Alibaba Cloud ACK Deployment

This page includes only Alibaba Cloud Container Service for Kubernetes (ACK)-specific delta steps.

Review the Kubernetes Helm deployment page first, then apply the ACK changes in this guide.

Scope

This guide assumes that the baseline Helm deployment flow is complete, including:

• Helm chart setup
• base values.yaml preparation
• installation and upgrade flow
• Gateway admin and permission model

This page focuses on ACK RAM identity integration and ACK-specific values.yaml changes.

Prerequisites

Complete all baseline prerequisites from the main Helm deployment page, and add:

• An AliCloud authentication method in Akeyless.
• An ACK RAM role strategy:
  • Worker node RAM role, or
  • RAM Roles for Service Accounts (RRSA).
• If using RRSA, RRSA enabled on the cluster, the ack-pod-identity-webhook add-on installed, and a RAM role bound to the target Kubernetes ServiceAccount as documented in the ACK RRSA guide.

ACK Identity Delta

Set the Gateway auth type to alicloud and provide your AliCloud Access ID:

globalConfig:
  gatewayAuth:
    gatewayAccessId: <AliCloud Access ID>
    gatewayAccessType: alicloud
  allowedAccessPermissions: {}

With a worker node RAM role, nothing else is required: the Gateway uses the RAM role of the ECS instance it runs on.

For RRSA, enable automatic injection on the Gateway namespace:

kubectl label namespace <namespace> pod-identity.alibabacloud.com/injection=on

Then set the ServiceAccount annotation with the RAM role name:

globalConfig:
  serviceAccount:
    create: true
    serviceAccountName: <ACK ServiceAccount Name>
    annotations:
      pod-identity.alibabacloud.com/role-name: <RAM Role Name>

Validation Delta

After deployment, validate that the Gateway pod uses AliCloud identity successfully:

1. Confirm the pod is running:

   Shell

   kubectl get pods -n <namespace>

2. If using RRSA, verify the ServiceAccount annotation:

   Shell

   kubectl get sa <ACK ServiceAccount Name> -n <namespace> -o yaml

3. If using RRSA, verify that the role and OIDC token were injected into the pod:

   Shell

   kubectl get pod <Gateway Pod Name> -n <namespace> -o yaml | grep ALIBABA_CLOUD_

4. Validate Gateway connectivity and login through the management endpoint after install.

Related Tasks

• For shared Helm install and upgrade commands, use the main Kubernetes Helm deployment page.
• For advanced chart settings, use Advanced Kubernetes Configuration.
• For TLS configuration, use Configuring TLS.