Updated on 2026-09-08 GMT+08:00

Creating a Pod Identity Association

Function

This API is used to create a pod identity association to associate a service account of the container cluster with an IAM agency.

Calling Method

For details, see Calling APIs.

Authorization Information

Each account has all the permissions required to call all APIs, but IAM users must be assigned the required permissions.

  • If you are using role/policy-based authorization, see Permissions Policies and Supported Actions for details on the required permissions.
  • If you are using identity policy-based authorization, the following identity policy-based permissions are required.

    Action

    Access Level

    Resource Type (*: required)

    Condition Key

    Alias

    Dependencies

    cce:podIdentityAssociation:create

    Write

    podidentityassociation *

    -

    -

    -

    -

    • g:EnterpriseProjectId

    • g:TagKeys

    • g:RequestTag/<tag-key>

    • cce:ClusterId

URI

POST /api/v3/projects/{project_id}/clusters/{cluster_id}/pod-identity-associations

Table 1 Path Parameters

Parameter

Mandatory

Type

Description

project_id

Yes

String

Details:

Project ID. For details about how to obtain the value, see How to Obtain Parameters in the API URI.

Constraints:

None

Options:

Project IDs of the account

Default value:

N/A

cluster_id

Yes

String

Details:

Cluster ID. For details about how to obtain the value, see How to Obtain Parameters in the API URI.

Constraints:

None

Options:

Cluster IDs

Default value:

N/A

Request Parameters

Table 2 Request header parameters

Parameter

Mandatory

Type

Description

Content-Type

Yes

String

Definition:

Type (or format) of the request body. The default value is application/json. Other values of this field will be provided for specific APIs, if any.

Constraints:

GET requests are not validated.

Range:

N/A

Default Value:

N/A

X-Auth-Token

Yes

String

Details:

Requests for calling an API can be authenticated using either a token or AK/SK. If token-based authentication is used, this parameter is mandatory and must be set to a user token. For details, see Obtaining a User Token.

Constraints:

None

Options:

N/A

Default value:

N/A

Table 3 Request body parameters

Parameter

Mandatory

Type

Description

namespace

Yes

String

Definition

Namespace of the service account associated with a pod identity association

Constraints

The value cannot be changed.

Range

N/A

Default Value

N/A

serviceAccount

Yes

String

Definition

Name of the service account associated with a pod identity association

Constraints

Only one pod identity association can be created for a service account.

Range

N/A

Default Value

N/A

agencyName

Yes

String

Definition

Name of the agency to be associated with a pod identity association. The agency can be a general agency or a trust agency.

Constraints

N/A

Range

N/A

Default Value

N/A

tags

No

Array of ResourceTag objects

Definition

Resource tag list of a pod identity association

Constraints

N/A

Table 4 ResourceTag

Parameter

Mandatory

Type

Description

key

No

String

Details:

Key

Constraints:

None

Options:

  • The value cannot be empty and cannot start or end with spaces. A maximum of 128 characters is supported.

  • The value can contain letters, digits, and spaces in UTF-8 format.

  • The value can contain the following special characters: _.:=+-@

  • The value cannot start with _sys_.

Default value:

N/A

value

No

String

Details:

Value

Constraints:

None

Options:

  • The value can be null but not the default. Max characters: 255

  • Letters, digits, and spaces in UTF-8 format are supported.

  • The value can contain the following special characters: _.:/=+-@

Default value:

N/A

Response Parameters

Status code: 201

Table 5 Response body parameters

Parameter

Type

Description

uid

String

Definition

UID of a pod identity association

Range

N/A

clusterId

String

Definition

ID of the cluster that the pod identity association belongs to

Range

N/A

namespace

String

Definition

Namespace of the service account associated with a pod identity association

Range

N/A

serviceAccount

String

Definition

Name of the service account associated with a pod identity association

Range

N/A

agencyName

String

Definition

Name of the agency associated with a pod identity association

Range

N/A

tags

Array of ResourceTag objects

Definition

Resource tag list of a pod identity association

createdAt

String

Definition

Time when a pod identity association was created

Range

N/A

modifiedAt

String

Definition

Time when a pod identity association was last updated

Range

N/A

Table 6 ResourceTag

Parameter

Type

Description

key

String

Details:

Key

Options:

  • The value cannot be empty and cannot start or end with spaces. A maximum of 128 characters is supported.

  • The value can contain letters, digits, and spaces in UTF-8 format.

  • The value can contain the following special characters: _.:=+-@

  • The value cannot start with _sys_.

Default value:

N/A

value

String

Details:

Value

Options:

  • The value can be null but not the default. Max characters: 255

  • Letters, digits, and spaces in UTF-8 format are supported.

  • The value can contain the following special characters: _.:/=+-@

Default value:

N/A

Example Requests

Create a pod identity association.

POST /api/v3/projects/{project_id}/clusters/{cluster_id}/pod-identity-associations

{
  "namespace" : "example-namespace",
  "serviceAccount" : "example-serviceaccount",
  "agencyName" : "example-agency",
  "tags" : [ {
    "key" : "example-tag-key",
    "value" : "example-tag-val"
  } ]
}

Example Responses

Status code: 201

A pod identity association has been created in the specified cluster.

{
  "uid" : "402358e8-2e3a-4531-bae7-fe9cbxxxxxx1",
  "clusterId" : "402358e8-2e3a-4531-bae7-fe9cbxxxxxx1",
  "namespace" : "example-namespace",
  "serviceAccount" : "example-serviceaccount",
  "agencyName" : "example-agency",
  "tags" : [ {
    "key" : "example-tag-key",
    "value" : "example-tag-val"
  } ],
  "createdAt" : "",
  "modifiedAt" : ""
}

SDK Sample Code

The SDK sample code is as follows.

Create a pod identity association.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
package com.huaweicloud.sdk.test;

import com.huaweicloud.sdk.core.auth.ICredential;
import com.huaweicloud.sdk.core.auth.BasicCredentials;
import com.huaweicloud.sdk.core.exception.ConnectionException;
import com.huaweicloud.sdk.core.exception.RequestTimeoutException;
import com.huaweicloud.sdk.core.exception.ServiceResponseException;
import com.huaweicloud.sdk.cce.v3.region.CceRegion;
import com.huaweicloud.sdk.cce.v3.*;
import com.huaweicloud.sdk.cce.v3.model.*;

import java.util.List;
import java.util.ArrayList;

public class CreatePodIdentityAssociationSolution {

    public static void main(String[] args) {
        // The AK and SK used for authentication are hard-coded or stored in plaintext, which has great security risks. It is recommended that the AK and SK be stored in ciphertext in configuration files or environment variables and decrypted during use to ensure security.
        // In this example, AK and SK are stored in environment variables for authentication. Before running this example, set environment variables CLOUD_SDK_AK and CLOUD_SDK_SK in the local environment
        String ak = System.getenv("CLOUD_SDK_AK");
        String sk = System.getenv("CLOUD_SDK_SK");
        String projectId = "{project_id}";

        ICredential auth = new BasicCredentials()
                .withProjectId(projectId)
                .withAk(ak)
                .withSk(sk);

        CceClient client = CceClient.newBuilder()
                .withCredential(auth)
                .withRegion(CceRegion.valueOf("<YOUR REGION>"))
                .build();
        CreatePodIdentityAssociationRequest request = new CreatePodIdentityAssociationRequest();
        request.withClusterId("{cluster_id}");
        PodIdentityAssociation body = new PodIdentityAssociation();
        List<ResourceTag> listbodyTags = new ArrayList<>();
        listbodyTags.add(
            new ResourceTag()
                .withKey("example-tag-key")
                .withValue("example-tag-val")
        );
        body.withTags(listbodyTags);
        body.withAgencyName("example-agency");
        body.withServiceAccount("example-serviceaccount");
        body.withNamespace("example-namespace");
        request.withBody(body);
        try {
            CreatePodIdentityAssociationResponse response = client.createPodIdentityAssociation(request);
            System.out.println(response.toString());
        } catch (ConnectionException e) {
            e.printStackTrace();
        } catch (RequestTimeoutException e) {
            e.printStackTrace();
        } catch (ServiceResponseException e) {
            e.printStackTrace();
            System.out.println(e.getHttpStatusCode());
            System.out.println(e.getRequestId());
            System.out.println(e.getErrorCode());
            System.out.println(e.getErrorMsg());
        }
    }
}

Create a pod identity association.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
# coding: utf-8

import os
from huaweicloudsdkcore.auth.credentials import BasicCredentials
from huaweicloudsdkcce.v3.region.cce_region import CceRegion
from huaweicloudsdkcore.exceptions import exceptions
from huaweicloudsdkcce.v3 import *

if __name__ == "__main__":
    # The AK and SK used for authentication are hard-coded or stored in plaintext, which has great security risks. It is recommended that the AK and SK be stored in ciphertext in configuration files or environment variables and decrypted during use to ensure security.
    # In this example, AK and SK are stored in environment variables for authentication. Before running this example, set environment variables CLOUD_SDK_AK and CLOUD_SDK_SK in the local environment
    ak = os.environ["CLOUD_SDK_AK"]
    sk = os.environ["CLOUD_SDK_SK"]
    projectId = "{project_id}"

    credentials = BasicCredentials(ak, sk, projectId)

    client = CceClient.new_builder() \
        .with_credentials(credentials) \
        .with_region(CceRegion.value_of("<YOUR REGION>")) \
        .build()

    try:
        request = CreatePodIdentityAssociationRequest()
        request.cluster_id = "{cluster_id}"
        listTagsbody = [
            ResourceTag(
                key="example-tag-key",
                value="example-tag-val"
            )
        ]
        request.body = PodIdentityAssociation(
            tags=listTagsbody,
            agency_name="example-agency",
            service_account="example-serviceaccount",
            namespace="example-namespace"
        )
        response = client.create_pod_identity_association(request)
        print(response)
    except exceptions.ClientRequestException as e:
        print(e.status_code)
        print(e.request_id)
        print(e.error_code)
        print(e.error_msg)

Create a pod identity association.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
package main

import (
	"fmt"
	"github.com/huaweicloud/huaweicloud-sdk-go-v3/core/auth/basic"
    cce "github.com/huaweicloud/huaweicloud-sdk-go-v3/services/cce/v3"
	"github.com/huaweicloud/huaweicloud-sdk-go-v3/services/cce/v3/model"
    region "github.com/huaweicloud/huaweicloud-sdk-go-v3/services/cce/v3/region"
)

func main() {
    // The AK and SK used for authentication are hard-coded or stored in plaintext, which has great security risks. It is recommended that the AK and SK be stored in ciphertext in configuration files or environment variables and decrypted during use to ensure security.
    // In this example, AK and SK are stored in environment variables for authentication. Before running this example, set environment variables CLOUD_SDK_AK and CLOUD_SDK_SK in the local environment
    ak := os.Getenv("CLOUD_SDK_AK")
    sk := os.Getenv("CLOUD_SDK_SK")
    projectId := "{project_id}"

    auth, err := basic.NewCredentialsBuilder().
        WithAk(ak).
        WithSk(sk).
        WithProjectId(projectId).
        SafeBuild()

    if err != nil {
        fmt.Println(err)
        return
    }

    hcClient, err := cce.CceClientBuilder().
         WithRegion(region.ValueOf("<YOUR REGION>")).
         WithCredential(auth).
         SafeBuild()


    if err != nil {
        fmt.Println(err)
        return
    }

    client := cce.NewCceClient(hcClient)

    request := &model.CreatePodIdentityAssociationRequest{}
	request.ClusterId = "{cluster_id}"
	keyTags:= "example-tag-key"
	valueTags:= "example-tag-val"
	var listTagsbody = []model.ResourceTag{
        {
            Key: &keyTags,
            Value: &valueTags,
        },
    }
	request.Body = &model.PodIdentityAssociation{
		Tags: &listTagsbody,
		AgencyName: "example-agency",
		ServiceAccount: "example-serviceaccount",
		Namespace: "example-namespace",
	}
	response, err := client.CreatePodIdentityAssociation(request)
	if err == nil {
        fmt.Printf("%+v\n", response)
    } else {
        fmt.Println(err)
    }
}

For SDK sample code of more programming languages, see the Sample Code tab in API Explorer. SDK sample code can be automatically generated.

Status Codes

Status Code

Description

201

A pod identity association has been created in the specified cluster.

Error Codes

See Error Codes.