Container Service for Kubernetes:Manually restrict the permissions of a Worker RAM role for an ACK managed cluster

Prerequisites

Before you begin, make sure that you have:

• An ACK managed cluster (ACK Pro cluster or ACK basic cluster) running Kubernetes 1.18 or later. For more information, see Create an ACK managed cluster and Manually upgrade a cluster

• (If applicable) Migrated any ACK dedicated cluster to an ACK Pro cluster. For more information, see Hot migrate an ACK dedicated cluster to an ACK Pro cluster

• Granted the default service roles required by the ACK managed cluster. For more information, see Grant permissions to service roles with one click

Step 1: Assess current permissions

Determine whether the Worker RAM role has excess permissions that need to be restricted.

1. Log on to the ACK console. In the left-side navigation pane, click Clusters.

2. On the Clusters page, click the name of the target cluster. On the Basic Information tab, click the link next to Worker RAM Role to open the RAM console.

3. On the Permissions tab of the Role page, check whether any access policies are attached.

   • If the list is empty, no restriction is needed. The Worker RAM role has no extra permissions.

   • If the list contains one or more policies (for example, k8sWorkerRolePolicy-db8ad5c7***), the role may have more permissions than necessary. Continue with Step 2.

Step 2: Upgrade system components

Upgrade the system components in your cluster to the minimum required versions listed below. Newer component versions use token-based authentication through managed service roles instead of relying on the Worker RAM role directly.

For more information about managing components, see Manage components.

Step 3: Collect audit logs

Set up audit logging to track which Alibaba Cloud API operations the Worker RAM role performs. This data tells you which permissions are still in use and which can be safely removed.

1. Log on to the ActionTrail console.

2. Create a single-account trail for the region where the cluster is located. When creating the trail, select Deliver Events To Simple Log Service (SLS). For more information, see Create a single-account trail.

For the full list of services that ActionTrail supports, see Supported Alibaba Cloud services.

Step 4: Test cluster features

After upgrading components and redeploying workloads, verify that core cluster features still work correctly.

Step 5: Analyze audit logs

After collecting logs for at least one week, query the data to identify which API operations the Worker RAM role performed.

1. Log on to the Simple Log Service (SLS) console.

2. In the Projects section, click the project you specified in Step 3.

   

3. On the Log Storage > Logstores tab, click the destination Logstore. The Logstore is named actiontrail_<trail_name>.

4. Run the following query to list the API operations called through the Security Token Service (STS) token of the Worker RAM role. Replace <worker_role_name> with the name of the Worker RAM role for your cluster. The results show which Alibaba Cloud services and API operations are being called. Use this data in Step 6 to decide which permissions to keep and which to remove.

      * and event.userIdentity.userName: <worker_role_name> | select "event.serviceName", "event.eventName", count(*) as total GROUP BY "event.eventName", "event.serviceName"

Step 6: Restrict permissions

Based on the audit log analysis, remove permissions that the Worker RAM role does not need.

1. Log on to the ACK console. In the left-side navigation pane, click Clusters.

2. On the Clusters page, click the name of the target cluster. On the Basic Information tab, click the link next to Worker RAM Role to open the RAM console.

3. On the Permissions tab of the Role page, click the destination access policy to go to the Policy Document tab. Click Edit Policy.

   Important

   Before you modify the policy document, back up the existing policy document. This lets you roll back the permission configuration if needed.

4. When you modify the policy document, decide whether to delete unnecessary permissions based on your requirements and the analysis results of the audit logs from Step 5. For example, you can delete the Action permissions that do not appear in the statistics. If you confirm that no permissions are required, you can revoke all granted access policies.

5. Redeploy the system component workloads. Use the redeploy commands listed in Step 2.

6. Repeat Steps 4, 5, and 6 until the Worker RAM role is granted only the minimum permissions required by the components or applications.

References

• Best practices for authorization