# DevOps Server Docker Image

## Aliyun Profiles

Used by Jump Service to allow DevOps Server to access Aliyun ACK clusters.

When DevOps Server accesses other Aliyun ACK clusters, it uses the following authentication method:

```go
type ACKAuth struct {
	ClusterID   string // The ack cluster id
	ProfileName string // The profile name in alicloud config file
	ProfileFile string // The alicloud config file path, default is ~/.aliyun/config.json
}

// AddACKAuth adds a ack auth.
//
// It exec the `ack-ram-tool` command to auth, so you need install `ack-ram-tool`
// in host firstly.
//
// The ack-ram-tool use local profile to auth, you need config the alicloud profile
// in the host.
func (b *ConfigBuilder) AddACKAuth(authName string, ackAuth *ACKAuth) *ConfigBuilder {
	auth := &api.AuthInfo{
		Exec: &api.ExecConfig{
			APIVersion:      authV1Beta1APIVersion,
			InteractiveMode: api.NeverExecInteractiveMode,
			Command:         "ack-ram-tool",
			Args: []string{
				"credential-plugin",
				"get-token",
				"--cluster-id", ackAuth.ClusterID,
				"--api-version", "v1beta1",
				"--log-level", "error",
			},
		},
	}

    if ackAuth.ProfileName != "" {
		auth.Exec.Args = append(auth.Exec.Args, "--profile-name", ackAuth.ProfileName)
    }

	if ackAuth.ProfileFile != "" {
		auth.Exec.Args = append(auth.Exec.Args, "--profile-file", ackAuth.ProfileFile)
	}

	b.cfg.AuthInfos[authName] = auth
	return b
}

```

In other words, each access request obtains the token required for ACK cluster access by invoking the `ack-ram-tool` program.

At the same time, to enable cross-cloud or cross-account access to ACK clusters, it is necessary to assume the corresponding Aliyun role in the target account before accessing the target ACK cluster.

This assume behavior is defined in the CLI profile and selected through `--profile-name`.

### Partition Global: Cross-Cloud Access

In Partition Global, DevOps Server is deployed on AWS. Therefore, it uses the pod's OIDC token to assume an Aliyun role.

```json
{
    "profiles": [
        // ...
        {
            "name": "jump-service-role-for-5841052134823325",
            "mode": "OIDC",
            "ram_role_arn": "acs:ram::5841052134823325:role/jump-service-role",
            "ram_session_name": "jump-service-role-for-5841052134823325-dev",
            "expired_seconds": 3600,
            "region_id": "ap-southeast-1",
            "output_format": "json",
            "oidc_provider_arn": "acs:ram::5841052134823325:oidc-provider/devops-cluster-dev",
            "oidc_token_file": "/var/run/secrets/federated-tokens/token-alicloud"
        }
    ],
    "meta_path": ""
}
```


### Partition CN: Cross-Account Access

In Partition CN, DevOps Server is deployed on Aliyun. Therefore, the pod first uses an OIDC token to assume its own available DevOps Server role, and then performs a chained assume to another account's Aliyun role.

```json
{
    "profiles": [
        {
            "name": "default",
            "mode": "OIDC",
            "ram_role_arn": "acs:ram::1069570256310404:role/devops-server-dev",
            "oidc_provider_arn": "acs:ram::1069570256310404:oidc-provider/ack-rrsa-cdcca42d030814cbe9f4db5c84157f02c",
            "oidc_token_file": "/var/run/secrets/ack.alibabacloud.com/rrsa-tokens/token",
            "region_id": "cn-beijing",
            "output_format": "json"
        },
        {
            "name": "jump-service-role-for-1069570256310404",
            "mode": "RamRoleArn",
            "ram_role_arn": "acs:ram::1069570256310404:role/jump-service-role",
            "ram_session_name": "jump-service-role-for-1069570256310404-dev",
            "source_profile": "default", 
            "expired_seconds": 3600,
            "region_id": "cn-beijing",
            "output_format": "json"
        }
    ],
    "meta_path": ""
}
```