Service Accounts

A service account is a special kind of non-human account for applications, services, or virtual machines (VMs) to securely interact with other systems or APIs. Service accounts operate in the background, without user interaction.

For example, to programmatically download logs from Kloudfuse for analysis or archival, create a service account with specific permissions and use it to access the Kloudfuse API. Follow these steps:

  1. Create a service account with a specific role: *Viewer*, *Editor*, or *Admin*.

  2. Attach a policy to limit access.

    For example, a policy {kube_namespace="prometheus"} grants log access to the Prometheus namespace, only.

  3. Create an API token with an expiration date.

  4. Use the token as a Bearer token in API calls to get and download logs.

Advantages

Automation

Service accounts are purpose-built for automation, to be used by software, not people.

Continuous Integration and Deployment

They are ideal for CI/CD pipelines, background jobs, or apps that access cloud services.

Authentication and Authorization

Service accounts have their own credentials (keys, tokens, or certificates).

Permissions

You can add specific permissions (roles or scopes) to limit access to only what the service account requires.

Security

Service accounts provide secure, auditable access to APIs without exposing user credentials.

Follow these steps to get to the Service Accounts interface:

  1. Click the Admin tab, and then the Service Accounts option in the drop-down menu.

    navigate to service accounts list

  2. The Service Accounts interface appears.

Create a Service Account

To create a service account, follow these steps:

  1. Click Create new service account (Create new service account).

    service accounts create go

  2. The Create new service account interface appears.

    service accounts create new

  3. Specify the new service account:

    service accounts create new create
    Account name

    Specify the name of the service account.

    Owner email

    Specify the email that corresponds to the service account.

    Role

    Specify the role for the service account: Viewer, Editor, or Admin.

  4. Click Create (Create).

  5. Kloudfuse confirms that you successfully created a service account.

Set Query Priorities

The Query priority section on the service-account detail page lets you override the cluster-wide priority and per-call timeout for the Machine class. Service accounts run programmatic traffic only, so the Interactive class is not exposed here. See Override Priorities for a User, Team, or Service Account for instructions, and Query Priorities Concepts for the resolution model.

Examples

Use a service account to download logs

To create a service account for retrieving logs from Kloudfuse, and use it, follow these steps.

Create the service account

  1. Navigate to Admin → Service Accounts.

  2. Click Create new service account.

  3. Specify the parameters:

    Account name

    log-downloader

    Owner email

    automation@example.com

    Role

    Viewer (sufficient for read-only access to logs)

  4. Click Create.

Attach a policy

After you create the service account, attach a policy that limits its access to what it needs:

  1. Click the service account name.

  2. Add a policy to restrict access. For example:

    {kube_namespace="prometheus"}

    Grants access to logs from the prometheus namespace only.

    {kube_namespace="dd-trace-example"}

    Grants access to logs from the dd-trace-example namespace only.

Create an API token

  1. In the service account details, click Create Token.

  2. Set an expiration date, for example 30 days, 90 days, or 1 year.

  3. Copy the generated token.

  4. Store the token securely. You can’t view it again after you close the dialog.

Use the token in API calls

Pass the token as a Bearer token in the Authorization header of each API call. This request downloads up to 2,000 log lines from a 5-minute window:

Example: download logs with a service account token
export KFUSE_HOST=<your-kloudfuse-hostname>   (1)
export TOKEN=<service-account-token>          (2)

curl "https://$KFUSE_HOST/query" \
  -H 'Content-Type: application/json' \
  -H "Authorization: Bearer $TOKEN" \
  --data-raw '{"query":"query GetLogsV2 { getLogsV2(cursor: null, query: {and: []}, limit: 2000, timestamp: \"2025-07-22T12:01:40-07:00\", durationSecs: 300, sortBy: \"ts\", sortOrder: Asc) { cursor events { timestamp logLine fpString fpHash level labels facets { name dataType content } } } }"}'
bash
1 KFUSE_HOST: the hostname of your Kloudfuse cluster.
2 TOKEN: the token you created in Create an API token.

The response contains only the logs that the service account’s policy allows. With the {kube_namespace="prometheus"} policy, Kloudfuse returns only logs from the prometheus namespace:

Response
{
  "data": {
    "getLogsV2": {
      "cursor": "",
      "events": [
        {
          "timestamp": "2025-07-22T19:00:03.171Z",
          "logLine": "level=info ts=2025-07-22T19:00:02.381Z caller=compact.go:507 component=tsdb msg=\"write block\" duration=48.895847ms",
          "level": "info",
          "labels": {
            "kube_namespace": "prometheus",
            "pod_name": "prometheus-server-0",
            ...
          }
        }
      ]
    }
  }
}
json

Query APM services

The same token works with the PromQL query API. With the policy {kube_namespace="dd-trace-example"}, this request returns only the services in that namespace, not every service in the cluster:

Example: query APM services with a service account token
curl -G "https://$KFUSE_HOST/api/v1/query" \
  -H "Authorization: Bearer $TOKEN" \
  --data-urlencode 'query=min(min_over_time(edge_latency_min{kf_source="apm",span_type!="db"}[5m])) by (service_hash, service_name)' \
  --data-urlencode 'time=2025-07-22T18:43:38.000Z'
bash