Create an ACK dedicated cluster

Enter a custom cluster name.

Supported only for Kubernetes 1.22 or later, only with Terway, and cannot be used together with eRDMA.

The cluster supports both IPv4 and IPv6 protocols, but communication between worker nodes and the control plane still uses IPv4 addresses. Ensure the following:

• The cluster VPC supports IPv6 dual-stack.

• When using Terway in shared ENI mode, the instance type of the node must support IPv6 and have the same number of assignable IPv4 and IPv6 addresses.

The VPC for the cluster. To ensure high availability, we recommend selecting two or more zones.

• Auto-create: ACK creates a vSwitch in each selected zone.

• Use existing: Select a vSwitch to specify the cluster zone. You can create a new vSwitch or use an existing one.

We recommend using standard private CIDR blocks for the cluster VPC (for example, 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16). If you have special requirements, apply at the Quota Center (Create a cluster using a public CIDR block VPC).

Cloud resource and billing information: VPC

When using an existing VPC, you can select Select Existing Security Group

This security group applies to the cluster control plane, default node pool, and any node pool without a custom security group.

Compared with basic security groups, enterprise security groups can accommodate a larger number of private IP addresses but do not support intra-group connectivity. For more information, see Security Group Classification.

• Auto-create: All outbound traffic is allowed by default. Inbound rules follow recommended configurations. If you modify rules later, ensure inbound access to the 100.64.0.0/10 CIDR block is allowed.

  This CIDR block is used to access other Alibaba Cloud services for operations such as image pulling and querying ECS basic information.

• Use existing: ACK does not add extra access rules to the security group. You must manage security group rules yourself to avoid access issues. For details, see Configure cluster security groups.

The network plugin provides the foundation for pod-to-pod communication in the cluster.

For a detailed comparison, see Compare Terway and Flannel container network plugins.

• Flannel: A lightweight, open-source community network plugin. In ACK, it integrates deeply with Alibaba Cloud VPC and uses direct VPC route table management for pod communication.

  • Use case: Simple configuration and low resource consumption. Suitable for small-scale clusters (limited by VPC route table quotas), simplified networking, and scenarios that do not require custom container network control.

• Terway: A high-performance network plugin developed by Alibaba Cloud that uses Elastic Network Interfaces (ENIs) for pod communication.

  • Use case: Offers eBPF-based network acceleration, NetworkPolicy, and per-pod vSwitch and security group capabilities. Ideal for high-performance computing, gaming, microservices, and other scenarios requiring large-scale nodes, high network performance, and strong security.

  • Pod limit: Each pod consumes one secondary IP address from an ENI. The number of IPs per ENI is limited (depending on the instance type). Therefore, the maximum number of pods per node is constrained by ENI and secondary IP quotas.

    When using a shared VPC, only Terway is supported.

  Terway also provides the following capabilities.

  For details, see Use the Terway network plugin.

  • DataPathV2

    Configurable only during cluster creation.

    Enable DataPathV2 acceleration mode. Terway uses eBPF technology to optimize traffic forwarding paths, delivering lower latency and higher throughput for network-intensive applications.

    Supported only on Alibaba Cloud Linux 3 (all versions), ContainerOS, and Ubuntu with Linux kernel version 5.10 or later. For details, see Network acceleration.

  • NetworkPolicy support

    In public preview. Apply on the Quota Center console.

    Supports native Kubernetes NetworkPolicy to implement pod-level "firewalls" and fine-grained access control rules, enhancing cluster security.

  • Support for ENI Trunking

    Allows assigning dedicated IPs, vSwitches, and security groups to pods. Suitable for special business scenarios requiring fixed IPs or independent network policy management for specific pods. For details, see Assign fixed IPs, dedicated vSwitches, and security groups to pods.

Requires IPv6 dual-stack to be enabled.

Configure an IPv6 address range for the Service CIDR block. Use a ULA address (within the fc00::/7 range) with a prefix length between /112 and /120. We recommend matching the number of available addresses to that of the Service CIDR.

Select the kube-proxy proxy mode, which determines how cluster Services distribute requests to backend pods.

• iptables: Uses Linux firewall rules for traffic forwarding. Stable but limited in performance. As the number of Services increases, firewall rules grow exponentially, slowing request processing. Suitable for clusters with few Services.

• IPVS: A high-performance traffic distribution solution that uses hash tables for fast pod targeting, delivering lower latency under heavy Service loads. Suitable for large-scale production clusters or scenarios requiring high network performance.

For selection guidance, see Compare containerd, sandboxed container, and Docker runtimes.

• containerd (recommended): Community standard, supported for Kubernetes 1.20 and later.

• Sandboxed container: Provides a strongly isolated environment based on lightweight virtualization technology. For procedures and limitations, see Create and manage sandboxed container node pools.

• Docker (deprecated): Supported only for Kubernetes 1.22 and earlier. Creation is no longer supported.

The default billing method used when scaling out nodes in the node pool.

• Pay-As-You-Go: Can be enabled and released on demand.

• Subscription: Requires configuring Duration and Auto Renewal.

• Preemptible Instance: Currently, only spot instances with a protection period are supported. You must also configure the Instance Price Cap.

  The instance is created successfully when the real-time price of the specified instance type is below the maximum bid price. After the protection period (1 hour), the system checks the real-time price and inventory every 5 minutes. If the market price exceeds the bid price or inventory is insufficient, the spot instance is released. For usage recommendations, see Spot instance node pool best practices

To maintain node pool consistency, you cannot change a Pay-As-You-Go or Subscription node pool to a Preemptible Instance node pool, or vice versa.

When creating nodes, ACK applies the selected security baseline policy.

• Disable: No security hardening is applied to ECS instances.

• MLPS Security Hardening: Alibaba Cloud provides baseline check standards and scanning tools for Alibaba Cloud Linux MLPS 2.0 Level 3 images that comply with classified protection requirements. While ensuring native image compatibility and performance, these images are adapted for MLPS compliance to meet "GB/T22239-2019 Information Security Technology—Cybersecurity Classified Protection Basic Requirements." For details, see ACK MLPS hardening usage guide.

  In this mode, the root user cannot log on remotely via SSH. Connect to the instance via VNC in the ECS console and create a regular user that supports SSH logon.

• OS Security Hardening: Supported only for Alibaba Cloud Linux 2 or Alibaba Cloud Linux 3.

Select a cloud disk type based on your business needs, including ESSD AutoPL, ESSD, ESSD Entry, and previous-generation disks (SSD and ultra disk). Configure capacity, IOPS, and other parameters.

Available system disk types depend on the selected instance family. Disk types not displayed are unsupported.

Supports selecting More Disk Categories to configure disk types different from the primary System Disk, improving scale-out success rates. When creating nodes, ACK selects the first matching disk type from the specified order.

Cloud resource and billing information: ECS block storage

Select a cloud disk type based on your business needs, including ESSD AutoPL, ESSD, ESSD Entry, and previous-generation disks (SSD and ultra disk). Configure capacity, IOPS, and other parameters.

Available data disk types depend on the selected instance family. Disk types not displayed are unsupported.

• When mounting data disks, all cloud disk types support Encrypted. By default, Alibaba Cloud uses the service key (Default Service CMK) for encryption. You can also select a custom key (BYOK) pre-created in KMS.

• During node creation, the last data disk is automatically formatted, and /var/lib/container is mounted to this disk. /var/lib/kubelet and /var/lib/containerd are mounted to /var/lib/container.

  To customize mount directories, adjust the data disk initialization configuration. You can select only one data disk as the container runtime directory. For details, see Can I customize directory mounting for data disks in ACK node pools?

• For scenarios requiring container image acceleration or rapid large model loading, use snapshots to create data disks, improving system response speed and processing capability.

Select Add Data Disk Type to configure disk types different from the primary Data Disk, improving scale-out success rates. When creating nodes, ACK selects the first matching disk type from the specified order.

An ECS instance can mount up to 64 data disks. The maximum number of disks supported varies by instance type. Query the disk quantity limit for an instance type using the DescribeInstanceTypes API (DiskQuantity).

Cloud resource and billing information: ECS block storage

Add key-value taints to nodes. A valid taint key includes an optional prefix and a name. If a prefix is specified, separate it from the name with a forward slash (/).

After nodes join the cluster, run the specified instance user User-Data script.

Example: If the instance user data is touch /tmp/post-script, the combined script execution order on the node is as follows.

#!/bin/bash
# ACK node initialization script executes here

# Input instance user data executes here
touch /tmp/post-script

For the execution logic of this configuration during node initialization, see Node initialization process overview.

Successful cluster creation or node scale-out does not guarantee successful execution of the instance user script. Log on to the node and run grep cloud-init /var/log/messages to view execution logs.

View and monitor node and application status in the CloudMonitor console.

This setting applies only to new nodes added to the node pool, not existing nodes.

To enable this for existing nodes, install it in the CloudMonitor console.

Cloud resource and billing information: Cloud Monitor

ACK assigns an IPv4 public IP address to nodes.

This setting applies only to new nodes added to the node pool, not existing nodes. To grant public network access to existing nodes, configure and bind an EIP. For details, see Bind EIP to cloud resources.

Cloud resource and billing information: ECS public network