Alibaba Cloud architecture for APAC workloads
Provider-scoped consulting on this control plane is Alibaba Cloud architecture consulting. Region comparison with other providers is AWS vs Azure vs Google Cloud vs Alibaba Cloud for APAC.
Alibaba Cloud
Account design for Alibaba Cloud in APAC, then a private ACK cluster built with OpenTofu. Read the architecture guide before the cluster series. The later pages cover node pools, shared state, and the networking, identity and cost decisions that show up once the cluster exists. The OpenTofu modules are in the VigilesHQ Alibaba Cloud ACK repository .
Guides
-
-
Building Secure Alibaba Cloud ACK Platforms
Build private Alibaba Cloud ACK clusters with OpenTofu, secure node pools, Spot autoscaling, OSS state locking and private Argo CD.
-
Build a secure Alibaba Cloud ACK cluster with OpenTofu
The example is a private API in ap-southeast-1, three zones, and pod egress that leaves nodes without a public address. The complete OpenTofu example is available in the VigilesHQ Alibaba Cloud ACK repository. VPC 172.21.0.0/16 and names such as vpc-example are stand-ins. A real apply uses the account GetCallerIdentity returns.
-
Alibaba Cloud ACK node pools: subscription, Spot and autoscaling
CoreDNS, the Terway daemon and the cluster autoscaler components have a different failure budget from the application. If a Spot node disappears, the API should reschedule. If the only node running CoreDNS disappears, every lookup in the cluster fails until a replacement is Ready. This page splits those two budgets for the private ACK cluster described in Build a secure Alibaba Cloud ACK cluster with OpenTofu.
-
OpenTofu remote state and private GitOps on Alibaba Cloud
Two people applying the same stack from two laptops will eventually both think they hold the latest state. One apply refreshes, the other writes an older serial, and a node pool disappears because the second plan never saw it. The fix is a private OSS object per stack and a TableStore row that only one OpenTofu process can hold. Do that before the migration. The first collision is too late.
-
Generative AI on Alibaba Cloud
A chapter-by-chapter series that applies Generative AI on AWS to Alibaba Cloud Model Studio, PAI and Qwen, with runnable demos and token cost for each step.
-
Generative AI on Alibaba Cloud: use cases, Qwen models and the project life cycle
Generative AI on AWS describes a six-stage project life cycle. On Alibaba Cloud the same stages run on Model Studio, PAI and the monitoring stack. This part maps each stage, prices four Qwen models for one realistic workload, and walks through a first API call from Singapore with cost controls in place.
-
Prompt engineering with Qwen on Alibaba Cloud Model Studio
Chapter 2 of Generative AI on AWS teaches prompt structure, in-context learning and sampling parameters. This part runs every technique against qwen3.8-flash on Model Studio, adds the two things the book could not cover in 2023, built-in thinking mode and JSON output, and shows what each choice does to the token bill.
-
How Qwen models work: tokens, embeddings, attention and scaling laws
Chapter 3 of Generative AI on AWS explains tokenizers, embeddings, the transformer and scaling laws. This part measures the Qwen tokenizer across five languages, sizes text-embedding-v4 vectors for a search index, and shows where each internal step shows up on a Model Studio bill, with scripts you can run to check the numbers yourself.
Networking
Hub routing and egress cost. The ACK series sends node and pod traffic out through one NAT gateway.
-
Hub-and-spoke cloud networking
Background terms sit in cloud networking fundamentals. Egress money sits in egress cost planning. The hub is the place you put things you do not want copied in every application network:
-
Egress cost planning
Use the egress cost estimator for a formula pass. It is not an invoice. The operational path for a sudden jump is cross-region traffic cost. Treat each hop as a meter:
-
NAT gateway cost increase
NAT cost has two parts: time the gateway exists, and traffic it translates. Most surprises are traffic. Related: egress cost planning and unexpected cost spike.
Kubernetes
The ACK build is listed above. These pages cover cluster cost after the nodes are running.
-
Kubernetes cost allocation
The worksheet on this site is the Kubernetes cost allocation calculator. A spend jump on the cluster is Kubernetes cluster cost increase. The provider bills: It cannot see that namespace/payments used 30% of a node's CPU unless you export in-cluster usage and join it to the node SKU price. That join is cost allocation. The FinOps Framework calls this allocation. It is not the same as a discount.
-
Kubernetes cluster cost increase
A Kubernetes bill is a bundle: control plane, workers, disks, load balancers, NAT, logs and often GPU. Allocation comes after you know which of those moved. See Kubernetes cost allocation.
Security
RAM roles and RRSA for the cluster are in the ACK guide. These pages cover identity when Alibaba Cloud is one of the control planes.
-
What a Cross-Cloud Security Incident Changed in Our Kubernetes Rebuild
The response team found evidence that cloud identities and compute resources could no longer be trusted. The affected estate spanned AWS and Alibaba Cloud. Workloads were still running.
-
Designing multi-cloud identity
The single-cloud baseline is IAM fundamentals. Whether a second cloud is justified at all is single cloud vs multi-cloud. AWS IAM Identity Center (used by Control Tower) maps IdP groups to permission sets, then to accounts in Organizations. Azure RBAC maps Entra groups to roles on management groups, subscriptions and resource groups.
-
Identity and access management fundamentals
Human sign-in (IAM Identity Center, Microsoft Entra ID, Google identities, Alibaba Cloud accounts) is the front door. Authorization is the part that pages you at 2 a.m.
FinOps
Tagging and spend spikes for an Alibaba Cloud account, including the lines a NAT gateway or a node pool can add.
-
Cloud tagging and cost allocation
The concept layer is cloud cost allocation fundamentals. The FinOps operating definition is What is FinOps?. Required keys that earn their place: Optional keys (compliance, data-class) help security reviews. They rarely help the monthly allocate meeting. AWS tag policies and Azure Policy can deny creates that omit the required set. Google Cloud organization policies can require labels on selected resource types.
-
Finding unexpected cloud cost increases
The hour-by-hour operational checklist is unexpected cloud cost spike. Optimization after you know the meter is cloud cost optimization. Pick a baseline window (last month, or the same weekdays last week) and the spike window. Use the same granularity and the same metric.