Deckhouse Kubernetes Platform on Huawei Cloud

Deckhouse Kubernetes Platform components interact with Huawei Cloud resources through the Huawei Cloud API. To configure this connection, you need to create a user in the Huawei Cloud IAM service and provide it with the necessary permissions.

Configuring IAM via the web interface

To configure IAM via the web interface, first create a new user group and assign the necessary permissions. Follow these steps:

1. Go to the “Identity and Access Management (IAM)” section.
2. Open the “User Groups” page and click “Create User Group”.
3. In the “Name” field, enter the group name (e.g., deckhouse).
4. Click “OK” to create the group.
5. Select the newly created group from the list.
6. On the “Permissions” tab, click “Authorize”.
7. Assign the following policies: “ECS Admin”, “VPC Administrator”, “NAT Admin”, “ELB FullAccess”, “DEW KeypairFullAccess”.
8. Click “Next”, then “OK”, and complete the setup by clicking “Finish”.

Then add a new user. Follow these steps:

1. Go to the “Users” page in the IAM section and click “Create User”.
2. In the “Username” field, enter the username (e.g., deckhouse).
3. Set “Access type” to “Programmatic access” and make sure “Management console access” is disabled.
4. Select “Access key” as the “Credential Type”.
5. Click “Next”.
6. Select the previously created user group.
7. Click “Create” to complete the user creation process.
8. Click “OK” to download the Access Key ID and Secret Access Key. Make sure to save these credentials in a secure location, as they will be needed to access the API.

Obtain the ID of the project where the cluster will be deployed. To do this, follow these steps:

1. Go to the “Identity and Access Management (IAM)” section.
2. In the left-hand menu, select “Projects”.
3. From the project list, select the project that corresponds to the region where the cluster will be deployed.
4. On the project page, in the “Basic Information” section, copy the value of the Project ID field.
5. Use the obtained value as the projectID parameter when configuring the cluster.

To obtain the Enterprise Project ID, follow these steps:

1. In the upper-right corner of the Huawei Cloud console, open the profile menu.
2. Select “Enterprise Management”.
3. On the “Enterprise Project Management Service” page, select the Enterprise Project where the cluster resources should be placed.
4. On the selected Enterprise Project page, copy the value of the ID field.
5. Use the obtained value as the enterpriseProjectID parameter when configuring the cluster.

JSON policies

Below are the contents of the policies in JSON format:

  {
  "Version": "1.1",
  "Statement": [
  {
      "Action": [
      "ecs:*:*",
      "evs:*:get",
      "evs:*:list",
      "evs:volumes:create",
      "evs:volumes:delete",
      "evs:volumes:attach",
      "evs:volumes:detach",
      "evs:volumes:manage",
      "evs:volumes:update",
      "evs:volumes:use",
      "evs:volumes:uploadImage",
      "evs:snapshots:create",
      "vpc:*:get",
      "vpc:*:list",
      "vpc:networks:create",
      "vpc:networks:update",
      "vpc:subnets:update",
      "vpc:subnets:create",
      "vpc:ports:*",
      "vpc:routers:get",
      "vpc:routers:update",
      "vpc:securityGroups:*",
      "vpc:securityGroupRules:*",
      "vpc:floatingIps:*",
      "vpc:publicIps:*",
      "ims:images:create",
      "ims:images:delete",
      "ims:images:get",
      "ims:images:list",
      "ims:images:update",
      "ims:images:upload"
      ],
      "Effect": "Allow"
  }
  ]
  }

  {
      "Version": "1.1",
      "Statement": [
          {
              "Action": [
                  "vpc:vpcs:*",
                  "vpc:routers:*",
                  "vpc:networks:*",
                  "vpc:subnets:*",
                  "vpc:ports:*",
                  "vpc:privateIps:*",
                  "vpc:peerings:*",
                  "vpc:routes:*",
                  "vpc:lbaas:*",
                  "vpc:vpns:*",
                  "ecs:*:get",
                  "ecs:*:list",
                  "elb:*:get",
                  "elb:*:list"
              ],
              "Effect": "Allow"
          }
      ]
  }

  {
      "Version": "1.1",
      "Statement": [
          {
              "Action": [
                  "nat:*:*",
                  "vpc:*:*"
              ],
              "Effect": "Allow"
          }
      ]
  }

  {
      "Version": "1.1",
      "Statement": [
          {
              "Action": [
                  "kps:domainKeypairs:*",
                  "ecs:serverKeypairs:*"
              ],
              "Effect": "Allow"
          }
      ]
  }

  {
    "Version": "1.1",
    "Statement": [
        {
            "Action": [
                "elb:*:*",
                "vpc:*:get*",
                "vpc:*:list*",
                "ecs:*:get*",
                "ecs:*:list*"
            ],
            "Effect": "Allow"
        }
    ]
  }