容器服务的用户授权包括 IAM （Identity and Access Management，基于身份的权限控制）授权和 RBAC （Role\-Based Access Control ，基于角色的权限控制）授权。本文介绍针对 IAM 用户的授权最佳实践。 ## 前提条件已创建 IAM 用户。详细操作，请参见 [用户管理](https://www.volcengine.com/docs/6257/64977)。 ## 场景一：为 IAM 用户授权指定的集群 ### 场景介绍为某个 IAM 用户（User）授予指定集群的访问和操作权限，即该 User 只能在指定的 VKE 集群里进行相关资源的增、删、查、改操作。 ### 操作步骤 1. 使用火山引擎账号（Account）或具有相关权限的 IAM 用户登录 [IAM 控制台](https://console.volcengine.com/iam)。 2. 左侧导航栏选择 **策略管理**，单击 **系统预设策略**，搜索 **VKEReadOnlyAccess**。 ![图片](https://portal.volccdn.com/obj/volcfe/cloud-universal-doc/upload_d19a61ea3fd3523ec4cf5169c2e69fc8.png =962x) 3. 单击 **VKEReadOnlyAccess**，进入策略详情页面，选择 **语法** 页签，复制 **VKEReadOnlyAccess** 策略语法到本地。 4. 按如下说明修改复制到本地的 **VKEReadOnlyAccess** 策略语法，并保存为新的自定义策略，例如 **Access\-Cluster\-A**。 1. 将 VKE 相关 **Action** 中的内容替换为`vke:*`，**Resource** 中的内容替换为需要约束。 ```json { "Effect": "Allow", "Action": [ "vke:*" ], "Resource": [ "trn:vke:{Region_ID}:{Account_ID}:cluster/{Cluster_ID}", "trn:iam:{Account_ID}:project/*", "trn:vpc:{Region_ID}:{Account_ID}:securitygroup/*", "trn:vpc:{Region_ID}:{Account_ID}:subnet/*" ] } ``` 其中变量说明如下： * `{Region_ID}`：替换为目标 VKE 集群所在地域的 ID，例如`cn-shanghai`。 * `{Account_ID}`：替换为您火山引擎账号（主账号）ID，例如`210001****`。 * `{Cluster_ID}`：替换为目标 VKE 集群的 ID，例如`ccm0i61o93a9te2k8****`。完整示例如下： ```json { "Effect": "Allow", "Action": [ "vke:*" ], "Resource": [ "trn:vke:cn-shanghai:210001****:cluster/ccm0i61o93a9te2k8****", "trn:iam::210001****:project/*", "trn:vpc:cn-shanghai:210001****:securitygroup/*", "trn:vpc:cn-shanghai:210001****:subnet/*" ] } ``` 2. 增加如下弹性块存储相关 **Action** 和 **Resource**。 ```json { "Effect": "Allow", "Action": [ "storage_ebs:Describe*", "storage_ebs:CalculatePrice" ], "Resource": [ "*" ] } ``` 5. 新建自定义策略 **Access\-Cluster\-A**。详细操作，请参见 [新建策略](https://www.volcengine.com/docs/6257/1158323)。 ![图片](https://portal.volccdn.com/obj/volcfe/cloud-universal-doc/upload_c203a89e51084326af843b26315193c4.png =962x) 6. 为 IAM 用户授权 **Access\-Cluster\-A** 策略。详细操作，请参见 [管理用户](https://www.volcengine.com/docs/6257/64977#%E7%AE%A1%E7%90%86%E7%94%A8%E6%88%B7)。 ![图片](https://portal.volccdn.com/obj/volcfe/cloud-universal-doc/upload_4b667e69524e6d30563cfc21d7dfd740.png =965x) ## 场景二：创建项目范围使用的自定义权限并授权 ### 场景介绍 VKE 中部分操作（Action）和资源（Resource）是按照项目（Project）划分的，可满足项目粒度的权限控制需求。若需要将该类操作和资源授权给 IAM 用户，需要以项目权限的形式授予。 :::warning VKE 中有一部分 Action 和 Resource 是无法按照项目划分，因此为 IAM 用户授予项目权限的同时，还需要将无法按照项目划分的 Action 和 Resource，以全局权限的形式授予给该 IAM 用户。否则该 IAM 用户可能无法正常操作和使用容器服务资源。 ::: 容器服务相关的 Action 和 Resource 说明，请参见 [用户自定义策略](https://www.volcengine.com/docs/6460/101024#.55So5oi36Ieq5a6a5LmJ562W55Wl)。 ### 操作步骤 1. 使用火山引擎账号或具有相关权限的 IAM 用户登录 [IAM 控制台](https://console.volcengine.com/iam)。 2. 新建自定义策略，例如名称为 **vke\-project**。策略的 JSON 内容示例如下所示，请按需自行增删具体的 Action 或 Resource 。VKE 依赖的云服务资源访问权限，请参见 [VKE 服务关联角色说明](https://www.volcengine.com/docs/6460/1218654)。 ```json { "Statement": [ { "Effect": "Allow", "Action": [ "vke:CreateCluster", "vke:ListClusters", "vke:UpdateClusterConfig", "vke:DeleteCluster", "vke:CreateKubeconfig", "vke:DeleteKubeconfigs", "vke:CreateNodePool", "vke:CreateDefaultNodePool", "vke:UpdateNodePoolConfig", "vke:DeleteNodePool", "vke:CreateNodes", "vke:DeleteNodes", "vke:CreateAddon", "vke:UpdateAddonConfig", "vke:UpdateAddonVersion", "vke:DeleteAddon", "vke:ForwardKubernetesApi", "vke:CreateScalingPolicy", "vke:UpdateScalingPolicy", "vke:DeleteScalingPolicies", "vke:ListKubeconfigs", "vke:ListNodePools", "vke:ListNodes", "vke:ListAddons", "vke:SetGlobalDefaultDeleteOption", "vke:ListScalingPolicies", "vke:ListScalingEvents", "vke:UpdateClusterVersion", "vke:UpdateImageCache", "alb:DescribeLoadBalancers", "clb:DescribeLoadBalancers", "FileNAS:DescribeFileSystems", "storage_ebs:DescribeVolumes", "FileNAS:DescribeMountPoints", "tls:DescribeTopics", "tls:DescribeProject", "tls:DescribeTopic", "TLS:DescribeTopic", "vpc:DescribeSubnets", "vpc:DescribeSecurityGroups", "vpc:DescribeVpcs", "vpc:DescribeBandwidthPackages", "vpc:DescribeSecurityGroupAttributes", "clb:DescribeListeners", "alb:DescribeListeners", "natgateway:DescribeNatGateways", "ecs:DescribeImages", "ecs:DescribeKeyPairs", "ecs:DescribeInstances", "alb:DescribeCertificates", "clb:DescribeCertificates", "vepfs:DescribeFileSystems", "vepfs:DescribeMountServices", "auto_scaling:DescribeScalingGroups", "auto_scaling:DescribeScalingActivities", "certificate_service:CertificateGetInstance", "artifacts:ListRepositories", "artifacts:ListInstances", "artifacts:GetPackageInfo", "apig:ListGateways", "cr:ListNamespaces" ], "Resource": [ "*" ] } ] } ``` 3. 为已创建的 **vke\-project** 策略添加授权。 ![图片](https://portal.volccdn.com/obj/volcfe/cloud-universal-doc/upload_b354db78c10bb3396e270416537d6a31.png =965x) 4. 选择目标 IAM 用户，添加 **vke\-project** 策略的项目权限。 ![图片](https://portal.volccdn.com/obj/volcfe/cloud-universal-doc/upload_fca555c9adf21e566c5e1dccfb1cf21e.png =965x) 5. 为无法按照项目划分的 Action 和 Resource 新建自定义策略并授权给目标 IAM 用户。 1. 例如名称为 **vke\-global**。策略的 JSON 内容示例如下所示，请按需自行增删具体的 Action 或 Resource 。VKE 依赖的云服务资源访问权限，请参见 [VKE 服务关联角色说明](https://www.volcengine.com/docs/6460/1218654)。 :::tip 如果您已为无法按照项目划分的 Action 和 Resource 创建了自定义策略，则直接将策略授权给 IAM 用户即可，无需重复创建。 ::: ```json { "Statement": [ { "Effect": "Allow", "Action": [ "vke:AddClusterNode", "vke:AddVciSubnets", "vke:CheckClusterCidrConflict", "vke:CheckNameConflict", "vke:CreateAddonInner", "vke:CreateConfigMap", "vke:CreateCronHorizontalPodAutoscaler", "vke:CreateCronJob", "vke:CreateDaemonSet", "vke:CreateDefaultNodePoolInner", "vke:CreateDeployment", "vke:CreateHorizontalPodAutoscaler", "vke:CreateIHPA", "vke:CreateIngress", "vke:CreateJob", "vke:CreateLogCollectRule", "vke:CreateLogConfig", "vke:CreateNamespace", "vke:CreateNodePoolInner", "vke:CreateNodesInner", "vke:CreatePersistentVolume", "vke:CreatePersistentVolumeClaim", "vke:CreateRelease", "vke:CreateResourceByYaml", "vke:CreateResourcePackages", "vke:CreateSecret", "vke:CreateService", "vke:CreateStatefulSet", "vke:CreateStorageClass", "vke:CreateUserRbac", "vke:CreateVirtualNode", "vke:DeleteCRD", "vke:DeleteConfigMap", "vke:DeleteCronHorizontalPodAutoscaler", "vke:DeleteCronJob", "vke:DeleteDaemonSet", "vke:DeleteDeployment", "vke:DeleteHorizontalPodAutoscaler", "vke:DeleteIHPA", "vke:DeleteImageCache", "vke:DeleteIngress", "vke:DeleteJob", "vke:DeleteLogCollectRule", "vke:DeleteLogConfig", "vke:DeleteNamespace", "vke:DeletePersistentVolume", "vke:DeletePersistentVolumeClaim", "vke:DeletePod", "vke:DeleteRelease", "vke:DeleteResource", "vke:DeleteSecret", "vke:DeleteService", "vke:DeleteStatefulSet", "vke:DeleteStorageClass", "vke:DeleteUserRbac", "vke:GetAPIGroup", "vke:GetAccountQuotaUsages", "vke:GetApplicationCronInspection", "vke:GetApplicationInspection", "vke:GetApplicationInspectionItem", "vke:GetApplicationInspectionStatus", "vke:GetChart", "vke:GetCheckItem", "vke:GetClusterDeployProgress", "vke:GetClusterOverview", "vke:GetClusterResources", "vke:GetConfigMap", "vke:GetContainerLogs", "vke:GetCronJob", "vke:GetCronScan", "vke:GetDaemonSet", "vke:GetDeployment", "vke:GetEventTopic", "vke:GetHorizontalPodAutoscaler", "vke:GetIHPA", "vke:GetIngress", "vke:GetJob", "vke:GetListeners", "vke:GetLogCollectRule", "vke:GetLogProjectID", "vke:GetLogTopicID", "vke:GetNamespace", "vke:GetNamespaceResource", "vke:GetNodePoolNodeStatistics", "vke:GetPersistentVolume", "vke:GetPersistentVolumeClaim", "vke:GetPod", "vke:GetRelease", "vke:GetResource", "vke:GetResourceYaml", "vke:GetSecret", "vke:GetSecretDomains", "vke:GetService", "vke:GetStatefulSet", "vke:GetStorageClass", "vke:GetTerminal", "vke:InnerReconcileVCIQuotaUsage", "vke:InnerSyncVCIQuota", "vke:IsAffectedByVci", "vke:ListAPIGroups", "vke:ListAddonFeatureSchemas", "vke:ListAddonNotRefactoredVersions", "vke:ListAiSuiteStatus", "vke:ListAllAddons", "vke:ListAllSupportedAddons", "vke:ListApplicationInspectionItems", "vke:ListApplicationInspectionReports", "vke:ListBatchSuiteStatus", "vke:ListBenchmarks", "vke:ListCRDs", "vke:ListChartCategories", "vke:ListCharts", "vke:ListCheckItems", "vke:ListClusterNode", "vke:ListConfigMaps", "vke:ListContainerInstances", "vke:ListCronHorizontalPodAutoscalers", "vke:ListCronJobs", "vke:ListCustomRoles", "vke:ListDaemonSets", "vke:ListDeployments", "vke:ListEvent", "vke:ListHorizontalPodAutoscalers", "vke:ListIHPAs", "vke:ListImageCaches", "vke:ListIngress", "vke:ListInstanceTypes", "vke:ListJobs", "vke:ListJobsFromCronJob", "vke:ListKubernetesObservability", "vke:ListKubernetesObservabilityComponentConfigs", "vke:ListLogCollectRules", "vke:ListLogConfigs", "vke:ListLogProjects", "vke:ListLogTopics", "vke:ListNamespace", "vke:ListNodePoolNodes", "vke:ListNodePoolScalingRecords", "vke:ListNodeReports", "vke:ListNodeZones", "vke:ListNodesInner", "vke:ListObjectEvents", "vke:ListPersistentVolume", "vke:ListPersistentVolumeClaim", "vke:ListPods", "vke:ListReleases", "vke:ListReservedContainerInstanceGroups", "vke:ListResourcePackageSpecs", "vke:ListResources", "vke:ListSecrets", "vke:ListServices", "vke:ListStatefulSets", "vke:ListStorageClass", "vke:ListTagsForResources", "vke:ListTasks", "vke:ListUpdateRecords", "vke:ListUserRbacs", "vke:ListVirtualNodes", "vke:ListWorkloadHistories", "vke:ListWorkloadHorizontalPodAutoscalers", "vke:ListWorkloadPods", "vke:ListWorkloadServices", "vke:PatchCronJobSuspend", "vke:PatchWorkloadImage", "vke:PatchWorkloadParallelism", "vke:PatchWorkloadReplicas", "vke:RestartWorkload", "vke:RollbackRelease", "vke:RollbackWorkload", "vke:SetApplicationCronInspection", "vke:SetApplicationInspection", "vke:StartApplicationInspection", "vke:StartNodeScan", "vke:StartScan", "vke:TagResources", "vke:UntagResources", "vke:UpdateAiSuiteStatus", "vke:UpdateConfigMap", "vke:UpdateCronHorizontalPodAutoscaler", "vke:UpdateCronJob", "vke:UpdateCronScan", "vke:UpdateDaemonSet", "vke:UpdateDeployment", "vke:UpdateHorizontalPodAutoscaler", "vke:UpdateIHPA", "vke:UpdateIngress", "vke:UpdateJob", "vke:UpdateLogCollectRule", "vke:UpdateNamespace", "vke:UpdateNamespaceResource", "vke:UpdateNodePoolForCA", "vke:UpdateNodesSystemConfigInner", "vke:UpdateNodesVersion", "vke:UpdateRelease", "vke:UpdateResourceByYaml", "vke:UpdateSecret", "vke:UpdateService", "vke:UpdateStatefulSet", "vke:UpdateUserRbac", "vmp:CreateAlertingRuleGroup", "vmp:DeleteAlertingRuleGroup", "vmp:ListAlertingRuleGroups", "vmp:ListAlertingRuleTemplates", "vmp:ListAlertingRules", "vmp:ListDashboards", "vmp:ListDatasources", "vmp:ListNotifyGroupPolicies", "vmp:ListNotifyPolicies", "vmp:ListWorkspaceInstanceTypes", "vmp:ListWorkspaces", "vmp:UpdateAlertingRuleGroup", "vpc:DescribeIpv6AddressBandwidths", "vpc:InnerGetLimitFromKeys", "vpc:ListTagsForResources", "alb:DescribeRules", "apig:CheckGatewayExist", "cfs:ListFs", "cfs:ListNs", "clb:DescribeCertificates", "clb:DescribeLoadBalancerAttributes", "clb:ListTagsForResources", "cr:GetVpcEndpoint", "cr:ListRegistries", "cr:ListRepositories", "ecs:DescribeDeploymentSetSupportedInstanceTypeFamily", "ecs:DescribeDeploymentSets", "ecs:DescribeTags", "iam:AttachRolePolicy", "iam:CreateRole", "iam:ListAttachedRolePolicies", "iam:ListPolicies", "iam:ListRoles", "tls:DescribeProjects", "tos:ListBuckets", "vepfs:DescribeFileSystemStatistics", "vepfs:DescribeMountServices" ], "Resource": [ "*" ] } ] } ``` 2. 为已创建的 **vke\-global** 策略添加授权。 ![图片](https://portal.volccdn.com/obj/volcfe/cloud-universal-doc/upload_82c2ca2ce0c21ff11820c66ccb662351.png =937x) 3. 选择目标 IAM 用户，添加 **vke\-global** 策略的全局权限。 ![图片](https://portal.volccdn.com/obj/volcfe/cloud-universal-doc/upload_0727f98f0c5db5660435b776bf658702.png =939x)