本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。
ROSA 经典运营商政策
本节提供有关 ROSA classic 所需的运营商策略的详细信息。在创建 ROSA 经典集群之前，必须先将这些策略附加到相关的操作员角色。每个集群都需要一组独有的操作员角色。
需要这些权限才能允许 OpenShift 操作员管理 ROSA 经典群集节点。您可以为策略名称分配自定义前缀以简化策略管理（例如ManagedOpenShift-openshift-ingress-operator-cloud-credentials）。
[前缀]-openshift-ingress-operator-cloud-证书
您可以将 [Prefix]-openshift-ingress-operator-cloud-credentials 附加到 IAM 实体。此策略向 Ingress 操作员授予必要的权限，以配置和管理用于外部集群访问的负载均衡器和 DNS 配置。该政策还允许 Ingress 操作员读取和筛选 Route 53 资源标签值以发现托管区域。有关运算符的更多信息，请参阅 OpenShift GitHub 文档中的 OpenShift Ingress Operator
本策略文档中定义的权限指定了允许或拒绝哪些操作。
{ "Version":"2012-10-17", "Statement": [ { "Action": [ "elasticloadbalancing:DescribeLoadBalancers", "route53:ListHostedZones", "route53:ListTagsForResources", "route53:ChangeResourceRecordSets", "tag:GetResources" ], "Effect": "Allow", "Resource": "*" } ] }
[前缀]-openshift-cluster-csi-drivers-ebs-cloud-credentials
您可以将 [Prefix]-openshift-cluster-csi-drivers-ebs-cloud-credentials 附加到 IAM 实体。此策略向 Amazon EBS CSI 驱动程序操作员授予在 ROSA 经典集群上安装和维护 Amazon EBS CSI 驱动程序所需的权限。有关运算符的更多信息，请参阅 OpenShift GitHub 文档中的 aws-ebs-csi-driver-operator
本策略文档中定义的权限指定了允许或拒绝哪些操作。
{ "Version":"2012-10-17", "Statement": [ { "Action": [ "ec2:AttachVolume", "ec2:CreateSnapshot", "ec2:CreateTags", "ec2:CreateVolume", "ec2:DeleteSnapshot", "ec2:DeleteTags", "ec2:DeleteVolume", "ec2:DescribeAvailabilityZones", "ec2:DescribeInstances", "ec2:DescribeSnapshots", "ec2:DescribeTags", "ec2:DescribeVolumes", "ec2:DescribeVolumesModifications", "ec2:DetachVolume", "ec2:EnableFastSnapshotRestores", "ec2:ModifyVolume" ], "Effect": "Allow", "Resource": "*" } ] }
[前缀]-openshift-machine-api-aws-云凭证
您可以将 [Prefix]-openshift-machine-api-aws-cloud-credentials 附加到 IAM 实体。此策略向 Machine Config 操作员授予描述、运行和终止作为工作节点管理的 Amazon EC2 实例所需的权限。此策略还授予允许使用对工作节点根卷进行磁盘加密的权限 AWS KMS keys。有关运算符的更多信息，请参阅 OpenShift GitHub 文档machine-config-operator
本策略文档中定义的权限指定了允许或拒绝哪些操作。
{ "Version":"2012-10-17", "Statement": [ { "Action": [ "ec2:CreateTags", "ec2:DescribeAvailabilityZones", "ec2:DescribeDhcpOptions", "ec2:DescribeImages", "ec2:DescribeInstances", "ec2:DescribeInternetGateways", "ec2:DescribeInstanceTypes", "ec2:DescribeSecurityGroups", "ec2:DescribeRegions", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "ec2:RunInstances", "ec2:TerminateInstances", "elasticloadbalancing:DescribeLoadBalancers", "elasticloadbalancing:DescribeTargetGroups", "elasticloadbalancing:DescribeTargetHealth", "elasticloadbalancing:RegisterInstancesWithLoadBalancer", "elasticloadbalancing:RegisterTargets", "elasticloadbalancing:DeregisterTargets", "iam:CreateServiceLinkedRole" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "kms:Decrypt", "kms:Encrypt", "kms:GenerateDataKey", "kms:GenerateDataKeyWithoutPlainText", "kms:DescribeKey" ], "Effect": "Allow", "Resource": "*" }, { "Action": [ "kms:RevokeGrant", "kms:CreateGrant", "kms:ListGrants" ], "Effect": "Allow", "Resource": "*", "Condition": { "Bool": { "kms:GrantIsForAWSResource": true } } } ] }
[前缀]-openshift-cloud-credential-operator-云凭证
您可以将 [Prefix]-openshift-cloud-credential-operator-cloud-credentials 附加到 IAM 实体。此政策向云凭证操作员授予检索 IAM 用户 详细信息的必要权限，包括访问密钥 IDs、附加的内联策略文档、用户的创建日期、路径、用户 ID 和 Amazon 资源名称 (ARN)。有关运算符的更多信息，请参阅 OpenShift GitHub 文档cloud-credential-operator
本策略文档中定义的权限指定了允许或拒绝哪些操作。
{ "Version":"2012-10-17", "Statement": [ { "Action": [ "iam:GetUser", "iam:GetUserPolicy", "iam:ListAccessKeys" ], "Effect": "Allow", "Resource": "*" } ] }
[前缀]-openshift-image-registry-installer-云凭证
您可以将 [Prefix]-openshift-image-registry-installer-cloud-credentials 附加到 IAM 实体。该策略向映像注册表操作员授予所需的权限，以配置和管理ROSA classic的集群内映像注册表和相关服务的资源，包括 Amazon S3。这是必需的，这样操作员才能安装和维护 ROSA classic 集群的内部注册表。有关该运算符的更多信息，请参阅 OpenShift GitHub 文档中的图像注册表运算符
本策略文档中定义的权限指定了允许或拒绝哪些操作。
{ "Version":"2012-10-17", "Statement": [ { "Action": [ "s3:CreateBucket", "s3:DeleteBucket", "s3:PutBucketTagging", "s3:GetBucketTagging", "s3:PutBucketPublicAccessBlock", "s3:GetBucketPublicAccessBlock", "s3:PutEncryptionConfiguration", "s3:GetEncryptionConfiguration", "s3:PutLifecycleConfiguration", "s3:GetLifecycleConfiguration", "s3:GetBucketLocation", "s3:ListBucket", "s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:ListBucketMultipartUploads", "s3:AbortMultipartUpload", "s3:ListMultipartUploadParts" ], "Effect": "Allow", "Resource": "*" } ] }
[前缀]-openshift-cloud-network-config-controller-cloud-cr
您可以将 [Prefix]-openshift-cloud-network-config-controller-cloud-cr 附加到 IAM 实体。此策略向 Cloud Network Config Config Config Controller 操作员授予配置和管理网络资源以供 ROSA 经典集群网络覆盖层使用的必要权限。操作员使用这些权限来管理作为 ROSA 经典集群一部分的 Amazon EC2 实例的私有 IP 地址。有关运算符的更多信息，请参阅 OpenShift GitHub 文档loud-network-config-controller中的 C
本策略文档中定义的权限指定了允许或拒绝哪些操作。
{ "Version":"2012-10-17", "Statement": [ { "Action": [ "ec2:DescribeInstances", "ec2:DescribeInstanceStatus", "ec2:DescribeInstanceTypes", "ec2:UnassignPrivateIpAddresses", "ec2:AssignPrivateIpAddresses", "ec2:UnassignIpv6Addresses", "ec2:AssignIpv6Addresses", "ec2:DescribeSubnets", "ec2:DescribeNetworkInterfaces" ], "Effect": "Allow", "Resource": "*" } ] }
