Container Service for Kubernetes:Manually limit the permissions of the worker RAM role of an ACK managed cluster

Prerequisites

• An ACK managed cluster that runs Kubernetes 1.18 or later is created. ACK managed clusters are classified into ACK Pro clusters and ACK Basic clusters. For more information, see Create an ACK managed cluster and Update an ACK cluster.

• If you want to limit the permissions of the worker RAM role of an ACK dedicated cluster, you must first migrate from the ACK dedicated cluster to an ACK Pro cluster. For more information, see Hot migration from ACK dedicated clusters to ACK Pro clusters.

• Default roles are assigned to ACK to grant the permissions required by ACK managed clusters. For more information, see Assign default roles to ACK.

Step 1: Confirm whether permission limits are required

1. Log on to the ACK console. In the left-side navigation pane, click Clusters.

2. On the Clusters page, click the name of the cluster that you want to manage. On the cluster details page, click the Basic Information tab. Click the hyperlink on the right side of Worker RAM Role to go to the RAM console.

3. On the Permissions tab of the Role Details page, check whether policies are displayed.

   • If no policy is displayed, you do not need to limit the permissions of the worker RAM role.

   • If a policy is displayed, such as k8sWorkerRolePolicy-db8ad5c7***, you may need to limit the permissions of the worker RAM role. In this case, we recommend that you limit the permissions of the worker RAM role based on your requirements and the least privilege principle.

Step 2: Update system components

Update the key system components of the ACK managed cluster to the minimum required version or the latest version. For more information, see Manage system components.

Components can be installed from the Add-ons page in the ACK console or by using node pools. The following table describes how to update components installed by using the preceding methods.

kubectl -n kube-system rollout restart deployment/metrics-server

kubectl -n kube-system rollout restart deployment/alicloud-monitor-controller

kubectl -n kube-system rollout restart daemonset/logtail-ds
kubectl -n kube-system rollout restart deployment/alibaba-log-controller

kubectl -n kube-system rollout restart daemonset/terway

kubectl -n kube-system rollout restart daemonset/terway-eni

kubectl -n kube-system rollout restart daemonset/terway-eniip

kubectl -n kube-system rollout restart deployment/terway-controlplane

kubectl -n kube-system rollout restart daemonset/flexvolume

kubectl -n kube-system rollout restart daemonset/csi-plugin

kubectl -n kube-system rollout restart deployment/csi-provisioner

kubectl -n kube-system rollout restart deployment/storage-auto-expander
kubectl -n kube-system rollout restart deployment/storage-cnfs
kubectl -n kube-system rollout restart deployment/storage-monitor
kubectl -n kube-system rollout restart deployment/storage-snapshot-manager
kubectl -n kube-system rollout restart deployment/storage-operator

kubectl -n kube-system rollout restart deployment/alicloud-disk-controller

kubectl -n kube-system rollout restart deployment/ack-node-problem-detector-eventer

kubectl -n kube-system rollout restart deployment/aliyun-acr-credential-helper

kubectl -n kube-system rollout restart deployment/ack-cost-exporter

kubectl -n mse-ingress-controller rollout restart deployment/ack-mse-ingress-controller

kubectl -n arms-prom rollout restart deployment/arms-prometheus-ack-arms-prometheus

kubectl -n ack-onepilot rollout restart deployment/ack-onepilot-ack-onepilot

kubectl -n kube-system rollout restart deployment/cluster-autoscaler

Check the configurations of Terway

If terway, terway-eni, or terway-eniip is installed in your cluster, you need to manually check the configuration file of Terway, which is the eni_conf ConfigMap in the kube-system namespace.

1. Run the following command to view and modify the eni_conf ConfigMap:

   kubectl edit cm eni-config -n kube-system

   • If the "credential_path": "/var/addon/token-config", setting is included in the eni-conf ConfigMap, no additional action is required.

   • If the "credential_path": "/var/addon/token-config", setting is not included in the eni_conf ConfigMap, you need to add a new row below the min_pool_size parameter and specify "credential_path": "/var/addon/token-config", in the row.

     "credential_path": "/var/addon/token-config",

2. Run the corresponding command in the preceding table to redeploy Terway.

Step 3: Use ActionTrail to collect cluster logs

Use ActionTrail to collect API audit logs to analyze the API operations performed in the cluster. This way, you can identify the applications that rely on the RAM policy attached to the worker RAM role of the cluster. For more information about the Alibaba Cloud services that work with ActionTrail, see Services that work with ActionTrail.

Go to the ActionTrail console and create a single-account trail in the region where the cluster resides. When you create the single-account trail, select Delivery to Simple Log Service. For more information, see Create a single-account trail.

Step 4: Perform a functional test on the cluster

After the preceding steps are completed, perform a functional test on the cluster to check whether the cluster works as expected.

Step 5: Analyze the logs collected by ActionTrail

1. Log on to the Simple Log Service console.

2. In the Projects section, click the project that you want to manage.

   

3. On the details page of the project, choose Log Storage > Logstores and click the Logstore that you want to manage on the Logstores tab.

   The name of the Logstore that you use to store the logs collected by ActionTrail in Step 3 is in the actiontrail_<trail name> format

4. Use the following query statement to retrieve the API operations that the worker RAM role of the cluster performs by using STS tokens.

   Replace <worker_role_name> with the name of the worker RAM role of the cluster.

   * and event.userIdentity.userName: <worker_role_name> | select "event.serviceName", "event.eventName", count(*) as total GROUP BY "event.eventName", "event.serviceName"

Step 6: Limit the permissions of the worker RAM role

1. Log on to the ACK console. In the left-side navigation pane, click Clusters.

2. On the Clusters page, click the name of the cluster that you want to manage. On the cluster details page, click the Basic Information tab. Click the hyperlink on the right side of Worker RAM Role to go to the RAM console.

3. On the Permissions tab of the Role Details page, click the RAM policy that you want to manage. On the Policy Content tab, click Modify Policy Document.

   Important

   Before you modify the policy, make a copy of the original policy content in case you need to roll back the policy.

   Delete permissions from the policy based on your business requirements and the analysis result generated in Step 5. For example, you can delete the API operations that are not included in the analysis result from the Action section of the policy content. If you confirm that all API operations in the policy content are not required, you can detach the RAM policy from the worker RAM role.

4. Redeploy the system component. For more information, see the redeploy commands in Step 2.

5. Repeat Step 4, Step 5, and Step 6 until the worker RAM role provides only the minimum permissions required by the components and applications in your cluster.

References

For more information about the authorization system of ACK, see Best practices of authorization.