Install a P2P acceleration kit in an ACK Edge cluster

Method 1: Worker RAM role

The P2P component inherits the permissions of the worker node's RAM role. The ACR Enterprise Edition instance and the ACK Edge cluster must belong to the same Alibaba Cloud account.

1. Log on to the ACK console. In the left-side navigation pane, click Clusters.

2. On the Clusters page, click the name of your cluster. In the left-side pane, click Cluster Information.

3. On the Cluster Information page, click the Basic Information tab. In the Cluster Resources section, click the URL next to Worker RAM Role.

4. On the RAM role page, click the Permissions tab, then click the permission policy name in the Policy column.

5. Check whether the policy already includes the following permissions. If not, click Modify Policy Document, add the following content, and click OK.

   {
       "Version": "1",
       "Statement": [
           {
               "Effect": "Allow",
               "Action": [
                   "cr:GetInstanceVpcEndpoint",
                   "cr:ListInstanceEndpoint"
               ],
               "Resource": "*"
           }
       ]
   }

Method 2: AccessKey pair of a RAM user

Use this method when your cluster runs outside Alibaba Cloud or when you need explicit credential control.

1. Create a RAM user. See Create a RAM user.

2. Attach the following permission policy to the RAM user, then get the RAM user's AccessKey pair. See View the information about AccessKey pairs of a RAM user.

   {
       "Version": "1",
       "Statement": [
           {
               "Effect": "Allow",
               "Action": [
                   "cr:GetInstanceVpcEndpoint",
                   "cr:ListInstanceEndpoint"
               ],
               "Resource": "*"
           }
       ]
   }

You'll enter the accessKey and accessKeySecret values in the Helm chart parameters in Step 3.

Method 3: RRSA

RAM Roles for Service Accounts (RRSA) provides pod-level access control. Before configuring RRSA for the P2P agent, you must first enable RRSA on the cluster.

Enable RRSA on the cluster

Enable RRSA for your ACK cluster. See Use RRSA to authorize different pods to access different cloud services.

Configure the RRSA role

The steps differ depending on whether the ACR Enterprise Edition instance and the ACK cluster belong to the same Alibaba Cloud account.

Same account

If Account A owns both the ACR Enterprise Edition instance and the ACK Edge cluster:

1. Create a RAM role for Account A. See Create a RAM role for a trusted Alibaba Cloud account.

2. Attach the following permission policy to the RAM role.

   {
       "Version": "1",
       "Statement": [
           {
               "Effect": "Allow",
               "Action": [
                   "cr:GetInstanceVpcEndpoint",
                   "cr:ListInstanceEndpoint"
               ],
               "Resource": "*"
           }
       ]
   }

3. Set the trust policy of the RAM role to allow the P2P service accounts to assume it. Replace <oidc_issuer_url> with the OIDC identity provider (IdP) URL and <oidc_provider_arn> with the OIDC IdP ARN. Both values are available on the Basic Information tab of the Cluster Information page in the ACK console.

   {
     "Statement": [
       {
         "Action": "sts:AssumeRole",
         "Condition": {
           "StringEquals": {
             "oidc:aud": [
               "sts.aliyuncs.com"
             ],
             "oidc:iss": "<oidc_issuer_url>",
             "oidc:sub": [
               "system:serviceaccount:aliyun-acr-acceleration:ack-acr-acceleration-p2p-job-sa",
               "system:serviceaccount:aliyun-acr-acceleration:ack-acr-acceleration-p2p-sa"
             ]
           }
         },
         "Effect": "Allow",
         "Principal": {
           "Federated": [
             "<oidc_provider_arn>"
           ]
         }
       }
     ],
     "Version": "1"
   }

Cross-account

If Account A owns the ACK cluster and Account B owns the ACR Enterprise Edition instance:

1. Create a RAM role for Account A. See Create a RAM role for a trusted Alibaba Cloud account.

2. Attach the AliyunSTSAssumeRoleAccess policy to the RAM role of Account A. This grants Account A permission to assume the RAM role of Account B.

3. Set the trust policy of Account A's RAM role. Replace <oidc_issuer_url> and <oidc_provider_arn> with the values from the Basic Information tab of the Cluster Information page in the ACK console.

   {
     "Statement": [
       {
         "Action": "sts:AssumeRole",
         "Condition": {
           "StringEquals": {
             "oidc:aud": [
               "sts.aliyuncs.com"
             ],
             "oidc:iss": "<oidc_issuer_url>",
             "oidc:sub": [
               "system:serviceaccount:aliyun-acr-acceleration:ack-acr-acceleration-p2p-job-sa",
               "system:serviceaccount:aliyun-acr-acceleration:ack-acr-acceleration-p2p-sa"
             ]
           }
         },
         "Effect": "Allow",
         "Principal": {
           "Federated": [
             "<oidc_provider_arn>"
           ]
         }
       }
     ],
     "Version": "1"
   }

4. Create a RAM role for Account B with access to the ACR Enterprise Edition instance. In Trust Policy Management, add the ARN of Account A's RAM role. Attach the following permission policy to Account B's RAM role.

   You can set MaxSessionDuration for Account B's RAM role. Valid values: 3600–43200 seconds. We recommend setting MaxSessionDuration to 43200. The expireDuration parameter you set in Step 3 must be less than or equal to MaxSessionDuration.

   {
       "Version": "1",
       "Statement": [
           {
               "Effect": "Allow",
               "Action": [
                   "cr:GetInstanceVpcEndpoint",
                   "cr:ListInstanceEndpoint"
               ],
               "Resource": "*"
           }
       ]
   }