Container Service for Kubernetes:Activate ACK and assign service roles with Terraform

Pré-requisitos

Certifique-se de ter:

• Um par de AccessKey para o seu usuário RAM

  Use um usuário RAM em vez da sua conta raiz. Permissões limitadas reduzem a exposição em caso de comprometimento das credenciais.

• Esta política, quando anexada ao seu usuário RAM, concede as permissões mínimas para executar os comandos do Terraform descritos neste tópico.

  {
    "Version": "1",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": [
          "ram:GetRole",
          "ram:ListRoles",
          "ram:AttachPolicyToRole",
          "ram:ListPoliciesForRole",
          "ram:CreateRole",
          "ram:DetachPolicyFromRole",
          "ram:DeleteRole"
        ],
        "Resource": "*"
      }
    ]
  }

• Ambiente de execução do Terraform (escolha uma das opções):

  Opção	Mais indicado para
  Terraform Explorer	Configuração no navegador, sem instalação
  Cloud Shell	Terraform pré-instalado com credenciais configuradas
  Local machine	Redes instáveis ou ambientes personalizados

Recursos do Terraform utilizados

Todos os exemplos usam estes recursos do Terraform:

Etapa 1: Ative o ACK

1. Crie um diretório de trabalho com um arquivo main.tf e copie o seguinte conteúdo para o arquivo:

   // Activate ACK.
   data "alicloud_ack_service" "open" {
       enable = "On"
       type   = "propayasgo"
   }

2. Inicialize o ambiente de execução do Terraform:

   terraform init

   Uma inicialização bem-sucedida gera a seguinte saída:

   Terraform has been successfully initialized!
   
   You may now begin working with Terraform. Try running "terraform plan" to see
   any changes that are required for your infrastructure. All Terraform commands
   should now work.
   
   If you ever set or change modules or backend configuration for Terraform,
   rerun this command to reinitialize your working directory. If you forget, other
   commands will detect it and remind you to do so if necessary.

3. Ative o ACK:

   terraform apply

   Quando solicitado, insira yes e pressione Enter. A saída da ativação do ACK será semelhante a:

   Apply complete!  Resources: 0 added, 0 changed, 0 destroyed.

Etapa 2: Atribuir service roles ao ACK

O ACK requer service roles RAM antes da criação de clusters para que os add-ons possam acessar outros Alibaba Cloud services em seu nome.

Você pode executar este comando várias vezes com segurança. As funções existentes são ignoradas e apenas as funções ausentes são criadas.

service roles e os respectivos componentes do ACK:

Selecione as service roles para o seu caso de uso. defina a lista default no bloco de variáveis abaixo.

1. Copie este código para o arquivo main.tf:

   // The RAM roles to create.
   variable "roles" {
     type = list(object({
       name            = string
       policy_document = string
       description     = string
       policy_name     = string
     }))
     default = [
       {
         name            = "AliyunCSManagedLogRole"
         policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
         description     = "The logging component of ACK clusters assumes this role to access your resources in other Alibaba Cloud services."
         policy_name     = "AliyunCSManagedLogRolePolicy"
       },
       {
         name            = "AliyunCSManagedCmsRole"
         policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
         description     = "The CMS component of ACK clusters assumes this role to access your resources in other Alibaba Cloud services."
         policy_name     = "AliyunCSManagedCmsRolePolicy"
       },
       {
         name            = "AliyunCSManagedCsiRole"
         policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
         description     = "The volume plug-in of ACK clusters assumes this role to access your resources in other Alibaba Cloud services."
         policy_name     = "AliyunCSManagedCsiRolePolicy"
       },
       {
         name            = "AliyunCSManagedCsiPluginRole"
         policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
         description     = "The volume plug-in of ACK clusters assumes this role to access your resources in other Alibaba Cloud services."
         policy_name     = "AliyunCSManagedCsiPluginRolePolicy"
       },
       {
         name            = "AliyunCSManagedCsiProvisionerRole"
         policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
         description     = "The volume plug-in of ACK clusters assumes this role to access your resources in other Alibaba Cloud services."
         policy_name     = "AliyunCSManagedCsiProvisionerRolePolicy"
       },
       {
         name            = "AliyunCSManagedVKRole"
         policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
         description     = "The VK component of ACK Serverless clusters assumes this role to access your resources in other Alibaba Cloud services."
         policy_name     = "AliyunCSManagedVKRolePolicy"
       },
       {
         name            = "AliyunCSServerlessKubernetesRole"
         policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
         description     = "By default, ACK clusters assume this role to access your cloud resources."
         policy_name     = "AliyunCSServerlessKubernetesRolePolicy"
       },
       {
         name            = "AliyunCSKubernetesAuditRole"
         policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
         description     = "The auditing feature of ACK assumes this role to access your resources in other Alibaba Cloud services."
         policy_name     = "AliyunCSKubernetesAuditRolePolicy"
       },
       {
         name            = "AliyunCSManagedNetworkRole"
         policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
         description     = "The network plug-in of ACK clusters assumes this role to access your resources in other Alibaba Cloud services."
         policy_name     = "AliyunCSManagedNetworkRolePolicy"
       },
       {
         name            = "AliyunCSDefaultRole"
         policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
         description     = "By default, ACK assumes this role to access your resources in other Alibaba Cloud services when managing ACK clusters."
         policy_name     = "AliyunCSDefaultRolePolicy"
       },
       {
         name            = "AliyunCSManagedKubernetesRole"
         policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
         description     = "By default, ACK clusters assume this role to access your cloud resources."
         policy_name     = "AliyunCSManagedKubernetesRolePolicy"
       },
       {
         name            = "AliyunCSManagedArmsRole"
         policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
         description     = "The Application Real-Time Monitoring Service (ARMS) plug-in of ACK clusters assumes this role to access your resources in other Alibaba Cloud services."
         policy_name     = "AliyunCSManagedArmsRolePolicy"
       },
       {
         name            = "AliyunCISDefaultRole"
         policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
         description     = "Container Intelligence Service (CIS) assumes this role to access your resources in other Alibaba Cloud services."
         policy_name     = "AliyunCISDefaultRolePolicy"
       },
       {
         name            = "AliyunOOSLifecycleHook4CSRole"
         policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"oos.aliyuncs.com\"]}}],\"Version\":\"1\"}"
         description     = "Operation Orchestration Service (OOS) assumes this role to access your resources in other Alibaba Cloud services. ACK relies on OOS to scale node pools."
         policy_name     = "AliyunOOSLifecycleHook4CSRolePolicy"
       },
       {
         name            = "AliyunCSManagedAutoScalerRole"
         policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
         description     = "The auto scaling component of ACK clusters assumes this role to access your node pool resources in other Alibaba Cloud services."
         policy_name     = "AliyunCSManagedAutoScalerRolePolicy"
       }
     ]
   }
   
   // Query existing RAM roles.
   data "alicloud_ram_roles" "roles" {
       policy_type = "Custom"
       name_regex  = "^Aliyun.*Role$"
   }
   
   locals {
     # All role names to create.
     all_role_names = [for role in var.roles : role.name]
     # Roles that already exist.
     created_role_names  = [for role in data.alicloud_ram_roles.roles.roles : role.name]
     # Roles that need to be created (set difference).
     complement_names = setsubtract(local.all_role_names, local.created_role_names)
     # Filter the full list to only the roles that need creating.
     complement_roles = [for role in var.roles : role if contains(local.complement_names, role.name)]
   }
   
   // Create RAM roles.
   resource "alicloud_ram_role" "role" {
     for_each    = { for r in local.complement_roles : r.name => r }
     name        = each.value.name
     document    = each.value.policy_document
     description = each.value.description
     force       = true
   }
   
   // Attach system policies to RAM roles.
   resource "alicloud_ram_role_policy_attachment" "attach" {
     for_each    = { for r in local.complement_roles : r.name => r }
     policy_name = each.value.policy_name
     policy_type = "System"
     role_name   = each.value.name
     depends_on  = [alicloud_ram_role.role]
   }

2. Visualize as alterações:

   terraform plan

3. Aplique as alterações:

   terraform apply

   Quando solicitado, insira yes e pressione Enter. A saída da criação da função será semelhante a:

   Apply complete!  Resources: 2 added, 0 changed, 0 destroyed.

Verifique os resultados

Confirme a existência das funções usando um dos métodos a seguir.

terraform show

D:\tool\terraform\projects\ack>terraform show
# alicloud_ram_role.role["AliyunCISDefaultRole"]:
resource "alicloud_ram_role" "role" {
    arn                  = "acs:ram::14xxx64:role/aliyuncisdefaultrole"
    description          = "Container Intelligence Service (CIS) assumes this role to access your resources in other Alibaba Cloud services."
    document             = jsonencode(
        {
            Statement = [
                {
                    Action    = "sts:AssumeRole"
                    Effect    = "Allow"
                    Principal = {
                        Service = [
                            "cs.aliyuncs.com",
                        ]
                    }
                },
            ]
            Version   = "1"
        }
    )
    force                = true
    id                   = "AliyunCISDefaultRole"
    max_session_duration = 3600
    name                 = "AliyunCISDefaultRole"
    ram_users            = []
    role_id              = "30xxx91"
    services             = [
        "cs.aliyuncs.com",
    ]
    version              = "1"
}

# alicloud_ram_role.role["AliyunCSDefaultRole"]:
resource "alicloud_ram_role" "role" {
    arn                  = "acs:ram::14xxx64:role/aliyuncsdefaultrole"
    description          = "By default, ACK assumes this role to access your resources in other Alibaba Cloud services when managing ACK clusters."
    document             = jsonencode(
        {
            Statement = [
                {
                    Action    = "sts:AssumeRole"
                    Effect    = "Allow"
                    Principal = {
                        Service = [
                            "cs.aliyuncs.com",
                        ]
                    }
                },
            ]
            Version   = "1"
        }
    )
    force                = true
    id                   = "AliyunCSDefaultRole"
    max_session_duration = 3600
    name                 = "AliyunCSDefaultRole"
    ram_users            = []
    role_id              = "30xxx91"
    services             = [
        "cs.aliyuncs.com",
    ]
    version              = "1"
}

Exclua recursos

Remova todos os recursos criados pelo Terraform:

terraform destroy

Consulte Common commands.

Apêndice

name            = "AliyunCSManagedLogRole"
policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
description     = "The logging component of ACK clusters assumes this role to access your resources in other Alibaba Cloud services."
policy_name     = "AliyunCSManagedLogRolePolicy"

name            = "AliyunCSManagedCmsRole"
policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
description     = "The CMS component of ACK clusters assumes this role to access your resources in other Alibaba Cloud services."
policy_name     = "AliyunCSManagedCmsRolePolicy"

name            = "AliyunCSManagedCsiRole"
policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
description     = "The volume plug-in of ACK clusters assumes this role to access your resources in other Alibaba Cloud services."
policy_name     = "AliyunCSManagedCsiRolePolicy"

name            = "AliyunCSManagedCsiPluginRole"
policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
description     = "The volume plug-in (new csi-plugin) of ACK managed clusters, ACK Edge clusters, and ACK Serverless clusters assumes this role to access your resources in ECS."
policy_name     = "AliyunCSManagedCsiPluginRolePolicy"

name            = "AliyunCSManagedCsiProvisionerRole"
policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
description     = "The volume plug-in (new csi-provisioner) of ACK managed clusters, ACK Edge clusters, and ACK Serverless clusters assumes this role to access your resources in ECS, NAS, and OSS."
policy_name     = "AliyunCSManagedCsiProvisionerRolePolicy"

name            = "AliyunCSServerlessKubernetesRole"
policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
description     = "By default, ACK Serverless clusters assume this role to access your resources in other cloud services."
policy_name     = "AliyunCSServerlessKubernetesRolePolicy"

name            = "AliyunCSKubernetesAuditRole"
policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
description     = "The auditing feature of ACK assumes this role to access your resources in other Alibaba Cloud services."
policy_name     = "AliyunCSKubernetesAuditRolePolicy"

name            = "AliyunCSManagedNetworkRole"
policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
description     = "The network plug-in of ACK clusters assumes this role to access your resources in other Alibaba Cloud services."
policy_name     = "AliyunCSManagedNetworkRolePolicy"

name            = "AliyunCSDefaultRole"
policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
description     = "By default, ACK assumes this role to access your resources in other Alibaba Cloud services when managing ACK clusters."
policy_name     = "AliyunCSDefaultRolePolicy"

name            = "AliyunCSManagedKubernetesRole"
policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
description     = "By default, ACK clusters assume this role to access your cloud resources."
policy_name     = "AliyunCSManagedKubernetesRolePolicy"

name            = "AliyunCSManagedArmsRole"
policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
description     = "The ARMS plug-in of ACK clusters assumes this role to access your resources in other Alibaba Cloud services."
policy_name     = "AliyunCSManagedArmsRolePolicy"

name            = "AliyunCISDefaultRole"
policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
description     = "CIS assumes this role to access your resources in other Alibaba Cloud services."
policy_name     = "AliyunCISDefaultRolePolicy"

name            = "AliyunOOSLifecycleHook4CSRole"
policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"oos.aliyuncs.com\"]}}],\"Version\":\"1\"}"
description     = "OOS assumes this role to access your resources in other Alibaba Cloud services. ACK relies on OOS to scale node pools."
policy_name     = "AliyunOOSLifecycleHook4CSRolePolicy"

name            = "AliyunCSManagedAcrRole"
policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
description     = "The Secret-free image pulling component of ACK clusters assumes this role to pull images from Container Registry."
policy_name     = "AliyunCSManagedAcrRolePolicy"

name            = "AliyunCSManagedNlcRole"
policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
description     = "The managed node pool controller of ACK clusters assumes this role to access your node pool resources in ECS and ACK."
policy_name     = "AliyunCSManagedNlcRolePolicy"

name            = "AliyunCSManagedAutoScalerRole"
policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
description     = "The auto scaling component of ACK clusters assumes this role to access your node pool resources in other Alibaba Cloud services."
policy_name     = "AliyunCSManagedAutoScalerRolePolicy"

name            = "AliyunCSManagedSecurityRole"
policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
description     = "The Secret encryption component of ACK clusters assumes this role to access your node pool resources in KMS."
policy_name     = "AliyunCSManagedSecurityRolePolicy"

name            = "AliyunCSManagedCostRole"
policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
description     = "The cost analysis component of ACK clusters assumes this role to access your resources in ECS and Elastic Container Instance, and call API operations of Bills Management."
policy_name     = "AliyunCSManagedCostRolePolicy"

name            = "AliyunCSManagedNimitzRole"
policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
description     = "The network plug-in of ACK Lingjun clusters assumes this role to access your resources in Intelligent Computing LINGJUN."
policy_name     = "AliyunCSManagedNimitzRolePolicy"

name            = "AliyunCSManagedBackupRestoreRole"
policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
description     = "The backup center component of ACK clusters assumes this role to access your resources in Cloud Backup and OSS."
policy_name     = "AliyunCSManagedBackupRestoreRolePolicy"

name            = "AliyunCSManagedEdgeRole"
policy_document = "{\"Statement\":[{\"Action\":\"sts:AssumeRole\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":[\"cs.aliyuncs.com\"]}}],\"Version\":\"1\"}"
description     = "The control component of ACK Edge clusters assumes this role to access your resources in SAG, VPC, and Cloud CEN."
policy_name     = "AliyunCSManagedEdgeRolePolicy"

Próximos passos

• What is Terraform?

• Crie uma stack do Terraform — implante modelos com o Resource Orchestration Service (ROS) a partir do console do ROS