Container Compute Service:Mejores prácticas de autorización

Cómo funcionan las dos capas en conjunto

Los clústeres de ACS son un tipo de clúster serverless de Container Service for Kubernetes (ACK). Todas las llamadas de administración del clúster invocan API de ACK, por lo que se requieren tanto los permisos a nivel de nube (RAM) como los permisos a nivel de clúster (RBAC).

Complete la autorización de RAM antes de otorgar permisos de RBAC.

{
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "acc:*",
            "Resource": "*"
        }
    ],
    "Version": "1"
}

{
    "Version": "1",
    "Statement": [
        {
            "Action": [
                "acc:Describe*",
                "acc:CheckServiceRole"
            ],
            "Resource": "*",
            "Effect": "Allow"
        }
    ]
}

{
    "Version": "1",
    "Statement": [
        {
            "Action": "cs:*",
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": "ram:PassRole",
            "Resource": "*",
            "Effect": "Allow",
            "Condition": {
                "StringEquals": {
                    "acs:Service": "cs.aliyuncs.com"
                }
            }
        }
    ]
}

{
    "Version": "1",
    "Statement": [
        {
            "Action": [
                "cs:CheckServiceRole",
                "cs:Get*",
                "cs:List*",
                "cs:Describe*"
            ],
            "Resource": "*",
            "Effect": "Allow"
        }
    ]
}

Escenario 1: Ingeniero de O&M de clústeres y aplicaciones

Este escenario está diseñado para usuarios que gestionan y mantienen clústeres de ACS y las aplicaciones que contienen. El proceso de autorización implica otorgar permisos de RAM y de RBAC.

1. Autorización de RAM

   ACK proporciona dos políticas de sistema para RAM: AliyunCSFullAccess y AliyunCSReadOnlyAccess.

   • AliyunCSFullAccess otorga permisos de lectura y escritura para todas las operaciones de OpenAPI de ACK.

   • AliyunCSReadOnlyAccess otorga permisos de solo lectura para todas las operaciones de OpenAPI de ACK.

     Importante

     Estas dos políticas de sistema otorgan permisos sobre todos los clústeres de ACK, incluidos los de tipo ACS. Otorgue estos permisos con precaución.

   Inicie sesión en la consola de RAM y adjunte una de las políticas de sistema según sus necesidades. Para obtener más información, consulte Manage permissions for a RAM user y Manage permissions for a RAM role.

   Si requiere un control de acceso detallado, cree una política personalizada. Para obtener más información, consulte Grant RAM permissions to a RAM user or RAM role.

   El siguiente código muestra un ejemplo de política de autorización de RAM para este escenario.

   {
       "Statement": [
           {
               "Effect": "Allow",
               "Action": [
                   "acc:DescribeCommodityStatus",
                   "acc:CheckServiceRole",
                   "acc:DescribeCloudProducts",
                   "acc:DescribeRegions",
                   "acc:DescribeZones",
                   "acc:GetInstancePrice",
                   "acc:RecommendZones",
                   "acc:DescribeGpuModelSeries"
               ],
               "Resource": "*"
           },
           {
               "Effect": "Allow",
               "Action": [
                   "bssapi:GetPayAsYouGoPrice",
                   "bssapi:QueryAccountBalance"
               ],
               "Resource": "*"
           },
           {
               "Action": [
                   "ecs:DescribePrice",
                   "ecs:DescribeAccountAttributes"
               ],
               "Effect": "Allow",
               "Resource": "*"
           },
           {
               "Action": [
                   "ram:GetRole",
                   "ram:CreateRole"
               ],
               "Effect": "Allow",
               "Resource": "*"
           },
           {
               "Action": [
                   "cs:CreateCluster",
                   "cs:DescribeAddons",
                   "cs:DescribeUserQuota",
                   "cs:DescribeTasks",
                   "cs:ListClusterAddonInstances"
               ],
               "Effect": "Allow",
               "Resource": "*"
           },
           {
               "Action": [
                   "cs:GetClusters",
                   "cs:DescribeClustersV1",
                   "cs:DescribeClusterUserKubeconfig",
                   "cs:DescribeClusterResources",
                   "cs:DescribeUserQuota",
                   "cs:DescribeClusterLogs",
                   "cs:ModifyCluster",
                   "cs:UpgradeCluster",
                   "cs:GetUpgradeStatus",
                   "cs:ResumeUpgradeCluster",
                   "cs:PauseClusterUpgrade",
                   "cs:CancelClusterUpgrade",
                   "cs:InstallClusterAddons",
                   "cs:UpgradeClusterAddons",
                   "cs:DescribeClusterAddonsUpgradeStatus",
                   "cs:UnInstallClusterAddons",
                   "cs:DeleteCluster",
                   "cs:DescribeClusterDetail",
                   "cs:GetClusterAuditProject",
                   "cs:DescribeClusterAddonsVersion",
                   "cs:DescribeClusterTasks",
                   "cs:DescribeClusterEvents",
                   "cs:DescribeEvents",
                   "cs:ListClusterReportSummary",
                   "cs:GetClusterBasicInfo",
                   "cs:ListReportTaskRule",
                   "cs:CreateReportTaskRule",
                   "cs:CheckControlPlaneLogEnable",
                   "cs:CreateClusterCheck"
               ],
               "Effect": "Allow",
               "Resource": "acs:cs:*:*:cluster/<yourclusterID>"
           },
           {
               "Action": [
                   "cs:CheckServiceRole",
                   "cs:DescribeKubernetesVersionMetadata"
               ],
               "Effect": "Allow",
               "Resource": "acs:cs:*:*:cluster/*"
           },
           {
               "Action": [
                   "log:ListProject",
                   "log:DescribeService",
                   "log:GetSlsService"
               ],
               "Effect": "Allow",
               "Resource": "*"
           },
           {
               "Action": [
                   "vpc:ListEnhanhcedNatGatewayAvailableZones",
                   "vpc:DescribeEipAddresses",
                   "vpc:DescribeVSwitches",
                   "vpc:DescribeVpcs"
               ],
               "Effect": "Allow",
               "Resource": "*"
           }
       ],
       "Version": "1"
   }

   En el ejemplo anterior, reemplace <yourclusterID> con el ID real del clúster de ACS.

2. Para obtener más información sobre la OpenAPI de ACK, consulte [[Product Change] Notice on ACK OpenAPI Authentication Optimization](t2103012.dita#task_2103012) y API overview.

3. Autorización de RBAC

   Después de otorgar los permisos de RAM, también debe conceder al usuario o rol de RAM los permisos de RBAC correspondientes al clúster. ACK proporciona cuatro roles predefinidos a nivel de clúster.

   Rol	Permisos de RBAC dentro del clúster
   Administrator	Permisos de lectura y escritura sobre todos los recursos en todos los espacios de nombres.
   O&M Engineer	Permisos de lectura y escritura sobre los recursos de Kubernetes visibles en la consola en todos los espacios de nombres. También incluye permisos de solo lectura sobre nodos del clúster, volúmenes persistentes (PV), espacios de nombres y cuotas.
   Developer	Permisos de lectura y escritura sobre los recursos de Kubernetes visibles en la consola, ya sea en todos los espacios de nombres o solo en los seleccionados.
   Restricted User	Permisos de solo lectura sobre los recursos de Kubernetes visibles en la consola, en todos los espacios de nombres o únicamente en los seleccionados.

   1. En la consola de Container Compute Service, haga clic en Authorizations en el panel de navegación izquierdo. En la pestaña sub account o RAM Roles, busque la identidad de destino y haga clic en Modify Permissions.

   2. En el cuadro de diálogo que aparece, haga clic en +Add Permissions. Establezca el permiso del clúster de destino y sus espacios de nombres en O&M Engineer y, a continuación, haga clic en Submit.

   Una vez asignado el rol predefinido, ACS crea automáticamente una instancia de ClusterRoleBinding en el clúster. Esta instancia corresponde a la identidad del usuario o rol autorizado. El siguiente código muestra los permisos de RBAC del rol predefinido O&M Engineer.

   Ejemplo de permisos de RBAC para el rol predefinido O&M Engineer

   apiVersion: rbac.authorization.k8s.io/v1
   kind: ClusterRole
   metadata:
     name: cs:ops
   rules:
   - apiGroups: [""]
     resources:  ["pods", "pods/attach", "pods/exec", "pods/portforward", "pods/proxy"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: [""]
     resources:  ["configmaps", "endpoints", "persistentvolumeclaims", "replicationcontrollers", "replicationcontrollers/scale", "secrets", "serviceaccounts", "services", "services/proxy"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: [""]
     resources:  ["bindings", "events", "limitranges", "namespaces/status", "replicationcontrollers/status", "pods/log", "pods/status", "resourcequotas", "resourcequotas/status", "componentstatuses"]
     verbs: ["get", "list", "watch"]
   - apiGroups: [""]
     resources:  ["namespaces", "nodes", "persistentvolumes"]
     verbs: ["get", "list", "watch", "patch"]
   - apiGroups: ["coordination.k8s.io"]
     resources:  ["leases"]
     verbs: ["get"]
   - apiGroups: ["apps"]
     resources:  ["daemonsets", "deployments", "deployments/rollback", "deployments/scale", "replicasets", "replicasets/scale", "statefulsets"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["autoscaling"]
     resources:  ["horizontalpodautoscalers"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["batch"]
     resources:  ["cronjobs", "jobs"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["extensions"]
     resources:  ["daemonsets", "deployments", "deployments/rollback", "deployments/scale","ingresses","replicasets", "replicasets/scale", "replicationcontrollers/scale"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["networking.k8s.io"]
     resources:  ["*"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["servicecatalog.k8s.io"]
     resources:  ["clusterserviceclasses", "clusterserviceplans", "clusterservicebrokers", "serviceinstances", "servicebindings"]
     verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["servicecatalog.k8s.io"]
     resources:  ["clusterservicebrokers/status", "clusterserviceclasses/status", "clusterserviceplans/status", "serviceinstances/status", "serviceinstances/reference", "servicebindings/status",]
     verbs: ["update"]
   - apiGroups: ["storage.k8s.io"]
     resources:  ["storageclasses"]
     verbs: ["get", "list", "watch"]
   - apiGroups: ["alicloud.com"]
     resources:  ["*"]
     verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["policy"]
     resources:  ["poddisruptionbudgets"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["metrics.k8s.io"]
     resources: ["pods"]
     verbs: ["get", "watch", "list"]
   - apiGroups: ["networking.istio.io"]
     resources:  ["*"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["config.istio.io"]
     resources:  ["*"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["rbac.istio.io"]
     resources:  ["*"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["istio.alibabacloud.com"]
     resources:  ["*"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["authentication.istio.io"]
     resources:  ["*"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["log.alibabacloud.com"]
     resources:  ["*"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["monitoring.kiali.io"]
     resources:  ["*"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["kiali.io"]
     resources:  ["*"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["apiextensions.k8s.io"]
     resources: ["customresourcedefinitions"]
     verbs: ["get", "list", "create", "watch", "patch", "update", "delete", "deletecollection"]
   - apiGroups: ["serving.knative.dev"]
     resources: ["*"]
     verbs: ["get", "list", "create", "watch", "patch", "update", "delete", "deletecollection"]
   - apiGroups: ["eventing.knative.dev"]
     resources: ["*"]
     verbs: ["get", "list", "create", "watch", "patch", "update", "delete", "deletecollection"]
   - apiGroups: ["messaging.knative.dev"]
     resources: ["*"]
     verbs: ["get", "list", "create", "watch", "patch", "update", "delete", "deletecollection"]
   - apiGroups: ["sources.eventing.knative.dev"]
     resources: ["*"]
     verbs: ["get", "list", "create", "watch", "patch", "update", "delete", "deletecollection"]
   - apiGroups: ["tekton.dev"]
     resources: ["*"]
     verbs: ["get", "list", "create", "watch", "patch", "update", "delete", "deletecollection"]
   - apiGroups: ["alert.alibabacloud.com"]
     resources: ["*"]
     verbs: ["get", "list", "create", "watch", "patch", "update", "delete", "deletecollection"]

   Si requiere permisos de RBAC más específicos, cree una instancia de ClusterRole personalizada con base en la documentación oficial de RBAC de Kubernetes. Después, en la página Authorizations de la consola de Container Compute Service, seleccione Custom y elija el nombre del ClusterRole personalizado en la lista desplegable. Para obtener más información, consulte Create a custom RBAC authorization policy.

Escenario 2: Desarrollador de aplicaciones dentro del clúster

1. Autorización de RAM

   Cree una política personalizada en la consola de RAM y adjúntela al usuario o rol de RAM de destino. Para obtener más información, consulte Grant RAM permissions to a RAM user or RAM role. La política personalizada es la siguiente:

   {
       "Statement": [
           {
               "Effect": "Allow",
               "Action": [
                   "acc:DescribeCommodityStatus",
                   "acc:CheckServiceRole",
                   "acc:DescribeCloudProducts",
                   "acc:DescribeRegions",
                   "acc:DescribeZones",
                   "acc:GetInstancePrice",
                   "acc:RecommendZones"
               ],
               "Resource": "*"
           },
           {
               "Effect": "Allow",
               "Action": "bssapi:GetPayAsYouGoPrice",
               "Resource": "*"
           },
           {
               "Action": [
                   "cs:Get*",
                   "cs:List*",
                   "cs:Check*",
                   "cs:Describe*"
               ],
               "Effect": "Allow",
               "Resource": [
                   "acs:cs:*:*:cluster/<yourclusterID>"
               ]
           },
           {
               "Action": [
                   "vpc:ListEnhanhcedNatGatewayAvailableZones",
                   "vpc:DescribeEipAddresses"
               ],
               "Effect": "Allow",
               "Resource": "*"
           }
       ],
       "Version": "1"
   }

   En el ejemplo anterior, reemplace <yourclusterID> con el ID real de su clúster de ACS.

   Nota

   Si solo necesita otorgar a un usuario permisos de solo lectura sobre un clúster de ACS específico, utilice esta política de ejemplo y especifique el ARN del clúster. No asigne la política de sistema AliyunCSReadOnlyAccess. Dicha política otorga permisos de solo lectura sobre todos los clústeres de ACK y resulta demasiado permisiva para este caso de uso.

2. Autorización de RBAC

   1. En la consola de Container Compute Service, haga clic en Authorizations en el panel de navegación izquierdo. En la pestaña sub account o RAM Roles, busque la identidad de destino y haga clic en Modify Permissions.

   2. En el cuadro de diálogo que aparece, haga clic en +Add Permissions. Establezca el permiso del clúster de destino y sus espacios de nombres en Developer y, a continuación, haga clic en Submit.

   Una vez asignado el rol predefinido, ACS crea automáticamente una instancia de ClusterRoleBinding en el clúster. Esta instancia corresponde a la identidad del usuario o rol autorizado. El siguiente código de ejemplo muestra los permisos de RBAC del rol predefinido Developer.

   Ejemplo de permisos de RBAC para el rol predefinido Developer

   apiVersion: rbac.authorization.k8s.io/v1
   kind: ClusterRole
   metadata:
     name: cs:ns:dev
   rules:
   - apiGroups: [""]
     resources:  ["pods", "pods/attach", "pods/exec", "pods/portforward", "pods/proxy"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: [""]
     resources:  ["configmaps", "endpoints", "persistentvolumeclaims", "replicationcontrollers", "replicationcontrollers/scale", "secrets", "serviceaccounts", "services", "services/proxy"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: [""]
     resources:  ["events", "replicationcontrollers/status", "pods/log", "pods/status"]
     verbs: ["get", "list", "watch"]
   - apiGroups: ["apps"]
     resources:  ["daemonsets", "deployments", "deployments/rollback", "deployments/scale", "replicasets", "replicasets/scale", "statefulsets"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["autoscaling"]
     resources:  ["horizontalpodautoscalers"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["batch"]
     resources:  ["cronjobs", "jobs"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["extensions"]
     resources:  ["daemonsets", "deployments", "deployments/rollback", "deployments/scale","ingresses","replicasets", "replicasets/scale", "replicationcontrollers/scale"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["networking.k8s.io"]
     resources:  ["*"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["servicecatalog.k8s.io"]
     resources:  ["clusterserviceclasses", "clusterserviceplans", "clusterservicebrokers", "serviceinstances", "servicebindings"]
     verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["servicecatalog.k8s.io"]
     resources:  ["clusterservicebrokers/status", "clusterserviceclasses/status", "clusterserviceplans/status", "serviceinstances/status", "serviceinstances/reference", "servicebindings/status",]
     verbs: ["update"]
   - apiGroups: ["alicloud.com"]
     resources:  ["*"]
     verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["policy"]
     resources:  ["poddisruptionbudgets"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["networking.istio.io"]
     resources:  ["*"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["config.istio.io"]
     resources:  ["*"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["rbac.istio.io"]
     resources:  ["*"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["istio.alibabacloud.com"]
     resources:  ["*"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["authentication.istio.io"]
     resources:  ["*"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["log.alibabacloud.com"]
     resources:  ["*"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["monitoring.kiali.io"]
     resources:  ["*"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["kiali.io"]
     resources:  ["*"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["apiextensions.k8s.io"]
     resources: ["customresourcedefinitions"]
     verbs: ["get", "list", "create", "watch", "patch", "update", "delete", "deletecollection"]
   - apiGroups: ["serving.knative.dev"]
     resources: ["*"]
     verbs: ["get", "list", "create", "watch", "patch", "update", "delete", "deletecollection"]
   - apiGroups: ["eventing.knative.dev"]
     resources: ["*"]
     verbs: ["get", "list", "create", "watch", "patch", "update", "delete", "deletecollection"]
   - apiGroups: ["messaging.knative.dev"]
     resources: ["*"]
     verbs: ["get", "list", "create", "watch", "patch", "update", "delete", "deletecollection"]
   - apiGroups: ["sources.eventing.knative.dev"]
     resources: ["*"]
     verbs: ["get", "list", "create", "watch", "patch", "update", "delete", "deletecollection"]
   - apiGroups: ["tekton.dev"]
     resources: ["*"]
     verbs: ["get", "list", "create", "watch", "patch", "update", "delete", "deletecollection"]
   - apiGroups: ["alert.alibabacloud.com"]
     resources: ["*"]
     verbs: ["get", "list", "create", "watch", "patch", "update", "delete", "deletecollection"]

Escenario 3: Administrador de permisos de aplicaciones dentro del clúster

El usuario o rol que autoriza necesita gestionar los permisos de RBAC de otros usuarios o roles de RAM. De forma predeterminada, un usuario o rol de RAM no tiene permiso para otorgar permisos de RBAC a otros usuarios o roles de RAM. Cuando el usuario o rol que autoriza accede a la página de gestión de autorizaciones en la consola de Container Service, la interfaz podría mostrar el mensaje The current RAM user does not have authorization management permissions. Please contact the Alibaba Cloud account or a permission administrator for authorization.. Esto indica que dicho usuario o rol carece de la autorización de RAM necesaria o de la autorización de administrador de RBAC para el clúster.

1. Autorización de RAM

   Asegúrese de que el usuario o rol cuente con los permisos de RAM necesarios. La política debe incluir permisos para:

   • Listar otros usuarios o roles de RAM.

   • Otorgar políticas de RAM a usuarios o roles de RAM específicos.

   • Consultar las configuraciones de permisos de RBAC de Kubernetes de usuarios o roles de RAM específicos.

   • Ejecutar la autorización de RBAC de Kubernetes.

   En la consola de RAM, otorgue los permisos de RAM correspondientes al usuario o rol de RAM especificado. Para obtener más información, consulte Grant RAM permissions to a RAM user or RAM role. El siguiente código de ejemplo muestra una política de RAM personalizada.

   {
       "Statement": [
           {
               "Effect": "Allow",
               "Action": [
                   "acc:DescribeCommodityStatus",
                   "acc:CheckServiceRole",
                   "acc:DescribeCloudProducts",
                   "acc:DescribeRegions",
                   "acc:DescribeZones",
                   "acc:GetInstancePrice",
                   "acc:RecommendZones"
               ],
               "Resource": "*"
           },
           {
               "Effect": "Allow",
               "Action": "bssapi:GetPayAsYouGoPrice",
               "Resource": "*"
           },
           {
               "Action": [
                   "ram:Get*",
                   "ram:List*",
                   "cs:GetUserPermissions",
                   "cs:GetSubUsers",
                   "cs:GrantPermission",
                   "cs:CheckServiceRole"
               ],
               "Resource": "*",
               "Effect": "Allow"
           },
           {
               "Action": [
                   "ram:AttachPolicyToUser",
                   "ram:AttachPolicyToRole"
               ],
               "Effect": "Allow",
               "Resource": [
                   "acs:ram:*:*:policy/xxxx",
                   "acs:*:*:*:user/*"
               ]
           },
           {
               "Action": [
                   "vpc:ListEnhanhcedNatGatewayAvailableZones",
                   "vpc:DescribeEipAddresses"
               ],
               "Effect": "Allow",
               "Resource": "*"
           }
       ],
       "Version": "1"
   }

2. Autorización de RBAC

   1. En la consola de Container Compute Service, haga clic en Authorizations en el panel de navegación izquierdo. En la pestaña sub account o RAM Roles, busque la identidad de destino y haga clic en Modify Permissions.

   2. En el cuadro de diálogo que aparece, haga clic en +Add Permissions. Establezca el permiso del clúster de destino y sus espacios de nombres en Administrator o en el rol personalizado cluster-admin y, a continuación, haga clic en Submit.

      Nota

      Una cuenta de Alibaba Cloud y el creador del clúster están vinculados al rol cluster-admin de forma predeterminada. Por lo tanto, tienen acceso a todos los objetos de recursos de Kubernetes del clúster.

Una vez completada la autorización de RAM y RBAC para un destino, este podrá gestionar la autorización de RBAC de otros usuarios o roles de RAM dentro de un alcance de permisos específico. Para obtener más información, consulte Grant RAM permissions to a RAM user or RAM role.