example.yaml

kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: ack-ram-authenticator
rules:
- apiGroups:
  - ramauthenticator.k8s.alibabacloud
  resources:
  - ramidentitymappings
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - ramauthenticator.k8s.alibabacloud
  resources:
  - ramidentitymappings/status
  verbs:
  - patch
  - update
- apiGroups:
  - ""
  resources:
  - events
  verbs:
  - create
  - update
  - patch
- apiGroups:
  - ""
  resources:
  - configmaps
  verbs:
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - configmaps
  resourceNames:
  - alibabacloud-auth
  verbs:
  - get
- apiGroups:
  - apiextensions.k8s.io
  resources:
  - customresourcedefinitions
  verbs:
  - get
  - create
  - update

---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: ack-ram-authenticator
  namespace: kube-system

---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: ack-ram-authenticator
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: ack-ram-authenticator
subjects:
- kind: ServiceAccount
  name: ack-ram-authenticator
  namespace: kube-system

---
apiVersion: v1
kind: ConfigMap
metadata:
  namespace: kube-system
  name: ack-ram-authenticator
  labels:
    k8s-app: ack-ram-authenticator
data:
  config.yaml: |
    # a unique-per-cluster identifier to prevent replay attacks
    # (good choices are a random token or a domain name that will be unique to your cluster)
    clusterID: <your-cluster-id>    # Replace <your-cluster-id> with actual cluster id
    # server listener configuration
    server:
      # localhost port where the server will serve the /authenticate endpoint
      port: 21362 # (default)

      # state directory for generated TLS certificate and private keys
      stateDir: /var/ack-ram-authenticator/

      # RAM Account IDs to scrub from server logs. (Defaults to empty list)
      scrubbedAccounts:

      # automatically map RAM ARN from these accounts to username.
      # NOTE: Always use quotes to avoid the account numbers being recognized as numbers
      # instead of strings by the yaml parser.
      mapAccounts:

      # source mappings from this file (mapUsers, mapRoles, & mapAccounts)
      backendMode:
        - CRD

---
apiVersion: apps/v1
kind: DaemonSet
metadata:
  namespace: kube-system
  name: ack-ram-authenticator
  labels:
    k8s-app: ack-ram-authenticator
spec:
  selector:
    matchLabels:
      k8s-app: ack-ram-authenticator
  updateStrategy:
    type: RollingUpdate
  template:
    metadata:
      labels:
        k8s-app: ack-ram-authenticator
    spec:
      # use service account with access to
      serviceAccountName: ack-ram-authenticator
      # run on the host network (don't depend on CNI)
      hostNetwork: true
      # run on each master node
      nodeSelector:
        node-role.kubernetes.io/control-plane: ""
      tolerations:
      - operator: Exists

      # mark pod as critical to the cluster
      priorityClassName: system-cluster-critical
      # run `ack-ram-authenticator server` with three volumes
      # - config (mounted from the ConfigMap at /etc/ack-ram-authenticator/config.yaml)
      # - state (persisted TLS certificate and keys, mounted from the host)
      # - output (output kubeconfig to plug into your apiserver configuration, mounted from the host)
      containers:
      - name: ack-ram-authenticator
        image: registry-cn-hangzhou.ack.aliyuncs.com/acs/ram-authenticator:v0.2.1.3-g694325a9-aliyun
        args:
        - server
        - --config=/etc/ack-ram-authenticator/config.yaml
        - --state-dir=/var/ack-ram-authenticator
        - --kubeconfig-pregenerated=true
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          seccompProfile:
            type: RuntimeDefault
        resources:
          requests:
            memory: 20Mi
            cpu: 50m
          limits:
            memory: 500Mi
            cpu: 500m
        volumeMounts:
        - name: config
          mountPath: /etc/ack-ram-authenticator
        - mountPath: /var/ack-ram-authenticator/
          name: state
        - mountPath: /etc/kubernetes/ack-ram-authenticator/
          name: output
      initContainers:
      - name: init-ack-ram-authenticator
        image: registry-cn-hangzhou.ack.aliyuncs.com/acs/ram-authenticator-init:v0.2.1.5-g9f72c3a5-aliyun
        command:
        - sh
        - -c
        # replace <your-cluster-id> to cctual cluster id
        - "ack-ram-authenticator init --cluster-id=<your-cluster-id> &&mkdir -p /var/ack-ram-authenticator /etc/kubernetes/ack-ram-authenticator &&mv cert.pem key.pem /var/ack-ram-authenticator &&mv ack-ram-authenticator.kubeconfig /etc/kubernetes/ack-ram-authenticator/kubeconfig.yaml &&chown -R 65534:65534 /var/ack-ram-authenticator /etc/kubernetes/ack-ram-authenticator"
        volumeMounts:
        - mountPath: /var/ack-ram-authenticator/
          name: state
        - mountPath: /etc/kubernetes/ack-ram-authenticator/
          name: output
      volumes:
      - name: config
        configMap:
          name: ack-ram-authenticator
      - hostPath:
          path: /etc/kubernetes/ack-ram-authenticator/
        name: output
      - hostPath:
          path: /var/ack-ram-authenticator/
        name: state