The authorization system of Container Compute Service (ACS) includes Resource Access Management (RAM) authorization for underlying compute resources and Role-Based Access Control (RBAC) authorization for ACS-type Container Service for Kubernetes (ACK) clusters. Different user roles require different permissions at both layers. This topic describes authorization best practices for enterprise resource managers, Kubernetes cluster administrators, cluster and application O&M engineers, application developers, and permission administrators.
ACS authorization system
How the two layers work together
ACS clusters are a type of Container Service for Kubernetes (ACK) Serverless cluster. All cluster management calls ACK APIs, so both cloud-level (RAM) and cluster-level (RBAC) permissions must be in place.
| Layer | Scope | Controls | Granted through |
|---|---|---|---|
| RAM authorization | Cloud resources (control plane) | Cluster lifecycle, RBAC management, monitoring, logs, and events | RAM system policies or custom policies |
| RBAC authorization | Kubernetes resources (data plane) | Workloads, networking, storage, namespaces, ConfigMaps, and Secrets | Predefined or custom ClusterRoles in the ACS console |
Complete RAM authorization before granting RBAC permissions.
What RAM authorization covers
RAM authorization grants permissions for cluster O&M operations:
-
Create, view, and delete clusters
-
Manage RBAC authorization
-
Monitor clusters and manage logs and events
What RBAC authorization covers
RBAC authorization grants namespace-level or cluster-wide permissions on Kubernetes resources:
-
Workload resources: Deployment, StatefulSet, Job, CronJob, pod, ReplicaSet, and HorizontalPodAutoscaler (HPA)
-
Network resources: Service, Ingress, and NetworkPolicy
-
Storage resources: persistent volume (PV), persistent volume claim (PVC), and StorageClass
-
Other resources: Namespace, ConfigMap, and Secret
Default system policies
ACS provides the following default system policies. You can attach these policies to RAM users or RAM roles to quickly grant permissions.
The default system policies grant broad permissions, which may include read or write access to all OpenAPI operations of ACK and ACS. Grant these policies with caution.
Default system policy | Description |
AliyunAccFullAccess | Permissions to manage ACS. |
AliyunAccReadOnlyAccess | Read-only permissions on ACS. |
AliyunCSFullAccess | Permissions to manage ACK. Important Grants read and write permissions on all ACK clusters, including ACS-type clusters. Grant these permissions with caution. |
AliyunCSReadOnlyAccess | Read-only permissions on ACK. Important Grants read permissions on all ACK clusters, including ACS-type clusters. Grant these permissions with caution. |
AliyunAccFullAccess policy
{
"Statement": [
{
"Effect": "Allow",
"Action": "acc:*",
"Resource": "*"
}
],
"Version": "1"
}AliyunAccReadOnlyAccess policy
{
"Version": "1",
"Statement": [
{
"Action": [
"acc:Describe*",
"acc:CheckServiceRole"
],
"Resource": "*",
"Effect": "Allow"
}
]
}AliyunCSFullAccess policy
{
"Version": "1",
"Statement": [
{
"Action": "cs:*",
"Resource": "*",
"Effect": "Allow"
},
{
"Action": "ram:PassRole",
"Resource": "*",
"Effect": "Allow",
"Condition": {
"StringEquals": {
"acs:Service": "cs.aliyuncs.com"
}
}
}
]
}AliyunCSReadOnlyAccess policy
{
"Version": "1",
"Statement": [
{
"Action": [
"cs:CheckServiceRole",
"cs:Get*",
"cs:List*",
"cs:Describe*"
],
"Resource": "*",
"Effect": "Allow"
}
]
}Authorization best practices
When a RAM user or RAM role requires permissions for cluster and application O&M, you must grant both RAM and RBAC permissions. Grant RAM permissions first, followed by RBAC permissions. The following sections describe the authorization procedures for three common scenarios:
If the user is an O&M engineer for clusters and applications, see Scenario 1: O&M engineer for clusters and applications.
If the user is a developer for in-cluster applications, see Scenario 2: Developer for in-cluster applications.
If the user is a permission administrator for in-cluster applications, see Scenario 3: Permission administrator for in-cluster applications.
Scenario 1: O&M engineer for clusters and applications
This scenario is for users who manage and maintain ACS clusters and the applications within them. The authorization process involves granting both RAM and RBAC permissions.
RAM authorization
ACK provides two system policies for RAM: AliyunCSFullAccess and AliyunCSReadOnlyAccess.
AliyunCSFullAccess grants read and write permissions for all OpenAPI operations of ACK.
AliyunCSReadOnlyAccess grants read-only permissions for all OpenAPI operations of ACK.
ImportantThese two system policies grant permissions on all ACK clusters, including ACS-type clusters. Grant these permissions with caution.
Log on to the RAM console and attach one of the system policies as needed. For more information, see Manage permissions for a RAM user and Manage permissions for a RAM role.
If you require fine-grained access control, you can create a custom policy. For more information, see Grant RAM permissions to a RAM user or RAM role.
The following code is a sample RAM authorization policy for this scenario.
{ "Statement": [ { "Effect": "Allow", "Action": [ "acc:DescribeCommodityStatus", "acc:CheckServiceRole", "acc:DescribeCloudProducts", "acc:DescribeRegions", "acc:DescribeZones", "acc:GetInstancePrice", "acc:RecommendZones", "acc:DescribeGpuModelSeries" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "bssapi:GetPayAsYouGoPrice", "bssapi:QueryAccountBalance" ], "Resource": "*" }, { "Action": [ "ecs:DescribePrice", "ecs:DescribeAccountAttributes" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "ram:GetRole", "ram:CreateRole" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "cs:CreateCluster", "cs:DescribeAddons", "cs:DescribeUserQuota", "cs:DescribeTasks", "cs:ListClusterAddonInstances" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "cs:GetClusters", "cs:DescribeClustersV1", "cs:DescribeClusterUserKubeconfig", "cs:DescribeClusterResources", "cs:DescribeUserQuota", "cs:DescribeClusterLogs", "cs:ModifyCluster", "cs:UpgradeCluster", "cs:GetUpgradeStatus", "cs:ResumeUpgradeCluster", "cs:PauseClusterUpgrade", "cs:CancelClusterUpgrade", "cs:InstallClusterAddons", "cs:UpgradeClusterAddons", "cs:DescribeClusterAddonsUpgradeStatus", "cs:UnInstallClusterAddons", "cs:DeleteCluster", "cs:DescribeClusterDetail", "cs:GetClusterAuditProject", "cs:DescribeClusterAddonsVersion", "cs:DescribeClusterTasks", "cs:DescribeClusterEvents", "cs:DescribeEvents", "cs:ListClusterReportSummary", "cs:GetClusterBasicInfo", "cs:ListReportTaskRule", "cs:CreateReportTaskRule", "cs:CheckControlPlaneLogEnable", "cs:CreateClusterCheck" ], "Effect": "Allow", "Resource": "acs:cs:*:*:cluster/<yourclusterID>" }, { "Action": [ "cs:CheckServiceRole", "cs:DescribeKubernetesVersionMetadata" ], "Effect": "Allow", "Resource": "acs:cs:*:*:cluster/*" }, { "Action": [ "log:ListProject", "log:DescribeService", "log:GetSlsService" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "vpc:ListEnhanhcedNatGatewayAvailableZones", "vpc:DescribeEipAddresses", "vpc:DescribeVSwitches", "vpc:DescribeVpcs" ], "Effect": "Allow", "Resource": "*" } ], "Version": "1" }In the example above, replace
<yourclusterID>with the actual ACS cluster ID.For more information about the ACK OpenAPI, see [Product Change] Notice on ACK OpenAPI Authentication Optimization and API overview.
RBAC authorization
After granting RAM permissions, you must also grant the RAM user or RAM role RBAC permissions for the cluster. ACK provides four predefined roles at the cluster level.
Role
In-cluster RBAC permissions
Administrator
Read and write permissions on all resources in all namespaces.
O&M Engineer
Read and write permissions on Kubernetes resources that are visible in the console in all namespaces, and read-only permissions on cluster nodes, persistent volumes (PVs), namespaces, and quotas.
Developer
Read and write permissions on Kubernetes resources that are visible in the console in all or selected namespaces.
Restricted User
Read-only permissions on Kubernetes resources that are visible in the console in all or selected namespaces.
In the Container Compute Service console, click Authorizations in the left-side navigation pane. On the sub account or RAM Roles tab, find the target identity and click Modify Permissions.
In the dialog box that appears, click +Add Permissions. Set the permission for the target cluster and its namespaces to O&M Engineer, and then click Submit.
After you assign the predefined role, ACS automatically creates a ClusterRoleBinding instance in the cluster that corresponds to the identity of the authorized user or role. The following code shows the RBAC permissions for the predefined O&M Engineer role.
If you require fine-grained RBAC permissions, you can create a custom ClusterRole instance by referring to the official Kubernetes RBAC documentation. Then, on the Authorizations page of the Container Compute Service console, select Custom and select the name of the custom ClusterRole from the drop-down list. For more information, see Create a custom RBAC authorization policy.
Scenario 2: Developer for in-cluster applications
This scenario applies to users who only manage Kubernetes resources within an ACS cluster (using RBAC authorization) and do not require access to other cloud resources.
Before you grant RBAC permissions, the user or role must have, at a minimum, read-only RAM permissions for the target cluster. Setting the Resource to * grants the specified Action permissions on all ACK clusters. Do not use a wildcard (*) for the resource unless you fully understand the scope and impact.
RAM authorization
You need to create a custom policy in the RAM console and attach the policy to the target RAM user or RAM role. For more information, see Grant RAM permissions to a RAM user or RAM role. The custom policy is as follows:
{ "Statement": [ { "Effect": "Allow", "Action": [ "acc:DescribeCommodityStatus", "acc:CheckServiceRole", "acc:DescribeCloudProducts", "acc:DescribeRegions", "acc:DescribeZones", "acc:GetInstancePrice", "acc:RecommendZones" ], "Resource": "*" }, { "Effect": "Allow", "Action": "bssapi:GetPayAsYouGoPrice", "Resource": "*" }, { "Action": [ "cs:Get*", "cs:List*", "cs:Check*", "cs:Describe*" ], "Effect": "Allow", "Resource": [ "acs:cs:*:*:cluster/<yourclusterID>" ] }, { "Action": [ "vpc:ListEnhanhcedNatGatewayAvailableZones", "vpc:DescribeEipAddresses" ], "Effect": "Allow", "Resource": "*" } ], "Version": "1" }In the example above, replace
<yourclusterID>with your actual ACS cluster ID.NoteIf you only need to grant a user read-only permissions on a specific ACS cluster, use this sample policy and specify the cluster's ARN. Do not assign the
AliyunCSReadOnlyAccesssystem policy. This policy grants read-only permissions on all ACK clusters and is too permissive for this use case.RBAC authorization
In the Container Compute Service console, click Authorizations in the left-side navigation pane. On the sub account or RAM Roles tab, find the target identity and click Modify Permissions.
In the dialog box that appears, click +Add Permissions. Set the permission for the target cluster and its namespaces to Developer, and then click Submit.
After you assign the predefined role, ACS automatically creates a ClusterRoleBinding instance in the cluster that corresponds to the identity of the authorized user or role. The following sample code provides the RBAC permissions for the predefined Developer role.
Scenario 3: Permission administrator for in-cluster applications
The authorizing user or role is required to manage the RBAC permissions of other RAM users or RAM roles. By default, a RAM user or RAM role does not have the permission to grant RBAC permissions to other RAM users or RAM roles. When the authorizing user or role accesses the authorization management page in the Container Service console, if the UI displays the message The current RAM user does not have authorization management permissions. Please contact the Alibaba Cloud account or a permission administrator for authorization., this indicates that the authorizing user or role lacks the necessary RAM authorization or the RBAC administrator authorization for the cluster.
RAM authorization
Ensure that the user or role is granted the necessary RAM permissions. The policy must include permissions to:
List other RAM users or RAM roles.
Grant RAM policies to specified RAM users or RAM roles.
View the Kubernetes RBAC permission configurations of specified RAM users or RAM roles.
Perform Kubernetes RBAC authorization.
In the RAM console, grant the corresponding RAM permissions to the specified RAM user or RAM role. For more information, see Grant RAM permissions to a RAM user or RAM role. The following sample code provides a custom RAM policy.
{ "Statement": [ { "Effect": "Allow", "Action": [ "acc:DescribeCommodityStatus", "acc:CheckServiceRole", "acc:DescribeCloudProducts", "acc:DescribeRegions", "acc:DescribeZones", "acc:GetInstancePrice", "acc:RecommendZones" ], "Resource": "*" }, { "Effect": "Allow", "Action": "bssapi:GetPayAsYouGoPrice", "Resource": "*" }, { "Action": [ "ram:Get*", "ram:List*", "cs:GetUserPermissions", "cs:GetSubUsers", "cs:GrantPermission", "cs:CheckServiceRole" ], "Resource": "*", "Effect": "Allow" }, { "Action": [ "ram:AttachPolicyToUser", "ram:AttachPolicyToRole" ], "Effect": "Allow", "Resource": [ "acs:ram:*:*:policy/xxxx", "acs:*:*:*:user/*" ] }, { "Action": [ "vpc:ListEnhanhcedNatGatewayAvailableZones", "vpc:DescribeEipAddresses" ], "Effect": "Allow", "Resource": "*" } ], "Version": "1" }RBAC authorization
In the Container Compute Service console, click Authorizations in the left-side navigation pane. On the sub account or RAM Roles tab, find the target identity and click Modify Permissions.
In the dialog box that appears, click +Add Permissions. Set the permission for the target cluster and its namespaces to Administrator or the cluster-admin custom role, and then click Submit.
NoteAn Alibaba Cloud account and the cluster creator are bound to the cluster-admin role by default and have access to all Kubernetes resource objects in the cluster.
After you complete the RAM and RBAC authorization for a target, the target can manage RBAC authorization for other RAM users or RAM roles within a specified permission scope. For more information, see Grant RAM permissions to a RAM user or RAM role.
Authorization actions
Permission name (Action) | Description |
acc:CheckServiceRole | Checks whether the account has authorized the product to assume a ServiceRole to access the resources of other cloud products. |
acc:DescribeCommodityStatus | Checks whether ACS is activated for the account. |
Permission name (Action) | Description |
bssapi:GetPayAsYouGoPrice | Queries the pricing service for pay-as-you-go products. |
ram:ListUserBasicInfos | Queries the basic information of all RAM users. |
ram:ListRoles | Queries the basic information of all RAM roles. |
For a description of the authorization Actions for ACK, see Authorization information.
Before writing authorization rules, ensure you understand the authorization Actions for ACK and follow the principle of least privilege. For more information, see Authorization information.
If you do not specify a target cluster ID and instead set the resource scope to a wildcard (*), permissions are granted to all ACK clusters, which may be broader than intended. Grant these permissions with caution.