Praktik terbaik untuk sistem otorisasi kluster ACK - Container Service for Kubernetes

Konfigurasikan izin RAM dan RBAC untuk empat peran umum kluster ACK.

Sistem otorisasi

RAM authorization menggunakan kebijakan sistem dan kustom untuk mengontrol akses ke operasi API ACK dan layanan Alibaba Cloud. Cakupannya meliputi:

Membuat, melihat, meningkatkan versi, dan menghapus kluster
Membuat, memodifikasi, dan menskalakan kelompok node
Mengelola otorisasi
Memantau kluster serta mengumpulkan log dan event

RBAC authorization mengontrol akses ke resource Kubernetes dalam suatu kluster menggunakan RBAC Kubernetes. Cakupannya mencakup operasi tambah, hapus, modifikasi, dan kueri pada:

Workload: Deployment, StatefulSet, DaemonSet, Job, CronJob, pod, dan ReplicaSet
Resource jaringan: Service, Ingress, dan NetworkPolicy
Resource penyimpanan: persistent volume (PV), persistent volume claim (PVC), dan StorageClass
Namespace, ConfigMap, dan Secret

Prasyarat

Verifikasi hal berikut:

Pengguna RAM atau peran telah ditetapkan sebagai administrator izin (tidak diperlukan untuk pemilik Akun Alibaba Cloud).

Kasus penggunaan 1: Otorisasi administrator read-only

Tetapkan peran RBAC yang telah ditentukan sebelumnya Read-only Administrator untuk akses read-only ke resource Kubernetes di semua namespace. Tidak diperlukan otorisasi RAM.

Tetapkan peran Read-only Administrator

ACK console

Lihat Berikan izin RBAC kepada pengguna RAM atau peran RAM.

Alibaba Cloud CLI

Panggil GrantPermissions dengan role_name diatur ke admin-view. Verifikasi dengan DescribeUserPermission.

aliyun cs POST /permissions/users/234xxxxxxxx --header "Content-Type=application/json;" --body "[{\"cluster\":\"c24xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx\",\"is_custom\":false,\"role_name\":\"admin-view\",\"role_type\":\"cluster\"}]"

Terraform

resource "alicloud_cs_kubernetes_permissions" "default" {
  uid = alicloud_ram_user.user.id
  permissions {
    cluster     = alicloud_cs_managed_kubernetes.default.id
    role_type   = "cluster"
    role_name   = "admin-view"
    namespace   = ""
    is_custom   = false
    is_ram_role = false
  }
}

Kasus penggunaan 2: Otorisasi insinyur O&M

Insinyur O&M memerlukan otorisasi RAM dan RBAC untuk mengelola kluster dan aplikasi.

Langkah 1: Otorisasi RAM

ACK menyediakan dua kebijakan RAM yang dikelola sistem:

Policy	Access level
`AliyunCSFullAccess`	Akses baca/tulis penuh ke semua operasi API ACK
`AliyunCSReadOnlyAccess`	Akses read-only ke semua operasi API ACK

Di RAM console, sambungkan kebijakan tersebut ke pengguna RAM atau peran RAM. Lihat Berikan izin kepada pengguna RAM dan Berikan izin kepada peran RAM.RAM consoleRAM console

Untuk kontrol detail halus, buat kebijakan kustom. Lihat Gunakan RAM untuk memberikan izin akses ke kluster dan resource cloud. Contoh berikut mencakup semua operasi O&M. Untuk setiap action, lihat Deskripsi Action.

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "cs:GetClusters",
        "cs:ModifyCluster",
        "cs:UpgradeCluster",
        "cs:DescribeClusterDetail",
        "cs:DescribeClusterVuls",
        "cs:DescribeClusterSecuritySummary",
        "cs:DescribeClusterUserKubeconfig",
        "cs:RevokeK8sClusterKubeConfig",
        "cs:CheckControlPlaneLogEnable",
        "cs:DescribeClusterResources",
        "cs:DescribeClusterEvents",
        "cs:DescribeClusterLogs",
        "cs:GetClusterAuditProject",
        "cs:ListClusterChecks",
        "cs:GetClusterCheck",
        "cs:RunClusterCheck",
        "cs:ModifyClusterAudit",
        "cs:DescribeResourcesDeleteProtection",
        "cs:UpdateResourcesDeleteProtection",
        "cs:DescribeClusterNodePools",
        "cs:DescribeClusterNodePoolDetail",
        "cs:CreateClusterNodePool",
        "cs:ModifyClusterNodePool",
        "cs:UpgradeClusterNodepool",
        "cs:DeleteClusterNodepool",
        "cs:CreateAutoscalingConfig",
        "cs:SyncClusterNodePool",
        "cs:RepairClusterNodePool",
        "cs:AttachInstancesToNodePool",
        "cs:ModifyNodePoolNodeConfig",
        "cs:DescribeClusterNodes",
        "cs:RemoveClusterNodes",
        "cs:RemoveNodePoolNodes",
        "cs:DiagnoseClustersNode",
        "cs:DescribeNodePoolVuls",
        "cs:FixNodePoolVuls",
        "cs:DrainNodes",
        "cs:DescribeClusterAddonMetadata",
        "cs:DescribeClusterAddonsVersion",
        "cs:InstallClusterAddons",
        "cs:UpgradeClusterAddons",
        "cs:ModifyClusterAddon",
        "cs:UnInstallClusterAddons",
        "cs:DescribeClusterAddonInstance",
        "cs:DescribeClusterAddonsUpgradeStatus",
        "cs:DescribeClusterAddonUpgradeStatus",
        "cs:ListClusterComponent",
        "cs:GetClusterComponent",
        "cs:DescribePolicyInstances",
        "cs:DeployPolicyInstance",
        "cs:ModifyPolicyInstance",
        "cs:DeletePolicyInstance",
        "cs:DescribePolicyGovernanceInCluster",
        "cs:DescribePolicyInstancesStatus",
        "cs:UpdateContactGroupForAlert",
        "cs:StartAlert",
        "cs:StopAlert",
        "cs:ListAlertRules",
        "cs:GetAlertHistory",
        "cs:DescribeClusterTasks",
        "cs:GetClusterBasicInfo",
        "cs:ListClusterReportSummary",
        "cs:GetClusterReportSummary",
        "cs:ListReportTaskRule",
        "cs:CreateTrigger",
        "cs:DescribeKubernetesClusterHookTrigger",
        "cs:CreateDiagnose",
        "cs:CreateClusterOverviewReport",
        "cs:GetAIDiagnosisResult",
        "cs:CreateReportTaskRule",
        "cs:CreateClusterReport",
        "cs:GetClusterCheckResult",
        "cs:GetClusterServices",
        "cs:UpdateControlPlaneLog",
        "cs:UpdateClusterName"
      ],
      "Resource": "acs:cs:*:*:cluster/xxxxx"
    },
    {
      "Effect": "Allow",
      "Action": [
        "cs:DescribeSubAccountHelmPermission",
        "cs:CheckServiceRole",
        "cs:DeleteTriggerHook",
        "cs:QueryAlertContact",
        "cs:QueryAlertContactGroup",
        "cs:AddOrUpdateAlertContact",
        "cs:AddOrUpdateAlertContactGroup",
        "cs:DeleteAlertContact",
        "cs:DeleteAlertContactGroup",
        "cs:DescribeKubernetesVersionMetadata",
        "cs:ListOperationPlans",
        "cs:DescribeClusterEndpoints",
        "cs:DescribeTaskInfo",
        "cs:DescribeEvents",
        "cs:DescribeUserQuota",
        "cs:DescribeTasks",
        "cs:PauseTask",
        "cs:CancelTask",
        "cs:DescribeAddons",
        "cs:DeleteReportTaskRule",
        "cs:CreateSessionMessage",
        "cs:DescribePolicies",
        "cs:DescribePolicyDetails"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "vpc:DescribeVSwitches",
        "vpc:DescribeVpcs",
        "vpc:DescribeEipAddresses"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": "kms:ListKeys",
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "arms:ListDashboards",
        "arms:InstallAddon"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "cloudshell:CreateEnvironment",
        "cloudshell:AttachStorage",
        "cloudshell:DetachStorage",
        "cloudshell:CreateSession"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "ess:DescribeScalingActivities",
        "ess:DescribeScalingActivityDetail",
        "ess:DescribeLifecycleActions"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": "oos:ListExecutions",
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "ecs:DescribeKeyPairs",
        "ecs:DescribeInstances",
        "ecs:DescribeSecurityGroups",
        "ecs:DescribeImages",
        "ecs:DescribePrice"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "cr:ListInstance",
        "cr:ListInstanceDomain",
        "cr:ListRepository",
        "cr:ListArtifactTag"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": "ram:GetRole",
      "Resource": "acs:ram:*:*:role/aliyuncisdefaultrole"
    },
    {
      "Effect": "Allow",
      "Action": [
        "log:GetDashboard",
        "log:GetSavedSearch",
        "log:GetLogStore",
        "log:GetIndex",
        "log:UpdateIndex",
        "log:GetLogStoreLogs",
        "log:CreateDashboardSharing",
        "log:ListProject",
        "log:GetProjectLogs",
        "log:GetResourceRecord",
        "log:CreateResourceRecord",
        "log:UpdateResourceRecord"
      ],
      "Resource": "*"
    }
  ]
}

Ganti xxxxx dalam acs:cs:*:*:cluster/xxxxx dengan ID kluster Anda.

Untuk tindakan API ACK, lihat [Perubahan Produk] API ACK meningkatkan otentikasi pengguna dan Daftar operasi berdasarkan fungsi.

Langkah 2: Otorisasi RBAC

Setelah otorisasi RAM, tetapkan peran RBAC yang telah ditentukan sebelumnya. Tabel berikut menjelaskan semua peran yang telah ditentukan sebelumnya beserta cakupannya.

Predefined role	RBAC permissions on cluster resources	When to use
Administrator	Akses baca/tulis penuh ke semua resource Kubernetes di semua namespace, ditambah resource tingkat kluster: node, PV, namespace, dan kuota sumber daya	Akses kluster tanpa batasan. Untuk pengelolaan izin, gunakan Custom > `cluster-admin`.
Read-only Administrator	Akses read-only ke semua resource Kubernetes di semua namespace, ditambah resource tingkat kluster: node, PV, namespace, dan kuota sumber daya	Visibilitas seluruh kluster tanpa akses tulis.
O&M Engineer	Akses baca/tulis ke semua resource yang terlihat di konsol di semua namespace; akses baca dan pembaruan ke node, PV, dan namespace; akses read-only ke semua resource lainnya	Operasi kluster sehari-hari. Tidak ada pengelolaan izin.
Developer	Akses baca/tulis ke resource yang terlihat di konsol, dibatasi ke semua namespace atau kumpulan tertentu	Penerapan dan pengelolaan aplikasi. Dapat dibatasi ke namespace tertentu.
Restricted User	Akses read-only ke resource yang terlihat di konsol, dibatasi ke semua namespace atau kumpulan tertentu	Akses hanya-lihat untuk developer atau operator.
Custom	Ditentukan oleh ClusterRole yang Anda pilih. Tinjau izin sebelum menetapkannya. Lihat Gunakan peran RBAC kustom untuk membatasi operasi resource dalam kluster.	Kontrol akses detail halus di luar peran yang telah ditentukan sebelumnya.

Penting

Menetapkan ClusterRole cluster-admin memberikan izin yang sama dengan Akun Alibaba Cloud — kontrol penuh atas semua resource dalam kluster. Gunakan dengan hati-hati.

Untuk menetapkan peran di konsol:

Masuk ke ACK consoleACK console. Di panel navigasi kiri, klik Authorizations.
Di halaman Authorizations, klik tab RAM Users atau RAM Roles. Temukan target dan klik Modify Permissions.
Klik +Add Permissions, pilih O&M Engineer untuk kluster dan namespace target, lalu klik Submit.

ACK secara otomatis membuat ClusterRoleBinding. Berikut adalah definisi ClusterRole untuk peran O&M Engineer (cs:ops):

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cs:ops
rules:
- apiGroups: [""]
  resources:  ["pods", "pods/attach", "pods/exec", "pods/portforward", "pods/proxy"]
  verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
- apiGroups: [""]
  resources:  ["configmaps", "endpoints", "persistentvolumeclaims", "replicationcontrollers", "replicationcontrollers/scale", "secrets", "serviceaccounts", "services", "services/proxy"]
  verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
- apiGroups: [""]
  resources:  ["bindings", "events", "limitranges", "namespaces/status", "replicationcontrollers/status", "pods/log", "pods/status", "resourcequotas", "resourcequotas/status", "componentstatuses"]
  verbs: ["get", "list", "watch"]
- apiGroups: [""]
  resources:  ["namespaces", "nodes", "persistentvolumes"]
  verbs: ["get", "list", "watch", "patch"]
- apiGroups: ["coordination.k8s.io"]
  resources:  ["leases"]
  verbs: ["get"]
- apiGroups: ["apps"]
  resources:  ["daemonsets", "deployments", "deployments/rollback", "deployments/scale", "replicasets", "replicasets/scale", "statefulsets"]
  verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
- apiGroups: ["autoscaling"]
  resources:  ["horizontalpodautoscalers"]
  verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
- apiGroups: ["batch"]
  resources:  ["cronjobs", "jobs"]
  verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
- apiGroups: ["extensions"]
  resources:  ["daemonsets", "deployments", "deployments/rollback", "deployments/scale","ingresses","replicasets", "replicasets/scale", "replicationcontrollers/scale"]
  verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
- apiGroups: ["networking.k8s.io"]
  resources:  ["*"]
  verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
- apiGroups: ["servicecatalog.k8s.io"]
  resources:  ["clusterserviceclasses", "clusterserviceplans", "clusterservicebrokers", "serviceinstances", "servicebindings"]
  verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]
- apiGroups: ["servicecatalog.k8s.io"]
  resources:  ["clusterservicebrokers/status", "clusterserviceclasses/status", "clusterserviceplans/status", "serviceinstances/status", "serviceinstances/reference", "servicebindings/status",]
  verbs: ["update"]
- apiGroups: ["storage.k8s.io"]
  resources:  ["storageclasses"]
  verbs: ["get", "list", "watch"]
- apiGroups: ["alicloud.com"]
  resources:  ["*"]
  verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]
- apiGroups: ["policy"]
  resources:  ["poddisruptionbudgets"]
  verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
- apiGroups: ["metrics.k8s.io"]
  resources: ["pods", "nodes"]
  verbs: ["get", "watch", "list"]
- apiGroups: ["networking.istio.io"]
  resources:  ["*"]
  verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
- apiGroups: ["config.istio.io"]
  resources:  ["*"]
  verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
- apiGroups: ["rbac.istio.io"]
  resources:  ["*"]
  verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
- apiGroups: ["istio.alibabacloud.com"]
  resources:  ["*"]
  verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
- apiGroups: ["authentication.istio.io"]
  resources:  ["*"]
  verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
- apiGroups: ["log.alibabacloud.com"]
  resources:  ["*"]
  verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
- apiGroups: ["monitoring.kiali.io"]
  resources:  ["*"]
  verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
- apiGroups: ["kiali.io"]
  resources:  ["*"]
  verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
- apiGroups: ["apiextensions.k8s.io"]
  resources: ["customresourcedefinitions"]
  verbs: ["get", "list", "create", "watch", "patch", "update", "delete", "deletecollection"]
- apiGroups: ["serving.knative.dev"]
  resources: ["*"]
  verbs: ["get", "list", "create", "watch", "patch", "update", "delete", "deletecollection"]
- apiGroups: ["eventing.knative.dev"]
  resources: ["*"]
  verbs: ["get", "list", "create", "watch", "patch", "update", "delete", "deletecollection"]
- apiGroups: ["messaging.knative.dev"]
  resources: ["*"]
  verbs: ["get", "list", "create", "watch", "patch", "update", "delete", "deletecollection"]
- apiGroups: ["sources.eventing.knative.dev"]
  resources: ["*"]
  verbs: ["get", "list", "create", "watch", "patch", "update", "delete", "deletecollection"]
- apiGroups: ["tekton.dev"]
  resources: ["*"]
  verbs: ["get", "list", "create", "watch", "patch", "update", "delete", "deletecollection"]
- apiGroups: ["alert.alibabacloud.com"]
  resources: ["*"]
  verbs: ["get", "list", "create", "watch", "patch", "update", "delete", "deletecollection"]

Untuk kontrol detail halus, buat ClusterRole kustom dengan Kubernetes RBAC dan pilih di halaman Authorizations di ACK consoleACK console. Lihat Gunakan peran RBAC kustom untuk membatasi operasi resource dalam kluster.

Kasus penggunaan 3: Otorisasi developer

Developer memerlukan otorisasi RBAC untuk resource Kubernetes dan akses RAM read-only pada kluster.

Penting

Lengkapi otorisasi RAM sebelum otorisasi RBAC. Developer harus memiliki setidaknya izin RAM read-only pada kluster agar otorisasi RBAC dapat berlaku.

Langkah 1: Otorisasi RAM

Buat kebijakan kustom di RAM console dan sambungkan ke pengguna RAM atau peran RAM. Lihat Berikan akses ke kluster dan resource cloud menggunakan RAM. Izin read-only minimum:

{
  "Statement": [
    {
      "Action": [
        "cs:GetClusters",
        "cs:DescribeClusterDetail",
        "cs:GetClusterAuditProject",
        "cs:DescribeResourcesDeleteProtection"
      ],
      "Resource": "acs:cs:*:*:cluster/xxxxx",
      "Effect": "Allow"
    }
  ],
  "Version": "1"
}

Ganti xxxxx dengan ID kluster Anda. Untuk akses read-only ke semua kluster ACK, gunakan kebijakan sistem AliyunCSReadOnlyAccess.

Langkah 2: Otorisasi RBAC

Masuk ke ACK consoleACK console. Di panel navigasi kiri, klik Authorizations.
Di halaman Authorizations, klik tab RAM Users atau RAM Roles. Temukan target dan klik Modify Permissions.
Klik +Add Permissions, pilih Developer untuk kluster dan namespace target, lalu klik Submit.

ACK secara otomatis membuat ClusterRoleBinding. Berikut adalah definisi ClusterRole untuk peran Developer (cs:ns:dev):

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cs:ns:dev
rules:
- apiGroups: [""]
  resources:  ["pods", "pods/attach", "pods/exec", "pods/portforward", "pods/proxy"]
  verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
- apiGroups: [""]
  resources:  ["configmaps", "endpoints", "persistentvolumeclaims", "replicationcontrollers", "replicationcontrollers/scale", "secrets", "serviceaccounts", "services", "services/proxy"]
  verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
- apiGroups: [""]
  resources:  ["events", "replicationcontrollers/status", "pods/log", "pods/status"]
  verbs: ["get", "list", "watch"]
- apiGroups: ["apps"]
  resources:  ["daemonsets", "deployments", "deployments/rollback", "deployments/scale", "replicasets", "replicasets/scale", "statefulsets"]
  verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
- apiGroups: ["autoscaling"]
  resources:  ["horizontalpodautoscalers"]
  verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
- apiGroups: ["batch"]
  resources:  ["cronjobs", "jobs"]
  verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
- apiGroups: ["extensions"]
  resources:  ["daemonsets", "deployments", "deployments/rollback", "deployments/scale","ingresses","replicasets", "replicasets/scale", "replicationcontrollers/scale"]
  verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
- apiGroups: ["networking.k8s.io"]
  resources:  ["*"]
  verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
- apiGroups: ["servicecatalog.k8s.io"]
  resources:  ["clusterserviceclasses", "clusterserviceplans", "clusterservicebrokers", "serviceinstances", "servicebindings"]
  verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]
- apiGroups: ["servicecatalog.k8s.io"]
  resources:  ["clusterservicebrokers/status", "clusterserviceclasses/status", "clusterserviceplans/status", "serviceinstances/status", "serviceinstances/reference", "servicebindings/status",]
  verbs: ["update"]
- apiGroups: ["alicloud.com"]
  resources:  ["*"]
  verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]
- apiGroups: ["policy"]
  resources:  ["poddisruptionbudgets"]
  verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
- apiGroups: ["networking.istio.io"]
  resources:  ["*"]
  verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
- apiGroups: ["config.istio.io"]
  resources:  ["*"]
  verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
- apiGroups: ["rbac.istio.io"]
  resources:  ["*"]
  verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
- apiGroups: ["istio.alibabacloud.com"]
  resources:  ["*"]
  verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
- apiGroups: ["authentication.istio.io"]
  resources:  ["*"]
  verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
- apiGroups: ["log.alibabacloud.com"]
  resources:  ["*"]
  verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
- apiGroups: ["monitoring.kiali.io"]
  resources:  ["*"]
  verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
- apiGroups: ["kiali.io"]
  resources:  ["*"]
  verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
- apiGroups: ["apiextensions.k8s.io"]
  resources: ["customresourcedefinitions"]
  verbs: ["get", "list", "create", "watch", "patch", "update", "delete", "deletecollection"]
- apiGroups: ["serving.knative.dev"]
  resources: ["*"]
  verbs: ["get", "list", "create", "watch", "patch", "update", "delete", "deletecollection"]
- apiGroups: ["eventing.knative.dev"]
  resources: ["*"]
  verbs: ["get", "list", "create", "watch", "patch", "update", "delete", "deletecollection"]
- apiGroups: ["messaging.knative.dev"]
  resources: ["*"]
  verbs: ["get", "list", "create", "watch", "patch", "update", "delete", "deletecollection"]
- apiGroups: ["sources.eventing.knative.dev"]
  resources: ["*"]
  verbs: ["get", "list", "create", "watch", "patch", "update", "delete", "deletecollection"]
- apiGroups: ["tekton.dev"]
  resources: ["*"]
  verbs: ["get", "list", "create", "watch", "patch", "update", "delete", "deletecollection"]
- apiGroups: ["alert.alibabacloud.com"]
  resources: ["*"]
  verbs: ["get", "list", "create", "watch", "patch", "update", "delete", "deletecollection"]

Kasus penggunaan 4: Otorisasi administrator izin

Administrator izin mengelola izin RBAC untuk pengguna RAM dan peran RAM lainnya. Secara default, pengguna RAM atau peran tidak dapat memberikan izin RBAC — halaman Authorizations menampilkan: The current RAM user account has no permission to manage authorizations. Contact the Alibaba Cloud account owner or authorized RAM user to request permission.

Hal ini memerlukan otorisasi RAM dan RBAC.

Langkah 1: Otorisasi RAM

Kebijakan RAM harus mencakup izin untuk:

Menanyakan pengguna RAM dan peran di Akun Alibaba Cloud
Menanyakan izin RBAC pengguna RAM atau peran
Memberikan izin RBAC kepada pengguna RAM atau peran lainnya

Di RAM console, sambungkan kebijakan berikut ke pengguna RAM atau peran RAM:RAM console

{
  "Statement": [
    {
      "Action": [
        "ram:ListRoles",
        "ram:ListUserBasicInfos",
        "cs:GetClusters",
        "cs:DescribeUserPermission",
        "cs:DescribeClusterDetail",
        "cs:GrantPermissions",
        "cs:UpdateUserPermissions",
        "cs:GetClusterAuditProject",
        "cs:DescribeResourcesDeleteProtection",
        "cs:UpdateResourcesDeleteProtection",
        "cs:DescribeClusterAddonUpgradeStatus"
      ],
      "Resource": "*",
      "Effect": "Allow"
    }
  ],
  "Version": "1"
}

Langkah 2: Otorisasi RBAC

Masuk ke ACK consoleACK console. Di panel navigasi kiri, klik Authorizations.
Di halaman Authorizations, klik tab RAM Users atau RAM Roles. Temukan target dan klik Modify Permissions.
Klik Add Permissions, pilih Administrator atau cluster-admin di bawah Custom, lalu klik Submit.

Secara default, akun Alibaba Cloud dan pemilik kluster ditetapkan peran cluster-admin dan memiliki akses penuh ke semua resource Kubernetes dalam kluster.

Setelah kedua langkah selesai, pengguna RAM atau peran RAM tersebut dapat memberikan izin RBAC kepada pengguna RAM atau peran RAM lainnya dalam cakupan yang telah dikonfigurasi.