scenarios, you still need to fulfill certain obligations.

Alibaba Cloud responsibilities

Customer responsibilities

Shared responsibilities

  • Deployment, maintenance, and upgrade of the cluster control plane.

  • Installation, configuration, and upgrade of core cluster components.

  • Automatic scale-out, scale-in, operating system upgrades, and software upgrades of node pools, including fixes for Common Vulnerabilities and Exposures (CVEs).

  • Basic cluster information configuration, such as network planning and VPC configuration.

  • Configuration and management of cluster RAM permissions and role-based access control (RBAC).

  • Deployment, operations, and appropriate configuration of application workloads. Appropriate configuration includes the replica count, graceful shutdown policies such as PreStop, and PodDisruptionBudget policies, to ensure that nodes can be drained for maintenance without affecting your workloads.

  • Receive cluster and application monitoring alerts promptly and respond to them.

  • Overall cluster security. Cluster security responsibilities are subject to the shared responsibility model. For more information, see Shared responsibility model.

  • Fault troubleshooting and issue resolution.

Quotas and limits

If you have a large cluster or your account contains many resources, you must be aware of the quotas and limits for using ACK clusters. For more information, see Quotas and limits.

  • Limits: These include ACK configuration limits (such as account balance) and single-cluster capacity limits (the maximum capacity of different Kubernetes resources within a single cluster).

  • Quota limits and quota increase requests: This includes quota limits for ACK clusters and the cloud products on which ACK depends, such as ECS and VPC. To request a quota increase, follow the instructions in the relevant documentation.

Cluster configuration

Create a cluster with the default configuration, or make flexible adjustments based on your business requirements and the resources available in your account. In the Editable after creation column of the table, ✗ indicates that the item cannot be modified after creation, and ✓ indicates that the item can be modified. Pay special attention to items that cannot be modified.

Basic configuration

Configuration item

Description

Editable after creation

Cluster Name

Enter a custom name for the cluster.

✓

Region

The region where the cluster resources, such as ECS instances and cloud disks, are located. The closer the region is to your users and resource deployment region, the lower the network latency.

✗

Maintenance Window

ACK performs automated O&M tasks, such as automatic cluster upgrades and automatic OS CVE vulnerability fixes, only during the defined maintenance window.

✓

Network configuration

Configuration item

Description

Editable after creation

IPv6 Dual-stack

This feature is only available for Kubernetes 1.22 and later and only supports Terway. It cannot be used with the elastic Remote Direct Memory Access (eRDMA) feature

The cluster supports both IPv4 and IPv6 protocols. However, communication between worker nodes and the control plane still uses IPv4 addresses. Make sure that:

  • The cluster VPC supports IPv6 dual-stack.

  • When using Terway in shared ENI mode, the node's instance type must support IPv6 and have the same number of supported IPv4 and IPv6 addresses.

✗

VPC

The virtual private cloud (VPC) for the cluster. For high availability, select two or more different zones.

  • Automatic creation: ACK creates a corresponding vSwitch in each selected zone.

  • Use existing: Select a vSwitch to specify the zone for the cluster. You can create a new vSwitch or use an existing one.

We recommend using standard private CIDR blocks for the cluster VPC, such as 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16. If you have special requirements, go to Quota Center to apply for permission to use a public CIDR block to create a cluster.

Cloud resources and billing: imageVPC

✗

Configure SNAT for VPC

Do not select this option when using a shared VPC

Select this option if nodes need to access the public network (for example, to pull public images or access external services). ACK will automatically configure a NAT Gateway and SNAT rules to ensure that resources within the cluster can access the public network.

  • If the VPC does not have a NAT Gateway: ACK automatically creates a NAT Gateway, purchases a new EIP, and configures an SNAT rule for the vSwitch used by the cluster.

  • If the VPC already has a NAT Gateway: ACK determines whether to purchase an additional EIP and configure an SNAT rule. If no EIP is available, a new one is automatically purchased. If no VPC-level SNAT rule exists, an SNAT rule is configured for the vSwitch used by the cluster.

If you do not select this option, you can configure the NAT Gateway and SNAT rules yourself after creating the cluster. For more information, see Public NAT Gateway.

Cloud resources and billing: imageNAT Gateway, imageEIP

✓

Access to API Server

ACK automatically creates a pay-as-you-go private-facing Classic Load Balancer (CLB) instance as the internal endpoint for the API Server. This CLB instance cannot be reused or deleted. If deleted, the API Server will become inaccessible and cannot be recovered.

To use an existing CLB instance, submit a ticket. After you select Use Existing Gateway for VPC, you can set SLB Source to Use Existing Gateway.

You can choose to enable Expose API server with EIP.

  • Open: Binds an EIP to the API Server's private-facing CLB instance, allowing you to access and manage the cluster from the public network.

    This does not mean that resources within the cluster can access the public network. To allow cluster resources to access the public network, you must select Configure SNAT for VPC.

  • Not open: You can only connect to and operate the cluster using the kubeconfig file from within the VPC.

To enable this later, see Access the API server over the internet.
Starting from December 1, 2024, new CLB instances will no longer support the Subscription billing method and will incur an instance fee. For more information, see [Service Notice] Announcement on Discontinuing Subscription Billing for New Cluster API Server CLB Instances and Billing item adjustment for Classic Load Balancer (CLB).

Cloud resources and billing: imageCLB, imageEIP

✗

Network Plug-in

The network plugin is the foundation for network communication between pods in a cluster.

For a detailed comparison of the two plugins, see Comparison of Terway and Flannel.

  • Flannel: A lightweight, open source network plugin. In ACK, it uses a VPC-native mode that is deeply integrated with Alibaba Cloud VPC. It manages VPC route tables directly to enable communication between pods.

    • Scenarios: Simple to configure and consumes few resources. Suitable for scenarios with a small number of nodes (limited by VPC route table quotas), where simplified network configuration is needed, and custom control over the container network is not required.

  • Terway: A high-performance network plugin developed by Alibaba Cloud. It uses elastic network interfaces (ENIs) to enable communication between pods.

    • Scenarios: Provides capabilities such as eBPF-based network acceleration, NetworkPolicy, and pod-level vSwitches and security groups. Suitable for high-performance computing (HPC), gaming, and microservice scenarios that have high requirements for node scale, network performance, and security.

    • Pod quantity limit: Each pod occupies a secondary IP address of an ENI. The number of IPs that can be assigned to a single ENI is limited by the instance type. Therefore, the number of pods that can run on a node is limited by the node's ENI and secondary IP quotas.

      When using a shared VPC, only Terway is supported.

    Terway also provides the following capabilities.

    For more information, see Use the Terway network plugin.

    • DataPath V2

      Can only be configured when creating a cluster

      Enable DataPath V2 acceleration mode. Terway will use eBPF technology to optimize traffic forwarding paths, providing lower latency and higher throughput for network-intensive applications.

      This feature is only supported on Alibaba Cloud Linux 3 (all versions), ContainerOS, and Ubuntu with Linux kernel version 5.10 or later. For more information, see Network acceleration.

    • NetworkPolicy Support

      This feature is in public preview. Submit an application in Quota Center console

      Supports native Kubernetes NetworkPolicy to act as a "firewall" between pods. You can define fine-grained access control rules to enhance cluster security.

    • Support for ENI Trunking

      Allows you to configure independent IPs, vSwitches, and security groups for pods. This is suitable for special business scenarios that require fixed IPs or independent network policy management for specific pods. For more information, see Configure a fixed IP address, an independent virtual switch, and a security group for a pod.

✗

Pod vSwitch

This parameter is required only when you select Terway.

The vSwitch that assigns IP addresses to pods. Each pod vSwitch corresponds to a worker node's vSwitch. The pod vSwitch and the worker node's vSwitch must be in the same zone.

Important

The subnet mask for the pod vSwitch should not exceed 19, and the maximum is 25. Otherwise, the number of available pod IP addresses in the cluster network will be very limited, which will affect the normal use of the cluster.

✓

Container CIDR Block

This parameter is required only for Flannel

The address pool that assigns IP addresses to pods. This CIDR block cannot overlap with the VPC's CIDR block, the CIDR blocks used by existing ACK clusters in the VPC, or the Service CIDR.

✗

Number of Pods per Node

You only need to configure Flannel.

Defines the maximum number of pods that a single node can accommodate.

✗

Service CIDR

Also known as Service CIDR. This is the address pool that assigns IP addresses to services within the cluster. This CIDR block cannot overlap with the VPC's CIDR block, the CIDR blocks used by existing clusters in the VPC, or the Container CIDR Block.

✗

Forwarding Mode

Select the kube-proxy proxy mode, which determines how cluster services distribute requests to backend pods.

  • iptables: Uses Linux firewall rules for traffic forwarding. It is stable but has limited performance. As the number of services increases, the number of firewall rules grows, slowing down request processing. Suitable for clusters with a small number of services.

  • IPVS: A high-performance traffic distribution solution. It uses a hash table to quickly locate target pods, resulting in lower latency when handling many service requests. Suitable for large-scale production clusters or scenarios with high network performance requirements.

    Starting from Kubernetes 1.35, the ipvs mode of kube-proxy is marked as deprecated and is planned to be removed in a future version.

  • nftables: A modern replacement for iptables that provides a more efficient rule model. Its near-O(1) rule mapping lookup makes data plane latency independent of cluster size. Control plane updates use incremental synchronization, optimizing the efficiency of rule changes. As the mainstream development direction for the Linux kernel networking framework, it is the recommended mode by the kube-proxy community. Suitable for medium to large-scale clusters or scenarios that require better performance and maintainability than iptables.

    When using the nftables service forwarding mode, the Linux kernel version of the nodes in the cluster must be 5.13 or later. Otherwise, nodes will fail to be added.

✗

Advanced options

The following configuration items are based on Kubernetes cluster best practices. Use the default values. To adjust them, refer to the description of each configuration item and follow the on-screen prompts.

Configuration item

Description

Editable after creation

Kubernetes Version

You can only create clusters with the three most recent minor versions. We recommend using the latest version. For more information about the versions supported by ACK, see ACK version support overview.

✓

Supports Manually upgrade a cluster and Automatically upgrade a cluster.

Automatic Update

Enable automatic cluster upgrades to keep the cluster control plane and node pools periodically updated.

For more information about the auto-upgrade policy and instructions, see Automatically upgrade clusters.

✓

Security Group

When using an existing VPC, you can choose to Select Existing Security Group

This security group is applied to the cluster control plane, the default node pool, and any node pools that do not have a custom security group specified.

Compared to basic security groups, advanced security groups can contain more private IP addresses but do not support intra-group connectivity. For more information, see Security group classification.

  • Automatic creation: All outbound traffic is allowed by default. Inbound traffic is allowed based on the recommended configuration. If you modify the rules later, ensure that the 100.64.0.0/10 CIDR block is allowed for inbound traffic.

    This CIDR block is used to access other Alibaba Cloud services for operations such as pulling images and querying basic ECS information.

  • Use existing: ACK does not configure additional access rules for the security group by default. You must manage the security group rules yourself to avoid access issues. For more information, see Configure cluster security groups.

✓

Cluster Deletion Protection

We recommend enabling this feature to prevent accidental deletion of the cluster through the console or OpenAPI.

✓

Resource Group

Assign the cluster to the selected resource group for easier permission management and cost allocation.

A resource can belong to only one resource group.

✓

Label

Bind key-value tags to the cluster to identify cloud resources.

✓

Time Zone

The time zone used by the cluster. By default, this is the time zone configured in your browser.

✓

Log Service

Use an existing SLS Project or create a new one to collect cluster application logs.

This will also enable the cluster API Server audit feature to collect requests to the Kubernetes API and their results.

To enable this later, see Collect container logs from an ACK cluster and Use the cluster API Server audit feature.

Cloud resources and billing: imageSLS

✓

Alerts

Enable Container Service Alert Management. Based on SLS, Managed Service for Prometheus, and Cloud Monitor data sources, it sends alert notifications to alert contact groups when cluster anomalies occur.

✓

Previous：Auto ModeNext：Create and manage Auto Mode node pools