Container Compute Service：Praktik terbaik otorisasi

Skenario 1: Memberikan izin kepada insinyur O&M untuk kluster dan aplikasi dalam kluster

Objek otorisasi memerlukan izin untuk mengelola dan memelihara kluster ACS serta melakukan O&M pada objek sumber daya aplikasi dalam kluster ACS. Oleh karena itu, proses otorisasi mencakup otorisasi RAM dan otorisasi RBAC.

1. RAM Authorization

   Container Service for Kubernetes (ACK) menyediakan dua kebijakan sistem untuk RAM: AliyunCSFullAccess dan AliyunCSReadOnlyAccess.

   • AliyunCSFullAccess memberikan izin akses baca dan tulis untuk semua operasi OpenAPI ACK.

   • AliyunCSReadOnlyAccess memberikan izin akses read-only untuk semua operasi OpenAPI ACK.

     Penting

     Kedua kebijakan sistem ini berlaku untuk semua kluster ACK, termasuk kluster ACS. Berikan izin ini dengan hati-hati.

   Login ke Konsol RAM dan sambungkan salah satu kebijakan sistem sesuai kebutuhan. Untuk informasi lebih lanjut, lihat Memberikan izin kepada Pengguna RAM dan Memberikan izin kepada Peran RAM.

   Jika Anda memerlukan kontrol akses detail halus, Anda dapat membuat kebijakan kustom. Untuk informasi lebih lanjut, lihat Memberikan izin RAM kepada Pengguna RAM atau Peran RAM.

   Dalam skenario ini, contoh kebijakan otorisasi RAM adalah sebagai berikut.

   {
       "Statement": [
           {
               "Effect": "Allow",
               "Action": [
                   "acc:DescribeCommodityStatus",
                   "acc:CheckServiceRole",
                   "acc:DescribeCloudProducts",
                   "acc:DescribeRegions",
                   "acc:DescribeZones",
                   "acc:GetInstancePrice",
                   "acc:RecommendZones"
               ],
               "Resource": "*"
           },
           {
               "Effect": "Allow",
               "Action": "bssapi:GetPayAsYouGoPrice",
               "Resource": "*"
           },
           {
               "Action": "ecs:DescribePrice",
               "Effect": "Allow",
               "Resource": "*"
           },
           {
               "Action": "ram:GetRole",
               "Effect": "Allow",
               "Resource": "*"
           },
           {
               "Action": [
               "cs:CreateCluster",
               "cs:DescribeAddons",
               "cs:DescribeUserQuota",
               "cs:DescribeTasks",
               "cs:ListClusterAddonInstances"
               ],
               "Effect": "Allow",
               "Resource": "*"
           },
           {
               "Action": [
                   "cs:GetClusters",
                   "cs:DescribeClustersV1",
                   "cs:DescribeClusterUserKubeconfig",
                   "cs:DescribeClusterResources",
                   "cs:DescribeUserQuota",
                   "cs:DescribeClusterLogs",
                   "cs:ModifyCluster",
                   "cs:UpgradeCluster",
                   "cs:GetUpgradeStatus",
                   "cs:ResumeUpgradeCluster",
                   "cs:PauseClusterUpgrade",
                   "cs:CancelClusterUpgrade",
                   "cs:InstallClusterAddons",
                   "cs:UpgradeClusterAddons",
                   "cs:DescribeClusterAddonsUpgradeStatus",
                   "cs:UnInstallClusterAddons",
                   "cs:DeleteCluster",
                   "cs:DescribeClusterDetail",
                   "cs:GetClusterAuditProject",
                   "cs:DescribeClusterAddonsVersion",
                   "cs:DescribeClusterTasks",
                   "cs:DescribeClusterEvents",
                   "cs:DescribeEvents",
                   "cs:ListClusterReportSummary",
                   "cs:GetClusterBasicInfo",
                   "cs:ListReportTaskRule",
                   "cs:CreateReportTaskRule",
                   "cs:CheckControlPlaneLogEnable",
                   "cs:CreateClusterCheck"
               ],
               "Effect": "Allow",
               "Resource": "acs:cs:*:*:cluster/<yourclusterID>"
           },
           {
               "Action": [
                    "cs:CheckServiceRole",
                    "cs:DescribeKubernetesVersionMetadata"
               ],
               "Effect": "Allow",
               "Resource": "acs:cs:*:*:cluster/*"
           },
           {
               "Action": [
                    "log:ListProject"
               ],
               "Effect": "Allow",
               "Resource": "*"
           },
           {
               "Action": [
                    "vpc:ListEnhanhcedNatGatewayAvailableZones",
                    "vpc:DescribeEipAddresses",
                    "vpc:DescribeVSwitches"
               ],
               "Effect": "Allow",
               "Resource": "*"
           }
       ],
       "Version": "1"
   }

   Pada contoh di atas, ganti <yourclusterID> dengan ID kluster ACS Anda.

2. Untuk informasi lebih lanjut tentang OpenAPI ACK, lihat [Perubahan Produk] Pengumuman tentang optimalisasi autentikasi OpenAPI untuk Container Service dan Ikhtisar API.

3. RBAC Authorization

   Setelah memberikan izin RAM, Anda juga harus memberikan izin RBAC untuk kluster yang sesuai kepada Pengguna RAM atau Peran RAM tersebut. ACK menyediakan empat peran yang telah ditentukan sebelumnya di tingkat kluster.

   Peran	Izin RBAC dalam kluster
   Administrator	Izin baca dan tulis pada semua sumber daya di semua namespace.
   Insinyur O&M	Izin baca dan tulis pada sumber daya Kubernetes yang terlihat di konsol di semua namespace, serta izin read-only pada node kluster, PV, namespace, dan kuota.
   Pengembang	Izin baca dan tulis pada sumber daya Kubernetes yang terlihat di konsol di semua atau namespace tertentu.
   Pengguna terbatas	Izin read-only pada sumber daya Kubernetes yang terlihat di konsol di semua atau namespace tertentu.

   1. Di Konsol Container Compute Service, klik Permission Management di panel navigasi sebelah kiri. Pada tab RAM Users atau RAM Roles, temukan objek otorisasi dan klik Manage Permissions.

   2. Pada kotak dialog yang muncul, klik +Add Permission, atur pengelolaan izin untuk kluster target dan namespace yang sesuai menjadi O&M Engineer, lalu klik Submit Authorization untuk menyelesaikan konfigurasi.

   Setelah menyambungkan peran yang telah ditentukan sebelumnya, ACS secara otomatis membuat instance ClusterRoleBinding di kluster yang sesuai dengan identitas objek yang diberi otorisasi. Izin RBAC untuk peran Insinyur O&M yang telah ditentukan sebelumnya adalah sebagai berikut.

   Contoh izin RBAC untuk peran Insinyur O&M yang telah ditentukan sebelumnya

   apiVersion: rbac.authorization.k8s.io/v1
   kind: ClusterRole
   metadata:
     name: cs:ops
   rules:
   - apiGroups: [""]
     resources:  ["pods", "pods/attach", "pods/exec", "pods/portforward", "pods/proxy"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: [""]
     resources:  ["configmaps", "endpoints", "persistentvolumeclaims", "replicationcontrollers", "replicationcontrollers/scale", "secrets", "serviceaccounts", "services", "services/proxy"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: [""]
     resources:  ["bindings", "events", "limitranges", "namespaces/status", "replicationcontrollers/status", "pods/log", "pods/status", "resourcequotas", "resourcequotas/status", "componentstatuses"]
     verbs: ["get", "list", "watch"]
   - apiGroups: [""]
     resources:  ["namespaces", "nodes", "persistentvolumes"]
     verbs: ["get", "list", "watch", "patch"]
   - apiGroups: ["coordination.k8s.io"]
     resources:  ["leases"]
     verbs: ["get"]
   - apiGroups: ["apps"]
     resources:  ["daemonsets", "deployments", "deployments/rollback", "deployments/scale", "replicasets", "replicasets/scale", "statefulsets"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["autoscaling"]
     resources:  ["horizontalpodautoscalers"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["batch"]
     resources:  ["cronjobs", "jobs"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["extensions"]
     resources:  ["daemonsets", "deployments", "deployments/rollback", "deployments/scale","ingresses","replicasets", "replicasets/scale", "replicationcontrollers/scale"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["networking.k8s.io"]
     resources:  ["*"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["servicecatalog.k8s.io"]
     resources:  ["clusterserviceclasses", "clusterserviceplans", "clusterservicebrokers", "serviceinstances", "servicebindings"]
     verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["servicecatalog.k8s.io"]
     resources:  ["clusterservicebrokers/status", "clusterserviceclasses/status", "clusterserviceplans/status", "serviceinstances/status", "serviceinstances/reference", "servicebindings/status",]
     verbs: ["update"]
   - apiGroups: ["storage.k8s.io"]
     resources:  ["storageclasses"]
     verbs: ["get", "list", "watch"]
   - apiGroups: ["alicloud.com"]
     resources:  ["*"]
     verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["policy"]
     resources:  ["poddisruptionbudgets"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["metrics.k8s.io"]
     resources: ["pods"]
     verbs: ["get", "watch", "list"]
   - apiGroups: ["networking.istio.io"]
     resources:  ["*"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["config.istio.io"]
     resources:  ["*"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["rbac.istio.io"]
     resources:  ["*"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["istio.alibabacloud.com"]
     resources:  ["*"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["authentication.istio.io"]
     resources:  ["*"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["log.alibabacloud.com"]
     resources:  ["*"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["monitoring.kiali.io"]
     resources:  ["*"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["kiali.io"]
     resources:  ["*"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["apiextensions.k8s.io"]
     resources: ["customresourcedefinitions"]
     verbs: ["get", "list", "create", "watch", "patch", "update", "delete", "deletecollection"]
   - apiGroups: ["serving.knative.dev"]
     resources: ["*"]
     verbs: ["get", "list", "create", "watch", "patch", "update", "delete", "deletecollection"]
   - apiGroups: ["eventing.knative.dev"]
     resources: ["*"]
     verbs: ["get", "list", "create", "watch", "patch", "update", "delete", "deletecollection"]
   - apiGroups: ["messaging.knative.dev"]
     resources: ["*"]
     verbs: ["get", "list", "create", "watch", "patch", "update", "delete", "deletecollection"]
   - apiGroups: ["sources.eventing.knative.dev"]
     resources: ["*"]
     verbs: ["get", "list", "create", "watch", "patch", "update", "delete", "deletecollection"]
   - apiGroups: ["tekton.dev"]
     resources: ["*"]
     verbs: ["get", "list", "create", "watch", "patch", "update", "delete", "deletecollection"]
   - apiGroups: ["alert.alibabacloud.com"]
     resources: ["*"]
     verbs: ["get", "list", "create", "watch", "patch", "update", "delete", "deletecollection"]

   Jika Anda memerlukan kontrol akses RBAC detail halus, Anda dapat membuat instance ClusterRole kustom. Untuk informasi lebih lanjut, lihat RBAC. Kemudian, pada halaman pengelolaan izin di Konsol Container Compute Service, pilih Custom Role dan pilih nama ClusterRole kustom dari daftar drop-down. Untuk informasi lebih lanjut, lihat Membuat kebijakan otorisasi RBAC kustom.

Skenario 2: Memberikan izin kepada pengembang untuk aplikasi dalam kluster

1. RAM Authorization

   Di Konsol RAM, buat kebijakan kustom dan berikan kebijakan tersebut kepada Pengguna RAM atau Peran RAM target. Untuk informasi lebih lanjut, lihat Memberikan izin RAM kepada Pengguna RAM atau Peran RAM. Konten kebijakan kustom adalah sebagai berikut:

   {
     "Statement": [
      {
           "Effect": "Allow",
           "Action": [
               "acc:DescribeCommodityStatus",
               "acc:CheckServiceRole",
               "acc:DescribeCloudProducts",
               "acc:DescribeRegions",
               "acc:DescribeZones",
               "acc:GetInstancePrice",
               "acc:RecommendZones"
              ],
               "Resource": "*"
       },
       {
            "Effect": "Allow",
            "Action": "bssapi:GetPayAsYouGoPrice",
            "Resource": "*"
       },
       {
         "Action": [
           "cs:Get*",
           "cs:List*",
           "cs:Check*",
           "cs:Describe*"
         ],
         "Effect": "Allow",
         "Resource": [
           "acs:cs:*:*:cluster/<yourclusterID>"
         ]
        },
        {
          "Action": [
             "vpc:ListEnhanhcedNatGatewayAvailableZones",
             "vpc:DescribeEipAddresses"
          ],
             "Effect": "Allow",
             "Resource": "*"
         }
     ],
     "Version": "1"
   }

   Pada contoh di atas, ganti <yourclusterID> dengan ID kluster ACS Anda.

   Catatan

   Untuk memberikan objek otorisasi hanya izin read-only pada kluster ACS, gunakan contoh ini untuk menentukan ARN kluster ACS. Jangan berikan kebijakan sistem RAM AliyunCSReadOnlyAccess yang disediakan oleh ACK, karena kebijakan tersebut memberikan izin read-only pada semua kluster ACK dan terlalu luas untuk skenario ini.

2. RBAC Authorization

   1. Di Konsol Container Compute Service, klik Permission Management di panel navigasi sebelah kiri. Pada tab RAM Users atau RAM Roles, temukan objek otorisasi dan klik Manage Permissions.

   2. Pada kotak dialog yang muncul, klik +Add Permission, atur pengelolaan izin untuk kluster target dan namespace yang sesuai menjadi Developer, lalu klik Submit Authorization untuk menyelesaikan konfigurasi.

      

   Setelah menyambungkan peran yang telah ditentukan sebelumnya, ACS secara otomatis membuat instance ClusterRoleBinding di kluster yang sesuai dengan identitas objek yang diberi otorisasi. Izin RBAC untuk peran pengembang yang telah ditentukan sebelumnya adalah sebagai berikut.

   Contoh izin RBAC untuk peran pengembang yang telah ditentukan sebelumnya

   apiVersion: rbac.authorization.k8s.io/v1
   kind: ClusterRole
   metadata:
     name: cs:ns:dev
   rules:
   - apiGroups: [""]
     resources:  ["pods", "pods/attach", "pods/exec", "pods/portforward", "pods/proxy"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: [""]
     resources:  ["configmaps", "endpoints", "persistentvolumeclaims", "replicationcontrollers", "replicationcontrollers/scale", "secrets", "serviceaccounts", "services", "services/proxy"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: [""]
     resources:  ["events", "replicationcontrollers/status", "pods/log", "pods/status"]
     verbs: ["get", "list", "watch"]
   - apiGroups: ["apps"]
     resources:  ["daemonsets", "deployments", "deployments/rollback", "deployments/scale", "replicasets", "replicasets/scale", "statefulsets"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["autoscaling"]
     resources:  ["horizontalpodautoscalers"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["batch"]
     resources:  ["cronjobs", "jobs"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["extensions"]
     resources:  ["daemonsets", "deployments", "deployments/rollback", "deployments/scale","ingresses","replicasets", "replicasets/scale", "replicationcontrollers/scale"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["networking.k8s.io"]
     resources:  ["*"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["servicecatalog.k8s.io"]
     resources:  ["clusterserviceclasses", "clusterserviceplans", "clusterservicebrokers", "serviceinstances", "servicebindings"]
     verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["servicecatalog.k8s.io"]
     resources:  ["clusterservicebrokers/status", "clusterserviceclasses/status", "clusterserviceplans/status", "serviceinstances/status", "serviceinstances/reference", "servicebindings/status",]
     verbs: ["update"]
   - apiGroups: ["alicloud.com"]
     resources:  ["*"]
     verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["policy"]
     resources:  ["poddisruptionbudgets"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["networking.istio.io"]
     resources:  ["*"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["config.istio.io"]
     resources:  ["*"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["rbac.istio.io"]
     resources:  ["*"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["istio.alibabacloud.com"]
     resources:  ["*"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["authentication.istio.io"]
     resources:  ["*"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["log.alibabacloud.com"]
     resources:  ["*"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["monitoring.kiali.io"]
     resources:  ["*"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["kiali.io"]
     resources:  ["*"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["apiextensions.k8s.io"]
     resources: ["customresourcedefinitions"]
     verbs: ["get", "list", "create", "watch", "patch", "update", "delete", "deletecollection"]
   - apiGroups: ["serving.knative.dev"]
     resources: ["*"]
     verbs: ["get", "list", "create", "watch", "patch", "update", "delete", "deletecollection"]
   - apiGroups: ["eventing.knative.dev"]
     resources: ["*"]
     verbs: ["get", "list", "create", "watch", "patch", "update", "delete", "deletecollection"]
   - apiGroups: ["messaging.knative.dev"]
     resources: ["*"]
   verbs: ["get", "list", "create", "watch", "patch", "update", "delete", "deletecollection"]
   - apiGroups: ["sources.eventing.knative.dev"]
     resources: ["*"]
     verbs: ["get", "list", "create", "watch", "patch", "update", "delete", "deletecollection"]
   - apiGroups: ["tekton.dev"]
     resources: ["*"]
     verbs: ["get", "list", "create", "watch", "patch", "update", "delete", "deletecollection"]
   - apiGroups: ["alert.alibabacloud.com"]
     resources: ["*"]
     verbs: ["get", "list", "create", "watch", "patch", "update", "delete", "deletecollection"]

Skenario 3: Memberikan izin kepada administrator izin untuk aplikasi dalam kluster

Objek otorisasi perlu mengelola izin RBAC Pengguna RAM atau Peran RAM lainnya. Secara default, Pengguna RAM atau Peran RAM tidak memiliki izin untuk memberikan izin RBAC kepada Pengguna RAM atau Peran RAM lainnya. Ketika objek otorisasi membuka halaman pengelolaan izin di Konsol Container Compute Service, jika antarmuka menampilkan pesan The Current RAM User Does Not Have Permission Management Permissions. Contact Your Alibaba Cloud Account Or A Permission Administrator To Grant The Permissions, ini menunjukkan bahwa objek otorisasi kekurangan izin RAM yang diperlukan atau izin administrator RBAC untuk kluster tersebut.

1. Otorisasi RAM

   Pastikan objek otorisasi diberikan izin RAM yang diperlukan. Kebijakan harus mencakup izin untuk:

   • Menampilkan daftar Pengguna RAM atau Peran RAM lainnya.

   • Memberikan kebijakan otorisasi RAM kepada Pengguna RAM atau Peran RAM tertentu.

   • Menampilkan konfigurasi izin RBAC Kubernetes Pengguna RAM atau Peran RAM tertentu.

   • Melakukan otorisasi RBAC Kubernetes.

   Login ke Konsol RAM untuk memberikan izin RAM yang sesuai kepada Pengguna RAM atau Peran RAM tertentu. Untuk informasi lebih lanjut, lihat Memberikan izin RAM kepada Pengguna RAM atau Peran RAM. Contoh kebijakan RAM kustom adalah sebagai berikut.

   {
       "Statement": [
         {
           "Effect": "Allow",
           "Action": [
               "acc:DescribeCommodityStatus",
               "acc:CheckServiceRole",
               "acc:DescribeCloudProducts",
               "acc:DescribeRegions",
               "acc:DescribeZones",
               "acc:GetInstancePrice",
               "acc:RecommendZones"
              ],
               "Resource": "*"
         },
         {
            "Effect": "Allow",
            "Action": "bssapi:GetPayAsYouGoPrice",
            "Resource": "*"
         },
         {
               "Action": [
                   "ram:Get*",
                   "ram:List*",
                   "cs:GetUserPermissions",
                   "cs:GetSubUsers",
                   "cs:GrantPermission",
                   "cs:CheckServiceRole"
               ],
               "Resource": "*",
               "Effect": "Allow"
           },
           {
               "Action": [
                   "ram:AttachPolicyToUser",
                   "ram:AttachPolicyToRole"
               ],
               "Effect": "Allow",
               "Resource":  [
                   "acs:ram:*:*:policy/xxxx", # Ganti xxxx dengan nama kebijakan RAM yang perlu Anda sambungkan. Jika Anda menggantinya dengan *, berarti objek otorisasi memiliki kemampuan untuk menyambungkan semua kebijakan RAM.
                   "acs:*:*:*:user/*"
               ]
           },
           {
               "Action": [
                    "vpc:ListEnhanhcedNatGatewayAvailableZones",
                    "vpc:DescribeEipAddresses"
               ],
               "Effect": "Allow",
               "Resource": "*"
           }
       ],
       "Version": "1"
   }

2. RBAC Authorization

   1. Di Konsol Container Compute Service, klik Permission Management di panel navigasi sebelah kiri. Pada tab RAM Users atau RAM Roles, temukan objek otorisasi dan klik Manage Permissions.

   2. Pada kotak dialog yang muncul, klik +Add Permission, atur pengelolaan izin untuk kluster target dan namespace yang sesuai menjadi Administrator atau peran kustom cluster-admin, lalu klik Submit Authorization untuk menyelesaikan konfigurasi.

      Catatan

      Akun Alibaba Cloud (akun root) dan pembuat kluster secara default terikat pada peran cluster-admin dan memiliki akses ke semua objek sumber daya Kubernetes di kluster.

      

Setelah memberikan izin RAM dan RBAC di atas kepada objek otorisasi, objek tersebut dapat mengelola otorisasi RBAC untuk Pengguna RAM atau Peran RAM lainnya dalam cakupan izin yang ditentukan. Untuk informasi lebih lanjut, lihat Memberikan izin RAM kepada Pengguna RAM atau Peran RAM.