Create an ACK Auto Mode cluster

Supported only for Kubernetes 1.22 or later, only with Terway, and cannot be used together with eRDMA.

The cluster supports both IPv4 and IPv6 protocols, but communication between worker nodes and the control plane still uses IPv4 addresses. Ensure the following:

• The cluster VPC supports IPv6 dual-stack.

• When using Terway in shared ENI mode, the instance type of the node must support IPv6 and have the same number of assignable IPv4 and IPv6 addresses.

The VPC for the cluster. To ensure high availability, we recommend selecting two or more zones.

• Auto-create: ACK creates a vSwitch in each selected zone.

• Use existing: Select a vSwitch to specify the cluster zone. You can create a new vSwitch or use an existing one.

We recommend using standard private CIDR blocks for the cluster VPC (for example, 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16). If you have special requirements, apply at the Quota Center (Create a cluster using a public CIDR block VPC).

Cloud resource and billing information: VPC

The network plugin provides the foundation for pod-to-pod communication in the cluster.

For a detailed comparison, see Compare Terway and Flannel container network plugins.

• Flannel: A lightweight, open-source community network plugin. In ACK, it integrates deeply with Alibaba Cloud VPC and uses direct VPC route table management for pod communication.

  • Use case: Simple configuration and low resource consumption. Suitable for small-scale clusters (limited by VPC route table quotas), simplified networking, and scenarios that do not require custom container network control.

• Terway: A high-performance network plugin developed by Alibaba Cloud that uses Elastic Network Interfaces (ENIs) for pod communication.

  • Use case: Offers eBPF-based network acceleration, NetworkPolicy, and per-pod vSwitch and security group capabilities. Ideal for high-performance computing, gaming, microservices, and other scenarios requiring large-scale nodes, high network performance, and strong security.

  • Pod limit: Each pod consumes one secondary IP address from an ENI. The number of IPs per ENI is limited (depending on the instance type). Therefore, the maximum number of pods per node is constrained by ENI and secondary IP quotas.

    When using a shared VPC, only Terway is supported.

  Terway also provides the following capabilities.

  For details, see Use the Terway network plugin.

  • DataPathV2

    Configurable only during cluster creation.

    Enable DataPathV2 acceleration mode. Terway uses eBPF technology to optimize traffic forwarding paths, delivering lower latency and higher throughput for network-intensive applications.

    Supported only on Alibaba Cloud Linux 3 (all versions), ContainerOS, and Ubuntu with Linux kernel version 5.10 or later. For details, see Network acceleration.

  • NetworkPolicy support

    In public preview. Apply on the Quota Center console.

    Supports native Kubernetes NetworkPolicy to implement pod-level "firewalls" and fine-grained access control rules, enhancing cluster security.

  • Support for ENI Trunking

    Allows assigning dedicated IPs, vSwitches, and security groups to pods. Suitable for special business scenarios requiring fixed IPs or independent network policy management for specific pods. For details, see Assign fixed IPs, dedicated vSwitches, and security groups to pods.

Select the kube-proxy proxy mode, which determines how cluster Services distribute requests to backend pods.

• iptables: Uses Linux firewall rules for traffic forwarding. Stable but limited in performance. As the number of Services increases, firewall rules grow exponentially, slowing request processing. Suitable for clusters with few Services.

• IPVS: A high-performance traffic distribution solution that uses hash tables for fast pod targeting, delivering lower latency under heavy Service loads. Suitable for large-scale production clusters or scenarios requiring high network performance.