Alibaba Cloud ACK: Managed Kubernetes in Asia's Largest Cloud

Why ACK for Asia-Pacific Workloads

ACK (Alibaba Cloud Container Service for Kubernetes) is the managed Kubernetes offering on Alibaba Cloud. If your users or operations are in China, Southeast Asia, or the Middle East, ACK offers:

• Lowest latency to Alibaba Cloud regions (20+ regions in APAC)
• China compliance: Data residency, ICP licensing support, direct integration with China mainland infrastructure
• Alibaba ecosystem: Native integration with ApsaraDB, OSS, SLB, RAM, and Function Compute
• Aggressive pricing: Often 20-40% cheaper than AWS/Azure in APAC regions
• Spot instances: Called "preemptible instances" — up to 90% discount

---

ACK Cluster Types

Type	Description	Use Case
ACK Managed Cluster	Control plane managed by Alibaba	Most production workloads
ACK Serverless (ASK)	No nodes to manage, pay per pod	Burst workloads, dev/test
ACK Dedicated	You manage control plane nodes	Compliance, full control
ACK Edge	Extends cluster to edge nodes	IoT, edge computing

For most teams: ACK Managed Cluster.

---

Create a Cluster via Console

1. Log in to Alibaba Cloud Console → Container Service for Kubernetes
2. Click Create Cluster → Standard Managed Cluster
3. Configure:
   • Region: e.g., cn-hangzhou (China) or ap-southeast-1 (Singapore)
   • Cluster name: production-cluster
   • Kubernetes version: Latest stable (e.g., 1.29)
   • VPC: Select or create a VPC with private subnets
   • Node pool: Configure instance type (ecs.c7.2xlarge), disk type (ESSD), count

---

Create a Cluster via CLI

Install the Alibaba Cloud CLI:

# Install aliyun CLI
curl -O https://aliyunidaas-us-east-1.oss-us-east-1.aliyuncs.com/aliyun-cli/aliyun-linux-amd64-latest.tgz
tar -xzf aliyun-linux-amd64-latest.tgz
sudo mv aliyun /usr/local/bin/

# Configure
aliyun configure
# Access Key ID: <your-key>
# Access Key Secret: <your-secret>
# Default Region: ap-southeast-1
# Default Language: en

# Create cluster (via API — complex, better to use Terraform or Console)
aliyun cs POST /clusters --header "Content-Type=application/json" \
  --body '{
    "cluster_type": "ManagedKubernetes",
    "name": "production-cluster",
    "region_id": "ap-southeast-1",
    "kubernetes_version": "1.29.1-aliyun.1",
    "node_count": 3,
    "master_instance_types": ["ecs.c7.2xlarge"],
    "worker_instance_types": ["ecs.c7.4xlarge"],
    "vswitch_ids": ["vsw-xxx"]
  }'

For production, use Terraform — it's far more maintainable.

---

Terraform Configuration

# provider.tf
terraform {
  required_providers {
    alicloud = {
      source  = "aliyun/alicloud"
      version = "~> 1.210"
    }
  }
}

provider "alicloud" {
  region = "ap-southeast-1"
}

# VPC and networking
resource "alicloud_vpc" "main" {
  vpc_name   = "production-vpc"
  cidr_block = "10.0.0.0/16"
}

resource "alicloud_vswitch" "zone_a" {
  vpc_id       = alicloud_vpc.main.id
  cidr_block   = "10.0.1.0/24"
  zone_id      = "ap-southeast-1a"
  vswitch_name = "production-vsw-a"
}

resource "alicloud_vswitch" "zone_b" {
  vpc_id       = alicloud_vpc.main.id
  cidr_block   = "10.0.2.0/24"
  zone_id      = "ap-southeast-1b"
  vswitch_name = "production-vsw-b"
}

# ACK Managed Cluster
resource "alicloud_cs_managed_kubernetes" "main" {
  name                = "production-cluster"
  version             = "1.29.1-aliyun.1"
  cluster_spec        = "ack.pro.small"  # Pro edition for SLA

  # Networking
  vpc_id             = alicloud_vpc.main.id
  pod_cidr           = "172.20.0.0/16"
  service_cidr       = "172.21.0.0/20"
  new_nat_gateway    = true   # Auto-create NAT gateway for outbound

  # Control plane in multiple zones
  vswitch_ids        = [alicloud_vswitch.zone_a.id, alicloud_vswitch.zone_b.id]

  # Enable logging and monitoring
  cluster_log_config {
    type        = "SLS"
    project     = "k8s-log-production"
    log_ttl     = 90
    enable_audit = true
  }

  # RRSA (RAM Roles for Service Accounts)
  enable_rrsa = true

  # SLB ingress
  slb_internet_enabled = true

  # Maintenance window
  maintenance_window {
    enable            = true
    maintenance_time  = "03:00:00Z"
    duration          = "3h"
    weekly_period     = "Thursday"
  }
}

# System node pool
resource "alicloud_cs_kubernetes_node_pool" "system" {
  cluster_id     = alicloud_cs_managed_kubernetes.main.id
  node_pool_name = "system-pool"

  instance_types  = ["ecs.c7.2xlarge"]
  node_count      = 3
  desired_size    = 3

  scaling_config {
    min_size                = 2
    max_size                = 5
    type                    = "cpu"
    is_bond_eip             = false
    eip_internet_charge_type = "PayByTraffic"
  }

  vswitch_ids = [alicloud_vswitch.zone_a.id, alicloud_vswitch.zone_b.id]

  system_disk_category = "cloud_essd"
  system_disk_size     = 100
  system_disk_performance_level = "PL1"

  labels {
    key   = "role"
    value = "system"
  }

  taints {
    key    = "CriticalAddonsOnly"
    value  = "true"
    effect = "NoSchedule"
  }

  # Auto repair and upgrade
  management {
    auto_repair  = true
    auto_upgrade = true
  }
}

# Application node pool
resource "alicloud_cs_kubernetes_node_pool" "app" {
  cluster_id     = alicloud_cs_managed_kubernetes.main.id
  node_pool_name = "app-pool"

  instance_types = ["ecs.c7.4xlarge"]
  node_count     = 3

  scaling_config {
    min_size = 2
    max_size = 20
    type     = "cpu"
  }

  vswitch_ids = [alicloud_vswitch.zone_a.id, alicloud_vswitch.zone_b.id]

  system_disk_category          = "cloud_essd"
  system_disk_size              = 200
  system_disk_performance_level = "PL1"

  labels {
    key   = "role"
    value = "application"
  }
}

---

Get kubectl Access

# Install kubectl and alicloud CLI plugin
# Option 1: via console — download kubeconfig from cluster details page

# Option 2: via CLI
aliyun cs GET /k8s/production-cluster-id/user_config \
  | python3 -c "import sys, json; print(json.load(sys.stdin)['config'])" > ~/.kube/config

# Verify
kubectl get nodes
kubectl get pods -A

---

RRSA: RAM Roles for Service Accounts

RRSA (RAM Roles for Service Accounts) is ACK's equivalent of IRSA/Workload Identity. Pods authenticate using ServiceAccount tokens and assume RAM roles — no credentials in pods.

# Enable RRSA on cluster (if not enabled at creation)
aliyun cs POST /clusters/production-cluster-id/enable_rrsa

# Create a RAM Role for your application
# (Do this in RAM console or via Terraform)
# Trust policy: allow RRSA to assume this role

# Annotate the Kubernetes ServiceAccount
kubectl annotate serviceaccount myapp-sa \
  --namespace production \
  pod-identity.alibabacloud.com/role-arn=acs:ram::123456789:role/myapp-role

The annotated ServiceAccount gives pods access to Alibaba Cloud services like OSS, RDS, and SLB without static credentials.

---

Container Registry (ACR)

Alibaba Cloud Container Registry stores your images:

# Create a namespace in ACR
# Via console: Container Registry → Repositories → Create

# Login to ACR
docker login registry.ap-southeast-1.aliyuncs.com \
  --username <your-account-id> \
  --password <your-password>

# Build and push
docker build -t registry.ap-southeast-1.aliyuncs.com/myorg/myapp:v1 .
docker push registry.ap-southeast-1.aliyuncs.com/myorg/myapp:v1

# Deploy to ACK
kubectl set image deployment/myapp \
  myapp=registry.ap-southeast-1.aliyuncs.com/myorg/myapp:v2

For production, use ACR Enterprise Edition with VPC-only access, image scanning, and replication across regions.

---

SLB Ingress (Load Balancer)

ACK uses Server Load Balancer (SLB) for external access. The alicloud-loadbalancer-controller manages SLBs:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: myapp-ingress
  annotations:
    kubernetes.io/ingress.class: alb
    alb.ingress.kubernetes.io/address-type: internet  # or intranet for internal
    alb.ingress.kubernetes.io/listen-ports: '[{"HTTP": 80}, {"HTTPS": 443}]'
    alb.ingress.kubernetes.io/certificate-id: "cert-abc123"
spec:
  rules:
    - host: api.example.com
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: myapp-service
                port:
                  number: 8080

---

Cost Comparison vs AWS/Azure (APAC)

Approximate comparison for ap-southeast-1 (Singapore):

Resource	Alibaba Cloud	AWS	Azure
4 vCPU / 16 GB node	~$0.16/hr	~$0.19/hr	~$0.18/hr
Managed K8s control plane	$0.07/hr	$0.10/hr	Free
100 GB ESSD/SSD storage	$0.12/GB/mo	$0.10/GB/mo	$0.11/GB/mo
1 Mbps outbound bandwidth	$0.10/GB	$0.09/GB	$0.087/GB

Alibaba Cloud is typically cheaper in APAC regions, especially with reserved instance discounts (up to 66% off for 3-year commitments) and for China mainland deployments where AWS/Azure have limited presence.