访问管理 容器服务

一、服务（相关）角色是由腾讯云服务预定义，经用户授权后相应服务即可通过扮演服务相关角色对用户资源进行访问操作。这篇档介绍具体服务相关角色的使用场景及相关权限策略信息。

二、TKE_QCSLinkedRoleInAWV

·策略名称： QcloudAccessForTKELinkedRoleInCOS

·策略内容：{
"version": "2.0",
"statement": [
{
"effect": "allow",
"action": [
"cos:HeadObject",
"cos:GetObject",
"cos:PutObject",
"cos:DeleteObject",
"cos:InitiateMultipartUpload",
"cos:UploadPart",
"cos:CompleteMultipartUpload",
"cos:GetBucket",
"cos:GetBucketLifecycle",
"cos:PutBucketLifecycle",
"cos:GetBucketInventory",
"cos:PutBucketInventory"
],
"resource": "*"
}
]
}

三、TKE_QCSLinkedRoleInEIS

使用场景： 当前角色为容器服务（TKE）服务相关角色，用于授权TKE访问腾讯云弹性推理服务平台对云资源的访问权限权限策略

·策略名称： QcloudAccessForTKEInEISRole

·策略内容：{
"version": "2.0",
"statement": [
{
"effect": "allow",
"action": [
"cvm:ModifyInstancesProject",
"cvm:DescribeInstances",
"tke:InstallAddon",
"tke:DescribeAddon",
"tke:DescribeAddonValues",
"tke:UpdateAddon",
"tke:DeleteAddon",
"tke:AddVpcCniSubnets",
"tke:CheckClusterCIDR",
"tke:DescribeClusterKubeconfig",
"tke:AcquireClusterKubeConfigForProduct",
"tke:ModifyClusterTags",
"tke:ModifyClusterAttribute",
"tke:DisableClusterDeletionProtection",
"tke:DescribeClusterInstances",
"tke:DeleteCluster",
"tke:DescribeClusterStatus",
"tke:DescribeClusters",
"tke:DescribeExistedInstances",
"tke:CreateCluster",
"tke:DeleteClusterInstances",
"tke:AddExistedInstances",
"cls:CreateLogset",
"cls:DescribeLogsets",
"cls:CreateTopic",
"cls:DescribeTopics",
"monitor:DescribePrometheusInstances",
"monitor:CreatePrometheusMultiTenantInstancePostPayMode",
"monitor:CreatePrometheusClusterAgent",
"monitor:DescribePrometheusClusterAgents",
"monitor:DeletePrometheusClusterAgent",
"monitor:TerminatePrometheusInstances",
"monitor:CreateExporterIntegration",
"monitor:DescribeExporterIntegrations",
"monitor:CreateExternalCluster",
"monitor:DescribeExternalClusterRegisterCommand",
"vpc:DescribeSubnets",
"tke:CreateClusterRelease",
"tke:DescribeClusterReleases",
"tke:DescribeClusterPendingReleases",
"tke:UninstallClusterRelease",
"tke:DescribeLogSwitches",
"cvm:DescribeImages",
"cvm:RebootInstances",
"cvm:DescribeMarketImages",
"cvm:ModifyInstancesAttribute",
"cvm:RunInstances",
"cvm:ResetInstance",
"cvm:DescribeZones",
"cvm:DescribeInstanceTypeConfigs",
"cvm:DescribeZoneInstanceConfigInfos"
],
"resource": "*"
}
]
}

四、TKE_QCSLinkedRoleInTDCC

使用场景： 当前角色为容器服务（TKE）服务相关角色，该角色将在已关联策略的权限范围内访问你的其他云服务资源。权限策略

·策略名称： QcloudAccessForTKELinkedRoleInTDCC

·策略内容：{
"version": "2.0",
"statement": [
{
"effect": "allow",
"action": [
"cls:listTopic",
"cls:getTopic",
"cls:createTopic",
"cls:modifyTopic",
"cls:listMachineGroup",
"cls:getMachineGroup",
"cls:createMachineGroup",
"cls:modifyMachineGroup",
"cls:deleteMachineGroup",
"cls:getMachineStatus",
"cls:pushLog",
"cls:agentHeartBeat",
"cls:getConfig",
"cls:getIndex",
"cls:modifyIndex",
"cls:ApplyConfigToMachineGroup",
"cls:CreateConfig",
"cls:CreateIndex",
"cls:CreateLogset",
"cls:CreateMachineGroup",
"cls:CreateTopic",
"cls:DeleteConfig",
"cls:DeleteConfigFromMachineGroup",
"cls:DeleteLogset",
"cls:DeleteMachineGroup",
"cls:DeleteTopic",
"cls:DescribeConfigMachineGroups",
"cls:DescribeConfigs",
"cls:DescribeLogsets",
"cls:DescribeMachineGroupConfigs",
"cls:DescribeMachineGroups",
"cls:DescribeTopics",
"cls:ModifyConfig",
"cls:ModifyIndex",
"cls:ModifyMachineGroup",
"cls:ModifyTopic"
],
"resource": [
"*"
]
}
]
}

五、TKE_QCSLinkedRoleInEKSLog

使用场景： 当前角色为容器服务（TKE）服务角色，该角色将在已关联策略的权限范围内访问你的其他云服务资源。权限策略

·策略名称： QcloudAccessForTKELinkedRoleInEKSLog

·策略内容：{
"version": "2.0",
"statement": [
{
"effect": "allow",
"action": [
"cls:pushLog",
"cls:agentHeartBeat",
"cls:getConfig"
],
"resource": [
"*"
]
}
]
}

六、TKE_QCSLinkedRoleInEtcdService

使用场景： 当前角色为容器服务（TKE）服务角色，该角色将在已关联策略的权限范围内访问你的其他云服务资源。权限策略

·策略名称： QcloudAccessForTKELinkedRoleInEtcdService

·策略内容：{
"version": "2.0",
"statement": [
{
"effect": "allow",
"resource": [
"*"
],
"action": [
"cos:DeleteBucket",
"cos:GetBucket",
"cos:PutBucket",
"cos:HeadBucket",
"cos:GetObject",
"cos:HeadObject",
"cos:PutObject",
"cos:DeleteObject",
"cos:DeleteMultipleObjects",
"cos:ListMultipartUploads",
"cos:AbortMultipartUpload"
]
}
]
}

七、TKE_QCSLinkedRoleInEKSCostMaster

使用场景： 当前角色为容器服务（TKE）服务相关角色，该角色将在已关联策略的权限范围内访问你的其他云服务资源。权限策略

·策略名称： QcloudAccessForTKELinkedRoleInEKSCostMaster

·策略内容：{
"version": "2.0",
"statement": [
{
"action": [
"monitor:DescribeMidDimensionValueList",
"monitor:DescribeStatisticData",
"monitor:GetMonitorData"
],
"resource": "*",
"effect": "allow"
}
]
}

八、TKE_QCSLinkedRoleInPrometheusService

使用场景： 当前角色为容器服务（TKE）服务角色，该角色将在已关联策略的权限范围内访问你的其他云服务资源。权限策略

·策略名称： QcloudAccessForTKELinkedRoleInPrometheusService

·策略内容：{
"statement": [
{
"action": [
"cos:DeleteBucket",
"cos:GetBucket",
"cos:PutBucket",
"cos:HeadBucket",
"cos:GetObject",
"cos:HeadObject",
"cos:PutObject",
"cos:DeleteObject",
"cos:DeleteMultipleObjects",
"cos:ListMultipartUploads",
"cos:AbortMultipartUpload",
"cos:AbortMultipartUpload",
"cos:ListMultipartUploads",
"monitor:DescribePrometheusInstances",
"monitor:DescribeRecordingRules",
"monitor:DescribeAlertRules",
"monitor:DescribeAlarmNotice",
"monitor:DescribeAlarmNotices",
"monitor:DescribeAlarmNoticeCallbacks",
"monitor:DescribeAlarmHistories",
"monitor:CreatePrometheusMultiTenantInstance",
"monitor:TerminatePrometheusInstances",
"monitor:ModifyPrometheusInstanceAttributes",
"monitor:CreateRecordingRule",
"monitor:DeleteRecordingRules",
"monitor:UpdateRecordingRule",
"monitor:CreateAlertRule",
"monitor:DeleteAlertRules",
"monitor:UpdateAlertRule",
"monitor:UpdateAlertRuleState",
"monitor:CreateAlarmNotice",
"monitor:DeleteAlarmNotices",
"monitor:ModifyAlarmNotice",
"monitor:ModifyAlarmPolicyNotice",
"monitor:CreateManagedEKSAgent",
"monitor:DescribeManagedEKSAgent",
"monitor:CreateAlertRuleReceiverNotRequired",
"monitor:UpdateAlertRuleReceiverNotRequired",
"monitor:DescribeExporterIntegrations",
"monitor:CreateExporterIntegration",
"monitor:UpdateExporterIntegration",
"monitor:DeleteExporterIntegration",
"monitor:CreateGrafanaInstance",
"monitor:CreatePrometheusMultiTenantInstancePostPayMode",
"monitor:BindPrometheusManagedGrafana",
"monitor:DescribeGrafanaInstances",
"tdcc:DescribeExternalClusters",
"tdcc:DescribeExternalClusterCredential",
"monitor:UpgradeGrafanaDashboard",
"monitor:UninstallGrafanaDashboard",
"monitor:DescribePrometheusAlertGroups",
"monitor:CreatePrometheusAlertGroup",
"monitor:UpdatePrometheusAlertGroup",
"monitor:DeletePrometheusAlertGroups",
"monitor:UpdatePrometheusAlertGroupState",
"tke:DescribeTKEEdgeExternalKubeconfig",
"tke:DescribeTKEEdgeClusterCredential",
"tke:DescribeTKEEdgeClusters",
"tke:DescribeClusters",
"tke:DescribeClusterSecurity",
"cam:GetRole"
],
"effect": "allow",
"resource": [
"*"
]
}
],
"version": "2.0"
}