Container Service for Kubernetes:ack-pod-identity-webhook

Introduction

The following figure shows the architecture of the ack-pod-identity-webhook component.

Example

The application deployed in this example uses the RRSA feature to assume a specified role and retrieve a list of clusters that belong to the current account. The following information is used in this example.

• Namespace: rrsa-demo

• Service account: demo-sa

• RAM role: ack-pod-identity-webhook-demo

After you add the pod-identity.alibabacloud.com/injection: 'on' label to the namespace where the pod resides, the ack-pod-identity-webhook component automatically injects the relevant configuration items into the pod based on the annotations of the service account that the pod uses. The procedure is as follows.

1. Enable the RRSA feature for your cluster. For more information, see Enable the RRSA feature.

   After you enable the RRSA feature, obtain the URL and ARN of the OIDC IdP in the cluster.

2. Install the ack-pod-identity-webhook component.

   1. On the Clusters page, find the cluster you want and click its name. In the left-side pane, choose Operations > Add-ons.

   2. On the Add-ons page, click the Security tab, find the ack-pod-identity-webhook component, and then click Install in the lower-right corner of the component card.

   3. In the dialog box that appears, confirm the component information and click OK.

3. Create a RAM role named ack-pod-identity-webhook-demo. The following table describes the main parameters. For more information, see Create a RAM role for an OIDC IdP.

   Configuration item	Description
   Identity Provider Type	OIDC
   Identity Provider	ack-rrsa-<cluster_id>. <cluster_id> is the ID of your cluster.
   Condition	oidc:iss: Keep the default value. oidc:aud: Keep the default value. oidc:sub: Manually add this condition. Key: Select oidc:sub. Operator: Select StringEquals. Value: system:serviceaccount:<namespace>:<serviceAccountName>. <namespace> is the namespace where the application resides. <serviceAccountName> is the name of the service account. Based on the information of the test application, enter system:serviceaccount:rrsa-demo:demo-sa.

4. Grant the AliyunCSReadOnlyAccess system policy to the role that you created in the previous step. This policy provides the required permissions for the test application. For more information, see Grant permissions to a RAM role.

5. Deploy the test application.

   1. Create a demo.yaml file that contains the following content.

      In the following YAML example, the pod-identity.alibabacloud.com/injection: 'on' label is added to the namespace and the pod-identity.alibabacloud.com/role-name: ack-pod-identity-webhook-demo annotation is added to the service account to enable the automatic configuration injection feature of the ack-pod-identity-webhook component. For more information about the RRSA demo implementation, see the code.

      ---
      apiVersion: v1
      kind: Namespace
      metadata:
        name: rrsa-demo
        labels:
          pod-identity.alibabacloud.com/injection: 'on'
      
      ---
      apiVersion: v1
      kind: ServiceAccount
      metadata:
        name: demo-sa
        namespace: rrsa-demo
        annotations:
          pod-identity.alibabacloud.com/role-name: ack-pod-identity-webhook-demo
      
      ---
      apiVersion: v1
      kind: Pod
      metadata:
        name: demo
        namespace: rrsa-demo
      spec:
        serviceAccountName: demo-sa
        containers:
          - image: registry.cn-hangzhou.aliyuncs.com/acs/ack-ram-tool:1.0.0
            imagePullPolicy: "Always"
            args:
              - rrsa
              - demo
            name: demo
        restartPolicy: OnFailure

   2. Run the following command to deploy the test application.

      kubectl apply -f demo.yaml

6. Run the following command to view the test application pod and confirm that the ack-pod-identity-webhook component has automatically injected the required configurations.

   kubectl -n rrsa-demo get pod demo -o yaml

   Click to view the expected output

   apiVersion: v1
   kind: Pod
   metadata:
     name: demo
     namespace: rrsa-demo
   spec:
     containers:
     - args:
       - rrsa
       - demo
       env:
       - name: ALIBABA_CLOUD_ROLE_ARN
         value: acs:ram::1***:role/ack-pod-identity-webhook-demo
       - name: ALIBABA_CLOUD_OIDC_PROVIDER_ARN
         value: acs:ram::1***:oidc-provider/ack-rrsa-c***
       - name: ALIBABA_CLOUD_OIDC_TOKEN_FILE
         value: /var/run/secrets/ack.alibabacloud.com/rrsa-tokens/token
       image: registry.cn-hangzhou.aliyuncs.com/acs/ack-ram-tool:1.0.0
       imagePullPolicy: Always
       name: demo
       volumeMounts:
       - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
         name: kube-api-access-4bwdg
         readOnly: true
       - mountPath: /var/run/secrets/ack.alibabacloud.com/rrsa-tokens
         name: rrsa-oidc-token
         readOnly: true
     restartPolicy: OnFailure
     serviceAccount: demo-sa
     serviceAccountName: demo-sa
     volumes:
     - name: kube-api-access-4bwdg
       projected:
         defaultMode: 420
         sources:
         - serviceAccountToken:
             expirationSeconds: 3607
             path: token
         - configMap:
             items:
             - key: ca.crt
               path: ca.crt
             name: kube-root-ca.crt
         - downwardAPI:
             items:
             - fieldRef:
                 apiVersion: v1
                 fieldPath: metadata.namespace
               path: namespace
     - name: rrsa-oidc-token
       projected:
         defaultMode: 420
         sources:
         - serviceAccountToken:
             audience: sts.aliyuncs.com
             expirationSeconds: 3600
             path: token

   The expected output indicates that the ack-pod-identity-webhook component has automatically injected the following configurations into the pod.

   Category	Configuration item name	Configuration item description
   Environment variable	ALIBABA_CLOUD_ROLE_ARN	The ARN of the RAM role to assume.
   	ALIBABA_CLOUD_OIDC_PROVIDER_ARN	The ARN of the OIDC IdP.
   	ALIBABA_CLOUD_OIDC_TOKEN_FILE	The file path that contains the OIDC token.
   VolumeMount	rrsa-oidc-token	The configuration for mounting the OIDC token.
   Volume	rrsa-oidc-token	The configuration for mounting the OIDC token.

7. Run the following command to view the logs of the test application.

   kubectl -n rrsa-demo logs demo

   Expected output:

   cluster id: cf***, cluster name: foo*
   cluster id: c8***, cluster name: bar*
   cluster id: c4***, cluster name: foob*

Custom configurations

The ack-pod-identity-webhook component supports custom configurations for namespaces, service accounts, and pods.

apiVersion: v1
kind: Namespace
metadata:
  name: test
  labels:
    pod-identity.alibabacloud.com/injection: 'on'

apiVersion: v1
kind: ServiceAccount
metadata:
  name: test-sa
  namespace: test
  annotations:
    pod-identity.alibabacloud.com/role-name: test-role

apiVersion: v1
kind: ServiceAccount
metadata:
  name: test-sa
  namespace: test
  annotations:
    pod-identity.alibabacloud.com/service-account-token-expiration: '3600'

apiVersion: v1
kind: ServiceAccount
metadata:
  name: test-sa
  namespace: test
  annotations:
    pod-identity.alibabacloud.com/inject-sts-endpoint: 'on'

apiVersion: v1
kind: Pod
metadata:
  name: test
  labels:
    pod-identity.alibabacloud.com/injection: 'on'

apiVersion: v1
kind: Pod
metadata:
  name: test-pod
  namespace: test
  annotations:
    pod-identity.alibabacloud.com/service-account-token-expiration: '3600'

apiVersion: v1
kind: Pod
metadata:
  name: test-pod
  namespace: test
  annotations:
    pod-identity.alibabacloud.com/only-containers: 'controller,test'

apiVersion: v1
kind: Pod
metadata:
  name: test-pod
  namespace: test
  annotations:
    pod-identity.alibabacloud.com/skip-containers: 'controller,test'

RRSA SDK reference

Alibaba Cloud SDK V2.0 supports OIDC token authentication of RRSA. By default, all cloud service SDKs that support STS token authentication and are developed based on Alibaba Cloud SDK V2.0 support RRSA OIDC token authentication. The following table describes the supported SDK versions and demos.

Change log

References

Use RRSA to configure RAM permissions for a ServiceAccount to implement pod permission isolation