Container Compute Service:Yetkilendirme en iyi uygulamaları

İki katmanın birlikte çalışma şekli

ACS kümeleri, bir tür Serverless Container Service for Kubernetes (ACK) kümesidir. Tüm küme yönetimi çağrıları ACK API'lerini kullandığından hem cloud düzeyinde (RAM) hem de küme düzeyinde (RBAC) izinlerin yapılandırılması gerekir.

RBAC izinlerini vermeden önce eksiksiz RAM yetkilendirmesi yapın.

{
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "acc:*",
            "Resource": "*"
        }
    ],
    "Version": "1"
}

{
    "Version": "1",
    "Statement": [
        {
            "Action": [
                "acc:Describe*",
                "acc:CheckServiceRole"
            ],
            "Resource": "*",
            "Effect": "Allow"
        }
    ]
}

{
    "Version": "1",
    "Statement": [
        {
            "Action": "cs:*",
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": "ram:PassRole",
            "Resource": "*",
            "Effect": "Allow",
            "Condition": {
                "StringEquals": {
                    "acs:Service": "cs.aliyuncs.com"
                }
            }
        }
    ]
}

{
    "Version": "1",
    "Statement": [
        {
            "Action": [
                "cs:CheckServiceRole",
                "cs:Get*",
                "cs:List*",
                "cs:Describe*"
            ],
            "Resource": "*",
            "Effect": "Allow"
        }
    ]
}

Senaryo 1: Kümeler ve uygulamalar için işletim ve bakım mühendisi

Bu senaryo, ACS kümelerini ve bunların içindeki uygulamaları yöneten ve bakımını yapan kullanıcılar içindir. Yetkilendirme süreci hem RAM hem de RBAC izinlerinin verilmesini içerir.

1. RAM yetkilendirmesi

   ACK, RAM için iki sistem ilkesi sağlar: AliyunCSFullAccess ve AliyunCSReadOnlyAccess.

   • AliyunCSFullAccess, ACK'nin tüm OpenAPI işlemleri için okuma ve yazma izinleri verir.

   • AliyunCSReadOnlyAccess, ACK'nin tüm OpenAPI işlemleri için salt okunur izinler verir.

     Önemli

     Bu iki sistem ilkesi, ACS tipi kümeler dahil olmak üzere tüm ACK kümeleri üzerinde izinler verir. Bu izinleri dikkatli bir şekilde verin.

   Log on to the RAM console and attach one of the system policies as needed. For more information, see Manage permissions for a RAM user and Manage permissions for a RAM role.

   If you require fine-grained access control, you can create a custom policy. For more information, see Grant RAM permissions to a RAM user or RAM role.

   The following code is a sample RAM authorization policy for this scenario.

   {
       "Statement": [
           {
               "Effect": "Allow",
               "Action": [
                   "acc:DescribeCommodityStatus",
                   "acc:CheckServiceRole",
                   "acc:DescribeCloudProducts",
                   "acc:DescribeRegions",
                   "acc:DescribeZones",
                   "acc:GetInstancePrice",
                   "acc:RecommendZones",
                   "acc:DescribeGpuModelSeries"
               ],
               "Resource": "*"
           },
           {
               "Effect": "Allow",
               "Action": [
                   "bssapi:GetPayAsYouGoPrice",
                   "bssapi:QueryAccountBalance"
               ],
               "Resource": "*"
           },
           {
               "Action": [
                   "ecs:DescribePrice",
                   "ecs:DescribeAccountAttributes"
               ],
               "Effect": "Allow",
               "Resource": "*"
           },
           {
               "Action": [
                   "ram:GetRole",
                   "ram:CreateRole"
               ],
               "Effect": "Allow",
               "Resource": "*"
           },
           {
               "Action": [
                   "cs:CreateCluster",
                   "cs:DescribeAddons",
                   "cs:DescribeUserQuota",
                   "cs:DescribeTasks",
                   "cs:ListClusterAddonInstances"
               ],
               "Effect": "Allow",
               "Resource": "*"
           },
           {
               "Action": [
                   "cs:GetClusters",
                   "cs:DescribeClustersV1",
                   "cs:DescribeClusterUserKubeconfig",
                   "cs:DescribeClusterResources",
                   "cs:DescribeUserQuota",
                   "cs:DescribeClusterLogs",
                   "cs:ModifyCluster",
                   "cs:UpgradeCluster",
                   "cs:GetUpgradeStatus",
                   "cs:ResumeUpgradeCluster",
                   "cs:PauseClusterUpgrade",
                   "cs:CancelClusterUpgrade",
                   "cs:InstallClusterAddons",
                   "cs:UpgradeClusterAddons",
                   "cs:DescribeClusterAddonsUpgradeStatus",
                   "cs:UnInstallClusterAddons",
                   "cs:DeleteCluster",
                   "cs:DescribeClusterDetail",
                   "cs:GetClusterAuditProject",
                   "cs:DescribeClusterAddonsVersion",
                   "cs:DescribeClusterTasks",
                   "cs:DescribeClusterEvents",
                   "cs:DescribeEvents",
                   "cs:ListClusterReportSummary",
                   "cs:GetClusterBasicInfo",
                   "cs:ListReportTaskRule",
                   "cs:CreateReportTaskRule",
                   "cs:CheckControlPlaneLogEnable",
                   "cs:CreateClusterCheck"
               ],
               "Effect": "Allow",
               "Resource": "acs:cs:*:*:cluster/<yourclusterID>"
           },
           {
               "Action": [
                   "cs:CheckServiceRole",
                   "cs:DescribeKubernetesVersionMetadata"
               ],
               "Effect": "Allow",
               "Resource": "acs:cs:*:*:cluster/*"
           },
           {
               "Action": [
                   "log:ListProject",
                   "log:DescribeService",
                   "log:GetSlsService"
               ],
               "Effect": "Allow",
               "Resource": "*"
           },
           {
               "Action": [
                   "vpc:ListEnhanhcedNatGatewayAvailableZones",
                   "vpc:DescribeEipAddresses",
                   "vpc:DescribeVSwitches",
                   "vpc:DescribeVpcs"
               ],
               "Effect": "Allow",
               "Resource": "*"
           }
       ],
       "Version": "1"
   }

   In the example above, replace <yourclusterID> with the actual ACS cluster ID.

2. For more information about the ACK OpenAPI, see [[Product Change] Notice on ACK OpenAPI Authentication Optimization](t2103012.dita#task_2103012) and API overview.

3. RBAC yetkilendirmesi

   RAM izinlerini verdikten sonra RAM kullanıcısına veya RAM rolüne küme için RBAC izinleri de vermeniz gerekir. ACK, küme düzeyinde dört önceden tanımlanmış rol sağlar.

   Rol	Küme içi RBAC izinleri
   Administrator	Tüm ad alanlarında tüm kaynaklar üzerinde okuma ve yazma izinleri.
   O&M Engineer	Tüm ad alanlarında konsolda görünen Kubernetes kaynakları üzerinde okuma ve yazma izinleri; küme düğümleri, kalıcı birimler (PV'ler), ad alanları ve kotalar üzerinde salt okunur izinler.
   Developer	Tüm veya seçili ad alanlarında konsolda görünen Kubernetes kaynakları üzerinde okuma ve yazma izinleri.
   Restricted User	Tüm veya seçili ad alanlarında konsolda görünen Kubernetes kaynakları üzerinde salt okunur izinler.

   1. In the Container Compute Service console, click Authorizations in the left-side navigation pane. On the RAM Users or RAM Roles tab, find the target identity and click Modify Permissions.

   2. In the dialog box that appears, click +Add Permissions. Set the permission for the target cluster and its namespaces to O&M Engineer, and then click Submit.

   Önceden tanımlanmış rolü atadıktan sonra ACS, yetkili kullanıcının veya rolün kimliğine karşılık gelen bir ClusterRoleBinding örneğini kümede otomatik olarak oluşturur. Aşağıdaki kod, önceden tanımlanmış O&M Engineer rolü için RBAC izinlerini göstermektedir.

   Önceden tanımlanmış O&M Engineer rolü için RBAC izinleri örneği

   apiVersion: rbac.authorization.k8s.io/v1
   kind: ClusterRole
   metadata:
     name: cs:ops
   rules:
   - apiGroups: [""]
     resources:  ["pods", "pods/attach", "pods/exec", "pods/portforward", "pods/proxy"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: [""]
     resources:  ["configmaps", "endpoints", "persistentvolumeclaims", "replicationcontrollers", "replicationcontrollers/scale", "secrets", "serviceaccounts", "services", "services/proxy"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: [""]
     resources:  ["bindings", "events", "limitranges", "namespaces/status", "replicationcontrollers/status", "pods/log", "pods/status", "resourcequotas", "resourcequotas/status", "componentstatuses"]
     verbs: ["get", "list", "watch"]
   - apiGroups: [""]
     resources:  ["namespaces", "nodes", "persistentvolumes"]
     verbs: ["get", "list", "watch", "patch"]
   - apiGroups: ["coordination.k8s.io"]
     resources:  ["leases"]
     verbs: ["get"]
   - apiGroups: ["apps"]
     resources:  ["daemonsets", "deployments", "deployments/rollback", "deployments/scale", "replicasets", "replicasets/scale", "statefulsets"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["autoscaling"]
     resources:  ["horizontalpodautoscalers"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["batch"]
     resources:  ["cronjobs", "jobs"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["extensions"]
     resources:  ["daemonsets", "deployments", "deployments/rollback", "deployments/scale","ingresses","replicasets", "replicasets/scale", "replicationcontrollers/scale"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["networking.k8s.io"]
     resources:  ["*"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["servicecatalog.k8s.io"]
     resources:  ["clusterserviceclasses", "clusterserviceplans", "clusterservicebrokers", "serviceinstances", "servicebindings"]
     verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["servicecatalog.k8s.io"]
     resources:  ["clusterservicebrokers/status", "clusterserviceclasses/status", "clusterserviceplans/status", "serviceinstances/status", "serviceinstances/reference", "servicebindings/status",]
     verbs: ["update"]
   - apiGroups: ["storage.k8s.io"]
     resources:  ["storageclasses"]
     verbs: ["get", "list", "watch"]
   - apiGroups: ["alicloud.com"]
     resources:  ["*"]
     verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["policy"]
     resources:  ["poddisruptionbudgets"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["metrics.k8s.io"]
     resources: ["pods"]
     verbs: ["get", "watch", "list"]
   - apiGroups: ["networking.istio.io"]
     resources:  ["*"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["config.istio.io"]
     resources:  ["*"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["rbac.istio.io"]
     resources:  ["*"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["istio.alibabacloud.com"]
     resources:  ["*"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["authentication.istio.io"]
     resources:  ["*"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["log.alibabacloud.com"]
     resources:  ["*"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["monitoring.kiali.io"]
     resources:  ["*"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["kiali.io"]
     resources:  ["*"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["apiextensions.k8s.io"]
     resources: ["customresourcedefinitions"]
     verbs: ["get", "list", "create", "watch", "patch", "update", "delete", "deletecollection"]
   - apiGroups: ["serving.knative.dev"]
     resources: ["*"]
     verbs: ["get", "list", "create", "watch", "patch", "update", "delete", "deletecollection"]
   - apiGroups: ["eventing.knative.dev"]
     resources: ["*"]
     verbs: ["get", "list", "create", "watch", "patch", "update", "delete", "deletecollection"]
   - apiGroups: ["messaging.knative.dev"]
     resources: ["*"]
     verbs: ["get", "list", "create", "watch", "patch", "update", "delete", "deletecollection"]
   - apiGroups: ["sources.eventing.knative.dev"]
     resources: ["*"]
     verbs: ["get", "list", "create", "watch", "patch", "update", "delete", "deletecollection"]
   - apiGroups: ["tekton.dev"]
     resources: ["*"]
     verbs: ["get", "list", "create", "watch", "patch", "update", "delete", "deletecollection"]
   - apiGroups: ["alert.alibabacloud.com"]
     resources: ["*"]
     verbs: ["get", "list", "create", "watch", "patch", "update", "delete", "deletecollection"]

   If you require fine-grained RBAC permissions, you can create a custom ClusterRole instance by referring to the official Kubernetes RBAC documentation. Then, on the Authorizations page of the Container Compute Service console, select Custom and select the name of the custom ClusterRole from the drop-down list. For more information, see Create a custom RBAC authorization policy.

Senaryo 2: Küme içi uygulamalar için geliştirici

1. RAM yetkilendirmesi

   You need to create a custom policy in the RAM console and attach the policy to the target RAM user or RAM role. For more information, see Grant RAM permissions to a RAM user or RAM role. The custom policy is as follows:

   {
       "Statement": [
           {
               "Effect": "Allow",
               "Action": [
                   "acc:DescribeCommodityStatus",
                   "acc:CheckServiceRole",
                   "acc:DescribeCloudProducts",
                   "acc:DescribeRegions",
                   "acc:DescribeZones",
                   "acc:GetInstancePrice",
                   "acc:RecommendZones"
               ],
               "Resource": "*"
           },
           {
               "Effect": "Allow",
               "Action": "bssapi:GetPayAsYouGoPrice",
               "Resource": "*"
           },
           {
               "Action": [
                   "cs:Get*",
                   "cs:List*",
                   "cs:Check*",
                   "cs:Describe*"
               ],
               "Effect": "Allow",
               "Resource": [
                   "acs:cs:*:*:cluster/<yourclusterID>"
               ]
           },
           {
               "Action": [
                   "vpc:ListEnhanhcedNatGatewayAvailableZones",
                   "vpc:DescribeEipAddresses"
               ],
               "Effect": "Allow",
               "Resource": "*"
           }
       ],
       "Version": "1"
   }

   In the example above, replace <yourclusterID> with your actual ACS cluster ID.

   Not

   If you only need to grant a user read-only permissions on a specific ACS cluster, use this sample policy and specify the cluster's ARN. Do not assign the AliyunCSReadOnlyAccess system policy. This policy grants read-only permissions on all ACK clusters and is too permissive for this use case.

2. RBAC yetkilendirmesi

   1. In the Container Compute Service console, click Authorizations in the left-side navigation pane. On the RAM Users or RAM Roles tab, find the target identity and click Modify Permissions.

   2. In the dialog box that appears, click +Add Permissions. Set the permission for the target cluster and its namespaces to Developer, and then click Submit.

   Önceden tanımlanmış rolü atadıktan sonra ACS, yetkili kullanıcının veya rolün kimliğine karşılık gelen bir ClusterRoleBinding örneğini kümede otomatik olarak oluşturur. Aşağıdaki örnek kod, önceden tanımlanmış Developer rolü için RBAC izinlerini sağlar.

   Önceden tanımlanmış Developer rolü için RBAC izinleri örneği

   apiVersion: rbac.authorization.k8s.io/v1
   kind: ClusterRole
   metadata:
     name: cs:ns:dev
   rules:
   - apiGroups: [""]
     resources:  ["pods", "pods/attach", "pods/exec", "pods/portforward", "pods/proxy"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: [""]
     resources:  ["configmaps", "endpoints", "persistentvolumeclaims", "replicationcontrollers", "replicationcontrollers/scale", "secrets", "serviceaccounts", "services", "services/proxy"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: [""]
     resources:  ["events", "replicationcontrollers/status", "pods/log", "pods/status"]
     verbs: ["get", "list", "watch"]
   - apiGroups: ["apps"]
     resources:  ["daemonsets", "deployments", "deployments/rollback", "deployments/scale", "replicasets", "replicasets/scale", "statefulsets"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["autoscaling"]
     resources:  ["horizontalpodautoscalers"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["batch"]
     resources:  ["cronjobs", "jobs"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["extensions"]
     resources:  ["daemonsets", "deployments", "deployments/rollback", "deployments/scale","ingresses","replicasets", "replicasets/scale", "replicationcontrollers/scale"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["networking.k8s.io"]
     resources:  ["*"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["servicecatalog.k8s.io"]
     resources:  ["clusterserviceclasses", "clusterserviceplans", "clusterservicebrokers", "serviceinstances", "servicebindings"]
     verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["servicecatalog.k8s.io"]
     resources:  ["clusterservicebrokers/status", "clusterserviceclasses/status", "clusterserviceplans/status", "serviceinstances/status", "serviceinstances/reference", "servicebindings/status",]
     verbs: ["update"]
   - apiGroups: ["alicloud.com"]
     resources:  ["*"]
     verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["policy"]
     resources:  ["poddisruptionbudgets"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["networking.istio.io"]
     resources:  ["*"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["config.istio.io"]
     resources:  ["*"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["rbac.istio.io"]
     resources:  ["*"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["istio.alibabacloud.com"]
     resources:  ["*"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["authentication.istio.io"]
     resources:  ["*"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["log.alibabacloud.com"]
     resources:  ["*"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["monitoring.kiali.io"]
     resources:  ["*"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["kiali.io"]
     resources:  ["*"]
     verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
   - apiGroups: ["apiextensions.k8s.io"]
     resources: ["customresourcedefinitions"]
     verbs: ["get", "list", "create", "watch", "patch", "update", "delete", "deletecollection"]
   - apiGroups: ["serving.knative.dev"]
     resources: ["*"]
     verbs: ["get", "list", "create", "watch", "patch", "update", "delete", "deletecollection"]
   - apiGroups: ["eventing.knative.dev"]
     resources: ["*"]
     verbs: ["get", "list", "create", "watch", "patch", "update", "delete", "deletecollection"]
   - apiGroups: ["messaging.knative.dev"]
     resources: ["*"]
     verbs: ["get", "list", "create", "watch", "patch", "update", "delete", "deletecollection"]
   - apiGroups: ["sources.eventing.knative.dev"]
     resources: ["*"]
     verbs: ["get", "list", "create", "watch", "patch", "update", "delete", "deletecollection"]
   - apiGroups: ["tekton.dev"]
     resources: ["*"]
     verbs: ["get", "list", "create", "watch", "patch", "update", "delete", "deletecollection"]
   - apiGroups: ["alert.alibabacloud.com"]
     resources: ["*"]
     verbs: ["get", "list", "create", "watch", "patch", "update", "delete", "deletecollection"]

Senaryo 3: Küme içi uygulamalar için izin yöneticisi

The authorizing user or role is required to manage the RBAC permissions of other RAM users or RAM roles. By default, a RAM user or RAM role does not have the permission to grant RBAC permissions to other RAM users or RAM roles. When the authorizing user or role accesses the authorization management page in the Container Service console, if the UI displays the message The current RAM user does not have authorization management permissions. Please contact the Alibaba Cloud account or a permission administrator for authorization., this indicates that the authorizing user or role lacks the necessary RAM authorization or the RBAC administrator authorization for the cluster.

1. RAM yetkilendirmesi

   Kullanıcının veya rolün gerekli RAM izinlerine sahip olduğundan emin olun. İlke şu izinleri içermelidir:

   • Diğer RAM kullanıcılarını veya RAM rollerini listeleme.

   • Belirtilen RAM kullanıcılarına veya RAM rollerine RAM ilkeleri atama.

   • Belirtilen RAM kullanıcılarının veya RAM rollerinin Kubernetes RBAC izin yapılandırmalarını görüntüleme.

   • Kubernetes RBAC yetkilendirmesi gerçekleştirme.

   In the RAM console, grant the corresponding RAM permissions to the specified RAM user or RAM role. For more information, see Grant RAM permissions to a RAM user or RAM role. The following sample code provides a custom RAM policy.

   {
       "Statement": [
           {
               "Effect": "Allow",
               "Action": [
                   "acc:DescribeCommodityStatus",
                   "acc:CheckServiceRole",
                   "acc:DescribeCloudProducts",
                   "acc:DescribeRegions",
                   "acc:DescribeZones",
                   "acc:GetInstancePrice",
                   "acc:RecommendZones"
               ],
               "Resource": "*"
           },
           {
               "Effect": "Allow",
               "Action": "bssapi:GetPayAsYouGoPrice",
               "Resource": "*"
           },
           {
               "Action": [
                   "ram:Get*",
                   "ram:List*",
                   "cs:GetUserPermissions",
                   "cs:GetSubUsers",
                   "cs:GrantPermission",
                   "cs:CheckServiceRole"
               ],
               "Resource": "*",
               "Effect": "Allow"
           },
           {
               "Action": [
                   "ram:AttachPolicyToUser",
                   "ram:AttachPolicyToRole"
               ],
               "Effect": "Allow",
               "Resource": [
                   "acs:ram:*:*:policy/xxxx",
                   "acs:*:*:*:user/*"
               ]
           },
           {
               "Action": [
                   "vpc:ListEnhanhcedNatGatewayAvailableZones",
                   "vpc:DescribeEipAddresses"
               ],
               "Effect": "Allow",
               "Resource": "*"
           }
       ],
       "Version": "1"
   }

2. RBAC yetkilendirmesi

   1. In the Container Compute Service console, click Authorizations in the left-side navigation pane. On the RAM Users or RAM Roles tab, find the target identity and click Modify Permissions.

   2. In the dialog box that appears, click +Add Permissions. Set the permission for the target cluster and its namespaces to Administrator or the cluster-admin custom role, and then click Submit.

      Not

      An Alibaba Cloud account and the cluster creator are bound to the cluster-admin role by default and have access to all Kubernetes resource objects in the cluster.

After you complete the RAM and RBAC authorization for a target, the target can manage RBAC authorization for other RAM users or RAM roles within a specified permission scope. For more information, see Grant RAM permissions to a RAM user or RAM role.