Container Service for Kubernetes:Use RRSA to authorize different pods to access different cloud services

Get the OIDC provider URL and ARN

After RRSA is enabled, hover over the Enabled label next to RRSA OIDC in the Security and Auditing section. The URL and Alibaba Cloud Resource Name (ARN) of the OIDC provider are displayed.

You need both values when configuring RAM roles and application templates.

Step 1: Install ack-pod-identity-webhook

ack-pod-identity-webhook automatically injects the OIDC token file path and RAM role ARN into pods as environment variables. Skip this step if you prefer to configure the pod template manually — see Configure the pod template manually.

1. In the ACK console, click the name of your cluster. In the left navigation pane, choose Operations > Add-ons.

2. On the Add-ons page, click the Security tab.

3. Find ack-pod-identity-webhook and click Install on the card.

4. Confirm the information and click OK.

Step 2: Create a RAM role for the OIDC identity provider

Create a RAM role named demo-role-for-rrsa that trusts the cluster's OIDC identity provider (IdP). For full instructions, see Create a RAM role for an OIDC IdP.

Use the following parameter values:

The oidc:sub condition scopes the trust to a specific service account in a specific namespace. Replace rrsa-demo and demo-sa with your actual namespace and service account name.

Step 3: Grant permissions to the RAM role

Attach the AliyunCSReadOnlyAccess policy to demo-role-for-rrsa. For instructions, see Grant permissions to a RAM role.

This grants the application read-only access to ACK cluster information.

Step 4: Deploy the application

Create a file named demo.yaml with the following content. The namespace label pod-identity.alibabacloud.com/injection: 'on' and the service account annotation pod-identity.alibabacloud.com/role-name: demo-role-for-rrsa enable automatic injection by ack-pod-identity-webhook. For configuration details, see ack-pod-identity-webhook.

---
apiVersion: v1
kind: Namespace
metadata:
  name: rrsa-demo
  labels:
    pod-identity.alibabacloud.com/injection: 'on'

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: demo-sa
  namespace: rrsa-demo
  annotations:
    pod-identity.alibabacloud.com/role-name: demo-role-for-rrsa

---
apiVersion: v1
kind: Pod
metadata:
  name: demo
  namespace: rrsa-demo
spec:
  serviceAccountName: demo-sa
  containers:
    - image: registry.cn-hangzhou.aliyuncs.com/acs/ack-ram-tool:1.2.0
      imagePullPolicy: "Always"
      args:
        - rrsa
        - demo
        - --region=cn-hangzhou
      name: demo
  restartPolicy: OnFailure

Deploy the application:

kubectl apply -f demo.yaml

Step 5: Verify the injected configuration

Run the following command to confirm that ack-pod-identity-webhook injected the required environment variables and volume mounts into the pod:

kubectl -n rrsa-demo get pod demo -o yaml

The expected output includes the following injected items:

A correctly injected pod spec looks like this:

apiVersion: v1
kind: Pod
metadata:
  name: demo
  namespace: rrsa-demo
spec:
  containers:
  - args:
    - rrsa
    - demo
    env:
    - name: ALIBABA_CLOUD_ROLE_ARN
      value: acs:ram::1***:role/demo-role-for-rrsa
    - name: ALIBABA_CLOUD_OIDC_PROVIDER_ARN
      value: acs:ram::1***:oidc-provider/ack-rrsa-c***
    - name: ALIBABA_CLOUD_OIDC_TOKEN_FILE
      value: /var/run/secrets/ack.alibabacloud.com/rrsa-tokens/token
    image: registry.cn-hangzhou.aliyuncs.com/acs/ack-ram-tool:1.0.0
    imagePullPolicy: Always
    name: demo
    volumeMounts:
    - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
      name: kube-api-access-4bwdg
      readOnly: true
    - mountPath: /var/run/secrets/ack.alibabacloud.com/rrsa-tokens
      name: rrsa-oidc-token
      readOnly: true
  restartPolicy: OnFailure
  serviceAccount: demo-sa
  serviceAccountName: demo-sa
  volumes:
  - name: kube-api-access-4bwdg
    projected:
      defaultMode: 420
      sources:
      - serviceAccountToken:
          expirationSeconds: 3607
          path: token
      - configMap:
          items:
          - key: ca.crt
            path: ca.crt
          name: kube-root-ca.crt
      - downwardAPI:
          items:
          - fieldRef:
              apiVersion: v1
              fieldPath: metadata.namespace
            path: namespace
  - name: rrsa-oidc-token
    projected:
      defaultMode: 420
      sources:
      - serviceAccountToken:
          audience: sts.aliyuncs.com
          expirationSeconds: 3600
          path: token

Step 6: Check application logs

Run the following command to print the application log:

kubectl -n rrsa-demo logs demo

A successful run lists the clusters in your Alibaba Cloud account:

cluster id: cf***, cluster name: foo*
cluster id: c8***, cluster name: bar*
cluster id: c4***, cluster name: foob*

Optional: To verify that RRSA correctly enforces least-privilege access, detach the AliyunCSReadOnlyAccess policy from the RAM role (see Remove permissions from a RAM role). Wait 30 seconds, then run the log command again. The application returns a 403 error similar to:

   StatusCode: 403
   Code: StatusForbidden
   Message: code: 403, STSToken policy Forbidden for action cs:DescribeClustersForRegion request id: E78A2E2D-***
   Data: {"accessDeniedDetail":{"AuthAction":"cs:DescribeClustersForRegion","AuthPrincipalDisplayName":"demo-role-for-rrsa:ack-ram-tool","AuthPrincipalOwnerId":"11***","AuthPrincipalType":"AssumedRoleUser","NoPermissionType":"ImplicitDeny","PolicyType":"ResourceGroupLevelIdentityBasedPolicy"},"code":"StatusForbidden","message":"STSToken policy Forbidden for action cs:DescribeClustersForRegion","requestId":"E78A2E2D-***","status":403,"statusCode":403}

This confirms that RRSA is enforcing permissions at the pod level.

Supported SDK versions and demos

For the authentication method reference ("Method 6: Use the RAM role of an OIDC IdP"), see the credentials documentation for each language.

Cloud-service-specific SDK demos

Some cloud service SDKs have their own OIDC token support. The following demos show how to use RRSA with those SDKs:

Alibaba Cloud CLI

Alibaba Cloud CLI v3.0.206 and later support RRSA. Set region_id to your target region.

Option A: Configuration file. Set mode to OIDC in ~/.aliyun/config.json:

{
  "current": "rrsa",
  "profiles": [
    {
      "name": "rrsa",
      "mode": "OIDC",
      "region_id": "cn-hangzhou",
      "ram_session_name": "test-rrsa"
    }
  ],
  "meta_path": ""
}

Option B: Direct command (no configuration file required):

aliyun sts GetCallerIdentity --region cn-hangzhou --role-session-name=test-rrsa

Expected output:

{
  "AccountId": "11380***",
  "Arn": "acs:ram::1138***:assumed-role/test-rrsa-***/test-rrsa",
  "IdentityType": "AssumedRoleUser",
  "PrincipalId": "33300***:test-rrsa",
  "RequestId": "20F78881-F47E-5771-90D6-***",
  "RoleId": "33300***"
}

For credential type details, see Credential types.

ossutil 2.0

ossutil V2.1.0 and later support RRSA. Replace region with your actual region.

Set mode to oidcRoleArn in ~/.ossutilconfig:

cat <<EOF > ~/.ossutilconfig
[default]
mode = oidcRoleArn
OIDCProviderArn = "${ALIBABA_CLOUD_OIDC_PROVIDER_ARN}"
OIDCTokenFilePath = "${ALIBABA_CLOUD_OIDC_TOKEN_FILE}"
roleArn = "${ALIBABA_CLOUD_ROLE_ARN}"
roleSessionName = test-rrsa
region = cn-hangzhou
EOF

For configuration examples, see Examples in the ossutil 2.0 documentation.

Simple Log Service CLI

Simple Log Service CLI does not support OIDC configuration files. Use ack-ram-tool to inject credentials at runtime:

ack-ram-tool export-credentials -f environment-variables -- aliyunlog log list_project --region-endpoint=cn-hangzhou.log.aliyuncs.com

Terraform

Alibaba Cloud Provider V1.222.0 and later support assume_role_with_oidc. Set region to your target region.

Add assume_role_with_oidc to your provider configuration:

provider "alicloud" {
  assume_role_with_oidc {
    role_session_name = "terraform-with-rrsa-auth-example"
  }
  region = "cn-hangzhou"
}

For complete examples, see Terraform RRSA demo.

SDK errors