ack-ram-tool

A command line utility and library for using RAM、Credential and permission related features in Alibaba Cloud Container Service For Kubernetes (ACK). 中文文档

Contents

Installation
Credential
Usage
- kubectl/client-go credential plugin
- RAM Roles for Service Accounts (RRSA)

Installation

You can download the latest release from Releases page.

Credential

You can reuse ~/.aliyun/config.json file from aliyun cli (For detailed configuration instructions, please visit the document Configuration Alibaba Cloud CLI ).

Or use ~/.alibabacloud/credentials file (this path can be overridden using the --profile-file flag):

$ cat ~/.alibabacloud/credentials

[default]
type = access_key
access_key_id = foo
access_key_secret = bar

Or environment variables (also support credential related environment variables from aliyun cli):

# access key id
$ export ALIBABA_CLOUD_ACCESS_KEY_ID=foo
# access key secret
$ export ALIBABA_CLOUD_ACCESS_KEY_SECRET=bar
# sts token (optional)
$ export ALIBABA_CLOUD_SECURITY_TOKEN=foobar

# or use credentials URI: https://github.com/aliyun/aliyun-cli#use-credentials-uri
$ export ALIBABA_CLOUD_CREDENTIALS_URI=http://localhost:6666/?user=jacksontian

Usage

kubectl/client-go credential plugin

A kubectl/client-go credential plugin for ACK。

Get a kubeconfig with exec credential plugin format：

ack-ram-tool credential-plugin get-kubeconfig --cluster-id <clusterId> > kubeconfig

Use this kubeconfig to access cluster:

kubectl --kubeconfig=kubeconfig get ns

Remove cached credentials:

rm ~/.kube/cache/ack-ram-tool/credential-plugin/*.json

RAM Roles for Service Accounts (RRSA)

Enable RRSA feature :

$ ack-ram-tool rrsa enable -c <clusterId>

? Are you sure you want to enable RRSA feature? Yes
Enable RRSA feature for cluster c86fdd*** successfully

Check status of RRSA feature:

$ ack-ram-tool rrsa status -c <clusterId>

RRSA feature:          enabled
OIDC Provider Name:    ack-rrsa-c86fdd***
OIDC Provider Arn:     acs:ram::18***:oidc-provider/ack-rrsa-c86fdd***
OIDC Token Issuer:     https://oidc-ack-***/c86fdd***

Associate an RAM Role to a service account (use the --create-role-if-not-exist flag to auto create an RAM Role when it doesn't exist):

$ ack-ram-tool rrsa associate-role --create-role-if-not-exist \
    -c <clusterId> -r <roleName> -n <namespace> -s <serviceAccount>

? Are you sure you want to associate RAM Role test-rrsa to service account test-serviceaccount (namespace: test-namespace)? Yes
Will change the assumeRolePolicyDocument of RAM Role test-rrsa with blow content:
{
  "Statement": [
   {
    "Action": "sts:AssumeRole",
    "Effect": "Allow",
    "Principal": {
     "RAM": [
      "acs:ram::18***:root"
     ]
    }
   },
   {
    "Action": "sts:AssumeRole",
    "Condition": {
     "StringEquals": {
      "oidc:aud": "sts.aliyuncs.com",
      "oidc:iss": "https://oidc-ack-**/c86fdd***",
      "oidc:sub": "system:serviceaccount:test-namespace:test-serviceaccount"
     }
    },
    "Effect": "Allow",
    "Principal": {
     "Federated": [
      "acs:ram::18***:oidc-provider/ack-rrsa-c86fdd***"
     ]
    }
   }
  ],
  "Version": "1"
 }
? Are you sure you want to associate RAM Role test-rrsa to service account test-serviceaccount (namespace: test-namespace)? Yes
Associate RAM Role test-rrsa to service account test-serviceaccount (namespace: test-namespace) successfully

Testing assume role with give OIDC token:

$ ack-ram-tool rrsa assume-role -r <roleArn> -p <oidcProviderArn> -t <oidcTokenFile>

Retrieved a STS token:
AccessKeyId:       STS.***
AccessKeySecret:   7UVy***
SecurityToken:     CAIS***
Expiration:        2021-12-03T05:51:37Z

The setup-addon command allows you to quickly configure the RAM-related configuration required for the cluster components to use the RRSA feature. For example, configure the RAM configuration required for the kritis-validation-hook component (needs to be configured before installing the component):