Use RBAC to authorize operations on cluster resources - Container Service for Kubernetes

How it works

The ACK authorization system has two layers: Alibaba Cloud RAM and Kubernetes RBAC. Together, they form a complete authorization chain from cloud resources to in-cluster resources.

RAM: Controls who can access a cluster. It manages permissions at the cloud resource level, governing a user's permissions to perform OpenAPI operations on ACK clusters and dependent cloud services.
RBAC: Determines what a user can do inside the cluster. It provides fine-grained authorization within the cluster, defining which operations, such as create or delete, a user can perform on specific Kubernetes resources, such as Pods and Deployments.

Step 1: Grant RAM permissions

RAM permissions determine whether a user can access the cloud resources of an ACK cluster. An Alibaba Cloud account already has all RAM permissions and can skip this step. To grant RAM permissions to a RAM user or role, choose one of the following methods.

Method 1: Use system policies

Important

The system policies AliyunRAMReadOnlyAccess and AliyunCSFullAccess grant broad permissions. For more granular control, see Method 2: Use a custom policy for fine-grained authorization.

Log on to the RAM console with an Alibaba Cloud account and find the RAM user or role you want to authorize.
- For a RAM user: Choose Credential Management > User. In the user list, find the target user and click Attach Policy in the Actions column.
- For a RAM role: Choose Credential Management > Role. In the role list, find the target role and click Attach Policy in the Actions column.
Set Resource Scope to Account. In the Policies section, find and select the AliyunRAMReadOnlyAccess and AliyunCSFullAccess system policies. Follow the on-screen instructions to complete the authorization.

Method 2: Use a custom policy

A permissions administrator must be able to perform the following actions:

View information about other RAM identities.
View cluster lists and details.
View existing RBAC configurations in a cluster.
Perform RBAC authorization operations in a cluster.

Log on to the RAM console and use the following sample policy to grant the required RAM permissions to the target RAM user or RAM role. For more information, see Use a custom policy to grant permissions.

{
    "Statement": [{
            "Action": [
                "ram:Get*",
                "ram:List*",
                "cs:Get*",
                "cs:Describe*",
                "cs:List*",
                "cs:GrantPermission"
            ],
            "Resource": "*",
            "Effect": "Allow"
        }
    ],
    "Version": "1"
}

Step 2: Grant RBAC permissions

RBAC permissions determine which operations a user can perform on Kubernetes resources within a cluster.

(Optional) Set a permissions administrator

An Alibaba Cloud account can manage RBAC permissions by default. To delegate this to a RAM user or role, first designate them as a permissions administrator. You can skip this step if a permissions administrator already exists or if you are using your Alibaba Cloud account.

Log on to the ACK console with your Alibaba Cloud account and grant the predefined Administrator role to the target RAM user or RAM role at the cluster level.

Log on to the ACK console. In the left navigation pane, click Authorizations.
On the Authorizations page, configure management permissions.
- To authorize a RAM user: Click the RAM Users tab, find the target RAM user, and click Modify Permissions in the Actions column to go to the Permissions page.
- To authorize a RAM role: Click the RAM Role tab, select the target RAM role, and click Modify Permissions to go to the Permissions page.
Click + Add Permissions. Follow the on-screen instructions to add cluster-level and namespace-level permissions, and select Administrator as the predefined role.
If you grant this authorization for all clusters, the permissions administrator role is automatically applied to new clusters, eliminating the need for repeated authorization.

Authorize operations

Log on to the console as an Alibaba Cloud account or a permissions administrator to grant RBAC permissions to the target RAM user or RAM role.

Log on to the ACK console. In the left navigation pane, click Authorizations.
On the Authorizations page, configure management permissions.
- To authorize a RAM user: Click the RAM Users tab, find the target RAM user, and click Modify Permissions in the Actions column to go to the Permissions page.
- To authorize a RAM role: Click the RAM Role tab, select the target RAM role, and click Modify Permissions to go to the Permissions page.
Click + Add Permissions. Follow the on-screen instructions to add cluster-level or namespace-level permissions for the target RAM user or RAM role, and then select a predefined role.
Select a predefined role based on the user's responsibilities. For more information about the permissions of each predefined role, see Predefined roles.

After authorization is complete, the target RAM user or RAM role can operate Kubernetes resources in the cluster according to their granted permissions.

Applying to production environments

To enhance the security and maintainability of permission management, follow these best practices.

Follow the principle of least privilege
Grant principals, such as RAM users and RAM roles, only the minimum set of permissions required to perform their tasks. Avoid indiscriminately granting high-privilege roles, such as Administrator.
Implement fine-grained authorization
- Layered authorization: Separate responsibilities between RAM for cloud resource access and RBAC for in-cluster resource access.
- Scoped access: Whenever possible, use a RoleBinding to limit permissions to a specific namespace instead of a cluster-wide ClusterRoleBinding.
- Precise role selection: Use the predefined roles from ACK whenever possible. If you must create a custom role, define the permission rules precisely and avoid using wildcards (*).
Practice continuous governance
Permission management is a dynamic process. Establish a regular audit mechanism to promptly revoke redundant or excessive permissions. Record and monitor the operations of high-privilege roles, such as permissions administrators.

Predefined roles

To simplify permission management and quickly address common use cases, ACK provides several predefined roles based on the RBAC mechanism.

Preset role	In-cluster RBAC permissions
Administrator	Full read/write access to all Kubernetes resources across all namespaces, including cluster nodes, PVs, namespaces, and resource quotas.
Read-only Administrator	Read-only access to all Kubernetes resources across all namespaces, including cluster nodes, PVs, namespaces, and resource quotas.
OM Engineer	Read/write access to console-exposed resources across all namespaces. Includes read/update access to cluster nodes, PVs, and namespaces, and read-only access to all other resources.
Developer	Read/write access to console-exposed resources in all or specified namespaces of the cluster.
Restricted User	Read-only access to console-exposed resources in all or specified namespaces of the cluster.
Custom	Permissions depend on the specified ClusterRole. To prevent identities from gaining unintended access, verify the permissions of the ClusterRole before assigning it. See Restrict resource operations with custom RBAC. Important Any RAM user or RAM role with the `cluster-admin` permission has full control over all cluster resources, equivalent to a root Alibaba Cloud account. Grant this permission with extreme caution.

FAQ

What do I do if I encounter a permission denied error code?

If an operation performed through the console or an API lacks the necessary RBAC permissions, a permission error is returned. The following table lists common errors and their solutions.

Error code or message	Note	Solution
`ForbiddenCheckControlPlaneLog`	Permission to view control plane logs is denied.	Grant the user the Administrator or O&M Engineer role.
`ForbiddenHelmUsage`	Permission to perform Helm operations is denied.	Grant the user the Administrator role.
`ForbiddenRotateCert`	Permission to perform certificate rotation is denied.	Grant the user the Administrator role.
`ForbiddenAttachInstance`	Permission to add a node is denied.	Grant the user the Administrator or O&M Engineer role.
`ForbiddenUpdateKMSState`	Permission to modify the cluster's Key Management Service (KMS) encryption-at-rest status is denied.	Grant the user the Administrator or O&M Engineer role.
`Forbidden get trigger`	Permission to retrieve application trigger information is denied.	Grant the user the Administrator, O&M Engineer, or Developer role.
`ForbiddenQueryClusterNamespace`	Permission to query cluster namespaces is denied.	Grant the user the Administrator, O&M Engineer, Developer, or Restricted User role.

How can I create custom permissions if predefined RBAC roles do not meet my needs?

Create a custom Role or ClusterRole by writing a YAML manifest. For example, you can create a ClusterRole that only allows users to view Pods, and then select this custom role during authorization. For more information, see Use a custom RBAC role to restrict operations on in-cluster resources.

RBAC policies only support 'Allow' rules. Explicit 'Deny' rules are not supported.

Container Service for Kubernetes:Use RBAC to authorize operations on cluster resources