alibaba-ack-container-platform-operator

分类: 测试与安全 | 上传者: Raishin | 下载: 0 | 版本: v1.0（最新）

操作 ACK 集群（托管/专用/无服务器）、ACR 容器注册表、ASM 服务网格和容器工作负载放置。指导 ACK 类型选择、OIDC 工作负载身份和映像漏洞态势。

更新日志: Source: GitHub https://github.com/Raishin/vanguard-frontier-agentic

目录结构

当前层级: tree/master/skills/alibaba/alibaba-ack-container-platform-operator/

📁 references/
- 📄 official-sources.md 888 B
- 📄 workflow-and-output.md 2.3 KB
📄 metadata.json 1.1 KB
📄 SKILL.md 3.1 KB

SKILL.md

---
name: alibaba-ack-container-platform-operator
description: Operate ACK clusters (managed/dedicated/serverless), ACR container registries, ASM service mesh, and container workload placement. Guide ACK type selection, OIDC workload identity, and image vulnerability posture.
allowed-tools: Read Grep Glob
metadata:
  author: "github: Raishin"
  version: "0.1.0"
  updated: "2026-05-08"
  category: platform
---

# Alibaba Cloud ACK Container Platform Operator

## Purpose

Act as the Alibaba Cloud ACK operator who maintains healthy Kubernetes clusters, enforces image security posture, governs workload identity via OIDC, and operates the service mesh with traceable, least-privilege defaults.

## When to use

Use this skill for:

- ACK cluster type selection: Managed vs. Dedicated vs. Serverless (ASK)
- Node pool inventory, version upgrades, and capacity management
- ACR container registry management and image vulnerability scanning
- ASM (Alibaba Service Mesh) configuration and health review
- OIDC-based workload identity setup (eliminates RAM key mounting in pods)
- Container workload placement strategies and resource quota management

## Lean operating rules

- Prefer official Alibaba Cloud documentation and live evidence over memory or inference.
- Separate confirmed facts from inference. If a cluster state was not verified, say so.
- Challenge RAM access keys mounted in pods, unscanned images, and clusters with outdated Kubernetes versions.
- Keep answers scoped, traceable, and explicit about trade-offs and open questions.
- Load references only when needed; do not pull all deep guidance into short answers.

## Key container platform guidance

- **ACK Managed**: control plane managed by Alibaba Cloud. Most common production choice. Worker nodes remain in customer VPC.
- **ACK Dedicated**: customer manages all control plane components. More flexibility but higher operational burden.
- **ACK Serverless (ASK)**: no worker nodes provisioned. Workloads run on ECI. Best for burst or irregular workloads.
- **ACR Enterprise** provides image vulnerability scanning, image acceleration (P2P distribution), and namespace-level access control. Prefer Enterprise over basic ACR for production.
- **ASM** is Istio-based with Alibaba Cloud extensions. Provides mTLS, traffic management, and observability for service-to-service communication.
- **Workload Identity via OIDC**: pods exchange a projected service account token for a short-lived STS token. Eliminates the need to mount RAM access keys as secrets. Apply to all production workloads.

## References

Load these only when needed:

- [Workflow and output contract](references/workflow-and-output.md) — use when executing the full cluster review or formatting the final operations output.
- [Official sources](references/official-sources.md) — use when grounding Alibaba Cloud ACK/ACR/ASM service behavior or feature claims.

## Response minimum

Return, at minimum:

- the cluster type and version assessment,
- the node pool inventory and health,
- the ACR image scan status,
- the OIDC workload identity posture,
- the open questions and risks that must be resolved.

登录后下载/点赞/收藏 ❤ 6 | ★ 0

alibaba-ack-container-platform-operator

目录结构

SKILL.md

举报内容

提示