CCE Agency Changes
Background
To improve the security of CCE agencies and provide more refined permission control, Huawei Cloud CCE has adjusted and upgraded the dependent agencies as follows:
- Agency permission isolation and least privilege: Agency permissions are split by scenario to reduce the risk of leakage of a single credential. In addition, the principle of least privilege is strictly followed to control the access scope of each component.
- Custom agencies: Clusters and add-ons can use custom agencies to meet users' requirements for permission control.
Impact
Old Agencies Will Be Gradually Disabled
| Change | Description |
|---|---|
| New users (after April 2026) | cce_admin_trust and cce_cluster_agency can no longer be created. |
| Existing users (before April 2026) | When the cluster or add-on version meets the requirements, the system automatically switches to the new agencies and no longer uses the old agencies. For details, see Detailed Description of Agency Adjustment. |
Cluster/Add-on Operations May Be Affected
When you create or upgrade a cluster or add-on for the first time or upgrade it to the corresponding version, the system automatically creates new agencies (if they already exist, no new agencies will be created again). If your cluster version is v1.35.1-r0 or later, make sure your account has the IAM operation permissions below. If your account does not have the permissions, the agency creation will fail, affecting cluster or add-on creation and upgrade.
- iam:agencies:createAgency: creates an agency.
- iam:permissions:revokeRoleFromAgencyOnProject: removes permissions of an agency for a region-specific project.
- iam:permissions:grantRoleToAgencyOnProject: grants permissions to an agency for a region-specific project.
- iam:permissions:grantRoleToAgency: grants permissions to an agency.
- iam:roles:createRole: creates a custom policy.
- iam:roles:updateRole: modifies a custom policy.
- iam:roles:listRoles: lists permissions.
- iam:agencies:listAgencies: queries agencies based on specified conditions.
For details about the new agencies, see Adjustment 1: Agency Permission Isolation and Least Privilege.
For details about how to add IAM operation permissions for an account, see User Operations.
Adjustment 1: Agency Permission Isolation and Least Privilege
To prevent credential leakage caused by excessive permissions of a single agency, CCE splits agency permissions by scenario and redesigns the authorization mechanism in strict compliance with the principle of least privilege.
Agencies before adjustment
| Scenario | Old Agency | Applicable Version |
|---|---|---|
| cce_admin_trust | Supported in all versions For details, see System Agencies. |
| cce_cluster_agency | This agency is only used in clusters v1.21 or later. If cce_cluster_agency does not exist in the account, use cce_admin_trust. For details, see System Agencies. |
| Authorizing HSS to query CCE clusters in the current region | hss_policy_trust | v1.19.16-r0, v1.21.2-r0, and later For details, see System Agencies. |
Agencies after the adjustment
CCE has added the following agencies to replace the old agencies: cce_admin_trust and cce_cluster_agency. New users are not allowed to create old agencies. For existing users, the system will automatically switch to the new agencies when the version meets the requirements.
| Scenario | New Agency | Applicable Version |
|---|---|---|
| Providing temporary access credentials for CCE, including the minimum permissions required by CCE to manage clusters and node lifecycles | CCEServiceAgency | All versions For details, see System Agencies. |
| Providing temporary access credentials for components on the CCE cluster control plane | CCEAutoClusterAgency (cluster agency) | The cluster version is v1.28.15-r90, v1.29.15-r50, v1.30.14-r50, v1.31.14-r10, v1.32.9-r10, v1.33.7-r10, v1.34.3-r0, or later. For details, see System Agencies. |
| CCENodeAgency | The cluster version is v1.28.15-r80, v1.29.15-r40, v1.30.14-r40, v1.31.14-r0, v1.32.9-r0, v1.33.7-r0, v1.34.2-r0, or later. For details, see System Agencies. |
| Providing temporary access credentials for CCE cluster add-ons, with each add-on using a different agency NOTE: Add-on agencies are created on demand. They are created only when the corresponding add-on is installed. | Currently, the following add-on agencies are supported:
| For details about the add-on versions that support new agencies, see Custom Agencies for Add-ons. |
Change 2: Custom Agencies for Clusters and Add-ons
By default, CCE clusters and add-ons use the default agencies created by CCE. If you need custom permissions, you can configure custom agencies.
For details about custom agencies, see Custom Agencies for Clusters and Custom Agencies for Add-ons.
User Operations
If the cluster version is v1.35.1-r0 or later, ensure that your account has the IAM agency operation permissions. If your account does not have the permissions, the agency creation will fail, affecting the creation and upgrades of clusters and add-ons.
If your account is in any of the following scenarios, you already have the IAM agency operation permissions and do not need to perform additional authorization:
- Administrator account
- Users in the default IAM user group admin
- Users granted the Security Administrator permissions
Granting IAM Agency Operation Permissions to an Account
- Log in to the IAM console and create the custom permission policy below. For details, see Creating a Custom Policy.
{ "Version": "1.1", "Statement": [ { "Effect": "Allow", "Action": [ "iam:agencies:createAgency", "iam:permissions:revokeRoleFromAgencyOnProject", "iam:permissions:grantRoleToAgencyOnProject", "iam:permissions:grantRoleToAgency", "iam:roles:createRole", "iam:roles:updateRole", "iam:roles:listRoles", "iam:agencies:listAgencies" ] } ] } - Grant the permissions in the created custom permission policy to IAM users or user groups. For details, see Managing Permissions Assigned to IAM Users and Managing Permissions of a User Group.
