Preparations

Creating an IAM user

If you want to allow multiple users to manage your resources without sharing your password or keys, you can create users using IAM and grant permissions to the users. These users can use specified links and their own accounts to access the cloud and manage resources efficiently. You can also configure account security policies to ensure the security of these accounts.

Your accounts have the permissions to use CCE. However, IAM users created by your accounts do not have the permissions. You need to manually assign the permissions to IAM users.

Obtaining Resource Permissions

After you agree to delegate the permissions, an agency named cce_admin_trust will be created for CCE in Identity and Access Management (IAM). The system account op_svc_cce will be delegated the Tenant Administrator role to perform operations on other cloud service resources. Tenant Administrator has the permissions on all cloud services except IAM, which calls the cloud services on which CCE depends. The delegation takes effect only in the current region.

To use CCE in multiple regions, you need to request cloud resource permissions in each region. You can go to the IAM console, choose Agencies, and click cce_admin_trust to view the delegation records of each region.

CCE may fail to run as expected if the Tenant Administrator role is not assigned. Therefore, do not delete or modify the cce_admin_trust agency when using CCE.

(Optional) Creating a VPC

A VPC provides an isolated, configurable, and manageable virtual network for CCE clusters.

Before creating the first cluster, ensure that a VPC has been created.

If you already have a VPC available, skip this step.

1. Log in to the management console.
2. Click in the upper left corner and select a region and a project.
3. Under Networking, click Virtual Private Cloud.
4. Click Create VPC.
5. On the Create VPC page, configure parameters as prompted.

   A default subnet will be created together with a VPC. You can click Add Subnet to create more subnets for the VPC.

6. Click Create Now.

(Optional) Creating a Key Pair

The cloud platform uses public key cryptography to protect the login information of your CCE nodes. Passwords or key pairs are used for identity authentication during remote login to nodes.

• You need to specify the key pair name and provide the private key when logging to CCE nodes using SSH if you choose the key pair login mode.
• If you choose the password login mode, skip this task.

If you want to create pods in multiple regions, you need to create a key pair in each region.

Creating a Key Pair on the Management Console

If you have no key pair, create one on the management console. The procedure is as follows:

1. Log in to the management console.
2. Click in the upper left corner and select a region and a project.
3. Under Computing, click Elastic Cloud Server.
4. In the navigation pane on the left, choose Key Pair.
5. On the right pane, click Create Key Pair.
6. Enter the key name and click OK.
7. A key pair name consists of two parts: KeyPair and four random digits. You can enter an easy-to-remember name, for example, KeyPair-xxxx_ecs.
8. Manually or automatically download the private key file. The file name is a specified key pair name with a suffix of .pem. Securely store the private key file. In the dialog box displayed, click OK.
   

   The private key file can be downloaded only once. Keep it secure. When creating an ECS, provide the name of your desired key pair. Each time you log in to the ECS using SSH, provide the private key.