Container Compute Service:Configure RBAC permissions for a RAM user or RAM role

Overview

Grant RBAC permissions to RAM users or roles

1. Log on to the ACS console. In the left navigation pane, choose Authorizations.

2. On the Authorizations page, configure permissions for a RAM user or RAM role.

   Important

   ACS clusters are a type of ACK serverless cluster. If you have already granted a RAM user or RAM role RBAC permissions for "All Clusters" in the ACK console, those permissions automatically apply to ACS clusters. You cannot grant separate permissions for ACS clusters from the ACS console; they inherit the "All Clusters" policy.

   1. To authorize a RAM user:

      On the RAM Users tab, find the target RAM user and click Modify Permissions in the Actions column, which opens the Permission Management panel.

   2. To authorize a RAM role:

      Click the RAM Roles tab. Enter the RAM Role Name and click Modify Permissions to open the Permission Management panel.

3. In the Permission Management panel, click + Add Permissions. Configure the permission settings for the target RAM user or RAM role at the Clusters and Namespace levels, select a predefined role, and then click Submit.

   Predefined role	In-cluster RBAC permissions
   Administrator	Read and write permissions for all resources across all namespaces.
   O&M Engineer	Read and write permissions for Kubernetes resources visible in the console across all namespaces, and read-only permissions for persistent volumes, namespaces, and quotas.
   Developer	Read and write permissions for Kubernetes resources visible in the console within all or selected namespaces.
   Restricted User	Read-only permissions for Kubernetes resources visible in the console within all or selected namespaces.
   Custom	The selected cluster role determines the permissions. To avoid granting unintended permissions, review the permissions of the cluster role before assigning it to a RAM user or RAM role. For instructions on how to view custom permissions, expand the section below. Important A RAM user or RAM role with the cluster-admin permission has super-administrator privileges within the cluster, equivalent to an Alibaba Cloud account. This role provides unrestricted access to all cluster resources. Assign this role with extreme caution.

4. After the configuration is complete, you can log on to the ACS console as the target RAM user or RAM role to perform operations.

   Note

   • Ensure that the RAM user or RAM role has the required RAM permissions for the cluster and is also granted the RBAC Administrator or cluster-admin role. For more information, see Grant RAM permissions to a RAM user or RAM role.

   • ACS provides four standard predefined roles: Administrator, O&M Engineer, Developer, and Restricted User. These roles meet most access control requirements. If you need to define more granular permissions, use the Custom role feature.

   • You can assign one predefined role and multiple custom roles to a RAM user or RAM role for a specific cluster or namespace.

   • If you want to grant permissions for all clusters at once so that new clusters automatically inherit these permissions, select All Clusters from the Clusters drop-down list.

   View custom permissions

   1. Click Custom, and then click View Details on the right to view the details of the custom permissions.

   2. Log on to a cluster node and run the following command to view details of custom permissions.

      kubectl get clusterrole

      Expected output:

      NAME                                                                   CREATED AT
      acs:view                                                               2024-12-31T06:18:06Z
      admin                                                                  2024-12-31T06:17:53Z
      alibaba-log-controller                                                 2024-12-31T06:25:03Z
      alicloud-csi-provisioner                                               2024-12-31T06:19:23Z
      aliyun-eci-pod-clusterrole                                             2024-12-31T06:18:52Z
      arms-aliyunserviceroleforarms-clusterrole                              2024-12-31T06:25:03Z
      cluster-admin                                                          2024-12-31T06:17:53Z
      ebs-token-controller                                                   2024-12-31T06:19:00Z
      edit                                                                   2024-12-31T06:17:53Z
      o11y:addon-controller:role                                             2024-12-31T06:24:32Z
      system:aggregate-to-admin                                              2024-12-31T06:17:53Z
      system:aggregate-to-edit                                               2024-12-31T06:17:53Z
      ...
      system:volume-scheduler                                                2024-12-31T06:17:53Z
      tenant-webhook-clusterrole                                             2024-12-31T06:19:45Z
      view                                                                   2024-12-31T06:17:53Z

   3. To view the permission details of the cluster-admin role, run the following command:

      Important

      A RAM user or RAM role with the cluster-admin permission has super-administrator privileges in the cluster, equivalent to an Alibaba Cloud account. This role provides unrestricted access to all cluster resources. Assign this role with caution.

      kubectl get clusterrole cluster-admin -o yaml

      Expected output:

      apiVersion: rbac.authorization.k8s.io/v1
      kind: ClusterRole
      metadata:
        annotations:
          rbac.authorization.kubernetes.io/autoupdate: "true"
        creationTimestamp: "2024-12-31T06:17:53Z"
        labels:
          kubernetes.io/bootstrapping: rbac-defaults
        name: cluster-admin
        resourceVersion: "70"
        uid: 759xxxxx-5ad2-42ce-872d-fbce117xxxxx
      rules:
      - apiGroups:
        - '*'
        resources:
        - '*'
        verbs:
        - '*'
      - nonResourceURLs:
        - '*'
        verbs:
        - '*'

Delegate RBAC authorization to RAM users or roles

To delegate this capability, an Alibaba Cloud account or a RAM user with the cluster-wide Administrator role must grant the necessary RAM and RBAC permissions to the intended user or role.

RAM permissions

1. Log on to the RAM console and grant the required RAM permissions to the RAM user or RAM role by using a policy similar to the following example. For more information, see Grant RAM permissions to a RAM user or RAM role.

   Important

   Replace xxxxxx with the name of the RAM policy to attach. Using an asterisk (*) allows the RAM user or RAM role to attach any RAM policy. Setting "Resource": "*" grants permission to perform the specified actions on all resources under your account. The cs:* action applies to all ACK clusters except for ACS clusters. Grant these permissions with caution.

   {
       "Statement": [{
               "Action": [
                   "ram:Get*",
                   "ram:List*",
                   "cs:DescribeClustersV1",
                   "cs:GrantPermission"
               ],
               "Resource": "*",
               "Effect": "Allow"
           },
           {
               "Action": [
                   "ram:AttachPolicyToUser",
                   "ram:AttachPolicy"
               ],
               "Effect": "Allow",
               "Resource":  [
                   "acs:ram:*:*:policy/xxxxxx",
                   "acs:*:*:*:user/*"
               ]
           }
       ],
       "Version": "1"
   }

2. After you grant the permissions, the RAM user or RAM role can grant RAM permissions to other RAM users or RAM roles within the scope of the specified policy.

RBAC permissions

1. After you grant the required RAM permissions, you must also assign the Administrator predefined role or the cluster-admin custom role to the RAM user or RAM role for the target cluster or namespace. For more information, see Set an authorization subject as a permission administrator for in-cluster applications.

Set RAM users or roles as permission administrators

If it is inconvenient to use an Alibaba Cloud account to grant permissions, you can set a RAM user or RAM role as a permission administrator. You can then use this permission administrator to perform authorization tasks.

1. Log on to the RAM console and locate the target RAM user or RAM role.

   • RAM user

     In the left-side navigation pane, choose Identities > Users. In the user list, find the target user and click Attach Policy in the Actions column.

   • RAM role

     In the left-side navigation pane, choose Identities > Roles. In the role list, find the target role and click Attach Policy in the Actions column.

2. In the Attach Policy dialog box, click the search box in the Policy section. Search for the AliyunRAMFullAccess and AliyunACCFullAccess system policies by name, and then select them. The selected policies are added to the Selected Policy area on the right. Click OK, and then close the dialog box to complete the authorization.

3. Log on to the ACS console and grant the Administrator predefined role to the RAM user or RAM role for all clusters. For more information, see Grant RBAC permissions to a RAM user or RAM role.

4. After you complete these steps, the RAM user or RAM role becomes a permission administrator and can grant RAM and RBAC permissions to other RAM users and RAM roles.

Permission error codes

If an operation in the console or an API call fails due to insufficient RBAC permissions, the system returns a corresponding error code. The following table lists the required cluster RBAC permissions for common error codes.

Related documents

• Customize RAM authorization policies

• Default roles in ACS

• Authorization best practices