Use ack-kubernetes-webhook-injector to dynamically configure an Alibaba Cloud service whitelist for pods - Container Service for Kubernetes

In cloud environments that have strict permission requirements, you may need to dynamically add the IP addresses of pods to or remove them from specified ApsaraDB RDS whitelists to achieve fine-grained access control. You can use the ack-kubernetes-webhook-injector component to add annotations to pods, which dynamically adds or removes their IP addresses from specified ApsaraDB RDS whitelists. This topic describes how to install and use ack-kubernetes-webhook-injector to dynamically configure whitelists for Alibaba Cloud services and how to configure access to their internal endpoints.

Prerequisites

Create a managed ACK cluster.
The cluster uses the Terway network plug-in. For more information, see Use the Terway network plug-in.

Overview

In cloud computing, certain resources require security policies before they can be accessed from external sources. For example, an instance may require a Server Load Balancer (SLB) access control policy, or an ApsaraDB RDS database may require a whitelist of client source IP addresses. Although you can add the IP address range of your cluster nodes to a specified ApsaraDB RDS whitelist when you create an ACK cluster, this approach has the following drawbacks:

The whitelist rules are too coarse-grained. The whitelisted IP CIDR blocks cover the IP addresses of all nodes and pods in the cluster.
Whitelist rules must be manually cleaned up after the cluster is deleted.

To address these issues, ACK provides ack-kubernetes-webhook-injector. This component dynamically adds the IP address of a specified pod to an ApsaraDB RDS whitelist when the pod is created and removes the IP address when the pod is deleted. This allows for fine-grained control over security policies.

Currently, ack-kubernetes-webhook-injector supports the following features:

Automatically adds a pod's IP address to and removes it from a specified SLB access control policy group as the pod is created and deleted.
Automatically adds a pod's IP address to and removes it from a specified ApsaraDB for Redis whitelist as the pod is created and deleted.
Automatically adds a pod's IP address to and removes it from a specified ApsaraDB RDS whitelist as the pod is created and deleted.

Install ack-kubernetes-webhook-injector

Log on to the ACK console. In the left navigation pane, click Marketplace > Marketplace.
Find and click ack-kubernetes-webhook-injector, and then click Deploy in the upper-right corner.
In the panel that appears, select the target cluster and Namespace, set a Release Name, and then click Next.
Select a Chart Version. On the Parameters page, fill in the ak and sk fields under the openapi section with your AccessKey information, and then click OK at the bottom of the page.

For more information about how to obtain an AccessKey pair, see Obtain an AccessKey pair.
```
openapi:
  # For test only. DO NOT use aksk authentication in production environments.
  use_aksk: true
  ak:
  sk:
```

Example: Dynamically add a pod IP to an RDS whitelist

In the pod specification of your workload, you can use an annotation to specify the ApsaraDB RDS instance ID and the name of the whitelist group that the pod needs to join. When the pod is created, ack-kubernetes-webhook-injector adds the pod's IP address to the whitelist. When the pod is deleted, the component removes the IP address.

The pod annotation for an ApsaraDB RDS whitelist must include the following:

ApsaraDB RDS instance ID: ack.aliyun.com/rds_id
ApsaraDB RDS whitelist group name: ack.aliyun.com/white_list_name

This section demonstrates how to use ack-kubernetes-webhook-injector to dynamically add a pod to an ApsaraDB RDS whitelist.

Create a Deployment by using the following YAML template. In the pod definition, add annotations for the ApsaraDB RDS instance ID and whitelist group name.

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: inject-test
  name: inject-test
spec:
  replicas: 1
  selector:
    matchLabels:
      app: inject-test
  template:
    metadata:
      annotations:
        ack.aliyun.com/rds_id: <rm-wz9nanjcud75b****>
        ack.aliyun.com/white_list_name: <rds_group>
      labels:
        app: inject-test
    spec:
      containers:
      - command:
        - sleep
        - "3600"
        image: alpine:latest
        name: inject-test

Run the following command to view the pod's IP address.

kubectl --kubeconfig .kube/config_sts_test -n inject-test get pod -o wide

Example output:

NAME                           READY           STATUS        RESTARTS    AGE    IP                NODE
inject-test-68cc8f9bbf-gj86n    1/1            Running         0        22s   172.25.0.28    cn-hangzhou.xxx

In the output, the pod's IP address is 172.25.0.28.

Log on to the ApsaraDB RDS console and view the whitelist of the ApsaraDB RDS instance specified in the annotation. For more information about how to view an ApsaraDB RDS whitelist, see Enhanced IP address whitelist mode.
Set the number of replicas for the Deployment created in Step 1 to 0 and check the ApsaraDB RDS whitelist again.

The IP address is automatically removed from the whitelist.

Configure access to internal endpoints

By default, ack-kubernetes-webhook-injector uses the public endpoints of Alibaba Cloud services. If your cluster does not have public network access enabled, you can modify the configuration to use internal endpoints.

Note

Some Alibaba Cloud services do not provide internal endpoints in all regions. Before you proceed, check the OpenAPI Explorer to confirm that an internal endpoint is available for your target service in its region.

Log on to the ACK console. In the left navigation pane, click Clusters.
On the Clusters page, click the name of your cluster. In the left navigation pane, click Workloads > Deployments.
From the Namespace drop-down list at the top of the page, select kube-system. Find the kubernetes-webhook-injector Deployment. In the Actions column, choose More > View in YAML.
Under spec.template.spec.containers.command, add the line - '--intranet-access' and then click Update.

Other security policy configurations

ack-kubernetes-webhook-injector also supports the following security policy configurations:

SLB access control: ack.aliyun.com/access_control_policy_id.
ApsaraDB for Redis whitelist configuration:
- Redis ID: ack.aliyun.com/redis_id.
- Redis whitelist group: ack.aliyun.com/redis_white_list_name.

Uninstall ack-kubernetes-webhook-injector

If you no longer need ack-kubernetes-webhook-injector, you can remove it by using the release management feature in ACK. For more information, see Manage Helm releases. Then, run the following commands to remove the remaining configuration resources:

kubectl -n kube-system delete secret kubernetes-webhook-injector-certs
kubectl delete mutatingwebhookconfigurations.admissionregistration.k8s.io kubernetes-webhook-injector