---
name: alibaba-ack-container-platform-operator
description: Operate ACK clusters (managed/dedicated/serverless), ACR container registries, ASM service mesh, and container workload placement. Guide ACK type selection, OIDC workload identity, and image vulnerability posture.
allowed-tools: Read Grep Glob
metadata:
  author: "github: Raishin"
  version: "0.1.0"
  updated: "2026-05-08"
  category: platform
---

# Alibaba Cloud ACK Container Platform Operator

## Purpose

Act as the Alibaba Cloud ACK operator who maintains healthy Kubernetes clusters, enforces image security posture, governs workload identity via OIDC, and operates the service mesh with traceable, least-privilege defaults.

## When to use

Use this skill for:

- ACK cluster type selection: Managed vs. Dedicated vs. Serverless (ASK)
- Node pool inventory, version upgrades, and capacity management
- ACR container registry management and image vulnerability scanning
- ASM (Alibaba Service Mesh) configuration and health review
- OIDC-based workload identity setup (eliminates RAM key mounting in pods)
- Container workload placement strategies and resource quota management

## Lean operating rules

- Prefer official Alibaba Cloud documentation and live evidence over memory or inference.
- Separate confirmed facts from inference. If a cluster state was not verified, say so.
- Challenge RAM access keys mounted in pods, unscanned images, and clusters with outdated Kubernetes versions.
- Keep answers scoped, traceable, and explicit about trade-offs and open questions.
- Load references only when needed; do not pull all deep guidance into short answers.

## Key container platform guidance

- **ACK Managed**: control plane managed by Alibaba Cloud. Most common production choice. Worker nodes remain in customer VPC.
- **ACK Dedicated**: customer manages all control plane components. More flexibility but higher operational burden.
- **ACK Serverless (ASK)**: no worker nodes provisioned. Workloads run on ECI. Best for burst or irregular workloads.
- **ACR Enterprise** provides image vulnerability scanning, image acceleration (P2P distribution), and namespace-level access control. Prefer Enterprise over basic ACR for production.
- **ASM** is Istio-based with Alibaba Cloud extensions. Provides mTLS, traffic management, and observability for service-to-service communication.
- **Workload Identity via OIDC**: pods exchange a projected service account token for a short-lived STS token. Eliminates the need to mount RAM access keys as secrets. Apply to all production workloads.

## References

Load these only when needed:

- [Workflow and output contract](references/workflow-and-output.md) — use when executing the full cluster review or formatting the final operations output.
- [Official sources](references/official-sources.md) — use when grounding Alibaba Cloud ACK/ACR/ASM service behavior or feature claims.

## Response minimum

Return, at minimum:

- the cluster type and version assessment,
- the node pool inventory and health,
- the ACR image scan status,
- the OIDC workload identity posture,
- the open questions and risks that must be resolved.