Service Accounts :: Kloudfuse Docs

Service Accounts

A service account is a special kind of non-human account for applications, services, or virtual machines (VMs) to securely interact with other systems or APIs. Service accounts operate in the background, without user interaction.

For example, to programmatically download logs from Kloudfuse for analysis or archival, create a service account with specific permissions and use it to access the Kloudfuse API. Follow these steps:

Create a service account with a specific role: Viewer, Editor, or Admin.
Attach a policy to limit access.

For example, a policy {kube_namespace="prometheus"} grants log access to the Prometheus namespace, only.
Create an API token with an expiration date.
Use the token as a Bearer token in API calls to get and download logs.

Advantages

Automation: Service accounts are purpose-built for automation, to be used by software, not people.
Continuous Integration and Deployment: They are ideal for CI/CD pipelines, background jobs, or apps that access cloud services.
Authentication and Authorization: Service accounts have their own credentials (keys, tokens, or certificates).
Permissions: You can add specific permissions (roles or scopes) to limit access to only what the service account requires.
Security: Service accounts provide secure, auditable access to APIs without exposing user credentials.

Follow these steps to get to the Service Accounts interface:

Click the Admin tab, and then the Service Accounts option in the drop-down menu.
The Service Accounts interface appears.

Create a Service Account

To create a service account, follow these steps:

Click (Create new service account).
The Create new service account interface appears.
Specify the new service account:

Account name: Specify the name of the service account.
- Owner email: Specify the email that corresponds to the service account.
- Role: Specify the role for the service account: Viewer, Editor, or Admin.

Click (Create).
Kloudfuse confirms that you successfully created a service account.

Set Query Priorities

The Query priority section on the service-account detail page lets you override the cluster-wide priority and per-call timeout for the Machine class. Service accounts run programmatic traffic only, so the Interactive class is not exposed here. See Override Priorities for a User, Team, or Service Account for instructions, and Query Priorities Concepts for the resolution model.

Examples

Using Service Accounts to Download Logs

To create and use a service account for retrieving logs from Kloudfuse, follow these steps:

Create a Service Account

Navigate to Admin → Service Accounts.
Click "Create new service account".
Specify the parameters:
- Account name: log-downloader
- Owner email: automation@example.com
- Role: Viewer (sufficient for read-only access to logs)
Click Create.

Attach a Policy

After creating the service account, attach a policy to constrain the access of the service account to its intended purpose:

Click on the service account name.
Add a policy to restrict access, For example:
- {kube_namespace="prometheus"}
- {kube_namespace="dd-trace-example"}

Create an API Token

In the service account details, click "Create Token".
Set an expiration date. For example, 30 days, 90 days, or 1 year.
Copy the generated token, such as glsa_vutX2rJ080fLHNaZISAFqmJHCBNxn6l8_5b746423.
Save and store the token securely, because you cannot see it again.

Use the token in API Calls

Use the service account token to access Kloudfuse APIs.

Example: Use the logs download API with Service Account

export TOKEN="glsa_vutX2rJ080fLHNaZISAFqmJHCBNxn6l8_5b746423" (1)

curl 'https://pisco.kloudfuse.io/query' \  (2)
  -H 'accept: */*' \
  -H 'accept-language: en-US,en;q=0.9' \
  -H 'baggage: sentry-environment=pisco.kloudfuse.io,sentry-release=3777701,sentry-public_key=62bfbfd50ed8a3e598645f272699c9ac,sentry-trace_id=6eae349b8c0343169d195d61cd8ba8b1' \
  -H 'content-type: application/json' \
  -H "Authorization: Bearer $TOKEN" \
  -H 'origin: https://pisco.kloudfuse.io' \
  -H 'priority: u=1, i' \
  -H 'referer: https://pisco.kloudfuse.io/' \
  -H 'sec-ch-ua: "Google Chrome";v="137", "Chromium";v="137", "Not/A)Brand";v="24"' \
  -H 'sec-ch-ua-mobile: ?0' \
  -H 'sec-ch-ua-platform: "macOS"' \
  -H 'sec-fetch-dest: empty' \
  -H 'sec-fetch-mode: cors' \
  -H 'sec-fetch-site: same-origin' \
  -H 'sentry-trace: 6eae349b8c0343169d195d61cd8ba8b1-a5c8db161f4afd46' \
  -H 'user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36' \
  --data-raw '{"operationName":null,"query":"\n    query GetLogsV2 {\n      getLogsV2(\n        cursor: null,\n        query: {and: []},\n        limit: 2000,\n        timestamp: \"2025-07-22T12:01:40-07:00\",\n        durationSecs: 300\n        sortBy: \"ts\"\n        sortOrder: Asc\n      ) {\n        cursor\n        events {\n          timestamp\n          logLine\n          fpString\n          fpHash\n          level\n          labels\n          facets {\n            name\n            dataType\n            content\n          }\n        }\n      }\n    }\n  ","variables":{}}


1	`export TOKEN`: Set the service account token.
2	`curl…`: Download logs using the service account token.

The response contains logs filtered by the policy attached to the service account. In this example, Kloudfuse returns only logs from the prometheus namespace.

Trace Query Service

With the appropriate policy, such as {kube_namespace="dd-trace-example"}, the following example returns only services from the allowed namespace, instead of all 55 services.

Use service accounts with Trace query Kloudfuse APIs:

# Set your service account token (if not already set)
export TOKEN="glsa_vutX2rJ080fLHNaZISAFqmJHCBNxn6l8_5b746423"

# Query traces using the service account token
curl 'https://pisco.kloudfuse.io/api/v1/query?query=min(min_over_time(edge_latency_min%7Bkf_source%3D%22apm%22%2Cspan_type!%3D%22db%22%7D%5B300000ms%5D))%20by%20(service_hash%2C%20service_name)&time=2025-07-22T18:43:38.000Z' \
  -H 'accept: */*' \
  -H 'accept-language: en-US,en;q=0.9' \
  -H 'content-type: application/json' \
  -H "Authorization: Bearer $TOKEN" \
  -H 'priority: u=1, i' \
  -H 'referer: https://pisco.kloudfuse.io/' \
  -H 'sec-ch-ua: "Google Chrome";v="137", "Chromium";v="137", "Not/A)Brand";v="24"' \
  -H 'sec-ch-ua-mobile: ?0' \
  -H 'sec-ch-ua-platform: "macOS"' \
  -H 'sec-fetch-dest: empty' \
  -H 'sec-fetch-mode: cors' \
  -H 'sec-fetch-site: same-origin' \
  -H 'user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36'