Container Compute Service:Configure pod-level permissions with RRSA

Create and authorize a new RAM role

The application deployed in this example uses the RRSA feature to assume a specified role and retrieve a list of clusters in the current account. The main resources used are as follows:

• Namespace: rrsa-demo.

• Service account: demo-sa.

• RAM role: demo-role-for-rrsa.

1. Create a RAM role named demo-role-for-rrsa.

   1. Log on to the RAM console by using your Alibaba Cloud account.

   2. In the left-side navigation pane, choose Identities > Roles. On the Roles page, click Create Role.

   3. In the Create Role panel, click Switch to Policy Editor to create a role.

   4. In the Visual Editor tab, configure the role information as described in the following table and then click OK.

      Parameter	Description
      Effect	The default value is Allow.
      Principal	Select Identity Provider and click Edit. Set Identity Provider Type to OIDC and select the OIDC identity provider of the cluster, such as ack-rrsa-<cluster_id>. <cluster_id> is your cluster ID.
      Action	By default, sts:AssumeRole is selected.
      Condition	oidc:iss: This condition is automatically added after you select the Identity Provider. Use the default setting. oidc:aud: This condition is automatically added after you select the Identity Provider. Use the default setting. oidc:sub: You need to manually Add Condition. Key: oidc:sub Operator: StringEquals Value: The format is system:serviceaccount:<namespace>:<serviceAccountName>. <namespace>: the namespace where the application resides. <serviceAccountName>: the name of the service account. Based on the information about the test application, enter system:serviceaccount:rrsa-demo:demo-sa.

   5. In the dialog box that appears, enter the role name demo-role-for-rrsa and click OK.

2. Grant the created role the AliyunCSReadOnlyAccess system policy, which is required by the test application. For more information, see Manage permissions for a RAM role.

3. Deploy the test application.

   1. Create a file named demo.yaml with the following content.

      Note

      Replace the following placeholders in the sample application template.

      • <role_arn>: Replace this with the ARN of the RAM role that the application uses. You can obtain the ARN from the ARN field on the Basic Information page of the role on the RAM console.

      • <oidc_provider_arn>: Replace this with the OIDC provider ARN of the cluster. You can obtain this ARN by hovering over Enabled next to RRSA OIDC on the Basic Information tab of the Cluster Information page.

      Expand to view the sample code

      ---
      apiVersion: v1
      kind: Namespace
      metadata:
        name: rrsa-demo
      ---
      apiVersion: v1
      kind: ServiceAccount
      metadata:
        name: demo-sa
        namespace: rrsa-demo
      ---
      apiVersion: v1
      kind: Pod
      metadata:
        name: demo
        namespace: rrsa-demo
      spec:
        containers:
        - args:
          - rrsa
          - demo
          env:
          - name: ALIBABA_CLOUD_ROLE_ARN
            value: <role_arn>
          - name: ALIBABA_CLOUD_OIDC_PROVIDER_ARN
            value: <oidc_provider_arn>
          - name: ALIBABA_CLOUD_OIDC_TOKEN_FILE
            value: /var/run/secrets/ack.alibabacloud.com/rrsa-tokens/token
          image: registry.cn-hangzhou.aliyuncs.com/acs/ack-ram-tool:1.0.0
          imagePullPolicy: Always
          name: demo
          volumeMounts:
          - mountPath: /var/run/secrets/ack.alibabacloud.com/rrsa-tokens
            name: rrsa-oidc-token
            readOnly: true
        restartPolicy: OnFailure
        serviceAccount: demo-sa
        serviceAccountName: demo-sa
        volumes:
        - name: rrsa-oidc-token
          projected:
            defaultMode: 420
            sources:
            - serviceAccountToken:
                audience: sts.aliyuncs.com
                expirationSeconds: 3600  # Unit: seconds. Valid values: [600, 43200], which means 10 minutes to 12 hours.
                path: token

   2. Run the following command to deploy the test application.

      kubectl apply -f demo.yaml

      After the application is deployed, the application can use the mounted OIDC token, the RAM role ARN, and the OIDC identity provider ARN to call the AssumeRoleWithOIDC API of STS to obtain a temporary credential for the specified RAM role. The application then uses this temporary credential to access cloud resource APIs. For more information, see AssumeRoleWithOIDC.

4. Run the following command to view the logs of the test application.

   kubectl -n rrsa-demo logs demo

   The expected output is a list of ACK clusters:

   20**/**/** 08:35:23 ======= [begin] list ACK clusters with RRSA =======
   clusters:
   cluster id: cf***, cluster name: foo*
   cluster id: c8***, cluster name: bar*
   cluster id: c4***, cluster name: foob*
   20**/**/** 08:35:24 ======= [end]   list ACK clusters with RRSA =======

5. Optional: Detach the AliyunCSReadOnlyAccess system policy from the role. For more information, see Remove permissions from a RAM role.

   Wait for about 30 seconds, and then run the following command to view the application logs again:

   kubectl -n rrsa-demo logs demo

   A permission denied error is expected:

   20**/**/** 10:09:33 ======= [begin] list ACK clusters with RRSA =======
   20**/**/** 10:09:33 SDKError:
      StatusCode: 403
      Code: StatusForbidden
      Message: code: 403, STSToken policy Forbidden for action cs:DescribeClusters request id: XXXX
      Data: {"accessDeniedDetail":{"AuthAction":"cs:DescribeClusters","AuthPrincipalDisplayName":"demo-role-for-rrsa:ack-ram-tool","AuthPrincipalOwnerId":"XXXX","AuthPrincipalType":"AssumedRoleUser","EncodedDiagnosticMessage":"XXXX","NoPermissionType":"ImplicitDeny","PolicyType":"ResourceGroupLevelIdentityBasedPolicy"},"code":"StatusForbidden","message":"STSToken policy Forbidden for action cs:DescribeClusters","requestId":"XXXX","status":403,"statusCode":403}

Authorize an existing RAM role

If your application needs to use an existing RAM role instead of a new one, you can modify the trust policy of the RAM role by adding a statement to allow applications that use a specific service account to assume this RAM role and obtain temporary credentials. For more information, see Modify the trust policy of a RAM role.

The following code is an example Statement entry to add to the trust policy of the RAM role.

{
  "Action": "sts:AssumeRole",
  "Condition": {
    "StringEquals": {
      "oidc:aud": "sts.aliyuncs.com",
      "oidc:iss": "<oidc_issuer_url>",
      "oidc:sub": "system:serviceaccount:<namespace>:<service_account>"
    }
  },
  "Effect": "Allow",
  "Principal": {
    "Federated": [
      "<oidc_provider_arn>"
    ]
  }
}