This topic describes the historical release notes for Container Service for Kubernetes (ACK) features that were released in 2021, and provides links to the relevant references.
Background information
The following Kubernetes versions are supported by ACK: 1.24, 1.22, and 1.20.
The following operating systems are supported by ACK: CentOS 7.9, Alibaba Cloud Linux 3.2104, Alibaba Cloud Linux 2.1903, Windows Server 2019, and Windows Server Core 1909.
December 2021
Feature | Description | Region | References |
ACK One | ACK One is a distributed cloud container platform that is provided by Alibaba Cloud. ACK One allows enterprise users to manage cloud-native applications in hybrid cloud, multi-cluster, distributed computing, and disaster recovery scenarios. You can register external Kubernetes clusters that are deployed in all regions or on all types of infrastructure with ACK One. In addition, ACK One is compatible with the APIs of open source Kubernetes. This allows you to centrally manage and maintain computing resources, networks, storage, security, monitoring, logs, jobs, applications, and traffic. | All regions | |
Kubernetes 1.22.3 | Kubernetes 1.22.3 can be selected when you create clusters. | All regions | |
Deployment sets for node pools | Deployment sets are used to manage the distribution of ECS instances. ECS instances in a deployment set are distributed across multiple physical servers for high redundancy. This improves the availability of your applications. A node pool that is associated with a deployment set contains ECS nodes that are distributed across multiple physical servers. You can configure pod affinity to deploy your application pods to different ECS nodes. This way, disaster recovery is implemented and the availability of your applications is improved. | All regions | Best practices for associating deployment sets with node pools |
Workbench | Workbench is used to log on to containers. Workbench provides higher stability and compatibility compared with the previous terminal tool. To log on to a container by using Workbench, find the container on the Pods page and click Terminal in the Actions column. | All regions | |
Custom configurations for the NGINX Ingress controller | The parameters of the NGINX Ingress controller can be configured on the Add-ons page of the ACK console. The custom configurations are retained after you update the NGINX Ingress controller. You can configure resource requests, resource limits, enable the host network mode, enable admission webhooks, and specify node selectors for the NGINX Ingress controller. | All regions | No impact on workloads |
Prometheus monitoring dashboards | Monitoring dashboards of the cloud controller manager (CCM) and kube-controller-manager are provided for ACK Pro clusters. This helps you gain better insight into your clusters. You can view the dashboards on the Prometheus Monitoring page in the Operations module of the ACK console. | All regions | |
Log center | The log of the CCM can be collected by using the log center feature. The log center feature is available in ACK Serverless Pro clusters. This improves the observability of ACK Serverless clusters. | All regions | Collect logs of control plane components in ACK managed clusters |
OPA-based policy governance | The Policy Governance feature is provided by ACK. This feature is developed based on the Open Policy Agent (OPA) policy engine and the gatekeeper admission controller. Policy Governance provides a variety of predefined policies that apply to more Kubernetes scenarios than pod security policies (PSPs). In addition, the configuration of these policies is easy and flexible, which helps the O&M engineers of enterprises better utilize the capabilities that are provided by ACK pod security policies. | All regions | |
Node pool priorities | Node pool priorities can be specified in the node pool auto scaling policy. If multiple node pools meet the requirement, ACK selects the node pool with the highest priority for a scale-out activity. | All regions | |
Open source the ALB Ingress controller on GitHub | The ALB Ingress controller is compatible with the NGINX Ingress controller, and provides improved traffic routing capabilities based on ALB instances. The ALB Ingress controller supports complex routing, automatic certificate discovery, and HTTP, HTTPS, and QUIC protocols. The ALB Ingress controller meets the requirements of cloud-native applications for ultra-high elasticity and balancing of heavy traffic loads at Layer 7. | All regions |
November 2021
Feature | Description | Region | References |
ALB Ingresses-based routing | ALB Ingresses can be created in the ACK console. You can create Ingress rules in ALB Ingresses and customize Ingress configurations. ALB Ingresses use ALB instances to balance the traffic loads at Layer 7. | All regions | |
Support for multiple route tables by using CCM | ACK uses the CCM to add route entries to the route table of the virtual private cloud (VPC) in which the cluster is deployed. This enables network connectivity between pods in the cluster. Multiple route tables can be configured for a VPC by using the CCM. To create multiple route tables for a VPC, configure the CCM on the Add-ons page or modify the CCM ConfigMap. | All regions | |
Desired number of nodes | The number of nodes in a node pool can be changed by setting the desired number of nodes in the node pool. If you set the desired number of nodes to a value larger than the current number of nodes, the node pool is scaled out after you submit the change. If you set the desired number of nodes to a value smaller than the current number of nodes, the node pool is scaled in after you submit the change. The scaling activity is performed based on the scaling policy that you configure when you create the node pool. | All regions | |
ACK quotas | The display of quotas and applications for quota increases are optimized by ACK. ACK displays the quotas of ACK managed clusters, ACK dedicated clusters, ACK Serverless clusters, ACK edge clusters, registered clusters, and other resources in the console. The ACK console also provides an entry point to Quota Center. | All regions | |
IPv4/IPv6 dual stack | IPv4/IPv6 dual stack can be selected when you create an ACK Serverless cluster. You can use IPv6 addresses to access services in a cluster that has IPv4/IPv6 dual stack enabled. To enable IPv4/IPv6 dual stack, the following prerequisites must be met:
| All regions | |
ContainerOS | ContainerOS is an operating system that Alibaba Cloud provides for containerized development. ContainerOS is fully compatible with Kubernetes. ContainerOS is based on Alibaba Cloud Linux 3 and provides enhanced security, faster startup, and simplified system services and software packages. ContainerOS is preinstalled with cloud-native components to provide out-of-the-box features in cloud-native scenarios. You can use ContainerOS in managed node pools in ACK clusters. ACK provides free technical support for ContainerOS. | All regions |
October 2021
Feature | Description | Region | References |
Kubernetes 1.20.11 | CVE-2021-25741 is discovered by the Kubernetes community. CVE-2021-25741 is a vulnerability that can be exploited by attackers to access the host directories by using a symbolic link and creating a container that has a subPath volume mounted. The severity of CVE-2021-25741 is rated as high. Update from Kubernetes 1.20 to Kubernetes 1.20.11 is supported. CVE-2021-25741 is fixed in Kubernetes 1.20.11. | All regions | |
ClusterRole | The lifecycles of ClusterRoles can be managed in the ACK console. This improves the efficiency of cluster management. | All regions | Use custom RBAC roles to restrict resource operations in a cluster |
ARMS monitoring | The network topology feature of ARMS is integrated with ACK, which helps enhance the cluster topology feature. This allows you to view the network topology of Services and workloads, and the network topology of resources and Alibaba Cloud services. | All regions | none |
Cost analysis | Application dashboards are provided by the cost analysis feature. Application dashboards provide cost trends, correlation analytic results, and cost saving suggestions and plans. | All regions | |
Cloud-native AI component set |
| All regions | |
ALB Ingress controller | ALB Ingresses are compatible with NGINX Ingresses and provide improved traffic management based on ALB instances. ALB Ingresses support complex routing, automatic certificate discovery, and the HTTP, HTTPS, and Quick UDP Internet Connection (QUIC) protocols. These features fully meet the requirements of cloud-native applications for ultra-high elasticity and balancing of heavy traffic loads at Layer 7. | All regions | |
ACK Serverless Pro cluster | ACK Serverless Pro clusters offer higher reliability and security based on ACK Serverless clusters. In addition, ACK Serverless Pro clusters are covered by the service level agreement (SLA) that supports compensation clauses. This type of cluster is suitable for enterprise users who require high stability and security for large-scale workloads. ACK Serverless Pro clusters are now in public preview. | All regions |
September 2021
Feature | Description | Region | References |
ARM node pools | ARM node pools are supported by ACK clusters. You can select ECS instances of the g6r and c6r instance families when you create ARM node pools. Alibaba Cloud ARM instances offer cost savings in general-purpose computing scenarios where NGINX, Redis, and SQL are used, and provide high concurrency and high throughput in big data computing scenarios. | All regions | |
Auto scaling for Windows node pools | Auto scaling can be enabled for Windows node pools to improve the elasticity of your applications. | All regions | |
Windows images for node pools | Windows images can be specified when you create node pools. Custom images based on Windows Server 2019 (kernel versions later than 1809) are supported. | All regions | |
Multiple security groups for a node pool | More than one security group can be configured for a node pool to enforce fine-grained access control. | All regions | |
IPv4/IPv6 dual stack | The IPv4/IPv6 dual stack mode can be enabled when you create an ACK cluster. Then, clients can connect to the application in the ACK cluster through an IPv6 address. | All regions | |
CIS Kubernetes V1.20 Benchmark v1.0.0 | CIS Kubernetes V1.20 Benchmark v1.0.0 is supported by the inspection feature for clusters of Kubernetes 1.20 and later. | All regions | None |
Node pool scale-out policy and scale-in activity settings | The node pool scale-out policy can be specified and scale-in activities can be set to allowed or disallowed when you configure the auto scaling feature. The node pool scale-out policy decides the priorities of the node pools that are to be scaled out. You can set the node pool scale-out policy to least-waste or random. | All regions | |
Backup center | The backup feature is in public preview. This feature allows you to back up applications deployed in both ACK clusters and self-managed clusters. The application backup feature of ACK is upgraded and renamed as backup center. This feature provides an all-in-one solution for you to back up, restore, and migrate both stateless and stateful applications deployed in ACK clusters. This solution meets the disaster recovery and migration requirements of stateful applications deployed in a hybrid cloud environment or across multiple clusters. | All regions | |
Model evaluation for AI project acceleration | Model evaluation includes model management and evaluation. This feature is used to control the versions of models trained by using the AI component set and evaluate models based on multiple metrics, such as the accuracy and recall rate. This feature also provides metrics to help you choose the model that best suits your business. | All regions |
August 2021
Feature | Description | Region | References |
ACK Scheduler V1.20-ack-4.0 released to support load-aware scheduling and Elastic Container Instance-based scheduling |
| All regions | |
CCM 2.0.1 released to support weighted routing across multiple Services and the reuse of existing vServer groups. |
| All regions | |
Subscription clusters can be created. Subscription and auto-renewal are supported by the SLB instance that is attached to the Kubernetes API server of the cluster. | Subscription clusters can be created. If you select the subscription billing method for a cluster, the ECS nodes and the SLB instance attached to the Kubernetes API server of the cluster use the subscription billing method. You can buy resource plans for elastic IP addresses (EIPs), NAT gateways, and Log Service projects that are used in the cluster. This allows you to complete all payments related to an ACK cluster at a time when you create the cluster and eliminates the hassle of paying the bills on a pay-as-you-go basis. | All regions | No impact on workloads |
An existing SLB instance can be reused by the NGINX Ingress controller when you create a cluster. | If you select the subscription billing method for a cluster, you can reuse an existing SLB instance for the NGINX Ingress controller. You can associate a subscription SLB instance that you previously created with the NGINX Ingress controller. This allows you to complete all payments related to an ACK cluster at a time when you create the cluster. | All regions | No impact on workloads |
Intelligent O&M: Cluster diagnostics and global check released |
| All regions | |
ACK Serverless Ingress ALB controller | The ALB Ingress controller is compatible with the NGINX Ingress controller and provides improved traffic routing capabilities based on ALB instances. The ALB Ingress controller supports complex routing, automatic certificate discovery, and HTTP, HTTPS, and QUIC protocols. The ALB Ingress controller meets the requirements of cloud-native applications for ultra-high elasticity and balancing of heavy traffic loads at Layer 7. You can install the ALB Ingress controller when you create an ACK cluster or on the Add-ons page after the cluster is created. | All regions | |
Windows Server 2019 supported by ACK edge clusters | Windows Server 2019 can be selected when you create node pools in the cloud for an ACK Edge cluster. This improves the cloud-edge coordination capability of Windows applications. | All regions | No impact on workloads |
CNFS enhanced to share and automatically expand NAS volumes |
| All regions |
July 2021
Feature | Description | Region | References |
Kubernetes version update | Update from Kubernetes 1.18 to Kubernetes 1.20 is supported. | All regions | |
CoreDNS | CoreDNS is supported on the Add-ons page of the console. CoreDNS is the default plug-in used to implement DNS-based service discovery in ACK clusters and ACK edge clusters. CoreDNS provides domain name resolutions for services within the clusters. | All regions | |
Cost analysis based on namespaces | The cost analysis feature is improved to provide resource usage trends and the cost estimation of individual CPU cores per unit time for applications and pods based on namespace. | All regions | |
Enhanced security for registered clusters | The security of registered clusters is enhanced. You can install security-inspector, aliyun-acr-credential-helper, and gatekeeper in registered clusters. security-inspector is used to perform security scans. aliyun-acr-credential-helper is used to pull images without passwords. gatekeeper is used to manage OPA policies. | All regions | |
CNFS 1.0 | The CNFS feature is released. CNFS allows you to abstract NAS file systems as Kubernetes resources by using CRD objects. You can use CNFS to create, delete, set quotas for, mount, monitor, and expand NAS file systems. CNFS provides a declarative management method, which is also used to manage containers. CNFS improves storage performance and data security. | All regions |
June 2021
Feature | Description | Region | References |
Resource groups selectable | The resource group can be selected from a drop-down list when you create the cluster or node pool in the console. The cluster and ECS instances in the cluster are grouped into the selected resource group. Previously, the resource group was selected at the top of the console. The resource group that you select at the top of the console is used to filter resources displayed on the page, such as VPCs. | All regions | No impact on workloads |
Visualized configuration for network policies | Kubernetes network policies can be used to configure policy-based network control. You can use network policies to control traffic at the IP address or port level. ACK provides a visual interface that you can use to configure network policies in a convenient manner. | All regions | |
ACK Terway Hubble | ACK Terway Hubble can be deployed in clusters by using App Catalog. ACK Terway Hubble is a network architecture, workload, and topology observability platform. You can deploy ACK Terway Hubble in an ACK managed cluster to gain observability into the network traffic and network policies. | All regions | Implement network observability by using ACK Terway and Cilium Hubble |
Cost analysis | Cost allocations and trends of resources, applications, and containers can be provided at the node pool level. The cost analysis feature also provides cost optimization suggestions based on the current cost and the sales strategies of node pools. | All regions | |
Auto scaling | You can set this parameter to configure the interval at which the cluster is evaluated for scaling. You can specify 15 seconds, 30 seconds, and 1 minute as the scan interval. | All regions | |
SANs modifiable for ACK Serverless clusters | Custom subject alternative names (SANs) can be modified for the API server certificate of an ACK Serverless cluster. This allows you to update the information about the API server certificate, such as the domain name, IP address, and URL, after the ACK Serverless cluster is created. | All regions | Customize the SANs of the API server certificate when you create an ACK cluster |
Cluster security | The inspection feature can be used to detect security risks in the workloads of a registered cluster. | All regions | |
Topology-aware scheduling | The following scheduling policies are supported by topology-aware CPU scheduling:
| All regions |
May 2021
Feature | Description | Region | References |
CIS reinforcement for worker nodes | Center for Internet Security (CIS) reinforcement is supported for worker nodes. You can enable CIS reinforcement to enhance OS security for cluster nodes. CIS is a third-party security organization that is committed to leading a global community of enterprises, public service sectors, and academia to develop security best practice solutions. CIS reinforcement supports only Alibaba Cloud Linux 2, which is the official OS image of Alibaba Cloud and the default OS image used in ACK clusters. | All regions | |
New region | ACK Pro clusters are available in Nanjing Local Region. | China (Nanjing - Local Region) | None |
New region | ACK Pro clusters are available in the China North 2 Ali Gov region on Alibaba Gov Cloud. | China North 2 Ali Gov | |
Cost analysis | The cost analysis feature is added to help IT administrators analyze resource usage and allocate costs. This feature offers suggestions on cost savings and helps improve resource utilization. This feature provides the following services:
| All regions | |
Custom SSL certificates | Custom SSL certificates can be specified for SLB instances by using annotations when you create Ingresses in ACK Serverless clusters. The SSL certificates are no longer forcibly specified by using Secrets. | All regions | No impact on workloads |
Topology-aware scheduling supported by AMD CPUs | resource-controller V1.2.1-d1e280f-aliyun is released. This component works with ack-sceduler of Kubernetes 1.20.4 to support the topology-aware scheduling for AMD CPUs. | All regions |
April 2021
Feature | Description | Region | References |
Kubernetes 1.20 | Kubernetes 1.20 is supported. You can select this Kubernetes version when you create a cluster. | All regions | |
Hot migration from ACK dedicated clusters to ACK Pro clusters | Hot migration from existing ACK dedicated clusters to ACK Pro clusters is supported. You can dynamically migrate workloads from ACK dedicated clusters to ACK Pro clusters without service interruptions. | All regions | Hot migration from ACK dedicated clusters to ACK Pro clusters |
NodeLocal DNSCache | ACK NodeLocal DNSCache is a local DNS cache solution developed based on the open source NodeLocal DNSCache project. This solution consists of a DNS caching agent that runs as a DaemonSet and an admission controller that runs as a Deployment to dynamically inject data to DNSConfig. The admission controller listens on pod creation requests and dynamically modifies DNSConfig. This enables pods to use local cache to accelerate DNS lookups. | All regions | |
Registered cluster | The Kubernetes event center feature and the aliyun-acr-credential-helper component are supported in registered clusters. | All regions | Create a registered cluster and Use the aliyun-acr-credential-helper component to pull images without using a password |
Custom configuration for control plane components | Custom control plane parameters are supported in ACK Pro clusters to meet the requirements for modifying control plane parameters in production environments. You can modify the parameters of kube-apiserver and kube-controller-manager based on your requirements. | All regions | Customize the parameters of control plane components in ACK Pro clusters |
Alerting | The alerting feature is added to enable centralized alert management. ACK allows you to configure alerts to centrally manage exceptions in the cluster and provides various metrics for different scenarios. By default, the alerting feature is enabled when you create clusters. ACK allows you to deploy CRD objects in a cluster to configure and manage alert rules. | All regions |
March 2021
Feature | Description | Region | References |
Data export supported by node pools | Information about nodes in a node pool can be exported to comma-separated values (CSV) files. This improves the O&M efficiency. | All regions | |
SANs updatable for ACK managed clusters | Updates to the SANs in the API server certificates are supported for ACK standard and ACK Pro clusters. | All regions | Customize the SANs of the API server certificate when you create an ACK cluster |
Temporary kubeconfig files for cluster access | Temporary kubeconfig files are supported for access to ACK clusters. The validity period of a temporary kubeconfig file used to access an ACK cluster ranges from 30 minutes to 3 days. This meets the requirements for temporary access to ACK clusters. | All regions | Obtain the kubeconfig file of a cluster and use kubectl to connect to the cluster |
containerd | The containerd runtime is supported by ACK. You can select containerd as the container runtime when you create a cluster. You can also select containerd when you create a regular node pool or a managed node pool. This allows you to deploy both containerd containers and Docker containers in a cluster. Hot migration from Docker containers to containerd containers is not supported. To migrate from Docker containers to containerd containers, you must recreate pods. | All regions |
February 2021
Feature | Description | Region | References |
ACK Edge Pro cluster | ACK Edge Pro cluster can be created. This type of cluster provides the same reliability and stability as ACK Pro clusters. The billing methods of ACK Edge Pro cluster are also the same as those of ACK Pro clusters. | All regions | |
Log center | The log center feature is available in the ACK console. You can check the log of a cluster and the logs of control plane components in the log center. | All regions | Query the logs of control plane components and View cluster logs |
Prometheus monitoring dashboards | A CoreDNS dashboard is displayed on the Prometheus Monitoring page in the ACK console. | All regions | |
EIPs supported by node pools | Public IPv4 addresses can be associated with regular node pools and managed node pools. When you create a regular node pool or a managed node pool, you can enable the nodes to automatically associate with EIPs. This enables the nodes to access the Internet. You can also configure a NAT gateway when you create a cluster to enable all nodes in the cluster to access the Internet by using the NAT gateway. | All regions | |
New region | ACK Pro clusters are available in the China South 1 Finance region. | China South 1 Finance |
January 2021
Feature | Description | Region | References |
Observability enabled for control plane components of ACK Pro clusters | The observabilities of the API server and etcd control components are enabled in ACK Pro clusters. You can observe these components in monitoring dashboards and receive alerts upon exceptions. This allows you to detect system exceptions and potential risks, and provides information to help you implement measures to ensure the stability of ACK clusters. | All regions | |
Custom configuration for control plane components of ACK Pro clusters | Custom parameters are supported for kube-apiserver and kube-controller-manager in ACK Pro clusters. This meets the requirements for custom parameters of cluster control components in production environments. | All regions | Customize the parameters of control plane components in ACK Pro clusters |
Log collection for control plane components | Logs of control components, such as kube-apiserver, kube-controller-manager, and kube-scheduler, can be collected. To enable log collection, select Enable for Log Collection for Control Plane Components when you create a cluster. This helps you monitor the cluster status and detect anomalies in the cluster. | All regions | |
Preemptible instances supported by node pools | Preemptible instances are supported when you set the billing method of a node pool. Preemptible instances are cost-effective. You can bid for idle resources of Alibaba Cloud, obtain the resources, and then run containers until the resources are reclaimed due to higher bids from other customers. This reduces the cost of computing resources. | All regions | Set the ratio of preemptible instances to pay-as-you-go instances in a node pool |
Edge node pool | Edge node pools are supported in ACK edge clusters. You can abstract a set of nodes with one or more identical attributes into an edge node pool for an ACK Edge cluster. This way, you can use the edge node pool to manage and perform O&M operations on nodes from different regions in a unified manner. An edge node pool uses the basic or enhanced coordination network between the cloud and edge. The enhanced coordination network is built by using the software-defined networking (SDN) solution of ACK@Edge, and allows you to coordinate cloud and edge computing in a secure and fast network environment. This allows applications deployed in edge node pools to access the cloud through the VPC where the cluster is deployed. Compared with the basic coordination network, the enhanced coordination network provides higher network quality and improves data security. | All regions | |
Elastic node pool supported by registered clusters | Node pools are supported in registered clusters. You can use a node pool to manage a set of ECS instances with the same attributes. You can also add them to a self-managed Kubernetes cluster or a Kubernetes cluster that is deployed in the public cloud of a third-party cloud service provider. This allows you to schedule resources in the cloud, data centers, and self-managed Kubernetes clusters in a unified, flexible, and cost-effective manner. | All regions | |
Application backup | The application backup feature is released. This feature meets the critical requirement for data security in Kubernetes clusters where an increasing number of applications are deployed. You can use application backups to restore applications that are accidentally disrupted for a long period of time. Different from the traditional single-server backup and disk backup, the application backup feature is used to back up applications and the relevant data, resource objects, and configurations. You can also use this feature to back up all resources in a namespace. This feature is available in ACK clusters and registered clusters. You can use this feature to back up applications, volumes, and persistent volumes (PVs) in a cluster, and also restore backups to other clusters. | All regions | |
Cost reduction policy | The ratio of preemptible instances to pay-as-you-go instances can be set in a node pool. This allows you to reduce the cost. However, you must make sure that the node pool has enough pay-as-you-go instances to ensure performance stability. | All regions | Set the ratio of preemptible instances to pay-as-you-go instances in a node pool |