feat: Grant ACK node pool upgrade permission on AliCloud

[dpappa]

Problem

The AliCloud vendor-access policy grants Container Service (ACK) permissions as an explicit per-API cs: action list rather than a wildcard. That list already includes cs:UpgradeCluster, which covers upgrading the ACK control plane, but it does not include the action backing the UpgradeClusterNodepool API (POST /clusters/{ClusterId}/nodepools/{NodepoolId}/upgrade).

The result is that AliCloud ACK node pool upgrades require this action; without it Kubernetes node upgrades cannot be performed by the vendor-access roles. Neither Terraform (alicloud_cs_kubernetes_node_pool) nor the aliyun CLI can raise the kubelet version of worker node pools, so a Kubernetes upgrade can only complete the control plane half and the nodes stay on the old version.

Change

Adds a single action to the cs: statement in modules/alicloud/vendor-access/files/access_policy.json.tpl:

         "cs:UpgradeCluster",
+        "cs:UpgradeClusterNodepool",
         "cs:UpgradeK8sComponents"

Placed alphabetically between cs:UpgradeCluster and cs:UpgradeK8sComponents, matching the existing ordering in that block. No other actions added, no reformatting, no other cloud vendors touched.

Both streamnative-bootstrap and streamnative-support consume this same policy document via local.access_policy_document in modules/alicloud/vendor-access/main.tf, so this one addition grants the action to both roles.

Action name

Confirmed against Alibaba Cloud's ACK API reference for UpgradeClusterNodepool, which documents cs:UpgradeClusterNodepool as the value to use in the Action policy element:

https://www.alibabacloud.com/help/en/ack/ack-managed-and-ack-dedicated/developer-reference/api-cs-2015-12-15-upgradeclusternodepool

Note the capitalization: Alibaba spells this API Nodepool (lowercase p), consistent with the existing cs:DeleteClusterNodepool in this file, and unlike cs:ModifyClusterNodePool / cs:ScaleClusterNodePool which Alibaba spells NodePool. The spelling here follows what each API's own documentation specifies.

Effect

This module is applied by the account owner in their own AliCloud account, so the change takes effect only after the module is re-applied there. Updating the policy creates a new RAM policy version and repoints the default, so a terraform apply is required — the existing roles do not pick it up automatically.

Consumers pinned to a release tag (?ref=vX.Y.Z) also need to bump the ref to a release containing this commit; consumers following the AliCloud README example (?ref=main) pick it up on their next apply.

Testing

• Verified the rendered policy document is still valid JSON.
• Change is additive to an "Effect": "Allow" statement on "Resource": ["*"], so it grants one additional ACK API and removes nothing.

🤖 Generated with Claude Code

[dpappa]

Closing: an ACK cluster upgrade upgrades worker kubelets in place along with the control plane, so this action isn't needed to complete a Kubernetes version upgrade — worth revisiting if node pools lag the control plane, get scaled out at an older version, or need image rotations.