CCE clusters rely on various cloud services in areas like compute, storage, networking, and monitoring to function properly. To access these cloud resources, CCE clusters need authorization, which is handled through agencies. By default, CCE uses system agencies to generate temporary access credentials. These credentials are used internally by the clusters to access cloud services. You can also configure a custom agency for your cluster. Once set, the cluster will use this custom agency to generate its temporary access credentials.

Custom agencies are supported only in clusters of v1.27 or later.
Custom agencies are supported only in CCE standard clusters.
Custom agencies do not support IAM 5.0 trust agencies.

Prerequisites

You need to create a custom agency of the cloud service type on the Agencies page of the IAM console and authorize it to CCE.
You need to authorize the created custom agency. CCE has preset the permissions required for cluster running as system policies. Some of them are mandatory, and the rest can be granted on demand based on what cluster functions you will use. For details, see System Policies.

Ensure that you have granted the required permissions to the created agency, or some functions of the cluster may be unavailable.

Configuring a Custom Agency During Cluster Creation

A custom agency can be configured during cluster creation only using APIs.

Call the API for and configure a custom agency.

The request body is as follows:

{
	"kind": "Cluster",
	"apiVersion": "v3",
	"metadata": {
		"name": "cce-cluster",
	},
	"spec": {
		"agencyName": "custom_agency_name",
		"category": "CCE",
		. . .
	}
}

custom_agency_name is the name of the custom agency created on IAM.

Configuring a Custom Agency for a Running Cluster

Custom agencies can be configured for running clusters only using APIs.