Using Pod Identities to Obtain IAM Credentials in a CCE Cluster

Pod Identity Overview

Pod identities provide a standard way for pods to obtain temporary IAM credentials. By associating a Huawei Cloud IAM agency with a Kubernetes service account, pods can use the service account token to directly obtain temporary IAM credentials.

Advantages

• Simple configuration: You only need to bind an agency to a service account. There is no need to configure any OIDC identity provider.
• Least privilege: Each agency is associated with a specific service account and granted only the permissions required by the pods that use that service account. This ensures precise permissions control.
• Permissions isolation: A pod can obtain only the credentials of the agency associated with the service account it uses. It cannot access the credentials of agencies associated with other service accounts. This ensures complete permissions isolation between pods that use different service accounts.

Application Scenario

Pods need to access Huawei Cloud services such as ELB, EVS, and VPC.

Notes and Constraints

• Only clusters of v1.28.15-r80, v1.29.15-r40, v1.30.14-r40, v1.31.14-r0, v1.32.9-r0, v1.33.7-r0, v1.34.2-r0, and later versions are supported.
• There are rate limiting restrictions for obtaining IAM credentials through pod identities. It is advised to cache the credentials based on their validity period (handled by the Huawei Cloud SDK) and avoid using any pod identity for DaemonSets.

Configuring and Using a Pod Identity for a Pod

1. Create an IAM agency.

   Create a custom agency of the cloud service type on the Agencies page of the IAM console and authorize it for CCE. For details, see Creating an Agency and Assigning Permissions.

   

   Do not delete an agency in use. Otherwise, the function will be abnormal.

2. Create a Kubernetes service account.

   Create a service account in the default namespace for the required pod. A cluster v1.29 is used in this example.

   kubectl create serviceaccount my-service-account

   Check whether the my-service-account service account has been created. If my-service-account is displayed in the NAME column, it has been created.

   kubectl get sa

   For more information about service accounts, see Service Accounts.

3. Create a pod identity association to associate the created agency with the Kubernetes service account.
   1. Log in to the CCE console. In the navigation pane, choose Permissions and switch to the Pod Identity Association tab.
   2. Select the cluster for which you want to create a pod identity association from the drop-down list on the left.
   3. Click Create. In the window that slides out from the right, select the created agency and service account and click OK.

      

   

   • Only one pod identity association can be created for each service account.
   • Do not delete a pod identity association that is currently in use. Doing so will cause the function to stop working properly.
   • After a pod identity association is created or updated, it takes about 15 seconds for the change to take effect.

4. Create a service account for the pod.
   An example is as follows:

   apiVersion: v1
   kind: Pod
   metadata:
     name: my-app
   spec:
     serviceAccountName: my-service-account  # Specify a service account.
     containers:
     - name: my-app
       image: my-app:latest

5. Enable pod identity injection.

   Method 1: Enabling pod identity injection at the namespace level

   • Add the pod-identity.cce.io/injection: "on" label to a namespace. An example is as follows:

     kubectl label namespace default pod-identity.cce.io/injection=on

   Method 2: Enabling pod identity injection at the pod level

   • Add the pod-identity.cce.io/injection: "on" label to a pod. An example is as follows:

     apiVersion: v1
     kind: Pod
     metadata:
       name: my-app
       labels:
         pod-identity.cce.io/injection: "on"
     spec:
       serviceAccountName: my-service-account
       containers:
       - name: my-app
         image: my-app:latest

   After pod identity injection is enabled, the following environment variables are automatically injected to the pod:

   • HC_CONTAINER_AUTHORIZATION_TOKEN_FILE: path to the authorization token file
   • HC_CONTAINER_CREDENTIALS_FULL_URI: full URI that points to the credential provider endpoint

   In addition, the following volume is mounted to the pod:

   volumes:
     - name: cce-pod-identity-token
       projected:
         defaultMode: 420
         sources:
         - serviceAccountToken:
             audience: service.cce.pods
             expirationSeconds: 86400 # Timeout interval, in seconds
             path: cce-pod-identity-token

6. Obtain a temporary IAM credential using the pod identity.

   Method 1: Using the Huawei Cloud SDK

   Use the Huawei Cloud SDK to obtain an IAM credential through a pod identity, as shown below.

   

   Method 2: Using your own code

   Access the address specified by HC_CONTAINER_CREDENTIALS_FULL_URI in the pod. The following is an example command:

   curl -XPOST http://169.254.170.23:3230/v1/credentials -H "Authorization: service-account-token"

   http://169.254.170.23:3230/v1/credentials is the address specified by HC_CONTAINER_CREDENTIALS_FULL_URI. service-account-token is the service account token read from the file specified by HC_CONTAINER_AUTHORIZATION_TOKEN_FILE.

Disabling the Pod Identity for a Pod

To prevent specific containers in a pod from using pod identity–related environment variables, configure the pod-identity.cce.io/skip-containers annotation on the pod. Set the annotation value to the target container names, separated by commas (,) if specifying multiple containers. Example:

apiVersion: v1
kind: Pod
metadata:
  name: my-app
  labels:
    pod-identity.cce.io/injection: "on"
  annotations:
    pod-identity.cce.io/skip-containers: "sidecar,init-container"  # Specify containers that do not use pod identity–related environment variables.
spec:
  serviceAccountName: my-service-account
  containers:
  - name: my-app
    image: my-app:latest
  - name: sidecar
    image: sidecar:latest