固定 AK/SK
    → 保存到 Secret 或外部配置系统
    → 注入 Pod
    → SDK 读取 AK/SK
    → 直接访问云 API

Pod 使用的 ServiceAccount
    → TKE 签发短时效 OIDC Token
    → STS 验证 Token 和角色信任关系
    → 返回 CAM 角色临时凭证
    → SDK 访问云 API

{
  "iss": "<TKE 集群的 OIDC Issuer URL>",
  "sub": "system:serviceaccount:prod:cos-reader",
  "aud": ["sts.cloud.tencent.com"],
  "iat": 1720000000,
  "exp": 1720003600
}

TKE OIDC Provider
  + aud = sts.cloud.tencent.com
  + sub = system:serviceaccount:prod:cos-reader
                         └──> CAM 角色 cos-reader-role
                                  └──> 只读指定 COS Bucket

{
  "version": "2.0",
  "statement": [{
    "effect": "allow",
    "principal": {
      "federated": ["qcs::cam::uin/xxx:oidcProvider/tke-<cluster-id>"]
    },
    "action": ["sts:AssumeRoleWithWebIdentity"],
    "condition": {
      "string_equal": {
        "oidc:aud": ["sts.cloud.tencent.com"],
        "oidc:sub": ["system:serviceaccount:prod:cos-reader"]
      }
    }
  }]
}

{
  "version": "2.0",
  "statement": [{
    "effect": "allow",
    "action": ["cos:GetObject", "cos:HeadObject", "cos:ListBucket"],
    "resource": ["qcs::cos:ap-guangzhou:uid/xxx:my-bucket-xxx/*"]
  }]
}

apiVersion: v1
kind: ServiceAccount
metadata:
  name: cos-reader
  namespace: prod
  annotations:
    tke.cloud.tencent.com/role-arn: qcs::cam::uin/xxx:roleName/cos-reader-role
    tke.cloud.tencent.com/audience: sts.cloud.tencent.com
    tke.cloud.tencent.com/token-expiration: "3600"

apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-app
  namespace: prod
spec:
  template:
    spec:
      serviceAccountName: cos-reader
      containers:
        - name: app
          image: my-app:latest

显式传入 SecretId/Key
    → 环境变量 TENCENTCLOUD_SECRET_ID/KEY
    → OIDC Web Identity Token（Pod OIDC 场景）
    → CVM 实例角色（节点角色）
    → 抛错

provider, err := common.DefaultTkeOIDCRoleArnProvider()
if err != nil { /* ... */ }

cred, err := provider.GetCredential()
if err != nil { /* ... */ }

client, _ := cos.NewClient(&cos.BaseURL{...}, &http.Client{
    Transport: &cos.AuthorizationTransport{
        SecretID:     cred.GetSecretId(),
        SecretKey:    cred.GetSecretKey(),
        SessionToken: cred.GetToken(),
    },
})

rules:
- apiGroups: [""]
  resources: ["serviceaccounts"]
  verbs: ["get", "watch", "list"]
- apiGroups: [""]
  resources: ["events"]
  verbs: ["patch", "update"]
- apiGroups: ["admissionregistration.k8s.io"]
  resources: ["mutatingwebhookconfigurations"]
  verbs: ["get"]

TKE ServiceAccount
    └──> TKE OIDC Token
            └──> AWS STS AssumeRoleWithWebIdentity
                    └──> AWS IAM Role 临时凭证
                            └──> S3 / DynamoDB / SQS / 其他 AWS 服务

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:ListBucket"],
      "Resource": ["arn:aws:s3:::example-bucket"]
    },
    {
      "Effect": "Allow",
      "Action": ["s3:GetObject"],
      "Resource": ["arn:aws:s3:::example-bucket/*"]
    }
  ]
}

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Federated": "arn:aws:iam::<AWS_ACCOUNT_ID>:oidc-provider/<ISSUER_HOST_AND_PATH>"
      },
      "Action": "sts:AssumeRoleWithWebIdentity",
      "Condition": {
        "StringEquals": {
          "<ISSUER_HOST_AND_PATH>:aud": "sts.amazonaws.com",
          "<ISSUER_HOST_AND_PATH>:sub": "system:serviceaccount:prod:s3-reader"
        }
      }
    }
  ]
}

apiVersion: v1
kind: ServiceAccount
metadata:
  name: s3-reader
  namespace: prod
  annotations:
    tke.cloud.tencent.com/role-arn: arn:aws:iam::<AWS_ACCOUNT_ID>:role/tke-s3-reader
    tke.cloud.tencent.com/audience: sts.amazonaws.com
    tke.cloud.tencent.com/token-expiration: "3600"

TKE_ROLE_ARN=arn:aws:iam::<AWS_ACCOUNT_ID>:role/tke-s3-reader
TKE_WEB_IDENTITY_TOKEN_FILE=/var/run/secrets/cloud.tencent.com/serviceaccount/token

package awsauth

import (
    "context"
    "fmt"
    "os"

    "github.com/aws/aws-sdk-go-v2/config"
    "github.com/aws/aws-sdk-go-v2/credentials/stscreds"
    "github.com/aws/aws-sdk-go-v2/service/s3"
    "github.com/aws/aws-sdk-go-v2/service/sts"
)

func NewS3Client(ctx context.Context, awsRegion string) (*s3.Client, error) {
    roleARN := os.Getenv("TKE_ROLE_ARN")
    tokenFile := os.Getenv("TKE_WEB_IDENTITY_TOKEN_FILE")
    if roleARN == "" || tokenFile == "" {
        return nil, fmt.Errorf("missing TKE_ROLE_ARN or TKE_WEB_IDENTITY_TOKEN_FILE")
    }

    baseCfg, err := config.LoadDefaultConfig(ctx, config.WithRegion(awsRegion))
    if err != nil {
        return nil, fmt.Errorf("load AWS base config: %w", err)
    }

    stsClient := sts.NewFromConfig(baseCfg)
    roleSessionName := os.Getenv("HOSTNAME")
    if roleSessionName == "" {
        roleSessionName = "tke-pod"
    }

    provider := stscreds.NewWebIdentityRoleProvider(
        stsClient,
        roleARN,
        stscreds.IdentityTokenFile(tokenFile),
        func(options *stscreds.WebIdentityRoleOptions) {
            options.RoleSessionName = roleSessionName
        },
    )

    cfg, err := config.LoadDefaultConfig(
        ctx,
        config.WithRegion(awsRegion),
        config.WithCredentialsProvider(provider),
    )
    if err != nil {
        return nil, fmt.Errorf("load AWS config with web identity: %w", err)
    }

    return s3.NewFromConfig(cfg), nil
}