Worker RAM Role Least-Privilege Architecture in ACK Managed Clusters - ACK - Alibaba Cloud - Container Service for Kubernetes

The default WorkerRolePolicy permissions for nodes in Container Service for Kubernetes (ACK) managed clusters are broad. To further strengthen security isolation for managed cluster nodes in multi-tenant scenarios, ACK has scoped down the permissions attached to the Resource Access Management (RAM) roles of managed cluster nodes since May 20, 2020.

Important

Starting July 17, 2023, no permission policy is granted by default to the worker RAM role of newly created ACK managed clusters that run version 1.22.15-aliyun.1 or later. For more information, see [Product Changes] Permissions of the worker RAM role of ACK managed clusters are revoked.

Role authorization

After the permissions are scoped down, the policies used by cluster system add-ons are removed from the node RAM role. Dedicated ACK system roles are added for each add-on. When you create a managed cluster in the ACK console after this change, the system prompts you to authorize the following system roles. Use your Alibaba Cloud account or a RAM user with AliyunRAMFullAccess or AdministratorAccess permissions. Click Go to RAM console to go to the batch authorization page and complete the authorization.

Note

If you use OpenAPI to create a cluster, use the authorization link to complete the authorization.

The error dialog displays the error code ErrManagedAddonRoleNotAttach and the authorization link https://ur.alipay.com/1paTcxSWdAEW70GVH5TZiO.

At the bottom of the batch authorization page, click Confirm Authorization Policy. Then log on to the ACK console again to create your cluster.

This batch authorization grants permissions to the following system roles, which are used by cluster add-ons to call OpenAPI operations:

AliyunCSManagedLogRole
AliyunCSManagedCmsRole
AliyunCSManagedCsiRole
AliyunCSManagedVKRole
AliyunCSManagedNetworkRole
AliyunCSManagedArmsRole

The scoped-down default WorkerRole RAM policy is defined as follows:

{
  "Version": "1",
  "Statement": [{
      "Action": [
        "ecs:DescribeInstanceAttribute",
        "ecs:DescribeInstanceTypesNew",
        "ecs:DescribeInstances"
      ],
      "Resource": [
        "*"
      ],
      "Effect": "Allow"
    },
    {
      "Action": [
        "log:GetProject",
        "log:GetLogStore",
        "log:GetConfig",
        "log:GetMachineGroup",
        "log:GetAppliedMachineGroups",
        "log:GetAppliedConfigs",
        "log:GetIndex",
        "log:GetSavedSearch",
        "log:GetDashboard",
        "log:GetJob"
      ],
      "Resource": [
        "*"
      ],
      "Effect": "Allow"
    },
    {
      "Action": [
       "cr:GetAuthorizationToken",
       "cr:ListInstanceEndpoint",
       "cr:PullRepository"
      ],  
      "Resource": [
        "*"
      ],
      "Effect": "Allow"
     }
  ]
}