Kubeconfig States in ACK Clusters Explained - ACK - Alibaba Cloud - Container Service for Kubernetes

If you need to view the access control status of the current cluster, you can invoke the ListClusterKubeconfigStates API to obtain the list and status of KubeConfig configurations that have been issued to users for the current cluster.

Operation description

Note

Invoking this API requires the ram:ListUsers and ram:ListRoles permissions.
Invoking this API requires permissions to manage Container Service (CS) (AliyunCSFullAccess).

Try it now

Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

Test

RAM authorization

The table below describes the authorization required to call this API. You can define it in a Resource Access Management (RAM) policy. The table's columns are detailed below:

Action: The actions can be used in the Action element of RAM permission policy statements to grant permissions to perform the operation.
API: The API that you can call to perform the action.
Access level: The predefined level of access granted for each API. Valid values: create, list, get, update, and delete.
Resource type: The type of the resource that supports authorization to perform the action. It indicates if the action supports resource-level permission. The specified resource must be compatible with the action. Otherwise, the policy will be ineffective.
- For APIs with resource-level permissions, required resource types are marked with an asterisk (*). Specify the corresponding Alibaba Cloud Resource Name (ARN) in the Resource element of the policy.
- For APIs without resource-level permissions, it is shown as All Resources. Use an asterisk (*) in the Resource element of the policy.
Condition key: The condition keys defined by the service. The key allows for granular control, applying to either actions alone or actions associated with specific resources. In addition to service-specific condition keys, Alibaba Cloud provides a set of common condition keys applicable across all RAM-supported services.
Dependent action: The dependent actions required to run the action. To complete the action, the RAM user or the RAM role must have the permissions to perform all dependent actions.

Action

Access level

Resource type

Condition key

Dependent action

cs:ListClusterKubeconfigStates

none

*Cluster

acs:cs:{#regionId}:{#accountId}:cluster/{#ClusterId}

None

Request syntax

GET /clusters/{ClusterId}/kubeconfig/states HTTP/1.1

Path Parameters

Parameter	Type	Required	Description	Example
ClusterId	string	No	The ID of the cluster.	c82e6987e2961451182edacd74faf****

Request parameters

Parameter	Type	Required	Description	Example
pageNumber	integer	No	The page number. Valid values: ≥ 1. Default value: 1.	1
pageSize	integer	No	The number of entries per page. Valid values: 10 to 50. Default value: 10	10
cloudServiceKubeConfig	boolean	No	Whether to query the KubeConfig list of service roles for cloud products within the cluster. true: Query the KubeConfig list of service roles for cloud products within the cluster. false: Query the KubeConfig list of Resource Access Management (RAM) users or roles within the cluster. Valid values: true : true false : false	true

Response elements

Element	Type	Description	Example
	object	The response body.
states	array<object>	The status list of the kubeconfig files associated with the cluster.
	array<object>
account_id	string	The ID of an Alibaba Cloud account, RAM user, or RAM role.	22855*****************
account_name	string	The logon name or role name of the RAM user.	tom
account_display_name	string	The displayed name or role name of the RAM user.	tom
account_type	string	The type of the account. RootAccount: Alibaba Cloud account. RamUser: RAM user. RamRole: RAM role.	RamUser
account_state	string	The status of the account. Active: The account is active. InActive: The account is locked. Deleted: The account is deleted.	Active
cert_expire_time	string	The expiration time of the client certificate for the kubeconfig file.	2027-07-15T01:32:20Z
cert_state	string	The status of the client certificate for the kubeconfig file. Unexpired: The certificate is not expired. Expired: The certificate is expired. Unknown: The status of the certificate is unknown.	Expired
revokable	boolean	Indicates whether the client certificate for the kubeconfig file can be revoked.	true
cloud_service_name	string	Cloud service name.	cs/ecs/sls
cloud_service_roles	array<object>	List of cluster roles associated with the cluster cloud product service roles.
	object	Information about the cluster role associated with the cluster cloud product service role.
type	string	The type of the cluster role associated with the cloud service role of the cluster. Valid values: Role : Role ClusterRole : ClusterRole	ClusterRole
role_name	string	Name of the cluster role associated with the cluster cloud product service role.	cluster-admin
role_namespace	string	Namespace of the cluster role associated with the cluster cloud product service role.	kube-system
is_default_template	boolean	Indicates whether the content matches the default cluster role template. true: Matches false: Does not match
page	object	The pagination information.
page_number	integer	The page number.	1
page_size	integer	The number of entries per page.	10
total_count	integer	The total number of entries returned.	5

Examples

Success response

JSON format

{
  "states": [
    {
      "account_id": "22855*****************",
      "account_name": "tom",
      "account_display_name": "tom",
      "account_type": "RamUser",
      "account_state": "Active",
      "cert_expire_time": "2027-07-15T01:32:20Z",
      "cert_state": "Expired",
      "revokable": true,
      "cloud_service_name": "cs/ecs/sls",
      "cloud_service_roles": [
        {
          "type": "ClusterRole",
          "role_name": "cluster-admin",
          "role_namespace": "kube-system",
          "is_default_template": false
        }
      ]
    }
  ],
  "page": {
    "page_number": 1,
    "page_size": 10,
    "total_count": 5
  }
}

Error codes

See Error Codes for a complete list.

Release notes

See Release Notes for a complete list.