Building Secure Alibaba Cloud ACK Platforms
Build private Alibaba Cloud ACK clusters with OpenTofu, secure node pools, Spot autoscaling, OSS state locking and private Argo CD.
Each guide includes tested configuration examples, deployment checks, common errors and the evidence needed before moving to the next stage.
Guide details
- Platform
- Alibaba Cloud ACK Pro managed clusters
- Infrastructure as code
- OpenTofu 1.12.x
- Provider
- aliyun/alicloud 1.241 or later
- Example region
- Singapore, ap-southeast-1
- Network model
- Private API, three zones and controlled NAT egress
- Last technically verified
- September 23, 2026
- Documentation baseline
- Alibaba Cloud documentation available on September 23, 2026
What you will build
-
Multi-zone network
A VPC with separate address space for nodes, pods, management, data and application entry points across three zones.
-
Private ACK cluster
An ACK Pro cluster with a private Kubernetes API, Terway networking, RRSA and deletion protection.
-
Controlled internet access
A NAT Gateway and stable EIP for node and pod egress, without public IP addresses on cluster nodes.
-
Secure node pools
Fixed subscription system pools and an autoscaling Spot application pool with encrypted ESSD disks.
-
Shared OpenTofu state
A private, versioned OSS bucket with TableStore locking for safe work across engineers and CI jobs.
-
Private GitOps
Argo CD running as a ClusterIP service, with private API access and no default public exposure.
Follow the guides in order. The network and cluster foundation must exist before node pools, and remote state must be protected before more engineers or CI jobs manage the platform.
-
Part 1
How to Build a Secure Alibaba Cloud ACK Cluster with OpenTofu
Plan the resource groups, CIDRs, VPC, vSwitches, NAT egress and private ACK control plane. Add Terway, RRSA, disk encryption, SLS logging and the required service roles.
You will finish with a validated private cluster foundation across three availability zones.
-
Part 2
Alibaba Cloud ACK Node Pools: Subscription, Spot and Autoscaling
Create fixed subscription pools for system services and a multi-zone Spot pool for applications. Check ECS stock, KMS access, ACK add-ons, SLB quota and autoscaling behaviour before applying.
You will finish with private, encrypted node pools that can scale application capacity from 2 to 10 nodes.
-
Part 3
OpenTofu Remote State and Private GitOps on Alibaba Cloud
Move OpenTofu state into private OSS with TableStore locking, then add controlled CI and private Argo CD. The guide covers migration, lock testing, GitLab allowlisting and recovery.
You will finish with shared state, working locks and a private GitOps path for the cluster.
Source code
The OpenTofu modules, example environments and validation tests are maintained in the public VigilesHQ repository. The website contains focused code excerpts only.