# 角色与策略授权参考（旧版IAM） 本章节介绍CCE角色与策略授权场景下支持的策略授权项。 #### 支持的授权项 策略包含系统策略和自定义策略，如果系统策略不满足授权要求，管理员可以创建自定义策略，并通过给用户组授予自定义策略来进行精细的访问控制。策略支持的操作与API相对应，授权项列表说明如下： - 权限：允许或拒绝某项操作。 - 对应API接口：自定义策略实际调用的API接口。 - 授权项：自定义策略中支持的Action，在自定义策略中的Action中写入授权项，可以实现授权项对应的权限功能。 - 依赖的授权项：部分Action存在对其他Action的依赖，需要将依赖的Action同时写入授权项，才能实现对应的权限功能。 - IAM项目(Project)/企业项目(Enterprise Project)：自定义策略的授权范围，包括IAM项目与企业项目。授权范围如果同时支持IAM项目和企业项目，表示此授权项对应的自定义策略，可以在IAM和企业管理两个服务中给用户组授权并生效。如果仅支持IAM项目，不支持企业项目，表示仅能在IAM中给用户组授权并生效，如果在企业管理中授权，则该自定义策略不生效。关于IAM项目与企业项目的区别，详情请参见：[IAM与企业管理的区别](https://support.huaweicloud.com/iam_faq/iam_01_0101.html)。 ![](https://support.huaweicloud.com/api-cce/public_sys-resources/note_3.0-zh-cn.png) "√"表示支持，"x"表示暂不支持。 云容器引擎（CCE）支持的自定义策略授权项如下所示： 表1Cluster | 权限 | 对应API接口 | 授权项（Action） | IAM项目(Project) | 企业项目 (Enterprise Project) | |:---|:---|:---|:---|:---| | 获取指定项目下的集群 | GET /api/v3/projects/{project_id}/clusters | cce:cluster:list | √ | √ | | 获取指定的集群 | GET /api/v3/projects/{project_id}/clusters/{cluster_id} | cce:cluster:get | √ | √ | | 创建集群 | POST /api/v3/projects/{project_id}/clusters | cce:cluster:create | √ | √ | | 更新指定的集群 | PUT /api/v3/projects/{project_id}/clusters/{cluster_id} | cce:cluster:update | √ | √ | | 删除集群 | DELETE /api/v3/projects/{project_id}/clusters/{cluster_id} | cce:cluster:delete | √ | √ | | 升级集群 | POST /api/v3/projects/{project_id}/clusters/{cluster_id}/operation/upgrade | cce:cluster:upgrade | √ | √ | | 唤醒集群 | POST /api/v3/projects/{project_id}/clusters/{cluster_id}/operation/awake | cce:cluster:start | √ | √ | | 休眠集群 | POST /api/v3/projects/{project_id}/clusters/{cluster_id}/operation/hibernate | cce:cluster:stop | √ | √ | | 变更集群规格 | POST /api/v3/projects/{project_id}/clusters/{cluster_id}/operation/resize | cce:cluster:resize | √ | √ | | 获取集群证书 | POST /api/v3/projects/{project_id}/clusters/{cluster_id}/clustercert | cce:cluster:get | √ | √ | | 获取LongAKSK配置 | GET /api/v3/projects/{project_id}/longaksk/config | cce:longaksk:getConfig | √ | √ | | 更新LongAKSK配置 | PUT /api/v3/projects/{project_id}/longaksk/config | cce:longaksk:updateConfig | √ | √ | | 更新集群LongAKSK配置 | PUT /api/v3/projects/{project_id}/clusters/{cluster_id}/longaksk/config | cce:cluster:updateLongAKSKConfig | √ | √ | | 获取集群LongAKSK配置 | GET /api/v3/projects/{project_id}/clusters/{cluster_id}/longaksk/config | cce:cluster:getLongAKSKConfig | √ | √ | | 吊销集群证书 | POST /api/v3/projects/{project_id}/clusters/{cluster_id}/clustercertrevoke | cce:cluster:revokeClientCredential | √ | √ | | 更新分区 | PUT /api/v3/projects/{project_id}/clusters/{cluster_id}/partitions/{partition_name} | cce:partition:update | √ | √ | | 创建分区 | POST /api/v3/projects/{project_id}/clusters/{cluster_id}/partitions | cce:partition:create | √ | √ | | 获取分区信息 | GET /api/v3/projects/{project_id}/clusters/{cluster_id}/partitions/{partition_name} | cce:partition:get | √ | √ | | 列出所有分区 | GET /api/v3/projects/{project_id}/clusters/{cluster_id}/partitions | cce:partition:list | √ | √ | 表2Node | 权限 | 对应API接口 | 授权项 | IAM项目(Project) | 企业项目 (Enterprise Project) | |:---|:---|:---|:---|:---| | 获取集群下所有节点 | GET /api/v3/projects/{project_id}/clusters/{cluster_id}/nodes | cce:node:list | √ | √ | | 获取指定的节点 | GET /api/v3/projects/{project_id}/clusters/{cluster_id}/nodes/{node_id} | cce:node:get | √ | √ | | 创建节点 | POST /api/v3/projects/{project_id}/clusters/{cluster_id}/nodes | cce:node:create | √ | √ 说明： 使用企业项目授权创建节点需额外添加evs:quotas:get、evs:types:get的全局权限。 | | 更新指定的节点 | PUT /api/v3/projects/{project_id}/clusters/{cluster_id}/nodes/{node_id} | cce:node:update | √ | √ | | 删除节点 | DELETE /api/v3/projects/{project_id}/clusters/{cluster_id}/nodes/{node_id} | cce:node:delete | √ | √ | | 移除节点 | PUT /api/v3/projects/{project_id}/clusters/{cluster_id}/nodes/operation/remove | cce:node:remove | √ | √ | | 迁移节点 | PUT /api/v3/projects/{project_id}/clusters/{cluster_id}/nodes/operation/migrateto/{target_cluster_id} | cce:node:migrate | √ | √ | 表3Job | 权限 | 对应API接口 | 授权项 | IAM项目(Project) | 企业项目 (Enterprise Project) | |:---|:---|:---|:---|:---| | 获取任务信息 | GET /api/v3/projects/{project_id}/jobs/{job_id} | cce:job:get | √ | √ | | 列出所有任务 | GET /api/v2/projects/{project_id}/jobs | cce:job:list | √ | √ | | 删除所有任务或删除单个任务 | DELETE /api/v2/projects/{project_id}/jobs DELETE /api/v2/projects/{project_id}/jobs/{job_id} | cce:job:delete | √ | √ | 表4Nodepool | 权限 | 对应API接口 | 授权项 | IAM项目(Project) | 企业项目 (Enterprise Project) | |:---|:---|:---|:---|:---| | 获取集群下所有节点池 | GET /api/v3/projects/{project_id}/clusters/{cluster_id}/nodepools | cce:nodepool:list | √ | √ | | 获取节点池 | GET /api/v3/projects/{project_id}/clusters/{cluster_id}/nodepools/{nodepool_id} | cce:nodepool:get | √ | √ | | 创建节点池 | POST /api/v3/projects/{project_id}/clusters/{cluster_id}/nodepools | cce:nodepool:create | √ | √ | | 更新节点池信息 | PUT /api/v3/projects/{project_id}/clusters/{cluster_id}/nodepools/{nodepool_id} | cce:nodepool:update | √ | √ | | 删除节点池 | DELETE /api/v3/projects/{project_id}/clusters/{cluster_id}/nodepools/{nodepool_id} | cce:nodepool:delete | √ | √ | | 伸缩节点池 | POST /api/v3/projects/{project_id}/clusters/{cluster_id}/nodepools/{nodepool_id}/operation/scale | cce:nodepool:scale | √ | √ | 表5Chart | 权限 | 对应API接口 | 授权项 | IAM项目(Project) | 企业项目 (Enterprise Project) | |:---|:---|:---|:---|:---| | 更新模板 | PUT /v2/charts/{id} | cce:chart:update | √ | × | | 上传模板 | POST /v2/charts | cce:chart:upload | √ | × | | 列出所有模板 | GET /v2/charts | cce:chart:list | √ | × | | 获取模板信息 | GET /v2/charts/{id} | cce:chart:get | √ | × | | 删除模板 | DELETE /v2/charts/{id} | cce:chart:delete | √ | × | 表6Release | 权限 | 对应API接口 | 授权项 | IAM项目(Project) | 企业项目 (Enterprise Project) | |:---|:---|:---|:---|:---| | 更新升级模板实例 | PUT /cce/cam/v3/clusters/{cluster_id}/namespace/{namespace}/releases/{name} | cce:release:update | √ | √ | | 列出所有模板实例 | GET /cce/cam/v3/clusters/{cluster_id}/releases | cce:release:list | √ | √ | | 创建模板实例 | POST /cce/cam/v3/clusters/{cluster_id}/releases | cce:release:create | √ | √ | | 获取模板实例信息 | GET /cce/cam/v3/clusters/{cluster_id}/namespace/{namespace}/releases/{name} | cce:release:get | √ | √ | | 删除模板实例 | DELETE /cce/cam/v3/clusters/{cluster_id}/namespace/{namespace}/releases/{name} | cce:release:delete | √ | √ | 表7Storage | 权限 | 对应API接口 | 授权项 | IAM项目(Project) | 企业项目 (Enterprise Project) | |:---|:---|:---|:---|:---| | 创建PersistentVolumeClaim | POST /api/v1/namespaces/{namespace}/cloudpersistentvolumeclaims | cce:storage:create | √ | √ | | 删除PersistentVolumeClaim | DELETE /api/v1/namespaces/{namespace}/cloudpersistentvolumeclaims/{name} | cce:storage:delete | √ | √ | | 列出所有磁盘 | GET /storage/api/v1/namespaces/{namespace}/listvolumes | cce:storage:list | √ | √ | 表8Addon | 权限 | 对应API接口 | 授权项 | IAM项目(Project) | 企业项目 (Enterprise Project) | |:---|:---|:---|:---|:---| | 创建插件实例 | POST /api/v3/addons | cce:addonInstance:create | √ | √ | | 获取插件实例 | GET /api/v3/addons/{id}?cluster_id={cluster_id} | cce:addonInstance:get | √ | √ | | 列出所有插件实例 | GET /api/v3/addons?cluster_id={cluster_id} | cce:addonInstance:list | √ | √ | | 删除插件实例 | DELETE /api/v3/addons/{id}?cluster_id={cluster_id} | cce:addonInstance:delete | √ | √ | | 更新升级插件实例 | PUT /api/v3/addons/{id} | cce:addonInstance:update | √ | √ | | 回滚插件实例 | POST /api/v3/addons/{id}/operation/rollback | cce:addonInstance:rollback | √ | √ | | 列出所有插件模板 | GET /api/v3/addontemplates | cce:addonTemplate:list | √ | × | 表9Quota | 权限 | 对应API接口 | 授权项 | IAM项目(Project) | 企业项目 (Enterprise Project) | |:---|:---|:---|:---|:---| | 查询配额详情 | GET /api/v3/projects/{project_id}/quotas | cce:quota:get | √ | √ | 表10资源标签 | 权限 | 对应API接口 | 授权项 | IAM项目(Project) | 企业项目 (Enterprise Project) | |:---|:---|:---|:---|:---| | 添加指定集群的资源标签 | POST /api/v3/projects/{project_id}/clusters/{cluster_id}/tags/create | cce:tag:operate | √ | √ | | 删除指定集群的资源标签 | POST /api/v3/projects/{project_id}/clusters/{cluster_id}/tags/delete | cce:tag:operate | √ | √ | 表11访问策略 | 权限 | 对应API接口 | 授权项 | IAM项目(Project) | 企业项目 (Enterprise Project) | |:---|:---|:---|:---|:---| | 创建访问策略 | POST /api/v3/access-policies | cce:accessPolicy:post | √ | × | | 获取访问策略列表 | GET /api/v3/access-policies | cce:accessPolicy:list | √ | × | | 获取访问策略 | GET /api/v3/access-policies/{policy_id} | cce:accessPolicy:get | √ | × | | 删除访问策略 | DELETE /api/v3/access-policies/{policy_id} | cce:accessPolicy:delete | √ | × | | 更新访问策略 | PUT /api/v3/access-policies/{policy_id} | cce:accessPolicy:put | √ | × |