Clean up cluster user permissions - Container Service for Kubernetes: Central de Documentação do Alibaba Cloud

O ack-ram-tool é uma ferramenta de linha de comando do Container Service for Kubernetes (ACK) que gerencia permissões do RAM e de Controle de Acesso Baseado em Função (RBAC) nos clusters ACK. Quando um usuário sai da organização ou não precisa mais acessar o cluster, use o ack-ram-tool para verificar as vinculações RBAC existentes e removê-las — incluindo a revogação do kubeconfig — antes que permissões obsoletas se tornem um risco de segurança.

Pré-requisitos

Antes de começar, verifique se você tem:

Um cluster ACK
Acesso de administrador ao console ACK
A CLI do Alibaba Cloud instalada e configurada (para usuários do CloudSSO)

Etapa 1: Instale o ack-ram-tool

Baixe o cliente ack-ram-tool correspondente ao seu sistema operacional e arquitetura.
Conceda permissões de execução ao binário:consulte Credentials
```
chmod +x ./ack-ram-tool
```

Mova o binário para um diretório no seu PATH:

mkdir -p $HOME/bin && cp ./ack-ram-tool $HOME/bin/ack-ram-tool && export PATH=$HOME/bin:$PATH

(Opcional) Torne a alteração do PATH persistente:

echo 'export PATH=$HOME/bin:$PATH' >> ~/.bash_profile

Verifique a instalação. O comando retorna a versão do cliente.
```
ack-ram-tool version
```

Etapa 2: Configure credenciais do Alibaba Cloud

Usuários RAM e CloudSSO podem configurar credenciais por um dos métodos abaixo.

Se houver variáveis de ambiente relacionadas a credenciais, o ack-ram-tool as usará por padrão. Para ignorá-las, adicione o sinalizador --ignore-env-credentials a qualquer comando do ack-ram-tool. Para obter a lista completa de variáveis de ambiente compatíveis, consulte Credentials .

Usuário RAM

O ack-ram-tool usa credenciais do Alibaba Cloud configuradas localmente para autenticação no RAM. Para instruções de configuração, consulte Alibaba Cloud CLI.

Usuário CloudSSO

Use o acs-sso, ferramenta CLI fornecida pelo CloudSSO, para fazer login e obter credenciais. Para mais informações, consulte Use the CLI to log on to CloudSSO and access Alibaba Cloud resources.

A CLI do Alibaba Cloud oferece um modo de credencial externo que executa um comando externo para recuperar credenciais dinamicamente. Execute o comando a seguir para configurar o login automático do CloudSSO na sua máquina local:

aliyun configure --mode External --profile sso

Os prompts interativos têm a seguinte aparência:

Configuring profile 'sso' in 'External' authenticate mode...
Process Command [acs-sso login --profile sso]:
Default Region Id [cn-shanghai]:
Default Output Format [json]: json (Only support json)
Default Language [zh|en] en:
Saving profile[sso] ...Done.

Configure Done!!!
..............888888888888888888888 ........=8888888888888888888D=..............
...........88888888888888888888888 ..........D8888888888888888888888I...........
.........,8888888888888ZI: ...........................=Z88D8888888888D..........
.........+88888888 ..........................................88888888D..........
.........+88888888 .......Welcome to use Alibaba Cloud.......O8888888D..........
.........+88888888 ............. ************* ..............O8888888D..........
.........+88888888 .... Command Line Interface(Reloaded) ....O8888888D..........
.........+88888888...........................................88888888D..........
..........D888888888888DO+. ..........................?ND888888888888D..........
...........O8888888888888888888888...........D8888888888888888888888=...........
............ .:D8888888888888888888.........78888888888888888888O ..............

Etapa 3: Configure permissões para as credenciais

O ack-ram-tool exige permissões do RAM e permissões RBAC do cluster.

Conceda a seguinte política do RAM ao usuário RAM. Para instruções, consulte Gerenciar permissões de usuário RAM.

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "cs:*"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "ram:ListUsers",
        "ram:ListRoles"
      ],
      "Resource": "*"
    }
  ]
}

Conceda permissão de administrador RBAC ao usuário RAM no cluster:
1. Faça login no console ACK. No painel de navegação à esquerda, clique em ACK consoleAuthorizations.
2. Na página Authorizations, clique na aba RAM User, localize o usuário RAM desejado e clique em Modify Permissions na coluna Actions.
3. Na página Permission Management, clique em Add Permissions, selecione o Cluster e o Namespace de destino, defina Permission Management como Administrator e clique em Submit.

Etapa 4: Verificar vinculações RBAC

Use ack-ram-tool rbac scan-user-permissions para identificar quais usuários e funções RAM ainda têm vinculações RBAC no cluster. A saída da verificação inclui uma coluna UID — copie o UID do usuário cujas permissões você deseja remover e use-o na Etapa 5.

As colunas de saída são: UID, UserType, UserName e Binding.

UserType	Descrição
RamRole	Função RAM
RamUser	Usuário RAM
Root	Conta Alibaba Cloud

Verificar usuários excluídos (padrão)

Por padrão, a verificação retorna apenas usuários e funções RAM excluídos.

ack-ram-tool rbac scan-user-permissions -c <cluster ID>

Saída esperada:

2023-12-12T15:34:37+08:00 INFO start to scan users and bindings for cluster c401890df511a4362bf24bece4da****
2023-12-12T15:34:43+08:00 WARN by default, only deleted users are included. Use the --all-users flag to include all users
UID                           UserType  UserName  Binding
30086537005566**** (deleted)  RamRole             ClusterRoleBinding/-/30086537005566****-clusterrolebinding
24320678733226**** (deleted)  RamUser             ClusterRoleBinding/-/24320678733226****-clusterrolebinding

Verificar todos os usuários e funções

Adicione --all-users para incluir usuários e funções RAM ativos nos resultados.

ack-ram-tool rbac scan-user-permissions --all-users -c <cluster ID>

Saída esperada:

2023-12-12T15:36:00+08:00 INFO Start to scan users and bindings for cluster c401890df511a4362bf24bece4da6****
UID                           UserType  UserName                   Binding
30032484611590**** (deleted)  RamRole                              ClusterRoleBinding/-/30032484611590****-clusterrolebinding
20492499986425**** (deleted)  RamUser                              ClusterRoleBinding/-/20492499986425****-clusterrolebinding
27203272572548****            RamUser   scan                       ClusterRoleBinding/-/27203272572548****-clusterrolebinding
113802571552****              Root                                 ClusterRoleBinding/-/113802571552****-cluster-admin-clusterrolebinding
29068913515444****            RamUser   test-ack-ram-check         ClusterRoleBinding/-/29068913515444****-clusterrolebinding

Verificar todos os clusters

Substitua o ID do cluster por all para verificar todos os clusters na sua conta Alibaba Cloud.

ack-ram-tool rbac scan-user-permissions -c all

Saída esperada:

2023-12-12T16:44:55+08:00 INFO start to scan users and bindings for all clusters
2023-12-12T16:44:55+08:00 INFO start to get all clusters, users and roles
2023-12-12T16:44:58+08:00 INFO ---- c401890df511a4362bf24bece4da6**** (test-pro111323223) ----
2023-12-12T16:44:58+08:00 INFO [c401890df511a4362bf24bece4da6****] start to scan bindings for cluster c401890df511a4362bf24bece4da6****
2023-12-12T16:45:00+08:00 WARN [c401890df511a4362bf24bece4da6****] by default, only deleted users are included. Use the --all-users flag to include all users
ClusterId: c401890df511a4362bf24bece4da6****
UID                           UserType  UserName  Binding
30086537005566**** (deleted)  RamRole             ClusterRoleBinding/-/30086537005566****-clusterrolebinding
20492499986425**** (deleted)  RamUser             ClusterRoleBinding/-/20492499986425****-clusterrolebinding
2023-12-12T16:45:00+08:00 INFO ---- c137a979dec21472c8279c903cfc**** (test-pro) ----
2023-12-12T16:45:00+08:00 INFO [c137a979dec21472c8279c903cfce****] start to scan bindings for cluster c137a979dec21472c8279c903cfce****
2023-12-12T16:45:01+08:00 WARN [c137a979dec21472c8279c903cfce****] by default, only deleted users are included. Use the --all-users flag to include all users
ClusterId: c137a979dec21472c8279c903cfce****
UID                           UserType  UserName  Binding
30086537005566**** (deleted)  RamRole             ClusterRoleBinding/-/30086537005566****-clusterrolebinding
24320678733226**** (deleted)  RamUser             ClusterRoleBinding/-/24320678733226****-clusterrolebinding

Etapa 5: Limpar permissões

Use ack-ram-tool rbac cleanup-user-permissions para remover vinculações RBAC de um usuário ou função RAM específica e revogar o kubeconfig correspondente. Forneça o <UID> obtido na saída da verificação da Etapa 4.

Importante

Se o log contiver this user has been active in the past 7 days, o usuário acessou o cluster nos últimos sete dias. Prossiga com cautela.
Antes de excluir qualquer vinculação, o ack-ram-tool faz backup do arquivo JSON original em uma pasta no diretório atual, nomeada com o ID do cluster.

Limpar permissões em um único cluster

ack-ram-tool rbac cleanup-user-permissions -c <cluster ID> -u <UID>

Saída esperada:

Detalhes

2023-12-12T18:17:10+08:00 INFO start to scan users and bindings
2023-12-12T18:17:15+08:00 WARN we will clean up RBAC bindings as follows:
UID                 UserType  UserName   Binding
25908395708943****  RamUser   ack-admin  ClusterRoleBinding/-/25908395708943****-clusterrolebinding
2023-12-12T18:17:15+08:00 WARN we will clean up kubeconfig permissions for users as follows:
UID: 25908395708943****
2023-12-12T18:17:15+08:00 INFO start to check cluster audit log for user 25908395708943****
2023-12-12T18:17:16+08:00 WARN this user has been active in the past 7 days, and the last activity time was: 2023-12-12T10:27:56+08:00. You will find the relevant audit log details below:
sls project: k8s-log-c137a979dec21472c8279c903cfce****
sls logstore: audit-c137a979dec21472c8279c903cfce****
last activity: 2023-12-12T10:27:56+08:00 (auditID: 8f6f1483-77f3-44b3-85cb-f23d1a76e****)
? Are you sure you want to clean up these bindings and permissions? Yes
2023-12-12T18:17:37+08:00 INFO start to backup binding ClusterRoleBinding/-/25908395708943****-clusterrolebinding
2023-12-12T18:17:38+08:00 INFO the origin binding ClusterRoleBinding/-/25908395708943****-clusterrolebinding have been backed up to file c137a979dec21472c8279c903cfce****/ClusterRoleBinding--25908395708943****-clusterrolebinding.json
2023-12-12T18:17:38+08:00 INFO start to clean up kubeconfig permissions for uid 25908395708943****
2023-12-12T18:17:38+08:00 INFO finished clean up kubeconfig permissions for uid 25908395708943****
2023-12-12T18:17:38+08:00 INFO all bindings and permissions have been cleaned up

Limpar permissões em todos os clusters

ack-ram-tool rbac cleanup-user-permissions -c all -u <UID>

Saída esperada:

Detalhes

2023-12-12T19:28:23+08:00 INFO start to scan users and bindings for all clusters
2023-12-12T19:28:23+08:00 INFO start to get all clusters, users and roles
2023-12-12T19:28:24+08:00 INFO ---- c401890df511a4362bf24bece4da6**** (test-pro111323223) ----
2023-12-12T19:28:24+08:00 INFO [c401890df511a4362bf24bece4da6****] start to clean up bindings and permissions for cluster c401890df511a4362bf24bece4da6****
2023-12-12T19:28:24+08:00 INFO [c401890df511a4362bf24bece4da6****] start to scan users and bindings
2023-12-12T19:28:25+08:00 WARN [c401890df511a4362bf24bece4da6****] we will clean up RBAC bindings as follows:
UID                 UserType  UserName   Binding
25908395708943****  RamUser   ack-admin  ClusterRoleBinding/-/25908395708943****-clusterrolebinding
2023-12-12T19:28:25+08:00 WARN [c401890df511a4362bf24bece4da6****] we will clean up kubeconfig permissions for users as follows:
UID: 259083957089437690
2023-12-12T19:28:25+08:00 INFO [c401890df511a4362bf24bece4da6****] start to check cluster audit log for user 25908395708943****
2023-12-12T19:28:25+08:00 WARN [c401890df511a4362bf24bece4da6****] this user has been active in the past 7 days, and the last activity time was: 2023-12-12T10:27:56+08:00. You will find the relevant audit log details below:
sls project: k8s-log-c401890df511a4362bf24bece4da****
sls logstore: audit-c401890df511a4362bf24bece4da6****
last activity: 2023-12-12T10:27:56+08:00 (auditID: 8f6f1483-77f3-44b3-85cb-f23d1a76****)
? Are you sure you want to clean up these bindings and permissions? Yes
2023-12-12T19:28:49+08:00 INFO [c401890df511a4362bf24bece4da6****] start to backup binding ClusterRoleBinding/-/25908395708943**** -clusterrolebinding
2023-12-12T19:28:49+08:00 INFO [c401890df511a4362bf24bece4da6****] the origin binding ClusterRoleBinding/-/25908395708943****-clusterrolebinding have been backed up to file c401890df511a4362bf24bece4da6**** /ClusterRoleBinding--259083957089437XXX-clusterrolebinding.json
2023-12-12T19:28:49+08:00 INFO [c401890df511a4362bf24bece4da6****] start to clean up kubeconfig permissions for uid 25908395708943****
2023-12-12T19:28:49+08:00 INFO [c401890df511a4362bf24bece4da6****] finished clean up kubeconfig permissions for uid 25908395708943****
2023-12-12T19:28:49+08:00 INFO [c401890df511a4362bf24bece4da6****] all bindings and permissions have been cleaned up
2023-12-12T19:28:49+08:00 INFO ---- c137a979dec21472c8279c903cfce****  (test-pro) ----
2023-12-12T19:28:49+08:00 INFO [c137a979dec21472c8279c903cfce****] start to clean up bindings and permissions for cluster c137a979dec21472c8279c903cfce****
2023-12-12T19:28:49+08:00 INFO [c137a979dec21472c8279c903cfce****] start to scan users and bindings
2023-12-12T19:28:51+08:00 WARN [c137a979dec21472c8279c903cfce****] we will clean up RBAC bindings as follows:
UID                 UserType  UserName   Binding
25908395708943****   RamUser   ack-admin  ClusterRoleBinding/-/25908395708943**** -clusterrolebinding
2023-12-12T19:28:51+08:00 WARN [c137a979dec21472c8279c903cfce****] we will clean up kubeconfig permissions for users as follows:
UID: 25908395708943****
2023-12-12T19:28:51+08:00 INFO [c137a979dec21472c8279c903cfce****] start to check cluster audit log for user 25908395708943****
2023-12-12T19:28:51+08:00 WARN [c137a979dec21472c8279c903cfce****] this user has been active in the past 7 days, and the last activity time was: 2023-12-12T17:55:50+08:00. You will find the relevant audit log details below:
sls project: k8s-log-c137a979dec21472c8279c903cfce****
sls logstore: audit-c137a979dec21472c8279c903cfce****
last activity: 2023-12-12T17:55:50+08:00 (auditID: 8f6f1483-77f3-44b3-85cb-f23d1a76****)
? Are you sure you want to clean up these bindings and permissions? Yes
2023-12-12T19:28:52+08:00 INFO [c137a979dec21472c8279c903cfce****] start to backup binding ClusterRoleBinding/-/25908395708943****-clusterrolebinding
2023-12-12T19:28:52+08:00 INFO [c137a979dec21472c8279c903cfce****] the origin binding ClusterRoleBinding/-/25908395708943****-clusterrolebinding have been backed up to file c137a979dec21472c8279c903cfce**** /ClusterRoleBinding--25908395708943**** -clusterrolebinding.json
2023-12-12T19:28:52+08:00 INFO [c137a979dec21472c8279c903cfce****] start to clean up kubeconfig permissions for uid 25908395708943****
2023-12-12T19:28:52+08:00 INFO [c137a979dec21472c8279c903cfce****] finished clean up kubeconfig permissions for uid 25908395708943****
2023-12-12T19:28:52+08:00 INFO [c137a979dec21472c8279c903cfce****] all bindings and permissions have been cleaned up

Próximos passos

Para gerenciar arquivos kubeconfig diretamente, consulte Excluir arquivos kubeconfig.