本文属于机器翻译版本。若本译文内容与英语原文存在差异，则一律以英文原文为准。
# ROSA 经典运营商政策
本节提供有关 ROSA classic 所需的运营商策略的详细信息。在创建 ROSA 经典集群之前，必须先将这些策略附加到相关的操作员角色。每个集群都需要一组独有的操作员角色。
需要这些权限才能允许 OpenShift 操作员管理 ROSA 经典群集节点。您可以为策略名称分配自定义前缀以简化策略管理（例如`ManagedOpenShift-openshift-ingress-operator-cloud-credentials`）。
## [前缀]-openshift-ingress-operator-cloud-证书
您可以将 `[Prefix]-openshift-ingress-operator-cloud-credentials` 附加到 IAM 实体。此策略向 Ingress 操作员授予必要的权限，以配置和管理用于外部集群访问的负载均衡器和 DNS 配置。该政策还允许 Ingress 操作员读取和筛选 Route 53 资源标签值以发现托管区域。有关运算符的更多信息，请参阅 OpenShift GitHub 文档中的 [OpenShift Ingress Operator](https://github.com/openshift/cluster-ingress-operator)。
### 权限策略
本策略文档中定义的权限指定了允许或拒绝哪些操作。
```
{
"Version":"2012-10-17",
"Statement": [
{
"Action": [
"elasticloadbalancing:DescribeLoadBalancers",
"route53:ListHostedZones",
"route53:ListTagsForResources",
"route53:ChangeResourceRecordSets",
"tag:GetResources"
],
"Effect": "Allow",
"Resource": "*"
}
]
}
```
## [前缀]-openshift-cluster-csi-drivers-ebs-cloud-credentials
您可以将 `[Prefix]-openshift-cluster-csi-drivers-ebs-cloud-credentials` 附加到 IAM 实体。此策略向 Amazon EBS CSI 驱动程序操作员授予在 ROSA 经典集群上安装和维护 Amazon EBS CSI 驱动程序所需的权限。有关运算符的更多信息，请参阅 OpenShift GitHub 文档中的 [aws-ebs-csi-driver-operator](https://github.com/openshift/aws-ebs-csi-driver-operator#aws-ebs-csi-driver-operator)。
### 权限策略
本策略文档中定义的权限指定了允许或拒绝哪些操作。
```
{
"Version":"2012-10-17",
"Statement": [
{
"Action": [
"ec2:AttachVolume",
"ec2:CreateSnapshot",
"ec2:CreateTags",
"ec2:CreateVolume",
"ec2:DeleteSnapshot",
"ec2:DeleteTags",
"ec2:DeleteVolume",
"ec2:DescribeAvailabilityZones",
"ec2:DescribeInstances",
"ec2:DescribeSnapshots",
"ec2:DescribeTags",
"ec2:DescribeVolumes",
"ec2:DescribeVolumesModifications",
"ec2:DetachVolume",
"ec2:EnableFastSnapshotRestores",
"ec2:ModifyVolume"
],
"Effect": "Allow",
"Resource": "*"
}
]
}
```
## [前缀]-openshift-machine-api-aws-云凭证
您可以将 `[Prefix]-openshift-machine-api-aws-cloud-credentials` 附加到 IAM 实体。此策略向 Machine Config 操作员授予描述、运行和终止作为工作节点管理的 Amazon EC2 实例所需的权限。此策略还授予允许使用对工作节点根卷进行磁盘加密的权限 AWS KMS keys。有关运算符的更多信息，请参阅 OpenShift GitHub 文档[machine-config-operator](https://github.com/openshift/machine-config-operator)中的。
### 权限策略
本策略文档中定义的权限指定了允许或拒绝哪些操作。
```
{
"Version":"2012-10-17",
"Statement": [
{
"Action": [
"ec2:CreateTags",
"ec2:DescribeAvailabilityZones",
"ec2:DescribeDhcpOptions",
"ec2:DescribeImages",
"ec2:DescribeInstances",
"ec2:DescribeInternetGateways",
"ec2:DescribeInstanceTypes",
"ec2:DescribeSecurityGroups",
"ec2:DescribeRegions",
"ec2:DescribeSubnets",
"ec2:DescribeVpcs",
"ec2:RunInstances",
"ec2:TerminateInstances",
"elasticloadbalancing:DescribeLoadBalancers",
"elasticloadbalancing:DescribeTargetGroups",
"elasticloadbalancing:DescribeTargetHealth",
"elasticloadbalancing:RegisterInstancesWithLoadBalancer",
"elasticloadbalancing:RegisterTargets",
"elasticloadbalancing:DeregisterTargets",
"iam:CreateServiceLinkedRole"
],
"Effect": "Allow",
"Resource": "*"
},
{
"Action": [
"kms:Decrypt",
"kms:Encrypt",
"kms:GenerateDataKey",
"kms:GenerateDataKeyWithoutPlainText",
"kms:DescribeKey"
],
"Effect": "Allow",
"Resource": "*"
},
{
"Action": [
"kms:RevokeGrant",
"kms:CreateGrant",
"kms:ListGrants"
],
"Effect": "Allow",
"Resource": "*",
"Condition": {
"Bool": {
"kms:GrantIsForAWSResource": true
}
}
}
]
}
```
## [前缀]-openshift-cloud-credential-operator-云凭证
您可以将 `[Prefix]-openshift-cloud-credential-operator-cloud-credentials` 附加到 IAM 实体。此政策向云凭证操作员授予检索 IAM 用户 详细信息的必要权限，包括访问密钥 IDs、附加的内联策略文档、用户的创建日期、路径、用户 ID 和 Amazon 资源名称 (ARN)。有关运算符的更多信息，请参阅 OpenShift GitHub 文档[cloud-credential-operator](https://github.com/openshift/cloud-credential-operator)中的。
### 权限策略
本策略文档中定义的权限指定了允许或拒绝哪些操作。
```
{
"Version":"2012-10-17",
"Statement": [
{
"Action": [
"iam:GetUser",
"iam:GetUserPolicy",
"iam:ListAccessKeys"
],
"Effect": "Allow",
"Resource": "*"
}
]
}
```
## [前缀]-openshift-image-registry-installer-云凭证
您可以将 `[Prefix]-openshift-image-registry-installer-cloud-credentials` 附加到 IAM 实体。该策略向映像注册表操作员授予所需的权限，以配置和管理ROSA classic的集群内映像注册表和相关服务的资源，包括 Amazon S3。这是必需的，这样操作员才能安装和维护 ROSA classic 集群的内部注册表。有关该运算符的更多信息，请参阅 OpenShift GitHub 文档中的[图像注册表运算符](https://github.com/openshift/cluster-image-registry-operator#image-registry-operator)。
### 权限策略
本策略文档中定义的权限指定了允许或拒绝哪些操作。
```
{
"Version":"2012-10-17",
"Statement": [
{
"Action": [
"s3:CreateBucket",
"s3:DeleteBucket",
"s3:PutBucketTagging",
"s3:GetBucketTagging",
"s3:PutBucketPublicAccessBlock",
"s3:GetBucketPublicAccessBlock",
"s3:PutEncryptionConfiguration",
"s3:GetEncryptionConfiguration",
"s3:PutLifecycleConfiguration",
"s3:GetLifecycleConfiguration",
"s3:GetBucketLocation",
"s3:ListBucket",
"s3:GetObject",
"s3:PutObject",
"s3:DeleteObject",
"s3:ListBucketMultipartUploads",
"s3:AbortMultipartUpload",
"s3:ListMultipartUploadParts"
],
"Effect": "Allow",
"Resource": "*"
}
]
}
```
## [前缀]-openshift-cloud-network-config-controller-cloud-cr
您可以将 `[Prefix]-openshift-cloud-network-config-controller-cloud-cr` 附加到 IAM 实体。此策略向 Cloud Network Config Config Config Controller 操作员授予配置和管理网络资源以供 ROSA 经典集群网络覆盖层使用的必要权限。操作员使用这些权限来管理作为 ROSA 经典集群一部分的 Amazon EC2 实例的私有 IP 地址。有关运算符的更多信息，请参阅 OpenShift GitHub 文档loud-network-config-controller中的 [C](https://github.com/openshift/cloud-network-config-controller#cloud-network-config-controller-cncc)。
### 权限策略
本策略文档中定义的权限指定了允许或拒绝哪些操作。
```
{
"Version":"2012-10-17",
"Statement": [
{
"Action": [
"ec2:DescribeInstances",
"ec2:DescribeInstanceStatus",
"ec2:DescribeInstanceTypes",
"ec2:UnassignPrivateIpAddresses",
"ec2:AssignPrivateIpAddresses",
"ec2:UnassignIpv6Addresses",
"ec2:AssignIpv6Addresses",
"ec2:DescribeSubnets",
"ec2:DescribeNetworkInterfaces"
],
"Effect": "Allow",
"Resource": "*"
}
]
}
```