APIG访问容器服务ACK的RBAC权限说明-API 网关(API Gateway)-阿里云帮助中心

ACK支持基于Kubernetes原生的RBAC（Role-Based Access Control）授权机制。RBAC授权支持为不同用户赋予同一集群内的Kubernetes资源不同的操作权限。当您同意授权APIG服务关联角色AliyunServiceRoleForNativeApiGw后，会默认绑定指定的RBAC角色apig-aliyunservicerolefornativeapigw-clusterrole，使得APIG通过服务角色所对应的RBAC权限访问ACK集群内部资源，从而满足APIG服务管控侧必要的集群资源访问需求。

APIG服务角色的RBAC权限策略

默认情况下，ACK集群不会主动创建该RBAC角色，只有在您授权APIG的服务角色并访问ACK集群时，由APIG触发创建该RBAC角色及授权绑定操作。
该RBAC角色仅用于APIG指定功能的最小化权限访问，不会影响您正常业务的RBAC授权。

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: apig-aliyunservicerolefornativeapigw-clusterrole
rules:
  # base
  - apiGroups: [""]
    resources: ["pods", "nodes", "services", "namespaces", "endpoints", "secrets", "configmaps"]
    verbs: ["get", "watch", "list"]
  - apiGroups: ["discovery.k8s.io"]
    resources: ["endpointslices"]
    verbs: ["get", "list", "watch"]

  # ingress
  - apiGroups: ["networking.k8s.io"]
    resources: ["ingresses", "ingressclasses"]
    verbs: ["get", "list", "watch"]
  - apiGroups: ["networking.k8s.io"]
    resources: ["ingresses/status"]
    verbs: ["*"]

  # gateway api
  - apiGroups: ["networking.x-k8s.io", "gateway.networking.k8s.io"]
    resources: ["*"]
    verbs: ["get", "watch", "list"]
  - apiGroups: ["networking.x-k8s.io", "gateway.networking.k8s.io"]
    resources: ["*"]
    verbs: ["*"]

  # CRD
  - apiGroups: ["apiextensions.k8s.io"]
    resources: ["customresourcedefinitions"]
    verbs: ["get", "list", "watch"]

  # istio
  - apiGroups: ["networking.istio.io"]
    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
    resources: [ "workloadentries" ]
  - apiGroups: ["networking.istio.io"]
    verbs: [ "get", "watch", "list", "update", "patch", "create", "delete" ]
    resources: [ "workloadentries/status" ]
 
  - apiGroups: [""]
    resources: ["services", "namespaces"]
    verbs: ["get", "list", "watch", "create"]
  - apiGroups: ["apps"]
    resources: ["deployments"]
    verbs: ["get", "list", "watch", "create"]

 # kingress
  - apiGroups: ["networking.internal.knative.dev"]
    resources: ["ingresses"]
    verbs: ["get", "list", "watch", "update", "patch"]
  - apiGroups: ["networking.internal.knative.dev"]
    resources: ["ingresses/status"]
    verbs: ["update", "patch"]

# readiness gate 
  - apiGroups: [""]
    resources: ["pods/status"]
    verbs: ["update"]

如何配置禁止APIG访问ACK集群的权限

方法一

您可以通过修改ClusterRole实现禁止访问集群，步骤如下：

使用阿里云账号登录容器服务ACK控制台，在左侧导航栏选择集群列表，单击目标集群名称。
在左侧导航栏中选择安全管理> 角色。
在角色页面单击Cluster Role页签，在搜索框中输入apig-aliyunservicerolefornativeapigw-clusterrole进行搜索。
在apig-aliyunservicerolefornativeapigw-clusterrole的操作列下，单击YAML 编辑，增加annotation配置inner.service.alibabacloud.com/user-customized: true ，同时删除rules字段下所有权限。
```
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  annotations:
    inner.service.alibabacloud.com/user-customized: true
  name: apig-aliyunservicerolefornativeapigw-clusterrole
rules:[]
```

方法二

您可以通过删除服务关联角色实现禁止访问集群。