Container Service for Kubernetes:Use RRSA for pod-level access control

Get the OIDC provider URL and ARN

After RRSA is enabled, hover over the Enabled label next to RRSA OIDC in the Security and Auditing section. The URL and Alibaba Cloud Resource Name (ARN) of the OIDC provider are displayed.

Record both values for use when configuring RAM roles and application templates.

1. Install ack-pod-identity-webhook

ack-pod-identity-webhook automatically injects the OIDC token file path and RAM role ARN into pods as environment variables. Skip this step to configure pod templates manually. See Manually configure pod templates.

1. In the ACK console, click the name of your cluster. In the left navigation pane, click Add-ons.

2. On the Add-ons page, click the Security tab.

3. Find ack-pod-identity-webhook and click Install.

4. Confirm the information and click OK.

2. Create or configure a RAM role for the OIDC identity provider

{
  "Action": "sts:AssumeRole",
  "Condition": {
    "StringEquals": {
      "oidc:aud": "sts.aliyuncs.com",
      "oidc:iss": "<oidc_issuer_url>",
      "oidc:sub": "system:serviceaccount:<namespace>:<service_account>"
    }
  },
  "Effect": "Allow",
  "Principal": {
    "Federated": [
      "<oidc_provider_arn>"
    ]
  }
}

ack-ram-tool rrsa associate-role --cluster-id <cluster_id> \
    --namespace <namespace> --service-account <service_account> \
    --role-name <role_name> --create-role-if-not-exist

3. Grant permissions to the RAM role

Attach the AliyunCSReadOnlyAccess policy to demo-role-for-rrsa. See Grant permissions to a RAM role.

This grants the application read-only access to ACK cluster information.

4. Deploy your application

Create a file named demo.yaml with the following content. The namespace label pod-identity.alibabacloud.com/injection: 'on' and the service account annotation pod-identity.alibabacloud.com/role-name: demo-role-for-rrsa enable automatic injection by ack-pod-identity-webhook. See ack-pod-identity-webhook.

---
apiVersion: v1
kind: Namespace
metadata:
  name: rrsa-demo
  labels:
    pod-identity.alibabacloud.com/injection: 'on'

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: demo-sa
  namespace: rrsa-demo
  annotations:
    pod-identity.alibabacloud.com/role-name: demo-role-for-rrsa

---
apiVersion: v1
kind: Pod
metadata:
  name: demo
  namespace: rrsa-demo
spec:
  serviceAccountName: demo-sa
  containers:
    - image: registry.cn-hangzhou.aliyuncs.com/acs/ack-ram-tool:1.3.0
      args:
        - rrsa
        - demo
      name: demo
  restartPolicy: OnFailure

Deploy the application:

kubectl apply -f demo.yaml

5. Verify the injected configuration

Confirm that ack-pod-identity-webhook injected the required environment variables and volume mounts:

kubectl -n rrsa-demo get pod demo -o yaml

The expected output includes the following injected items:

A correctly injected pod spec looks like this:

apiVersion: v1
kind: Pod
metadata:
  name: demo
  namespace: rrsa-demo
spec:
  containers:
  - args:
    - rrsa
    - demo
    env:
    - name: ALIBABA_CLOUD_ROLE_ARN
      value: acs:ram::1***:role/demo-role-for-rrsa
    - name: ALIBABA_CLOUD_OIDC_PROVIDER_ARN
      value: acs:ram::1***:oidc-provider/ack-rrsa-c***
    - name: ALIBABA_CLOUD_OIDC_TOKEN_FILE
      value: /var/run/secrets/ack.alibabacloud.com/rrsa-tokens/token
    - name: ALIBABA_CLOUD_STS_ENDPOINT
      value: sts-vpc.cn-hangzhou.aliyuncs.com
    - name: ALIBABA_CLOUD_STS_REGION
      value: cn-hangzhou
    - name: ALIBABA_CLOUD_VPC_ENDPOINT_ENABLED
      value: "true"
    image: registry.cn-hangzhou.aliyuncs.com/acs/ack-ram-tool:1.3.0
    imagePullPolicy: Always
    name: demo
    volumeMounts:
    - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
      name: kube-api-access-4bwdg
      readOnly: true
    - mountPath: /var/run/secrets/ack.alibabacloud.com/rrsa-tokens
      name: rrsa-oidc-token
      readOnly: true
  restartPolicy: OnFailure
  serviceAccount: demo-sa
  serviceAccountName: demo-sa
  volumes:
  - name: kube-api-access-4bwdg
    projected:
      defaultMode: 420
      sources:
      - serviceAccountToken:
          expirationSeconds: 3607
          path: token
      - configMap:
          items:
          - key: ca.crt
            path: ca.crt
          name: kube-root-ca.crt
      - downwardAPI:
          items:
          - fieldRef:
              apiVersion: v1
              fieldPath: metadata.namespace
            path: namespace
  - name: rrsa-oidc-token
    projected:
      defaultMode: 420
      sources:
      - serviceAccountToken:
          audience: sts.aliyuncs.com
          expirationSeconds: 3600
          path: token

6. Check application logs

Print the application log:

kubectl -n rrsa-demo logs demo

A successful run lists the clusters in your Alibaba Cloud account:

cluster id: cf***, cluster name: foo*
cluster id: c8***, cluster name: bar*
cluster id: c4***, cluster name: foob*

Optional: To verify least-privilege enforcement, detach the AliyunCSReadOnlyAccess policy from the RAM role (see Remove permissions from a RAM role). Wait 30 seconds, then run the log command again. The application returns a 403 error similar to:

   StatusCode: 403
   Code: StatusForbidden
   Message: code: 403, STSToken policy Forbidden for action cs:DescribeClustersForRegion request id: E78A2E2D-***
   Data: {"accessDeniedDetail":{"AuthAction":"cs:DescribeClustersForRegion","AuthPrincipalDisplayName":"demo-role-for-rrsa:ack-ram-tool","AuthPrincipalOwnerId":"11***","AuthPrincipalType":"AssumedRoleUser","NoPermissionType":"ImplicitDeny","PolicyType":"ResourceGroupLevelIdentityBasedPolicy"},"code":"StatusForbidden","message":"STSToken policy Forbidden for action cs:DescribeClustersForRegion","requestId":"E78A2E2D-***","status":403,"statusCode":403}

This confirms that RRSA is enforcing permissions at the pod level.

Supported SDK versions and demos

See the credentials documentation for each language — Method 6: Use the RAM role of an OIDC IdP.

Cloud-service-specific SDK demos

Some cloud service SDKs provide native OIDC token support:

Alibaba Cloud CLI

Alibaba Cloud CLI v3.0.206 and later support RRSA. Set region_id to your target region.

Option A: Configuration file. Set mode to OIDC in ~/.aliyun/config.json:

{
  "current": "rrsa",
  "profiles": [
    {
      "name": "rrsa",
      "mode": "OIDC",
      "region_id": "cn-hangzhou",
      "ram_session_name": "test-rrsa"
    }
  ],
  "meta_path": ""
}

Option B: Direct command (no configuration file required):

aliyun sts GetCallerIdentity --region cn-hangzhou --role-session-name=test-rrsa

Expected output:

{
  "AccountId": "11380***",
  "Arn": "acs:ram::1138***:assumed-role/test-rrsa-***/test-rrsa",
  "IdentityType": "AssumedRoleUser",
  "PrincipalId": "33300***:test-rrsa",
  "RequestId": "20F78881-F47E-5771-90D6-***",
  "RoleId": "33300***"
}

See Credential types.

ossutil 2.0

ossutil V2.1.0 and later support RRSA. Replace region with your actual region.

Set mode to oidcRoleArn in ~/.ossutilconfig:

cat <<EOF > ~/.ossutilconfig
[default]
mode = oidcRoleArn
OIDCProviderArn = "${ALIBABA_CLOUD_OIDC_PROVIDER_ARN}"
OIDCTokenFilePath = "${ALIBABA_CLOUD_OIDC_TOKEN_FILE}"
roleArn = "${ALIBABA_CLOUD_ROLE_ARN}"
roleSessionName = test-rrsa
region = cn-hangzhou
EOF

See Examples in the ossutil 2.0 documentation.

Simple Log Service CLI

Simple Log Service CLI does not support OIDC configuration files. Use ack-ram-tool to inject credentials at runtime:

ack-ram-tool export-credentials -f environment-variables -- aliyunlog log list_project --region-endpoint=cn-hangzhou.log.aliyuncs.com

Terraform

Alibaba Cloud Provider V1.222.0 and later support assume_role_with_oidc. Set region to your target region.

Add assume_role_with_oidc to your provider configuration:

provider "alicloud" {
  assume_role_with_oidc {
    role_session_name = "terraform-with-rrsa-auth-example"
  }
  region = "cn-hangzhou"
}

See Terraform RRSA demo.

SDK errors