备案控制台
首页 容器计算服务 操作指南 授权 授权最佳实践

授权最佳实践

更新时间: 2024-03-13 13:44:59

容器计算服务ACS的授权体系包含对基础计算资源的RAM授权和对ACS集群侧RBAC授权，不同用户角色在这两个层面都具有不同的权限要求。本文介绍针对企业资源管理人员，Kubernetes集群管理人员，以及集群与应用运维人员、应用开发人员、以及权限管理人员五类对象的授权最佳实践。

ACS授权体系

ACS的授权体系包含对基础资源层的RAM授权以及对ACS集群层的RBAC授权。ACS授权体系如下图所示。

image.png

  • RAM授权对应ACS计算资源以及ACS集群的运维操作，需要获取ACS产品及其所依赖阿里云云产品的OpenAPI操作权限，主要包括以下操作：

    • 集群：创建、查看、升级、删除

    • 授权管理

    • 集群监控、日志、事件

  • RBAC授权对应的是运行于ACS集群中Kubernetes应用的运维操作，需要获取ACS集群及其命名空间的操作权限，主要包括对以下Kubernetes对象的增删改查操作：

    • 工作负载：Deployment、StatefulSet、DaemonSet、Job、CronJob、Pod、ReplicaSet、HPA等

    • 网络：Service、Ingress、NetworkPolicy等

    • 存储：PV、PVC、StorageClass等

    • Namespace、ConfigMap 、Secrets等

容器计算服务ACS预置以下系统授权策略，您可以通过给RAM用户或RAM角色授权系统默认授权策略，完成快速授权。

重要

系统默认授权策略授权范围较大，可具有ACS所有OpenAPI的读或写权限，请谨慎授权。

系统默认授权策略

授权策略描述

AliyunAccFullAccess

管理容器计算服务ACS的权限。

AliyunAccReadOnlyAccess

只读访问容器计算服务ACS的权限。

AliyunAccFullAccess授权策略

{
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "acc:*",
      "Resource": "*"
    }
  ],
  "Version": "1"
}

AliyunAccReadOnlyAccess授权策略

{
  "Version": "1",
  "Statement": [
    {
      "Action": [
        "acc:Describe*",
        "acc:CheckServiceRole"
      ],
      "Resource": "*",
      "Effect": "Allow"
    }
  ]
}

当RAM用户或RAM角色需要进行资源管理、集群运维和应用运维时，您需要依次对其进行RAM授权和RBAC授权。在进行RBAC授权之前，您需要先进行RAM授权。四种典型场景的授权操作如下：

场景一：授权对象为资源管理员

授权对象需要对ACS中的资源类型进行管理，包括资源的预留以及云产品集成中的配额设定两部分，因此需要授权流程所需的必要权限。资源管理所涉及的主要功能包括资源预留的创建、修改等，以及与其他云产品之间的资源限额设定相关的管理操作。

RAM授权

您需要在RAM管理控制台新增自定义策略，并将该策略授权给目标RAM用户或RAM角色。具体操作，请参见自定义RAM授权策略。

展开查看自定义策略内容

{
    "Version": "1",
    "Statement": [
       {
            "Effect": "Allow",
            "Action": [
                "acc:DescribeCommodityStatus",
                "acc:CheckServiceRole",
                "acc:DescribeCloudProducts",
                "acc:DescribeAvailableZone",
                "acc:DescribeRegions"
            ],
            "Resource": "*"
      },
      {
            "Effect": "Allow",
            "Action": "bssapi:GetPayAsYouGoPrice",
            "Resource": "*"
      },
      {
            "Effect": "Allow",
            "Action": [
                "acc:DescribeResourceReservations",
                "acc:DescribeResourceReservationDetail",
                "acc:CreateResourceReservation",
                "acc:RenewResourceReservation",
                "acc:UpdateResourceReservation",
                "acc:DescribeResourceReservationData",
                "acc:DescribeReservationInventory",
                "acc:DescribeResourceUsageSummary"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "acc:DescribeResourceQuotas",
                "acc:DescribeResourceQuotaDetail",
                "acc:CreateResourceQuota",
                "acc:UpdateResourceQuota",
                "acc:DeleteResourceQuota",
                "acc:AssociateResourceQuota",
                "acc:DisassociateResourceQuota",
                "acc:CreateSubResourceQuota",
                "acc:UpdateSubResourceQuota",
                "acc:DescribeSubResourceQuotaDetail",
                "acc:DeleteSubResourceQuota",
                "acc:DescribeQuotaLimitation"
            ],
            "Resource": "*"
        }
    ]
}

当您对授权对象完成了上述RAM授权后，即可拥有对应的管理能力。

场景二：授权对象为集群管理员

授权对象需要管理ACS集群的生命周期，因此需要拥有授权流程所需的必要权限。

RAM授权

您需要在RAM管理控制台新增自定义策略，并将该策略授权给目标RAM用户或RAM角色。具体操作，请参见自定义RAM授权策略。

展开查看自定义策略内容

{
    "Version": "1",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "acc:DescribeCommodityStatus",
                "acc:CheckServiceRole",
                "acc:DescribeAvailableZone",
                "acc:DeleteCluster",
                "acc:DescribeClusterKubeconfig",
                "acc:DescribeClusterLogs",
                "acc:DescribeClusters",
                "acc:CreateCluster",
                "acc:CreateClusterValidate",
                "acc:ModifyCluster"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": "cs:DescribeClusterResources",
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": "bssapi:GetPayAsYouGoPrice",
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "vpc:DescribeVpcs",
                "vpc:DescribeVSwitches"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": "log:ListProject",
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": "arms:ListDashboards",
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": "ram:GetRole",
            "Resource": "acs:ram:*:*:role/AliyunServiceRoleForARMS"
        }
    ]
}

如果授权对象同时有ACS集群内应用资源对象的运维需求，可以结合场景三：授权对象为集群与集群内应用的运维和开发人员进行补充对应的权限。

场景三：授权对象为集群与集群内应用的运维和开发人员

授权对象需要管理和运维ACS集群所需的必要权限，同时有ACS集群内应用资源对象的运维需求。因此授权流程包含RAM授权和RBAC授权。

RAM授权

容器计算服务ACS在RAM侧提供了AliyunAccFullAccess和AliyunAccReadOnlyAccess两个系统策略。

  • AliyunAccFullAccess包含了容器计算服务ACS的全部OpenAPI的读写访问权限。

  • AliyunAccReadOnlyAccess包含了容器计算服务ACS的全部OpenAPI的只读访问权限。

您需要登录RAM管理控制台，根据实际需求选择绑定其中一个系统策略。具体操作，请参见为RAM用户授权和为RAM角色授权。

如果您有细粒度权限控制的需求，可以自定义授权策略。具体操作，请参见自定义RAM授权策略。

说明

请将RAM细粒度授权策略示例中的<ClusterID>按需替换为实际的ACS集群ID

展开查看RAM细粒度授权策略示例

{
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "acc:DescribeCommodityStatus",
                "acc:CheckServiceRole"
            ],
            "Resource": "*"
        },
        {
            "Action": [
                "cs:GetClusters",
                "cs:DescribeClusterDetail",
                "cs:DescribeClustersV1",
                "cs:DescribeClusterUserKubeconfig",
                "cs:DescribeClusterResources",
                "cs:DescribeUserQuota",
                "cs:ModifyCluster",
                "cs:UpgradeCluster",
                "cs:GetUpgradeStatus",
                "cs:ResumeUpgradeCluster",
                "cs:PauseClusterUpgrade",
                "cs:CancelClusterUpgrade",
                "cs:DescribeAddons",
                "cs:InstallClusterAddons",
                "cs:UpgradeClusterAddons",
                "cs:ModifyClusterAddon",
                "cs:DescribeClusterAddonsUpgradeStatus",
                "cs:DescribeClusterAddonsVersion",
                "cs:DescribeClusterAddonMetadata",
                "cs:UnInstallClusterAddons",
                "cs:DescribeClusterEvents",
                "cs:DescribeClusterTasks",
                "cs:GetClusterAuditProject",
                "cs:CheckControlPlaneLogEnable"
            ],
            "Effect": "Allow",
            "Resource": "acs:cs:*:*:cluster/<ClusterID>"
        },
        {
            "Effect": "Allow",
            "Action": [
                "cs:ListClusterReportSummary",
                "cs:GetClusterReportSummary",
                "cs:CreateClusterOverviewReport",
                "cs:GetClusterCheckItem",
                "cs:ListDiagnosisResult",
                "cs:GetClusterBasicInfo",
                "cs:CreateClusterCheck",
                "cs:CreateClusterReport",
                "cs:GetClusterServices",
                "cs:ListReportTaskRule",
                "cs:DeleteReportTaskRule",
                "cs:CreateReportTaskRule",
                "cs:GetClusterPods",
                "cs:GetClusterServices",
                "cs:GetNamespaces",
                "cs:CreateDiagnosis",
                "cs:CreateDiagnose",
                "cs:GetDiagnosisResult",
                "cs:ListDiagnoseResult",
                "cs:GetDiagnosisFeedback",
                "cs:GetDiagnosisFeedbackResult",
                "cs:CreateDiagnosisFeedback"
            ],
            "Resource": "acs:cs:*:*:cluster/<ClusterID>"
        },
        {
            "Effect": "Allow",
            "Action": "cs:DescribeAddons",
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "acc:DescribeClusterKubeconfig",
                "acc:DescribeClusterDetail",
                "acc:DescribeClusterLogs",
                "acc:DescribeClusterNamespaces",
                "acc:ModifyCluster"
            ],
            "Resource": "acs:acc:*:*:cluster/<ClusterID>"
        },
        {
            "Effect": "Allow",
            "Action": [
                "acc:DescribeClusters"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "log:ListProject",
                "log:ListLogStores",
                "log:ListDashboard",
                "log:GetDashboard",
                "log:GetIndex",
                "log:GetLogStore",
                "log:GetLogStoreLogs",
                "log:ListSavedSearch"
            ],
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": "ram:GetRole",
            "Resource": "*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "cloudshell:CreateEnvironment",
                "cloudshell:CreateSession"
            ],
            "Resource": "*"
        }
    ],
    "Version": "1"
}

RBAC授权

完成RAM授权后，您还需要为RAM用户或RAM角色授予对应集群的RBAC权限。容器计算服务ACS在集群层面提供了四种预置角色。

角色

集群内RBAC权限

管理员

对所有命名空间下的所有资源的读写权限。

运维人员

对所有命名空间下控制台可见的Kubernetes资源的读写权限，对集群存储卷、命名空间、配额的只读权限。

开发人员

对所有命名空间或所选命名空间下控制台可见的Kubernetes资源的读写权限。

受限用户

对所有命名空间或所选命名空间下控制台可见的Kubernetes资源的只读权限。

您可以在容器计算服务管理控制台的授权管理页面，为授权对象配置目标集群和对应命名空间的访问权限为运维人员。RBAC

绑定预置角色后，ACS会自动在集群中创建与被授权对象身份对应的ClusterRoleBinding实例。

展开查看预置运维人员角色的RBAC权限

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: cs:ops
rules:
- apiGroups: [""]
  resources:  ["pods", "pods/attach", "pods/exec", "pods/portforward", "pods/proxy"]
  verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
- apiGroups: [""]
  resources:  ["configmaps", "endpoints", "persistentvolumeclaims", "replicationcontrollers", "replicationcontrollers/scale", "secrets", "serviceaccounts", "services", "services/proxy"]
  verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
- apiGroups: [""]
  resources:  ["bindings", "events", "limitranges", "namespaces/status", "replicationcontrollers/status", "pods/log", "pods/status", "resourcequotas", "resourcequotas/status", "componentstatuses"]
  verbs: ["get", "list", "watch"]
- apiGroups: [""]
  resources:  ["namespaces","nodes","persistentvolumes"]
  verbs: ["get", "list", "watch", "patch"]
- apiGroups: ["coordination.k8s.io"]
  resources:  ["leases"]
  verbs: ["get"]
- apiGroups: ["apps"]
  resources:  ["daemonsets", "deployments", "deployments/rollback", "deployments/scale", "replicasets", "replicasets/scale", "statefulsets"]
  verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
- apiGroups: ["autoscaling"]
  resources:  ["horizontalpodautoscalers"]
  verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
- apiGroups: ["batch"]
  resources:  ["cronjobs", "jobs"]
  verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
- apiGroups: ["extensions"]
  resources:  ["daemonsets", "deployments", "deployments/rollback", "deployments/scale","ingresses","replicasets", "replicasets/scale", "replicationcontrollers/scale"]
  verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
- apiGroups: ["networking.k8s.io"]
  resources:  ["*"]
  verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
- apiGroups: ["servicecatalog.k8s.io"]
  resources:  ["clusterserviceclasses", "clusterserviceplans", "clusterservicebrokers", "serviceinstances", "servicebindings"]
  verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]
- apiGroups: ["servicecatalog.k8s.io"]
  resources:  ["clusterservicebrokers/status", "clusterserviceclasses/status", "clusterserviceplans/status", "serviceinstances/status", "serviceinstances/reference", "servicebindings/status",]
  verbs: ["update"]
- apiGroups: ["storage.k8s.io"]
  resources:  ["storageclasses"]
  verbs: ["get", "list", "watch"]
- apiGroups: ["alicloud.com"]
  resources:  ["*"]
  verbs: ["create", "delete", "get", "list", "patch", "update", "watch"]
- apiGroups: ["policy"]
  resources:  ["poddisruptionbudgets"]
  verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
- apiGroups: ["metrics.k8s.io"]
  resources: ["pods","nodes"]
  verbs: ["get", "watch", "list"]
- apiGroups: ["networking.istio.io"]
  resources:  ["*"]
  verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
- apiGroups: ["config.istio.io"]
  resources:  ["*"]
  verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
- apiGroups: ["rbac.istio.io"]
  resources:  ["*"]
  verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
- apiGroups: ["istio.alibabacloud.com"]
  resources:  ["*"]
  verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
- apiGroups: ["authentication.istio.io"]
  resources:  ["*"]
  verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
- apiGroups: ["log.alibabacloud.com"]
  resources:  ["*"]
  verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
- apiGroups: ["monitoring.kiali.io"]
  resources:  ["*"]
  verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
- apiGroups: ["kiali.io"]
  resources:  ["*"]
  verbs: ["create", "delete", "deletecollection", "get", "list", "patch", "update", "watch"]
- apiGroups: ["apiextensions.k8s.io"]
  resources: ["customresourcedefinitions"]
  verbs: ["get", "list", "create", "watch", "patch", "update", "delete", "deletecollection"]
- apiGroups: ["serving.knative.dev"]
  resources: ["*"]
  verbs: ["get", "list", "create", "watch", "patch", "update", "delete", "deletecollection"]
- apiGroups: ["eventing.knative.dev"]
  resources: ["*"]
  verbs: ["get", "list", "create", "watch", "patch", "update", "delete", "deletecollection"]
- apiGroups: ["messaging.knative.dev"]
  resources: ["*"]
  verbs: ["get", "list", "create", "watch", "patch", "update", "delete", "deletecollection"]
- apiGroups: ["sources.eventing.knative.dev"]
  resources: ["*"]
  verbs: ["get", "list", "create", "watch", "patch", "update", "delete", "deletecollection"]
- apiGroups: ["tekton.dev"]
  resources: ["*"]
  verbs: ["get", "list", "create", "watch", "patch", "update", "delete", "deletecollection"]
- apiGroups: ["alert.alibabacloud.com"]
  resources: ["*"]
  verbs: ["get", "list", "create", "watch", "patch", "update", "delete", "deletecollection"]

如果您有细粒度的RBAC权限控制需求，可以参考RBAC创建自定义ClusterRole实例，然后在容器计算服务管理控制台的授权管理页面选择自定义角色，再从下拉列表中选择自定义的ClusterRole名称。具体操作，请参见自定义Kubernetes授权策略。

场景四：授权对象为集群内应用的权限管理员

授权对象需要管理其他RAM用户或RAM角色的RBAC权限。默认情况下，RAM用户或RAM角色不具备对其他RAM用户或RAM角色授权RBAC的权限。当授权对象进入容器计算服务管理控制台的授权管理页面时，如果界面提示当前子账号不具备授权管理权限，请联系主账号或权限管理员授权，则说明授权对象缺少必要的RAM授权或对集群的RBAC管理员授权。

RAM授权

您需要确保授权对象被授予必要的RAM权限，策略内容需要包括：

  • 列举其他RAM用户或RAM角色。

  • 列举集群列表。

  • 查看指定RAM用户或RAM角色的Kubernetes RBAC权限配置。

  • Kubernetes RBAC授权能力。

您需要登录RAM管理控制台，为指定的RAM用户或RAM角色授予相应的RAM权限，具体操作，请参见自定义RAM授权策略。

展开查看RAM自定义策略内容示例

{
    "Statement": [
       {
            "Effect": "Allow",
            "Action": [
                "acc:DescribeCommodityStatus",
                "acc:CheckServiceRole"
            ],
            "Resource": "*"
        },
        {
            "Action": [
                "ram:ListUserBasicInfos",
                "ram:ListRoles"
            ]
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Action": "cs:GetClusters",
            "Resource": "*",
            "Effect": "Allow"
        },
        {
            "Effect": "Allow",
            "Action": [
                "acc:DescribeClusters",
                "acc:QuerySubaccountPermissionResources",
                "acc:RevokeK8sClusterUserKubeConfig",
                "acc:DescribeClusterNamespaces",
                "acc:GrantUserPermission",
                "acc:BatchGrantUserPermission",
                "acc:DescribeUserPermission"
            ],
            "Resource": "*"
        }
    ],
    "Version": "1"
}

RBAC授权

您需要为授权对象配置目标集群和对应命名空间的访问权限为管理员或者自定义角色中的cluster-admin。

说明

阿里云账号（即主账号）和集群创建者会默认绑定cluster-admin，拥有集群内所有Kubernetes资源对象的访问权限。

cluster-admin

当您对授权对象完成了上述RAM授权和RBAC授权后，即可拥有对其他RAM用户或RAM角色在指定权限范围内的RBAC授权管理能力。具体操作，请参见配置RAM用户或RAM角色RBAC权限。

容器计算服务ACS鉴权Action说明

权限名称（Action）

说明

acc:CheckServiceRole

检查账号是否授权产品通过角色扮演，访问其他云资源账号的ServiceRole。

acc:DescribeCommodityStatus

检查账号是否已开通ACS产品。

acc:CreateCluster

创建Kubernetes集群。

acc:ModifyCluster

更新Kubernetes集群。

acc:DeleteCluster

删除Kubernetes集群。

acc:DescribeClusters

查询Kubernetes集群列表。

acc:DescribeClusterDetail

查询一个Kubernetes集群的详情信息。

acc:DescribeClusterKubeconfig

查询一个Kubernetes集群的KubeConfig配置。

acc:DescribeResourceUsageSummary

查询资源预留用量概览数据。

acc:CreateResourceReservation

创建一个资源预留订单。

acc:DescribeResourceReservations

查询资源预留订单列表。

acc:DescribeResourceReservationDetail

查询一个资源预留订单的详情。

acc:RenewResourceReservation

扩容、延期一个资源预留订单。

acc:UpdateResourceReservation

更新一个资源预留订单的详情信息。

acc:DescribeResourceReservationData

查询一个资源预留订单的总量和使用量统计。

acc:DescribeCloudProducts

查询ACS支持集成的云产品。

acc:CreateResourceQuota

创建一个云产品资源配额。

acc:UpdateResourceQuota

更新一个云产品资源配额配置信息。

acc:DeleteResourceQuota

删除一个云产品的资源配额。

acc:DescribeResourceQuotas

查询资源配额订单列表。

acc:DescribeResourceQuotaDetail

查询一个资源配额订单的详情。

acc:DisassociateResourceQuota

解绑一个云产品的资源配额。

acc:AssociateResourceQuota

资源配额绑定到一个云产品。

acc:CreateSubResourceQuota

创建一个子级资源配额。

acc:DeleteSubResourceQuota

删除一个子级资源配额。

acc:UpdateSubResourceQuota

更新一个子级资源配额。

acc:DescribeSubResourceQuotaDetail

查询一个子级资源配额详情。

acc:DescribeUserPermission

查询RAM用户或角色的集群RBAC授权配置。

acc:GrantUserPermission

修改RAM用户或角色的集群RBAC授权配置。

acc:BatchGrantUserPermission

批量修改RAM用户或角色的集群RBAC授权配置。

acc:DescribeClusterNamespaces

查询RAM用户或角色在集群内有权限的命名空间。

acc:QuerySubaccountPermissionResources

查询RAM用户或角色具有管理权限的集群及命名空间。

acc:RevokeK8sClusterUserKubeConfig

吊销或重新生成KubeConfig。

acc:DescribeQuotaLimitation

查询可设置的资源配额上限。

acc:DescribeAvailableZone

获取一个地域下的可用区列表。

acc:DescribeReservationInventory

查询可购买的资源预留上限。

acc:DescribeClusterLogs

查询集群日志。

acc:CreateClusterValidate

创建集群校验。

权限名称（Action）

说明

bssapi:GetPayAsYouGoPrice

查询后付费产品询价服务。

ram:ListUserBasicInfos

查询所有RAM用户的基本信息

ram:ListRoles

查询所有RAM角色的基本信息

说明

该文档仅供授权参考，具体授权规则请您详细了解容器计算服务ACS鉴权Action说明后，满足最小授权原则为前提，根据实际需要编写。

文档推荐