Alibaba Cloud ACK: Managed Kubernetes for Asia-Pacific Workloads

If your primary audience is in China, Southeast Asia, or you need a cloud presence in those regions, Alibaba Cloud Container Service for Kubernetes (ACK) is the natural choice. It's deeply integrated with the Alibaba Cloud ecosystem — SLB for load balancing, ACR for container images, ARMS for APM, and RDS/PolarDB for databases.

This guide walks through creating a production ACK cluster using the Alibaba Cloud CLI, setting up autoscaling, configuring SLB-based ingress, and wiring up monitoring.

ACK Cluster Types

Type	Description	Use Case
ACK Managed	Control plane managed by Alibaba	Most production workloads
ACK Serverless (ASK)	Fully serverless, no node management	Burst/batch workloads
ACK Edge	Extends to edge nodes	IoT, CDN workloads
ACK Distro	Upstream Kubernetes, self-managed	On-premises or hybrid

For most teams: ACK Managed is the right choice. The control plane is free; you pay for worker nodes.

Prerequisites

# Install Alibaba Cloud CLI
pip install aliyun-python-sdk-core

# Or download from Alibaba Cloud docs
# https://www.alibabacloud.com/help/en/cli

# Configure credentials
aliyun configure set \
  --profile akProfile \
  --mode AK \
  --region cn-hangzhou \
  --access-key-id YOUR_ACCESS_KEY \
  --access-key-secret YOUR_ACCESS_SECRET

# Install kubectl
curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
chmod +x kubectl && sudo mv kubectl /usr/local/bin/

Create an ACK Managed Cluster

# Create VPC and vSwitch first (or use existing)
aliyun vpc CreateVpc \
  --RegionId cn-hangzhou \
  --CidrBlock 192.168.0.0/16 \
  --VpcName ack-prod-vpc

# Get VPC ID from output, then create vSwitches across zones
aliyun vpc CreateVSwitch \
  --RegionId cn-hangzhou \
  --ZoneId cn-hangzhou-h \
  --VpcId vpc-xxxxxxxxxxxxxxxxx \
  --CidrBlock 192.168.1.0/24 \
  --VSwitchName ack-vsw-h

aliyun vpc CreateVSwitch \
  --RegionId cn-hangzhou \
  --ZoneId cn-hangzhou-i \
  --VpcId vpc-xxxxxxxxxxxxxxxxx \
  --CidrBlock 192.168.2.0/24 \
  --VSwitchName ack-vsw-i

# Create ACK cluster via API
# (ACK cluster creation is done via the CS API, typically through the console
# or Terraform — the CLI wraps this)
aliyun cs POST /clusters \
  --header "Content-Type=application/json" \
  --body '{
    "name": "prod-cluster",
    "cluster_type": "ManagedKubernetes",
    "region_id": "cn-hangzhou",
    "kubernetes_version": "1.29.3-aliyun.1",
    "vpc_id": "vpc-xxxxxxxxxxxxxxxxx",
    "container_cidr": "172.20.0.0/16",
    "service_cidr": "172.21.0.0/20",
    "master_vswitch_ids": ["vsw-xxxxxxxxxx", "vsw-yyyyyyyyyy"],
    "worker_vswitch_ids": ["vsw-xxxxxxxxxx", "vsw-yyyyyyyyyy"],
    "num_of_nodes": 3,
    "worker_instance_types": ["ecs.c7.xlarge"],
    "worker_system_disk_category": "cloud_essd",
    "worker_system_disk_size": 120,
    "worker_data_disks": [
      {
        "category": "cloud_essd",
        "size": 200,
        "encrypted": "true"
      }
    ],
    "snat_entry": true,
    "endpoint_public_access": false,
    "deletion_protection": true,
    "node_cidr_mask": 26,
    "tags": [
      {"key": "env", "value": "production"},
      {"key": "team", "value": "platform"}
    ]
  }'

endpoint_public_access: false makes the API server private — accessible only from within the VPC. This is the correct default for production.

Get kubeconfig

# Download kubeconfig for private endpoint
aliyun cs GET /k8s/prod-cluster-id/user_config \
  --PrivateIpAddress true \
  > kubeconfig.yaml

export KUBECONFIG=./kubeconfig.yaml
kubectl get nodes

Configure Cluster Autoscaler

ACK's autoscaler integrates with Elastic Scaling Groups (ESS):

# Enable auto-scaling on the cluster via console or API
# Then create a scaling node pool

aliyun cs POST /clusters/CLUSTER_ID/nodepools \
  --header "Content-Type=application/json" \
  --body '{
    "nodepool_info": {
      "name": "spot-nodepool",
      "resource_group_id": ""
    },
    "scaling_group": {
      "vswitch_ids": ["vsw-xxxxxxxxxx", "vsw-yyyyyyyyyy"],
      "instance_types": ["ecs.c7.xlarge", "ecs.c7.2xlarge"],
      "instance_charge_type": "PreemptibleInstance",
      "spot_strategy": "SpotWithPriceLimit",
      "spot_price_limit": [
        {"instance_type": "ecs.c7.xlarge", "price_limit": "0.5"},
        {"instance_type": "ecs.c7.2xlarge", "price_limit": "1.0"}
      ],
      "system_disk_category": "cloud_essd",
      "system_disk_size": 120,
      "desired_size": 0,
      "min_size": 0,
      "max_size": 50
    },
    "auto_scaling": {
      "enable": true,
      "min_instances": 0,
      "max_instances": 50,
      "type": "cpu"
    },
    "kubernetes_config": {
      "labels": [{"key": "workload-type", "value": "spot"}],
      "taints": [
        {
          "key": "workload-type",
          "value": "spot",
          "effect": "NoSchedule"
        }
      ]
    }
  }'

Deploy an Application with SLB Ingress

ACK uses the Server Load Balancer (SLB) for external traffic. Create an ingress with the ACK-specific annotations:

# app-ingress.yaml
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: app-ingress
  namespace: production
  annotations:
    # Use Internet-facing SLB (remove for internal)
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-address-type: internet
    # SLB spec — slb.s2.medium for production
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-spec: slb.s2.medium
    # Enable access log for SLB
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-access-log-enabled: "true"
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-access-log-project: k8s-access-logs
    # Delete SLB when ingress is deleted
    service.beta.kubernetes.io/alibaba-cloud-loadbalancer-delete-protection: "on"
spec:
  ingressClassName: alb
  rules:
    - host: app.yourcompany.com
      http:
        paths:
          - path: /api
            pathType: Prefix
            backend:
              service:
                name: api-service
                port:
                  number: 80
          - path: /
            pathType: Prefix
            backend:
              service:
                name: frontend-service
                port:
                  number: 80
  tls:
    - hosts:
        - app.yourcompany.com
      secretName: app-tls-cert

For the Application Load Balancer (ALB) ingress controller (newer, L7):

# Install ALB Ingress Controller via ACK add-ons
# Console: Cluster > Add-ons > ALB Ingress Controller

# Or via helm
helm install alibaba-cloud-ingress-controller \
  oci://registry-1.docker.io/alibaba/alibaba-cloud-ingress-controller \
  --namespace kube-system \
  --set clusterID=YOUR_CLUSTER_ID \
  --set regionID=cn-hangzhou

ARMS APM Integration

ACK integrates with Application Real-Time Monitoring Service (ARMS) for APM:

# Add ARMS annotation to your deployment
apiVersion: apps/v1
kind: Deployment
metadata:
  name: api-service
  namespace: production
  annotations:
    # Enable ARMS Java agent auto-injection
    armsPilotAutoEnable: "on"
    armsPilotCreateAppName: "api-service-prod"
spec:
  template:
    metadata:
      labels:
        app: api-service
    spec:
      containers:
        - name: api
          image: registry-vpc.cn-hangzhou.aliyuncs.com/yourproject/api:1.0.0
          # ACR VPC endpoint — faster pulls within the same region

Using the VPC endpoint for ACR (registry-vpc.cn-hangzhou.aliyuncs.com) instead of the public endpoint is important — it's faster and doesn't consume public bandwidth.

Network Policies with Terway

ACK uses the Terway CNI plugin, which supports native VPC networking and NetworkPolicies:

# Allow only frontend to call api-service
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: api-service-ingress
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: api-service
  policyTypes:
    - Ingress
  ingress:
    - from:
        - podSelector:
            matchLabels:
              app: frontend
      ports:
        - protocol: TCP
          port: 8080

Cost Comparison: ACK Regions

Running 3 x ecs.c7.xlarge (4 vCPU, 8GB RAM) nodes:

Region	Node Cost/Month	Public IP	Notes
cn-hangzhou	~$120	Included	Best for China mainland
cn-hongkong	~$160	Included	Good for HK & global reach
ap-southeast-1 (SG)	~$155	Included	Southeast Asia
ap-northeast-1 (JP)	~$165	Included	Japan
us-west-1	~$170	Included	US West

The control plane for ACK Managed is free. You only pay for worker nodes, SLB instances, and storage.

Key Differences from EKS/GKE

Feature	ACK	EKS	GKE
Control plane cost	Free	$0.10/hr	Free (Autopilot: per pod)
CNI plugin	Terway (VPC-native)	AWS VPC CNI	Calico/Cilium
Load balancer	SLB / ALB	ALB/NLB	Cloud LB
Container registry	ACR	ECR	Artifact Registry
APM	ARMS	CloudWatch Container	Cloud Monitoring
China compliance	Native	Not available	Not available

ACK is the only practical option for workloads that must run within mainland China's regulatory environment.