Container Compute Service:ack-pod-identity-webhook

Setup overview

Complete the following steps in order:

1. Enable RRSA — Required once per cluster.

2. Install ack-pod-identity-webhook — Required once per cluster.

3. Create a RAM role — Required for each unique set of permissions.

4. Attach a policy to the role — Required for each unique set of permissions.

5. Deploy an application — Required for each application that needs RRSA.

6. Verify injection — Confirm the webhook injected the expected configurations.

7. Check application output — Confirm the application can access the target resource.

Step 1: Enable RRSA

1. Log on to the ACS console. In the left-side navigation pane, click Clusters.

2. On the Clusters page, click the name of the cluster you want to manage. In the left-side navigation pane of the cluster details page, click Cluster Information.

3. Click the Basic Information tab. In the Cluster Information section, click Enable RRSA to the right of RRSA OIDC.

4. In the dialog that appears, click Confirm. When the cluster status changes from Updating to Running, RRSA is enabled. The URL and Alibaba Cloud Resource Name (ARN) of the identity provider (IdP) are displayed next to RRSA OIDC.

Step 2: Install ack-pod-identity-webhook

1. In the left-side navigation pane, choose Operations > Add-ons.

2. Click the Security tab, find ack-pod-identity-webhook, and click Install.

3. In the dialog that appears, confirm the information and click OK.

Step 3: Create the RAM role

1. Log on to the RAM console with an Alibaba Cloud account.

2. In the left-side navigation pane, choose Identities > Roles.

3. On the Roles page, click Create Role.

4. On the Create Role page, select IdP in the Select Trusted Entity section, then click Next.

5. On the Configure Role page, set the following parameters and click OK.

   Parameter	Value
   Role Name	ack-pod-identity-webhook-demo
   IdP Type	OIDC
   Select IdP	Select the IdP named ack-rrsa-<cluster_id>, where <cluster_id> is your cluster ID.
   Conditions — oidc:iss	Use the default value.
   Conditions — oidc:aud	Select sts.aliyuncs.com.
   Conditions — oidc:sub	Set the condition operator to StringEquals and the value to system:serviceaccount:<namespace>:<serviceAccountName>. For this example, enter system:serviceaccount:rrsa-demo:demo-sa.

Step 4: Attach a policy to the RAM role

Attach the AliyunCSReadOnlyAccess policy to the ack-pod-identity-webhook-demo role. For details, see Grant permissions to a RAM role.

Step 5: Deploy the application

1. Connect to your ACS cluster. For details, see Connect to a cluster.

2. Create a file named demo.yaml with the following content. The YAML below adds the pod-identity.alibabacloud.com/injection: 'on' label to the rrsa-demo namespace and the pod-identity.alibabacloud.com/role-name: ack-pod-identity-webhook-demo annotation to the demo-sa service account, enabling auto injection. For the full RRSA demo source, see Code.

   The registry.cn-hangzhou.aliyuncs.com/acs/ack-ram-tool:1.0.0 image is pulled over the Internet. Make sure Internet access is enabled for the cluster. For details, see Enable an existing ACS cluster to access the Internet.

   ---
   apiVersion: v1
   kind: Namespace
   metadata:
     name: rrsa-demo
     labels:
       pod-identity.alibabacloud.com/injection: 'on'
   
   ---
   apiVersion: v1
   kind: ServiceAccount
   metadata:
     name: demo-sa
     namespace: rrsa-demo
     annotations:
       pod-identity.alibabacloud.com/role-name: ack-pod-identity-webhook-demo
   
   ---
   apiVersion: v1
   kind: Pod
   metadata:
     name: demo
     namespace: rrsa-demo
   spec:
     serviceAccountName: demo-sa
     containers:
       - image: registry.cn-hangzhou.aliyuncs.com/acs/ack-ram-tool:1.0.0
         imagePullPolicy: "Always"
         args:
           - rrsa
           - demo
         name: demo
     restartPolicy: OnFailure

3. Deploy the application:

   kubectl apply -f demo.yaml

Step 6: Verify injection

Run the following command to check that ack-pod-identity-webhook has injected the required configurations into the pod:

kubectl -n rrsa-demo get pod demo -o yaml

The expected output is similar to:

apiVersion: v1
kind: Pod
metadata:
  annotations:
    ProviderCreate: done
    alibabacloud.com/client-token: 5e68e5bf-1726-4f5e-****-abe61d2c1cff
    alibabacloud.com/instance-id: acs-uf6008givz63ta2v****
    alibabacloud.com/pod-ephemeral-storage: 30Gi
    alibabacloud.com/pod-use-spec: 0.25-0.5Gi
    alibabacloud.com/request-id: 5914A73F-8B24-5B9B-****-400F6B632D44
    alibabacloud.com/schedule-result: finished
    alibabacloud.com/user-id: "1488999589******"
    kubectl.kubernetes.io/last-applied-configuration: |
      {"apiVersion":"v1","kind":"Pod","metadata":{"annotations":{},"name":"demo","namespace":"rrsa-demo"},"spec":{"containers":[{"args":["rrsa","demo"],"image":"registry.cn-hangzhou.aliyuncs.com/acs/ack-ram-tool:1.0.0","imagePullPolicy":"Always","name":"demo"}],"restartPolicy":"OnFailure","serviceAccountName":"demo-sa"}}
    kubernetes.io/pod-stream-port: "10250"
    kubernetes.io/preferred-scheduling-node: virtual-kubelet-cn-shanghai-g/1
    network.alibabacloud.com/allocated-eni-id: eni-uf6fhxwakz5b0d******
    network.alibabacloud.com/enable-dns-cache: "false"
    network.alibabacloud.com/security-group-id: sg-uf60h6mbwry22r******
    network.alibabacloud.com/security-group-ids: sg-uf60h6mbwry22r******
    network.alibabacloud.com/vpc-id: vpc-uf6ncu6tpunqchrrr****
    network.alibabacloud.com/vswitch-id: vsw-uf6g4yjk3kemgei******
    network.alibabacloud.com/vswitch-ids: vsw-uf6g4yjk3kemgei******
    topology.kubernetes.io/region: cn-shanghai
    topology.kubernetes.io/zone: cn-shanghai-g
  creationTimestamp: "2024-08-19T09:29:57Z"
  labels:
    alibabacloud.com/cluster-id: cbec9a1f7b433470ebe4c900552******
    alibabacloud.com/compute-class: general-purpose
    alibabacloud.com/compute-qos: default
    topology.kubernetes.io/region: cn-shanghai
  name: demo
  namespace: rrsa-demo
  resourceVersion: "6795900"
  uid: 57ab5f1d-32b7-4d9d-****-16a4f2c1a1fa
spec:
  containers:
  - args:
    - rrsa
    - demo
    env:
    - name: ALIBABA_CLOUD_ROLE_ARN
      value: acs:ram::1488999589******:role/ack-pod-identity-webhook-demo
    - name: ALIBABA_CLOUD_OIDC_PROVIDER_ARN
      value: acs:ram::1488999589******:oidc-provider/ack-rrsa-cbec9a1f7b433470ebe4c900552******
    - name: ALIBABA_CLOUD_OIDC_TOKEN_FILE
      value: /var/run/secrets/ack.alibabacloud.com/rrsa-tokens/token
    - name: KUBERNETES_SERVICE_HOST
      value: 192.168.1.215
    - name: KUBERNETES_SERVICE_PORT
      value: "6443"
    image: registry.cn-hangzhou.aliyuncs.com/acs/ack-ram-tool:1.0.0
    imagePullPolicy: Always
    name: demo
    resources:
      limits:
        cpu: 250m
        ephemeral-storage: 30Gi
        memory: 512Mi
      requests:
        cpu: 250m
        ephemeral-storage: 30Gi
        memory: 512Mi
    terminationMessagePath: /dev/termination-log
    terminationMessagePolicy: File
    volumeMounts:
    - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
      name: kube-api-access-lrcfl
      readOnly: true
    - mountPath: /var/run/secrets/ack.alibabacloud.com/rrsa-tokens
      name: rrsa-oidc-token
      readOnly: true
  dnsPolicy: ClusterFirst
  enableServiceLinks: true
  nodeName: virtual-kubelet-cn-shanghai-g
  preemptionPolicy: PreemptLowerPriority
  priority: 0
  restartPolicy: OnFailure
  schedulerName: default-scheduler
  securityContext: {}
  serviceAccount: demo-sa
  serviceAccountName: demo-sa
  terminationGracePeriodSeconds: 30
  tolerations:
  - effect: NoExecute
    key: node.kubernetes.io/not-ready
    operator: Exists
  - effect: NoExecute
    key: node.kubernetes.io/unreachable
    operator: Exists
  volumes:
  - name: kube-api-access-lrcfl
    projected:
      defaultMode: 420
      sources:
      - serviceAccountToken:
          expirationSeconds: 3607
          path: token
      - configMap:
          items:
          - key: ca.crt
            path: ca.crt
          name: kube-root-ca.crt
      - downwardAPI:
          items:
          - fieldRef:
              apiVersion: v1
              fieldPath: metadata.namespace
            path: namespace
  - name: rrsa-oidc-token
    projected:
      defaultMode: 420
      sources:
      - serviceAccountToken:
          audience: sts.aliyuncs.com
          expirationSeconds: 3600
          path: token
status:
  conditions:
  - lastProbeTime: null
    lastTransitionTime: "2024-08-19T09:29:57Z"
    message: The container instance is creating.
    reason: Creating
    status: "False"
    type: ContainerInstanceScheduled
  - lastProbeTime: null
    lastTransitionTime: "2024-08-19T09:30:10Z"
    status: "True"
    type: Initialized
  - lastProbeTime: null
    lastTransitionTime: "2024-08-19T09:30:13Z"
    status: "True"
    type: Ready
  - lastProbeTime: null
    lastTransitionTime: "2024-08-19T09:30:13Z"
    status: "True"
    type: ContainersReady
  - lastProbeTime: null
    lastTransitionTime: "2024-08-19T09:30:10Z"
    status: "True"
    type: ContainerHasSufficientDisk
  - lastProbeTime: null
    lastTransitionTime: "2024-08-19T09:30:12Z"
    status: "True"
    type: ContainerInstanceCreated
  - lastProbeTime: null
    lastTransitionTime: "2024-08-19T09:30:13Z"
    status: "True"
    type: PodReadyToStartContainers
  - lastProbeTime: null
    lastTransitionTime: "2024-08-19T09:30:12Z"
    status: "True"
    type: PodScheduled
  containerStatuses:
  - containerID: containerd://5d4f205e068372f30a90715016465562b9988a981cb285e81c76b5b0dc******
    image: registry.cn-hangzhou.aliyuncs.com/acs/ack-ram-tool:1.0.0
    imageID: registry.cn-hangzhou.aliyuncs.com/acs/ack-ram-tool@sha256:ad4172d3ed3d6dab23f09218f9d478295e93c163915aac9e4e38a90c4d******
    lastState: {}
    name: demo
    ready: true
    restartCount: 0
    started: true
    state:
      running:
        startedAt: "2024-08-19T09:30:13Z"
  hostIP: 192.168.1.5
  phase: Running
  podIP: 192.168.1.5
  podIPs:
  - ip: 192.168.1.5
  qosClass: Guaranteed

The output confirms that ack-pod-identity-webhook injected the following configurations:

Compatible SDKs read ALIBABA_CLOUD_ROLE_ARN, ALIBABA_CLOUD_OIDC_PROVIDER_ARN, and ALIBABA_CLOUD_OIDC_TOKEN_FILE automatically. See RRSA SDK demos for language-specific examples.

Step 7: Check application output

kubectl -n rrsa-demo logs demo

Expected output:

cluster id: c66e40b731ab24f96b36bec5b1a******, cluster name: test-****
cluster id: cbec9a1f7b433470ebe4c900552******, cluster name: test-****

Each line corresponds to a cluster in the account, confirming that the application successfully assumed the RAM role and retrieved the cluster list.

Namespace configuration

apiVersion: v1
kind: Namespace
metadata:
  name: test
  labels:
    pod-identity.alibabacloud.com/injection: 'on'

Service account configuration

When pod-identity.alibabacloud.com/service-account-token-expiration is set at both the service account and the pod level, the pod-level setting takes precedence.

apiVersion: v1
kind: ServiceAccount
metadata:
  name: test-sa
  namespace: test
  annotations:
    pod-identity.alibabacloud.com/role-name: test-role
    pod-identity.alibabacloud.com/service-account-token-expiration: '3600'

Pod configuration

When a container name appears in both pod-identity.alibabacloud.com/only-containers and pod-identity.alibabacloud.com/skip-containers, the entry in only-containers is ignored and the container is skipped.

apiVersion: v1
kind: Pod
metadata:
  name: test-pod
  namespace: test
  annotations:
    pod-identity.alibabacloud.com/service-account-token-expiration: '3600'
    pod-identity.alibabacloud.com/only-containers: 'controller,test'

June 2024