AliyunContainerService/ack-ram-tool
GitHub: AliyunContainerService/ack-ram-tool
ack-ram-tool 是一个帮助用户在阿里云 ACK Kubernetes 集群中管理 RAM 凭证、配置 Service Account 角色关联（RRSA）的命令行工具和库。
Stars: 10 | Forks: 14
# ack-ram-tool
一个用于在阿里云容器服务 for Kubernetes (ACK) 中使用 RAM、凭证和权限相关功能的命令行工具和库。
`中文文档 `__
.. contents::
## 安装
您可以从 `Releases `__ 页面下载最新版本。
## 凭证
https://aliyuncontainerservice.github.io/ack-ram-tool/#credentials
## 用法
## kubectl/client-go credential plugin
一个用于 ACK 的 `kubectl/client-go credential plugin `__。
获取一个 exec credential plugin 格式的 kubeconfig：
.. code-block:: shell
```
ack-ram-tool credential-plugin get-kubeconfig --cluster-id > kubeconfig
```
使用该 kubeconfig 访问集群：
.. code-block:: shell
```
kubectl --kubeconfig=kubeconfig get ns
```
移除缓存的凭证：
.. code-block:: shell
```
rm ~/.kube/cache/ack-ram-tool/credential-plugin/*.json
```
## Service Account 的 RAM Roles (RRSA)
开启 `RRSA 特性 `__ ：
.. code-block:: shell
```
$ ack-ram-tool rrsa enable --cluster-id
? Are you sure you want to enable RRSA feature? Yes
Enable RRSA feature for cluster c86fdd*** successfully
```
将一个 RAM Role 关联到 service account（使用 ``--create-role-if-not-exist`` 标志可以在 RAM Role 不存在时自动创建）：
.. code-block:: shell
```
$ ack-ram-tool rrsa associate-role --cluster-id \
--namespace --service-account \
--role-name
? Are you sure you want to associate RAM Role test-rrsa to service account test-serviceaccount (namespace: test-namespace)? Yes
Will change the assumeRolePolicyDocument of RAM Role test-rrsa with blow content:
{
"Statement": [
{
"Action": "sts:AssumeRole",
"Effect": "Allow",
"Principal": {
"RAM": [
"acs:ram::18***:root"
]
}
},
{
"Action": "sts:AssumeRole",
"Condition": {
"StringEquals": {
"oidc:aud": "sts.aliyuncs.com",
"oidc:iss": "https://oidc-ack-**/c86fdd***",
"oidc:sub": "system:serviceaccount:test-namespace:test-serviceaccount"
}
},
"Effect": "Allow",
"Principal": {
"Federated": [
"acs:ram::18***:oidc-provider/ack-rrsa-c86fdd***"
]
}
}
],
"Version": "1"
}
? Are you sure you want to associate RAM Role test-rrsa to service account test-serviceaccount (namespace: test-namespace)? Yes
Associate RAM Role test-rrsa to service account test-serviceaccount (namespace: test-namespace) successfully
```
## 文档
欲了解更多信息，请参阅 `文档
标签：EVTX分析, 子域名突变, 日志审计, 权限控制, 身份与访问管理, 阿里云ACK