RRSA (RamRoleforServiceAccount) support for Alibaba Cloud

[NIZ-elsevier]

What would you like to be added: RRSA (RamRoleforServiceAccount) authentication support for Alibaba Cloud

Why is this needed:

Similar to IRSA in AWS, applications in a Pod’s containers can make requests to Alicloud APIs with dedicated roles to the service account. This will allow the external dns pod to use the service account to get the credentials from the RAM role, not using the worker node instance role anymore, which is a much more secured approach.

As now Alicloud has provided wider support of RRSA, I would like to request the same feature for external-dns, following other components such as ack-secret-manager.

The similar issue was raised here. The vendor is instructing me to raise it again.

[ivankatliarchuk]

Hi Niz, this project is primarily community-maintained. Implementing this feature might require in-depth knowledge of Alibaba Cloud, which could be challenging for us. Would you be willing to submit a pull request?

[NIZ-elsevier]

Hi @ivankatliarchuk, thank you for your quick reply. I am contacting with the vendor Alibaba Cloud about this, see if they can help us to provide the feature, as they know the best of RRSA.

We are the end user of the product. If we have the capacity, we will definitely consider contributing to the project ourselves.

[ivankatliarchuk]

/help

[k8s-ci-robot]

@ivankatliarchuk:
This request has been marked as needing help from a contributor.

Guidelines

Please ensure that the issue body includes answers to the following questions:

• Why are we solving this issue?
• To address this issue, are there any code changes? If there are code changes, what needs to be done in the code and what places can the assignee treat as reference points?
• Does this issue have zero to low barrier of entry?
• How can the assignee reach out to you for help?

For more details on the requirements of such an issue, please see here and ensure that they are met.

If this request no longer meets these requirements, the label can be removed
by commenting with the /remove-help command.

In response to this:

/help

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.