ack-ram-tool is a command-line interface (CLI) provided by Container Service for Kubernetes to help you manage Resource Access Management (RAM) and Role-Based Access Control (RBAC) permissions for your clusters. When users leave your organization or their permissions change, use ack-ram-tool to promptly clean up the permissions of deleted users in your cluster and prevent security risks.
Step 1: Install ack-ram-tool
Download the ack-ram-tool client for your environment's architecture.
Run the following command to grant execute permission to the client program.
chmod +x ./ack-ram-toolRun the following command to copy the ack-ram-tool file to a directory in your system's PATH.
mkdir -p $HOME/bin && cp ./ack-ram-tool $HOME/bin/ack-ram-tool && export PATH=$HOME/bin:$PATH(Optional) Run the following command to make the PATH configuration in
$HOME/binpersistent.echo 'export PATH=$HOME/bin:$PATH' >> ~/.bash_profileRun the following command to check the client version. This verifies that the ack-ram-tool client is installed.
ack-ram-tool version
Step 2: Configure Alibaba Cloud credentials
Alibaba Cloud RAM users and Cloud Single Sign-On (CloudSSO) users can configure access credentials for cloud resources in the following ways.
If access credential-related environment variables exist in the current environment, ack-ram-tool prioritizes the access credentials configured in the environment variables. You can ignore these environment variables by adding the parameter --ignore-env-credentials when executing the ack-ram-tool command. For access credential-related environment variables supported by ack-ram-tool, see Credentials.
RAM users
The ack-ram-tool client uses locally configured Alibaba Cloud key credentials to access RAM for identity authentication.
For more information about how to configure access credentials, see Cloud Assistant CLI.
CloudSSO users
For Alibaba Cloud CloudSSO users, you can use the acs-sso CLI tool provided by the CloudSSO service to log on and obtain access credentials for cloud resources. For more information about acs-sso, see Use the CLI to log on to CloudSSO and access Alibaba Cloud resources. The Cloud Assistant CLI supports the external mode, which lets you dynamically obtain resource credentials by running an external command-line tool. Run the following command to complete the CloudSSO logon and automate credential configuration on your local machine.
aliyun configure --mode External --profile sso
Configuring profile 'sso' in 'External' authenticate mode...
Process Command [acs-sso login --profile sso]:
Default Region Id [cn-shanghai]:
Default Output Format [json]: json (Only support json)
Default Language [zh|en] en:
Saving profile[sso] ...Done.
Configure Done!!!
..............888888888888888888888 ........=8888888888888888888D=..............
...........88888888888888888888888 ..........D8888888888888888888888I...........
.........,8888888888888ZI: ...........................=Z88D8888888888D..........
.........+88888888 ..........................................88888888D..........
.........+88888888 .......Welcome to use Alibaba Cloud.......O8888888D..........
.........+88888888 ............. ************* ..............O8888888D..........
.........+88888888 .... Command Line Interface(Reloaded) ....O8888888D..........
.........+88888888...........................................88888888D..........
..........D888888888888DO+. ..........................?ND888888888888D..........
...........O8888888888888888888888...........D8888888888888888888888=...........
............ .:D8888888888888888888.........78888888888888888888O ..............Step 3: Configure required permissions for the ack-ram-tool access credentials
The access credentials used by ack-ram-tool require RAM permissions and the cluster's RBAC permissions.
Grant the following permissions to the RAM user. For more information, see Manage the permissions of a RAM user.
{ "Version": "1", "Statement": [ { "Effect": "Allow", "Action": [ "cs:*" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ram:ListUsers", "ram:ListRoles" ], "Resource": "*" } ] }Grant the RAM user the RBAC administrative permissions for the cluster.
Log on to the ACK console. In the left navigation pane, choose Authorizations.
On the Authorization page, click the RAM Users tab. Find the RAM user that you want to add, click Manage Permissions in the right-side column, and go to the Permission Management page.
Click Add Permissions. Select a Cluster and a Namespace. Set Permission Management to Administrator, and then click Submit Authorization.
Step 4: Query the RBAC bindings of a specified RAM user in the cluster
You can run the ack-ram-tool rbac scan-user-permissions command to query the RBAC binding information of a specified RAM user in the destination cluster.
Query only the RBAC bindings of deleted RAM users and roles
Run the following command to view the RBAC binding information of deleted RAM users and roles in the cluster.
ack-ram-tool rbac scan-user-permissions -c <cluster_ID>Expected output:
2023-12-12T15:34:37+08:00 INFO start to scan users and bindings for cluster c401890df511a4362bf24bece4da****
2023-12-12T15:34:43+08:00 WARN by default, only deleted users are included. Use the --all-users flag to include all users
UID UserType UserName Binding
30086537005566**** (deleted) RamRole ClusterRoleBinding/-/30086537005566****-clusterrolebinding
24320678733226**** (deleted) RamUser ClusterRoleBinding/-/24320678733226****-clusterrolebinding
The following table describes the UserType parameter.
Value of UserType | Description |
RamRole | RAM role |
RamUser | RAM user |
Root | Alibaba Cloud account |
Query the RBAC bindings of all RAM users and roles
Query the RBAC bindings for all clusters under the current Alibaba Cloud account
Step 5: Clean up the RBAC bindings of a specified RAM user or RAM role and purge kubeconfig permissions
You can run the ack-ram-tool rbac cleanup-user-permissions command to clean up the RBAC bindings of a specified RAM user or RAM role in the destination cluster and purge the user's kubeconfig.
If the log contains
this user has been active in the past 7 days, the destination RAM user or RAM role has cluster access records within the last 7 days. Proceed with caution.Before the cleanup operation, ack-ram-tool backs up the original JSON files of the bindings to be deleted to a folder named after the cluster ID in the current directory.
Clean up the permissions of a RAM user or RAM role in a single cluster
Run the following command to clean up the permissions of a specified RAM user or RAM role in a single cluster.
To obtain the <UID> in the following command, run the ack-ram-tool rbac scan-user-permissions -c <cluster_ID> command.
ack-ram-tool rbac cleanup-user-permissions -c <cluster_ID> -u <UID>Expected output:
Clean up the permissions of a RAM user or RAM role in all clusters
Run the following command to clean up the RBAC bindings of a specified RAM user or role in all clusters under the current Alibaba Cloud account and purge their kubeconfig.
ack-ram-tool rbac cleanup-user-permissions -c all -u <UID>Expected output:
References
For more information about how to manage a kubeconfig, see Purge a kubeconfig.