Container Service for Kubernetes:ack-pod-identity-webhook

Table of contents

• Introduction

• Example

• Custom configurations

• RRSA SDK demos

• Release notes

• References

Introduction

The following figure shows the architecture of ack-pod-identity-webhook.

Example

The application in this example uses the RRSA feature to assume the specified role to obtain information about all clusters that belong to the current Alibaba Cloud account. The following resources are used in this example:

• Namespace: rrsa-demo

• Service account: demo-sa

• RAM role: ack-pod-identity-webhook-demo

After you add the pod-identity.alibabacloud.com/injection: 'on' label to the namespace of your pod, ack-pod-identity-webhook automatically injects relevant configurations into the pod based on the annotations of the service account used by the pod. The following steps are performed in this example.

1. Enable the RRSA feature for the cluster.

   1. Log on to the ACK console. In the left-side navigation pane, click Clusters.

   2. On the Clusters page, click the name of the cluster that you want to manage.

   3. On the cluster details page, click the Basic Information tab. In the Cluster Information section, click Enable RRSA on the right side of RRSA OIDC.

   4. In the message that appears, click Confirm.

      If the status of the cluster changes from Updating to Running, the RRSA feature is enabled for the cluster. The URL and Alibaba Cloud Resource Name (ARN) of the identity provider (IdP) are displayed on the right side of RRSA OIDC.

2. Install ack-pod-identity-webhook.

   1. On the Clusters page, click the name of the cluster that you want to manage and choose Operations > Add-ons in the left-side navigation pane.

   2. On the Add-ons page, click the Security tab, find ack-pod-identity-webhook, and then click Install in the lower-right corner.

   3. In the message that appears, confirm the information and click OK.

3. Create a RAM role named ack-pod-identity-webhook-demo.

   1. Log on to the RAM console with your Alibaba Cloud account.

   2. In the left-side navigation pane, choose Identities > Roles.

   3. On the Roles page, click Create Role.

   4. In the Create Role panel, select IdP for Select Trusted Entity and click Next.

   5. Configure the following parameters and click OK.

      Parameter	Description
      RAM Role Name	ack-pod-identity-webhook-demo
      IdP Type	OIDC
      Select IdP	ack-rrsa-<cluster_id>. Specify the ID of your cluster in <cluster_id>.
      Conditions	oidc:iss: Use the default value. oidc:aud: Select sts.aliyuncs.com. oidc:sub: Set the condition operator to StringEquals and the value to system:serviceaccount:<namespace>:<serviceAccountName>. <namespace>: Specify the namespace of the application. <serviceAccountName>: Specify the name of the service account. In this example, enter system:serviceaccount:rrsa-demo:demo-sa.

4. Attach the AliyunCSReadOnlyAccess policy to the RAM role to grant the required permissions to the application. For more information, see Grant permissions to a RAM role.

5. Deploy the application.

   1. Create a file named demo.yaml and copy the following content to the file.

      In the following YAML content, the pod-identity.alibabacloud.com/injection: 'on' label is added to the namespace, the pod-identity.alibabacloud.com/role-name: ack-pod-identity-webhook-demo annotation is added to the service account, and the auto injection feature of ack-pod-identity-webhook is enabled. For more information about the RRSA demo, see Code.

      ---
      apiVersion: v1
      kind: Namespace
      metadata:
        name: rrsa-demo
        labels:
          pod-identity.alibabacloud.com/injection: 'on'
      
      ---
      apiVersion: v1
      kind: ServiceAccount
      metadata:
        name: demo-sa
        namespace: rrsa-demo
        annotations:
          pod-identity.alibabacloud.com/role-name: ack-pod-identity-webhook-demo
      
      ---
      apiVersion: v1
      kind: Pod
      metadata:
        name: demo
        namespace: rrsa-demo
      spec:
        serviceAccountName: demo-sa
        containers:
          - image: registry.cn-hangzhou.aliyuncs.com/acs/ack-ram-tool:1.0.0
            imagePullPolicy: "Always"
            args:
              - rrsa
              - demo
            name: demo
        restartPolicy: OnFailure

   2. Run the following command to deploy the application:

      kubectl apply -f demo.yaml

6. Run the following command to check whether ack-pod-identity-webhook has injected the required configurations into the pod that is created for the application:

   kubectl -n rrsa-demo get pod demo -o yaml

   Expected output

   apiVersion: v1
   kind: Pod
   metadata:
     name: demo
     namespace: rrsa-demo
   spec:
     containers:
     - args:
       - rrsa
       - demo
       env:
       - name: ALIBABA_CLOUD_ROLE_ARN
         value: acs:ram::1***:role/ack-pod-identity-webhook-demo
       - name: ALIBABA_CLOUD_OIDC_PROVIDER_ARN
         value: acs:ram::1***:oidc-provider/ack-rrsa-c***
       - name: ALIBABA_CLOUD_OIDC_TOKEN_FILE
         value: /var/run/secrets/ack.alibabacloud.com/rrsa-tokens/token
       image: registry.cn-hangzhou.aliyuncs.com/acs/ack-ram-tool:1.0.0
       imagePullPolicy: Always
       name: demo
       volumeMounts:
       - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
         name: kube-api-access-4bwdg
         readOnly: true
       - mountPath: /var/run/secrets/ack.alibabacloud.com/rrsa-tokens
         name: rrsa-oidc-token
         readOnly: true
     restartPolicy: OnFailure
     serviceAccount: demo-sa
     serviceAccountName: demo-sa
     volumes:
     - name: kube-api-access-4bwdg
       projected:
         defaultMode: 420
         sources:
         - serviceAccountToken:
             expirationSeconds: 3607
             path: token
         - configMap:
             items:
             - key: ca.crt
               path: ca.crt
             name: kube-root-ca.crt
         - downwardAPI:
             items:
             - fieldRef:
                 apiVersion: v1
                 fieldPath: metadata.namespace
               path: namespace
     - name: rrsa-oidc-token
       projected:
         defaultMode: 420
         sources:
         - serviceAccountToken:
             audience: sts.aliyuncs.com
             expirationSeconds: 3600
             path: token

   The output indicates that ack-pod-identity-webhook has injected the following configurations into the pod.

   Category	Configuration item	Description
   Environment variables	ALIBABA_CLOUD_ROLE_ARN	The ARN of the RAM role to be assumed.
   	ALIBABA_CLOUD_OIDC_PROVIDER_ARN	The ARN of the OIDC IdP.
   	ALIBABA_CLOUD_OIDC_TOKEN_FILE	The path of the OIDC token file.
   VolumeMount	rrsa-oidc-token	The configuration for mounting the OIDC token.
   Volume	rrsa-oidc-token	The configuration for mounting the OIDC token.

7. Run the following command to print the log of the application:

   kubectl -n rrsa-demo logs demo

   Expected output:

   cluster id: cf***, cluster name: foo*
   cluster id: c8***, cluster name: bar*
   cluster id: c4***, cluster name: foob*

Custom configurations

You can customize the following configurations for ack-pod-identity-webhook: namespace, service account, and pod configurations.

Namespace configuration

apiVersion: v1
kind: Namespace
metadata:
  name: test
  labels:
    pod-identity.alibabacloud.com/injection: 'on'

Service account configuration

apiVersion: v1
kind: ServiceAccount
metadata:
  name: test-sa
  namespace: test
  annotations:
    pod-identity.alibabacloud.com/role-name: test-role

apiVersion: v1
kind: ServiceAccount
metadata:
  name: test-sa
  namespace: test
  annotations:
    pod-identity.alibabacloud.com/service-account-token-expiration: '3600'

Pod configuration

apiVersion: v1
kind: Pod
metadata:
  name: test-pod
  namespace: test
  annotations:
    pod-identity.alibabacloud.com/service-account-token-expiration: '3600'

apiVersion: v1
kind: Pod
metadata:
  name: test-pod
  namespace: test
  annotations:
    pod-identity.alibabacloud.com/only-containers: 'controller,test'

apiVersion: v1
kind: Pod
metadata:
  name: test-pod
  namespace: test
  annotations:
    pod-identity.alibabacloud.com/skip-containers: 'controller,test'

RRSA SDK demos

Release notes

June 2023

February 2023

References

Configure RRSA for service accounts to isolate permissions among pods