Starting with Kubernetes 1.33, newly created ACK managed clusters include the latest version of the ack-ram-authenticator managed component by default. This component does not consume additional cluster node resources.
Impact scope
This change applies only to newly created ACK managed clusters running Kubernetes version 1.33 or later, including ACK managed cluster Pro Edition and ACK managed cluster Basic Edition.
Changes
For details about the ack-ram-authenticator add-on and how to use it, see ack-ram-authenticator and Use ack-ram-authenticator for webhook authentication to the ACK managed cluster API server.
Beginning with Kubernetes version 1.33, the following changes apply to newly created ACK managed clusters:
New clusters install the latest version of ack-ram-authenticator by default. This add-on is a system component and cannot be uninstalled.
Node pool scale-out operations—both manual and automatic—depend on ack-ram-authenticator. During scale-out, the cluster generates a small number of OpenAPI access records in its VPC network. Specifically, worker nodes use the STS GetCallerIdentity API to authenticate their RAM roles.
Configure custom parameters for ack-ram-authenticator when creating a cluster
Custom parameters supported by ack-ram-authenticator
Configure ack-ram-authenticator parameters using Terraform
When you create a cluster with Terraform, specify the ack-ram-authenticator add-on and its custom parameters in the addons property of the alicloud_cs_managed_kubernetes resource. For more information about managing add-ons with Terraform, see Manage add-ons with Terraform.
resource "alicloud_cs_managed_kubernetes" "default" {
# Other parameters.
# ...
addons {
name = "ack-ram-authenticator"
config = jsonencode(
{
"EnableNonBootstrapMapping": false
}
)
}
}Configure ack-ram-authenticator parameters using OpenAPI
When you create a cluster with OpenAPI, use the addons parameter in the CreateCluster API to specify the ack-ram-authenticator add-on and its custom parameters.
"addons": [
// Other add-on configurations.
{
"name": "ack-ram-authenticator",
"config": "{\"EnableNonBootstrapMapping\": false}"
}
],Modify ack-ram-authenticator parameters in the console
By default, the ack-ram-authenticator add-on installed through the console disables RAM identity mapping for non-node-initialization scenarios. To change this setting, follow these steps.
Log on to the ACK console. In the left navigation pane, click Clusters.
On the Clusters page, click the name of your cluster. In the left navigation pane, click Components and Add-ons.
On the Add-ons page, click the Security tab. Find ack-ram-authenticator and click Configure in the lower-right corner. Then select Enable RAM identity mapping for non-node-initialization scenarios.
Contact us
If you have questions or feedback, submit a ticket.