Use RRSA to authorize pods to access different cloud services

Enable RRSA

Method 1: Enable RRSA in the ACK console

1. Log on to the ACK console.
2. In the left-side navigation pane of the ACK console, click Clusters.
3. On the Clusters page, find the cluster that you want to manage and click the name of the cluster or click Details in the Actions column. The details page of the cluster appears.
4. On the cluster details page, click the Basic Information tab and then click Enable RRSA next to URL of RRSA OIDC Provider.
5. In the Enable RRSA dialog box, click Confirm.
   After the cluster status changes from Updating to Running, the RRSA feature is enabled for the cluster and the OIDC Issuer URL is displayed next to URL of RRSA OIDC Provider.

Method 2: Enable RRSA by using ack-ram-tool

You can enable RRSA by using the ack-ram-tool CLI. For more information, see ack-ram-tool.

When you enable RRSA for an ACK cluster, ACK performs the following steps in the background:

1. Automatically creates an OIDC Issuer Service that is dedicated to the cluster. This Service is managed by ACK. For more information, see OIDC Issuer.
2. Enables the feature of service account token volume projection for your cluster. If your cluster already has this feature enabled, ACK overwrites the value of service-account-issuer with the setting of the OIDC Issuer created in the preceding step. For more information, see Enable service account token volume projection.
3. Creates a RAM role identity provider within your account. The identity provider uses the created OIDC Issuer for single sign-on. The identity provider is named ack-rrsa-<cluster_id>. <cluster_id> indicates the ID of your cluster. For more information, see Manage an OIDC IdP.

Work with RRSA

After you enable RRSA for your cluster, perform the following steps to enable the applications in the cluster to obtain STS tokens through RRSA. The STS tokens are used to call the APIs of specific cloud services.

1. Create a RAM role.

   Create a RAM role for the service account that is used by the application. Then, the application obtains an STS token that is used to assume the RAM role. For more information, see Create a RAM role for a trusted Alibaba Cloud account

2. Modify the trust policy of the RAM role.

   Make sure that the application with the specified service account has the permissions to obtain the STS token that is used to assume the RAM role. For more information, see Edit the trust policy of a RAM role

   The following code block shows the content of the trust policy. You can also use ack-ram-tool to automatically configure the policy.

   Notice Replace the following fields as required:

   • Replace <oidc_issuer_url> with the OIDC Issuer URL of your cluster. You can obtain the URL on the Basic Information tab of the cluster details page.
   • Replace <namespace> with the namespace to which the application belongs.
   • Replace <service_account> with the service account used by the application.
   • Replace <account_uid> with the UID of your Alibaba Cloud account.
   • Replace <cluster_id> with the ID of your cluster.

   {
     "Statement": [
       {
         "Action": "sts:AssumeRole",
         "Condition": {
           "StringEquals": {
             "oidc:aud": "sts.aliyuncs.com",
             "oidc:iss": "<oidc_issuer_url>",
             "oidc:sub": "system:serviceaccount:<namespace>:<service_account>"
           }
         },
         "Effect": "Allow",
         "Principal": {
           "Federated": [
             "acs:ram::<account_uid>:oidc-provider/ack-rrsa-<cluster_id>"
           ]
         }
       }
     ],
     "Version": "1"
   }

3. Grant permissions to the RAM role.

   Specify the cloud services that the RAM role is allowed to access. For more information, see Grant permissions to a RAM role

4. Deploy the application.

   When you deploy the application, you must modify the application template so that the system can automatically generate an OIDC token. For more information, see Enable service account token volume projection.

   Notice

   • The value of the audience parameter must be set to sts.aliyuncs.com.
   • The maximum value of the expirationSeconds parameter is 43200 (12 hours). If you specify a value that is greater than 43200, the validity period of the OIDC token is 12 hours.

   The following code block shows an example:

   apiVersion: v1
   kind: Pod
   metadata:
     name: test-rrsa
   spec:
     containers:
     - image: alpine:3.14
       command:
       - sh
       - -c
       - 'sleep inf'
       name: test
       volumeMounts:
       - mountPath: /var/run/secrets/tokens
         name: oidc-token
     serviceAccountName: build-robot
     volumes:
     - name: oidc-token     # The configurations that you add. 
       projected:
         sources:
         - serviceAccountToken:
             path: oidc-token
             expirationSeconds: 7200    # The validity period of the OIDC token in seconds. 
             audience: "sts.aliyuncs.com"

   After you provision the pod, the application in the pod can use the OIDC token in the /var/run/secrets/tokens/oidc-token token file to call the AssumeRoleWithOIDC API operation of STS and obtain an STS token. This way, the application can use the obtained STS token to assume the specified RAM role and call the API of the relevant cloud service. For more information, see AssumeRoleWithOIDC.

Alibaba Cloud SDKs that support the OIDC token authentication of RRSA

Some Alibaba Cloud SDKs allow applications to call the APIs of specific cloud resources by using the OIDC tokens of RRSA. The following table describes the supported SDK versions.