Use Terraform to activate ACK and assign service roles to ACK - Container Service for Kubernetes

Lors de votre première utilisation d'ACK, utilisez Terraform pour activer Container Service for Kubernetes (ACK) et attribuer les rôles de service requis.

L'exemple de code de cette rubrique est prêt à l'emploi. Cliquez ici ici ici &example=201-use-case-enable-ack-and-assign-role) pour l'exécuter directement.

Pour autoriser les rôles depuis la console ACK, consultez la rubrique Gérer les autorisations des utilisateurs RAM.

Prérequis

Assurez-vous de disposer des éléments suivants :

Une paire AccessKey pour votre utilisateur RAM

Utilisez un utilisateur RAM plutôt que votre compte racine. Des permissions limitées réduisent l'exposition en cas de compromission des identifiants.

Cette politique attachée à votre utilisateur RAM accorde les autorisations minimales nécessaires pour exécuter les commandes Terraform présentées ici.

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ram:GetRole",
        "ram:ListRoles",
        "ram:AttachPolicyToRole",
        "ram:ListPoliciesForRole",
        "ram:CreateRole",
        "ram:DetachPolicyFromRole",
        "ram:DeleteRole"
      ],
      "Resource": "*"
    }
  ]
}

Un environnement d'exécution Terraform (choisissez une option) :

Option

Recommandé pour

Terraform Explorer

Configuration via navigateur, sans installation

Cloud Shell

Terraform préinstallé avec les identifiants configurés

Machine locale

Réseaux instables ou environnements personnalisés

Ressources Terraform utilisées

alicloud_ack_service : active automatiquement ACK.
alicloud_ram_role : crée un rôle RAM.
alicloud_ram_role_policy_attachment : attache une politique à un rôle RAM.
alicloud_ram_roles : répertorie les rôles RAM de votre compte correspondant aux filtres spécifiés.

Tous les exemples utilisent ces ressources Terraform :

Ressource

Type

Objectif

alicloud_ack_service

Source de données

Active ACK

alicloud_ram_role

Ressource

Crée un rôle RAM

alicloud_ram_role_policy_attachment

Ressource

Attache une politique à un rôle RAM

alicloud_ram_roles

Source de données

Répertorie les rôles RAM correspondant à un filtre

Étape 1 : Activer ACK

Créez un répertoire de travail contenant un fichier main.tf et copiez-y le contenu suivant :

// Activate ACK.
data "alicloud_ack_service" "open" {
    enable = "On"
    type   = "propayasgo"
}

Initialisez l'environnement d'exécution Terraform :

terraform init

Une initialisation réussie génère la sortie suivante :

Terraform has been successfully initialized!

You may now begin working with Terraform. Try running "terraform plan" to see
any changes that are required for your infrastructure. All Terraform commands
should now work.

If you ever set or change modules or backend configuration for Terraform,
rerun this command to reinitialize your working directory. If you forget, other
commands will detect it and remind you to do so if necessary.

Activez ACK :
```
terraform apply
```
Lorsque vous y êtes invité, saisissez yes et appuyez sur Enter. Sortie de l'activation d'ACK :
```
Apply complete!  Resources: 0 added, 0 changed, 0 destroyed.
```

Étape 2 : Attribuer des rôles de service à ACK

ACK nécessite des rôles de service RAM avant de pouvoir créer des clusters, afin que les modules complémentaires puissent accéder à d'autres services Alibaba Cloud en votre nom.

L'exécution multiple de cette opération est sans risque. Les rôles existants sont ignorés ; seuls les rôles manquants sont créés.

Rôles de service et composants ACK qu'ils desservent :

Rôle

Module complémentaire

Services cloud accessibles

AliyunCSManagedLogRole

Composant de journalisation

Simple Log Service (SLS)

AliyunCSManagedCmsRole

Composant de surveillance

CloudMonitor, SLS

AliyunCSManagedCsiRole

Plug-in de volume

Elastic Compute Service (ECS), File Storage NAS (NAS), Object Storage Service (OSS)

AliyunCSManagedCsiPluginRole

Plug-in de volume (csi-plugin)

ECS

AliyunCSManagedCsiProvisionerRole

Plug-in de volume (csi-provisioner)

ECS, NAS, OSS

AliyunCSManagedVKRole

Composant VK (ACK Serverless)

Plusieurs services Alibaba Cloud

AliyunCSServerlessKubernetesRole

Rôle par défaut pour ACK Serverless et Edge

ECS, Virtual Private Cloud (VPC), Server Load Balancer (SLB), Alibaba Cloud DNS PrivateZone

AliyunCSKubernetesAuditRole

Fonctionnalité d'audit

SLS

AliyunCSManagedNetworkRole

Plug-in réseau

ECS, VPC

AliyunCSDefaultRole

Gestion des clusters ACK (par défaut)

ECS, VPC, SLB, Resource Orchestration Service (ROS), Auto Scaling

AliyunCSManagedKubernetesRole

Rôle par défaut pour les clusters ACK managés et Edge

ECS, VPC, SLB, Container Registry

AliyunCSManagedArmsRole

Composant ARMS

Application Real-Time Monitoring Service (ARMS)

AliyunCISDefaultRole

Container Intelligence Service (CIS)

ECS, VPC, SLB (diagnostics)

AliyunOOSLifecycleHook4CSRole

Mise à l'échelle des pools de nœuds (OOS)

ACK, ECS, PolarDB

AliyunCSManagedAutoScalerRole

Composant de mise à l'échelle automatique

ECS, ressources du pool de nœuds ACK

Sélectionnez les rôles adaptés à votre cas d'utilisation. Ajustez la liste default dans le bloc de variable ci-dessous.

Copiez ce code dans le fichier main.tf :

// The RAM roles to create.
variable "roles" {
  type = list(object({
    name            = string
    policy_document = string
    description     = string
    policy_name     = string
  }))
  default = [
    {
      name            = "AliyunCSManagedLogRole"
      policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
      description     = "The logging component of ACK clusters assumes this role to access your resources in other Alibaba Cloud services."
      policy_name     = "AliyunCSManagedLogRolePolicy"
    },
    {
      name            = "AliyunCSManagedCmsRole"
      policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
      description     = "The CMS component of ACK clusters assumes this role to access your resources in other Alibaba Cloud services."
      policy_name     = "AliyunCSManagedCmsRolePolicy"
    },
    {
      name            = "AliyunCSManagedCsiRole"
      policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
      description     = "The volume plug-in of ACK clusters assumes this role to access your resources in other Alibaba Cloud services."
      policy_name     = "AliyunCSManagedCsiRolePolicy"
    },
    {
      name            = "AliyunCSManagedCsiPluginRole"
      policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
      description     = "The volume plug-in of ACK clusters assumes this role to access your resources in other Alibaba Cloud services."
      policy_name     = "AliyunCSManagedCsiPluginRolePolicy"
    },
    {
      name            = "AliyunCSManagedCsiProvisionerRole"
      policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
      description     = "The volume plug-in of ACK clusters assumes this role to access your resources in other Alibaba Cloud services."
      policy_name     = "AliyunCSManagedCsiProvisionerRolePolicy"
    },
    {
      name            = "AliyunCSManagedVKRole"
      policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
      description     = "The VK component of ACK Serverless clusters assumes this role to access your resources in other Alibaba Cloud services."
      policy_name     = "AliyunCSManagedVKRolePolicy"
    },
    {
      name            = "AliyunCSServerlessKubernetesRole"
      policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
      description     = "By default, ACK clusters assume this role to access your cloud resources."
      policy_name     = "AliyunCSServerlessKubernetesRolePolicy"
    },
    {
      name            = "AliyunCSKubernetesAuditRole"
      policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
      description     = "The auditing feature of ACK assumes this role to access your resources in other Alibaba Cloud services."
      policy_name     = "AliyunCSKubernetesAuditRolePolicy"
    },
    {
      name            = "AliyunCSManagedNetworkRole"
      policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
      description     = "The network plug-in of ACK clusters assumes this role to access your resources in other Alibaba Cloud services."
      policy_name     = "AliyunCSManagedNetworkRolePolicy"
    },
    {
      name            = "AliyunCSDefaultRole"
      policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
      description     = "By default, ACK assumes this role to access your resources in other Alibaba Cloud services when managing ACK clusters."
      policy_name     = "AliyunCSDefaultRolePolicy"
    },
    {
      name            = "AliyunCSManagedKubernetesRole"
      policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
      description     = "By default, ACK clusters assume this role to access your cloud resources."
      policy_name     = "AliyunCSManagedKubernetesRolePolicy"
    },
    {
      name            = "AliyunCSManagedArmsRole"
      policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
      description     = "The Application Real-Time Monitoring Service (ARMS) plug-in of ACK clusters assumes this role to access your resources in other Alibaba Cloud services."
      policy_name     = "AliyunCSManagedArmsRolePolicy"
    },
    {
      name            = "AliyunCISDefaultRole"
      policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
      description     = "Container Intelligence Service (CIS) assumes this role to access your resources in other Alibaba Cloud services."
      policy_name     = "AliyunCISDefaultRolePolicy"
    },
    {
      name            = "AliyunOOSLifecycleHook4CSRole"
      policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"oos.aliyuncs.com\"]}}],\"Version\":\"1\"}"
      description     = "Operation Orchestration Service (OOS) assumes this role to access your resources in other Alibaba Cloud services. ACK relies on OOS to scale node pools."
      policy_name     = "AliyunOOSLifecycleHook4CSRolePolicy"
    },
    {
      name            = "AliyunCSManagedAutoScalerRole"
      policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
      description     = "The auto scaling component of ACK clusters assumes this role to access your node pool resources in other Alibaba Cloud services."
      policy_name     = "AliyunCSManagedAutoScalerRolePolicy"
    }
  ]
}

// Query existing RAM roles.
data "alicloud_ram_roles" "roles" {
    policy_type = "Custom"
    name_regex  = "^Aliyun.*Role$"
}

locals {
  # All role names to create.
  all_role_names = [for role in var.roles : role.name]
  # Roles that already exist.
  created_role_names  = [for role in data.alicloud_ram_roles.roles.roles : role.name]
  # Roles that need to be created (set difference).
  complement_names = setsubtract(local.all_role_names, local.created_role_names)
  # Filter the full list to only the roles that need creating.
  complement_roles = [for role in var.roles : role if contains(local.complement_names, role.name)]
}

// Create RAM roles.
resource "alicloud_ram_role" "role" {
  for_each    = { for r in local.complement_roles : r.name => r }
  name        = each.value.name
  document    = each.value.policy_document
  description = each.value.description
  force       = true
}

// Attach system policies to RAM roles.
resource "alicloud_ram_role_policy_attachment" "attach" {
  for_each    = { for r in local.complement_roles : r.name => r }
  policy_name = each.value.policy_name
  policy_type = "System"
  role_name   = each.value.name
  depends_on  = [alicloud_ram_role.role]
}

Prévisualisez les modifications :
```
terraform plan
```
Appliquez les modifications :
```
terraform apply
```
Lorsque vous y êtes invité, saisissez yes et appuyez sur Enter. Sortie de la création des rôles :
```
Apply complete!  Resources: 2 added, 0 changed, 0 destroyed.
```

Vérifier les résultats

Confirmez l'existence des rôles en utilisant l'une des méthodes suivantes.

Exécuter `terraform show`

terraform show

Vérifier la console RAM

Connectez-vous à la console RAM pour afficher les rôles créés.

Supprimer les ressources

Supprimez toutes les ressources créées par Terraform :

terraform destroy

Consultez la rubrique Commandes courantes.

Exemple de code complet

L'exemple de code de cette rubrique est prêt à l'emploi. Cliquez ici ici ici &example=201-use-case-enable-ack-and-assign-role) pour l'exécuter directement.

provider "alicloud" {
    region = var.region_id
}

variable "region_id" {
   type    = string
   default = "cn-hangzhou"
}

// Activate ACK.
data "alicloud_ack_service" "open" {
    enable = "On"
    type   = "propayasgo"
}

// The RAM roles to create.
variable "roles" {
  type = list(object({
    name            = string
    policy_document = string
    description     = string
    policy_name     = string
  }))
  default = [
    {
      name            = "AliyunCSManagedLogRole"
      policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
      description     = "The logging component of ACK clusters assumes this role to access your resources in other Alibaba Cloud services."
      policy_name     = "AliyunCSManagedLogRolePolicy"
    },
    {
      name            = "AliyunCSManagedCmsRole"
      policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
      description     = "The CMS component of ACK clusters assumes this role to access your resources in other Alibaba Cloud services."
      policy_name     = "AliyunCSManagedCmsRolePolicy"
    },
    {
      name            = "AliyunCSManagedCsiRole"
      policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
      description     = "The volume plug-in of ACK clusters assumes this role to access your resources in other Alibaba Cloud services."
      policy_name     = "AliyunCSManagedCsiRolePolicy"
    },
    {
      name            = "AliyunCSManagedCsiPluginRole"
      policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
      description     = "The volume plug-in of ACK clusters assumes this role to access your resources in other Alibaba Cloud services."
      policy_name     = "AliyunCSManagedCsiPluginRolePolicy"
    },
    {
      name            = "AliyunCSManagedCsiProvisionerRole"
      policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
      description     = "The volume plug-in of ACK clusters assumes this role to access your resources in other Alibaba Cloud services."
      policy_name     = "AliyunCSManagedCsiProvisionerRolePolicy"
    },
    {
      name            = "AliyunCSManagedVKRole"
      policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
      description     = "The VK component of ACK Serverless clusters assumes this role to access your resources in other Alibaba Cloud services."
      policy_name     = "AliyunCSManagedVKRolePolicy"
    },
    {
      name            = "AliyunCSServerlessKubernetesRole"
      policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
      description     = "By default, ACK clusters assume this role to access your cloud resources."
      policy_name     = "AliyunCSServerlessKubernetesRolePolicy"
    },
    {
      name            = "AliyunCSKubernetesAuditRole"
      policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
      description     = "The auditing feature of ACK assumes this role to access your resources in other Alibaba Cloud services."
      policy_name     = "AliyunCSKubernetesAuditRolePolicy"
    },
    {
      name            = "AliyunCSManagedNetworkRole"
      policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
      description     = "The network plug-in of ACK clusters assumes this role to access your resources in other Alibaba Cloud services."
      policy_name     = "AliyunCSManagedNetworkRolePolicy"
    },
    {
      name            = "AliyunCSDefaultRole"
      policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
      description     = "By default, ACK assumes this role to access your resources in other Alibaba Cloud services when managing ACK clusters."
      policy_name     = "AliyunCSDefaultRolePolicy"
    },
    {
      name            = "AliyunCSManagedKubernetesRole"
      policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
      description     = "By default, ACK clusters assume this role to access your cloud resources."
      policy_name     = "AliyunCSManagedKubernetesRolePolicy"
    },
    {
      name            = "AliyunCSManagedArmsRole"
      policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
      description     = "The ARMS plug-in of ACK clusters assumes this role to access your resources in other Alibaba Cloud services."
      policy_name     = "AliyunCSManagedArmsRolePolicy"
    },
    {
      name            = "AliyunCISDefaultRole"
      policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
      description     = "CIS assumes this role to access your resources in other Alibaba Cloud services."
      policy_name     = "AliyunCISDefaultRolePolicy"
    },
    {
      name            = "AliyunOOSLifecycleHook4CSRole"
      policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"oos.aliyuncs.com\"]}}],\"Version\":\"1\"}"
      description     = "OOS assumes this role to access your resources in other Alibaba Cloud services. ACK relies on OOS to scale node pools."
      policy_name     = "AliyunOOSLifecycleHook4CSRolePolicy"
    },
    {
      name            = "AliyunCSManagedAutoScalerRole"
      policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
      description     = "The auto scaling component of ACK clusters assumes this role to access your node pool resources in other Alibaba Cloud services."
      policy_name     = "AliyunCSManagedAutoScalerRolePolicy"
    }
  ]
}

// Query existing RAM roles.
data "alicloud_ram_roles" "roles" {
    policy_type = "Custom"
    name_regex  = "^Aliyun.*Role$"
}

locals {
  # All role names to create.
  all_role_names = [for role in var.roles : role.name]
  # Roles that already exist.
  created_role_names  = [for role in data.alicloud_ram_roles.roles.roles : role.name]
  # Roles that need to be created (set difference).
  complement_names = setsubtract(local.all_role_names, local.created_role_names)
  # Filter the full list to only the roles that need creating.
  complement_roles = [for role in var.roles : role if contains(local.complement_names, role.name)]
}

// Create RAM roles.
resource "alicloud_ram_role" "role" {
  for_each    = { for r in local.complement_roles : r.name => r }
  name        = each.value.name
  document    = each.value.policy_document
  description = each.value.description
  force       = true
}

// Attach system policies to RAM roles.
resource "alicloud_ram_role_policy_attachment" "attach" {
  for_each    = { for r in local.complement_roles : r.name => r }
  policy_name = each.value.policy_name
  policy_type = "System"
  role_name   = each.value.name
  depends_on  = [alicloud_ram_role.role]
}

Annexe

Rôles de service

AliyunCSManagedLogRole

Le composant de journalisation des clusters ACK managés, Edge et Serverless endosse ce rôle pour accéder aux ressources du service Simple Log Service (SLS).

name            = "AliyunCSManagedLogRole"
policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
description     = "The logging component of ACK clusters assumes this role to access your resources in other Alibaba Cloud services."
policy_name     = "AliyunCSManagedLogRolePolicy"

AliyunCSManagedCmsRole

Le composant de surveillance des clusters ACK managés, Edge et Serverless endosse ce rôle pour accéder aux ressources de services cloud tels que CloudMonitor et SLS.

name            = "AliyunCSManagedCmsRole"
policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
description     = "The CMS component of ACK clusters assumes this role to access your resources in other Alibaba Cloud services."
policy_name     = "AliyunCSManagedCmsRolePolicy"

AliyunCSManagedCsiRole

Le plug-in de volume des clusters ACK managés, Edge et Serverless endosse ce rôle pour accéder aux ressources d'Elastic Compute Service (ECS), File Storage NAS (NAS) et Object Storage Service (OSS).

name            = "AliyunCSManagedCsiRole"
policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
description     = "The volume plug-in of ACK clusters assumes this role to access your resources in other Alibaba Cloud services."
policy_name     = "AliyunCSManagedCsiRolePolicy"

AliyunCSManagedCsiPluginRole

Le composant csi-plugin des clusters ACK managés, Edge et Serverless endosse ce rôle pour accéder aux ressources d'ECS.

name            = "AliyunCSManagedCsiPluginRole"
policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
description     = "The volume plug-in (new csi-plugin) of ACK managed clusters, ACK Edge clusters, and ACK Serverless clusters assumes this role to access your resources in ECS."
policy_name     = "AliyunCSManagedCsiPluginRolePolicy"

AliyunCSManagedCsiProvisionerRole

Le composant csi-provisioner des clusters ACK managés, Edge et Serverless endosse ce rôle pour accéder aux ressources d'ECS, NAS et OSS.

name            = "AliyunCSManagedCsiProvisionerRole"
policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
description     = "The volume plug-in (new csi-provisioner) of ACK managed clusters, ACK Edge clusters, and ACK Serverless clusters assumes this role to access your resources in ECS, NAS, and OSS."
policy_name     = "AliyunCSManagedCsiProvisionerRolePolicy"

AliyunCSServerlessKubernetesRole

Les clusters ACK Edge et Serverless endossent ce rôle pour accéder aux ressources d'ECS, Virtual Private Cloud (VPC), Server Load Balancer (SLB) et Alibaba Cloud DNS PrivateZone.

name            = "AliyunCSServerlessKubernetesRole"
policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
description     = "By default, ACK Serverless clusters assume this role to access your resources in other cloud services."
policy_name     = "AliyunCSServerlessKubernetesRolePolicy"

AliyunCSKubernetesAuditRole

Le composant d'audit des clusters ACK managés, Edge et Serverless endosse ce rôle pour accéder aux ressources de SLS.

name            = "AliyunCSKubernetesAuditRole"
policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
description     = "The auditing feature of ACK assumes this role to access your resources in other Alibaba Cloud services."
policy_name     = "AliyunCSKubernetesAuditRolePolicy"

AliyunCSManagedNetworkRole

Le plug-in réseau des clusters ACK managés, Edge et Serverless endosse ce rôle pour accéder aux ressources d'ECS et VPC.

name            = "AliyunCSManagedNetworkRole"
policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
description     = "The network plug-in of ACK clusters assumes this role to access your resources in other Alibaba Cloud services."
policy_name     = "AliyunCSManagedNetworkRolePolicy"

AliyunCSDefaultRole

ACK endosse ce rôle pour accéder aux ressources d'ECS, VPC, SLB, Resource Orchestration Service (ROS) et Auto Scaling lors de la gestion des clusters.

name            = "AliyunCSDefaultRole"
policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
description     = "By default, ACK assumes this role to access your resources in other Alibaba Cloud services when managing ACK clusters."
policy_name     = "AliyunCSDefaultRolePolicy"

AliyunCSManagedKubernetesRole

Les clusters ACK managés et Edge endossent ce rôle pour accéder aux ressources d'ECS, VPC, SLB et Container Registry.

name            = "AliyunCSManagedKubernetesRole"
policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
description     = "By default, ACK clusters assume this role to access your cloud resources."
policy_name     = "AliyunCSManagedKubernetesRolePolicy"

AliyunCSManagedArmsRole

Le composant Application Real-Time Monitoring Service (ARMS) des clusters ACK Edge et Serverless endosse ce rôle pour accéder aux ressources d'ARMS.

name            = "AliyunCSManagedArmsRole"
policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
description     = "The ARMS plug-in of ACK clusters assumes this role to access your resources in other Alibaba Cloud services."
policy_name     = "AliyunCSManagedArmsRolePolicy"

AliyunCISDefaultRole

Container Intelligence Service (CIS) endosse ce rôle pour accéder aux ressources d'ECS, VPC et SLB afin d'effectuer des diagnostics et des inspections.

name            = "AliyunCISDefaultRole"
policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
description     = "CIS assumes this role to access your resources in other Alibaba Cloud services."
policy_name     = "AliyunCISDefaultRolePolicy"

AliyunOOSLifecycleHook4CSRole

Operation Orchestration Service (OOS) endosse ce rôle pour accéder aux ressources d'ACK, ECS et PolarDB. ACK s'appuie sur OOS pour mettre à l'échelle les pools de nœuds.

name            = "AliyunOOSLifecycleHook4CSRole"
policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"oos.aliyuncs.com\"]}}],\"Version\":\"1\"}"
description     = "OOS assumes this role to access your resources in other Alibaba Cloud services. ACK relies on OOS to scale node pools."
policy_name     = "AliyunOOSLifecycleHook4CSRolePolicy"

Rôles facultatifs

Ces rôles sont facultatifs pour la création de base d'un cluster, mais requis pour certaines fonctionnalités spécifiques.

AliyunCSManagedAcrRole

Le plug-in de tirage d'images sans Secret des clusters ACK managés, Edge et Serverless endosse ce rôle pour accéder aux ressources de Container Registry.

name            = "AliyunCSManagedAcrRole"
policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
description     = "The Secret-free image pulling component of ACK clusters assumes this role to pull images from Container Registry."
policy_name     = "AliyunCSManagedAcrRolePolicy"

AliyunCSManagedNlcRole

Le contrôleur de cycle de vie des nœuds des clusters ACK managés et Edge endosse ce rôle pour accéder aux ressources des pools de nœuds dans ECS et ACK.

name            = "AliyunCSManagedNlcRole"
policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
description     = "The managed node pool controller of ACK clusters assumes this role to access your node pool resources in ECS and ACK."
policy_name     = "AliyunCSManagedNlcRolePolicy"

AliyunCSManagedAutoScalerRole

Le composant de mise à l'échelle automatique des clusters ACK managés, Edge et Serverless endosse ce rôle pour accéder aux ressources des pools de nœuds dans ECS et ACK.

name            = "AliyunCSManagedAutoScalerRole"
policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
description     = "The auto scaling component of ACK clusters assumes this role to access your node pool resources in other Alibaba Cloud services."
policy_name     = "AliyunCSManagedAutoScalerRolePolicy"

AliyunCSManagedSecurityRole

Le composant de chiffrement des Secrets et de gestion des identifiants des clusters ACK managés, Edge et Serverless endosse ce rôle pour accéder aux ressources de Key Management Service (KMS).

name            = "AliyunCSManagedSecurityRole"
policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
description     = "The Secret encryption component of ACK clusters assumes this role to access your node pool resources in KMS."
policy_name     = "AliyunCSManagedSecurityRolePolicy"

Le composant d'analyse des coûts des clusters ACK managés, Edge et Serverless endosse ce rôle pour accéder aux ressources d'ECS et Elastic Container Instance, et pour appeler les API de Bills Management.

name            = "AliyunCSManagedCostRole"
policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
description     = "The cost analysis component of ACK clusters assumes this role to access your resources in ECS and Elastic Container Instance, and call API operations of Bills Management."
policy_name     = "AliyunCSManagedCostRolePolicy"

AliyunCSManagedNimitzRole

Le composant de contrôle des clusters ACK Edge endosse ce rôle pour accéder aux ressources de Smart Access Gateway (SAG), VPC et Cloud Enterprise Network (CEN).

name            = "AliyunCSManagedNimitzRole"
policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
description     = "The network plug-in of ACK Lingjun clusters assumes this role to access your resources in Intelligent Computing LINGJUN."
policy_name     = "AliyunCSManagedNimitzRolePolicy"

AliyunCSManagedBackupRestoreRole

Le composant Backup Center des clusters ACK managés, Edge et Serverless endosse ce rôle pour accéder aux ressources de Cloud Backup et Object Storage Service (OSS).

name            = "AliyunCSManagedBackupRestoreRole"
policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
description     = "The backup center component of ACK clusters assumes this role to access your resources in Cloud Backup and OSS."
policy_name     = "AliyunCSManagedBackupRestoreRolePolicy"

AliyunCSManagedEdgeRole

Le composant de contrôle des clusters ACK Edge endosse ce rôle pour accéder aux ressources de SAG, VPC et CEN.

name            = "AliyunCSManagedEdgeRole"
policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
description     = "The control component of ACK Edge clusters assumes this role to access your resources in SAG, VPC, and Cloud CEN."
policy_name     = "AliyunCSManagedEdgeRolePolicy"

Étapes suivantes

Qu'est-ce que Terraform ?
Créer une pile Terraform — déployez des modèles avec Resource Orchestration Service (ROS) depuis la console ROS