用户使用ACK注册集群通过stub<->agent的访问链路访问集群资源，所有操作的权限收敛于ack-cluster-agent组件所使用的ServiceAccount，默认是名为ack的sa，授权为admin权限，用户可以根据具体需求自行更改授权规则。
前置条件
- ack-cluster-agent版本已升级至v1.13.1.69-g00e1991-aliyun及以上。 （请在ACK注册集群组件管理页面进行升级）
默认要求的最小化RBAC权限
ACK注册集群要求的最小的授权为节点列表的获取权限，授权规则如下所示：
apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: ack-admin labels: ack/creator: "ack" rules: - apiGroups: [""] resources: ["nodes"] verbs: ["get", "list", "watch"] - apiGroups: [""] resources: ["configmaps"] resourceNames: ["ack-agent-config", "provider"] verbs: ["get", "list", "watch", "update"]
组件管理需要的RBAC权限
安装、更新addon组件，例如terway-eniip或logtail-ds等组件，需要临时将ClusterRole/ack-admin的权限设置为admin权限：
apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: ack-admin labels: ack/creator: "ack" rules: - apiGroups: ["*"] resources: ["*"] verbs: ["*"]
组件安装、升级完毕后，可恢复至以下最小权限：
apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: ack-admin labels: ack/creator: "ack" rules: - apiGroups: [""] resources: ["nodes"] verbs: ["get","list","watch"] - apiGroups: [""] resources: ["configmaps"] resourceNames: ["ack-agent-config","provider"] verbs: ["get","list","watch","update"] - apiGroups: [""] resources: ["configmaps"] resourceNames: ["autoscaler-meta"] verbs: ["get","list","watch","update"] - apiGroups: ["*"] resources: ["daemonsets", "deployments"] resourceNames: ["terway-eniip","security-inspector","ack-cluster-agent","gatekeeper","ack-virtual-node","metrics-server","logtail-ds","resource-controller","aliyun-acr-credential-helper","migrate-controller","ack-kubernetes-cronhpa-controller","tiller-deploy"] verbs: ["get", "list", "watch"] - apiGroups: ["*"] resources: ["daemonsets", "deployments"] resourceNames: ["cluster-autoscaler"] verbs: ["get", "list", "watch", "update"] - apiGroups: [""] resources: ["pods","secrets"] verbs: ["list"]
只启用节点池/弹性节点池功能的RBAC要求
安装terway组件或创建节点池时，需要临时将ClusterRole/ack-admin的权限设置为admin权限：
apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: ack-admin labels: ack/creator: "ack" rules: - apiGroups: ["*"] resources: ["*"] verbs: ["*"]
节点池配置完毕后，可恢复至以下最小权限：
apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: ack-admin labels: ack/creator: "ack" rules: - apiGroups: [""] resources: ["nodes"] verbs: ["get","list","watch"] - apiGroups: [""] resources: ["configmaps"] resourceNames: ["ack-agent-config","provider","autoscaler-meta","eni-config"] verbs: ["get","list","watch","update"] - apiGroups: ["*"] resources: ["daemonsets", "deployments"] resourceNames: ["terway-eniip", "cluster-autoscaler"] verbs: ["get", "list", "watch", "update"]
