All Products
Search
Document Center

Container Service for Kubernetes:Grant access permissions to an MSE Ingress controller

Last Updated:Nov 24, 2025

To access services through an MSE Ingress in an ACK Serverless cluster, you must grant the MSE Ingress controller the required permissions to access MSE before you deploy the services. This topic describes how to grant permissions to the MSE Ingress controller in an ACK Serverless cluster.

Step 1: Install the MSE Ingress Controller component

Method 1: Install the MSE Ingress Controller component when you create a cluster

When you create an ACK Serverless cluster, go to the Component Configurations step. In the Ingress section, select MSE Ingress. For more information about how to create an ACK Serverless cluster, see Create an ACK Serverless cluster.image

Method 2: Install the MSE Ingress Controller component on the Component Management page for an existing cluster

  1. Log on to the ACK console. In the left navigation pane, click Clusters.

  2. On the Clusters page, find the cluster that you want to manage and click the name of the cluster or click Details in the Actions column. The details page of the cluster appears.

  3. In the left-side navigation pane of the details page, click Add-ons.

  4. On the Add-ons page, click the Networking tab. In the lower-right corner of the MSE Ingress Controller component, click Install.

  5. In the dialog box that appears, click OK.

Step 2: Grant permissions to the MSE Ingress controller

  1. Go to the Cloud Resource Access Authorization page and click Confirm Authorization.

    After the authorization is successful, the MSE Ingress controller is granted the permissions of the AliyunMSEForECIRole role.

  2. Log on to the ACK console. In the left navigation pane, click Clusters.

  3. On the Clusters page, find the cluster you want to manage and click its name. In the left navigation pane, choose Workloads > Deployments.

  4. At the top of the Deployments page, select All Namespaces. In the search box, enter ack-mse-ingress-controller to find the application. In the Actions column for the application, choose image > Redeploy and click Confirm.

    After the redeployment is complete, click the ack-mse-ingress-controller application on the Deployments page. On the Pods tab, verify that the pod is in the Running state. This state indicates that the redeployment is successful.