Grant permissions to an MSE Ingress controller in Container Service - Microservices Engine

To access services in a cluster using an MSE Ingress, you must grant the MSE Ingress controller the required permissions to access MSE before you deploy the services.

Grant permissions to the MSE Ingress controller for an ACK managed cluster or an ACK serverless cluster

You can grant permissions to an MSE Ingress controller in an ACK managed cluster or an ACK serverless cluster in one of the following two ways.

If you want to use an MSE Ingress in an existing ACK managed cluster or ACK serverless cluster, see Method 1 to grant the required permissions.
If you plan to use an MSE Ingress when you create a new ACK managed cluster or ACK serverless cluster, see Method 2 to grant the required permissions.

Method 1: Grant permissions to the MSE Ingress controller in Component Management

When you install the MSE Ingress controller in Component Management, a permission verification is automatically performed. If the precheck fails, follow these steps to grant the required permissions.

Move the pointer over the Precheck failed message and click View Check Report.
On the Check Report page, click the red box in the Abnormal column, and then click the link in the panel that appears.

In the Cluster Authorization check results, the ManagedRamRole row shows an error. Click the box icon to the left of the row to expand the details panel. The error message for AliyunCSManagedMseRole is "RamRole does not exist". An authorization link is provided in the recommended fix.
On the Access Control Quick Authorization page, click Confirm Authorization.

This action grants the AliyunServiceRoleForMSE and AliyunCSManagedMseRole roles. The associated access policy is AliyunCSManagedMseRolePolicy, which is a system policy.
Install the component again.

Method 2: Grant permissions to the MSE Ingress controller when you create a cluster

When you install the MSE Ingress controller while creating a new cluster, go to the Dependency Check section of the Confirm Configuration step. Check whether the Status of the MSE Ingress Role Authorization Check is Passed. If the Status is Failed, click Go to Authorization.
On the Access Control Quick Authorization page, click Confirm Authorization.

This action creates the service-linked roles AliyunServiceRoleForMSE and AliyunCSManagedMseRole. The associated access policy is AliyunCSManagedMseRolePolicy.
After the authorization is complete, return to the Confirm Configuration page and click Recheck. After the check passes, click Create Cluster.

Grant permissions to the MSE Ingress controller in an ACK dedicated cluster

Log on to the Container Service console.
In the navigation pane on the left, click Cluster List, and then click the name of the destination cluster.
On the Cluster Information page, in the Cluster Resources section of the Basic Information tab, click the link to the right of Worker RAM Role.
In the RAM console, add the AliyunMSEFullAccess permission to the role.
1. On the Permissions tab of the Role page, click Grant Permission.
2. On the Grant Permission page, select System Policy from the drop-down list in the Access Policy section. Then, enter the name of the access policy in the search box to perform a fuzzy search.
  
  For example, you can enter mse to find AliyunMSEFullAccess.
  
  To the right of the access policy search box, filter the results by selecting System Policy as the policy type.
3. Select the AliyunMSEFullAccess access policy and click OK to grant the permission.
  
  Verify that the AliyunMSEFullAccess permission is successfully added to the role.
  
  On the role details page, click the Permissions tab. In the list of access policies, confirm that the AliyunMSEFullAccess system policy is added. The resource scope is at the account level.
In the mse-ingress-controller namespace of the destination cluster, find the ack-mse-ingress-controller application, click in the Actions column, select Redeploy, and then click OK.

After the redeployment is complete, click the ack-mse-ingress-controller application and confirm that the recreated pod is in the Running state.

(Optional) Create an SLS access policy and grant SLS-related permissions to the cluster

If you want to enable the Simple Log Service (SLS) log delivery service for an MSE cloud-native gateway using MseIngressConfig, you must grant additional SLS-related permissions to the Worker RAM role of the cluster resources.

Log on to the RAM console as a RAM administrator.
In the navigation pane on the left, choose .
On the Policies page, click Create Policy.

On the Create Policy page, click the Script Editor tab, enter the following policy document, and then click Continue to edit basic information.

{
    "Version": "1",
    "Statement": [
        {
            "Action": [
                "log:CloseProductDataCollection",
                "log:OpenProductDataCollection",
                "log:GetProductDataCollection"
            ],
            "Resource": [
                "acs:mse:*:*:instance/*",
                "acs:log:*:*:project/*/logstore/mse_*"
            ],
            "Effect": "Allow"
        },
        {
            "Action": "ram:PassRole",
            "Resource": "acs:ram::*:role/aliyunserviceroleforslsaudit",
            "Effect": "Allow"
        },
        {
            "Action": "ram:CreateServiceLinkedRole",
            "Resource": "*",
            "Effect": "Allow",
            "Condition": {
                "StringEquals": {
                    "ram:ServiceName": "audit.log.aliyuncs.com"
                }
            }
        }
    ]
}

On the Create Policy page, specify a Policy Name and a Note, and then click OK.
Grant SLS-related permissions to the Worker RAM role of the cluster resources.
1. Log on to the Container Service console.
2. In the navigation pane on the left, click Cluster List, and then click the name of the destination cluster.
3. On the Cluster Information page, in the Cluster Resources section of the Basic Information tab, click the link to the right of Worker RAM Role.
4. In the RAM console, add the SLS-related permission to the role.
  1. On the Permissions tab of the Role page, click Grant Permission.
  2. On the Grant Permission page, select Custom Policy from the drop-down list in the Access Policy section. Then, enter the name of the access policy that you created in the search box to perform a fuzzy search.
    
    Note
    The name of the SLS access policy is the name that you specified when you created the policy.
    
    Set Resource Scope to Account Level and confirm that the Authorized Entity is the correct worker role.
  3. Select the destination access policy and click OK to grant the permission.

Grant permissions to the MSE Ingress controller in an ACS cluster

If you plan to use an MSE Ingress when you create a new ACS cluster, you can grant the required permissions to the MSE Ingress controller during the cluster creation process.

When you install the MSE Ingress controller while creating a new cluster, go to the Dependency Check section of the Confirm Configuration step. Check whether the Status of the MSE Ingress Role Authorization Check is Passed. If the Status is Failed, click Go to Authorization.
On the Access Control Quick Authorization page, click Confirm Authorization.
After the authorization is complete, return to the Confirm Configuration page and click Recheck. After the check passes, click Create Cluster.

What to do next

For more information, see Access services in Container Service and Container Compute Service using an MSE Ingress.