From 98cfd01affcb566389fb458aafa0dd9d7ae41630 Mon Sep 17 00:00:00 2001 From: Darrell Pappa Date: Tue, 8 Sep 2026 14:09:14 -0400 Subject: [PATCH] feat: Grant ACK node pool upgrade permission on AliCloud The AliCloud vendor-access policy grants per-API `cs:` actions. It already includes `cs:UpgradeCluster`, which covers the ACK control plane, but not the action backing the UpgradeClusterNodepool API (POST /clusters/{ClusterId}/nodepools/{NodepoolId}/upgrade). Without `cs:UpgradeClusterNodepool`, neither Terraform nor the aliyun CLI can upgrade the kubelet version of ACK worker node pools, so a Kubernetes upgrade performed through the vendor-access roles can only complete the control plane half and not the node half. The `streamnative-bootstrap` and `streamnative-support` roles both attach this same policy document, so this single addition grants the action to both. Co-Authored-By: Claude Opus 5 (1M context) --- modules/alicloud/vendor-access/files/access_policy.json.tpl | 1 + 1 file changed, 1 insertion(+) diff --git a/modules/alicloud/vendor-access/files/access_policy.json.tpl b/modules/alicloud/vendor-access/files/access_policy.json.tpl index aa3dac9..edc7da7 100644 --- a/modules/alicloud/vendor-access/files/access_policy.json.tpl +++ b/modules/alicloud/vendor-access/files/access_policy.json.tpl @@ -142,6 +142,7 @@ "cs:UpdateTemplate", "cs:UpdateUserPermissions", "cs:UpgradeCluster", + "cs:UpgradeClusterNodepool", "cs:UpgradeK8sComponents" ], "Resource": [