Skip to main content
Nuphos reaches Tencent Cloud through OIDC web-identity federation. You create a CAM identity provider that trusts the Nuphos issuer and a role that trusts that provider; Nuphos mints a short-lived token per team and calls sts:AssumeRoleWithWebIdentity. No SecretId/SecretKey is stored. Nuphos keeps the role ARN and the OIDC provider’s name — Tencent references providers by name, not ARN.
Pick your partition when you connect: mainland China (console.cloud.tencent.com) or International (console.tencentcloud.com). They are separate accounts with separate consoles.

​
Connect

The wizard in Connectors → Connect → Tencent Cloud shows the values for your team — issuer, client id, subject, and the public key. Copy them from there, not from this page.

​
1. Add the identity provider

In the CAM console, open Identity Providers → Role SSO and create an OIDC provider with the issuer URL, client id, and public key the wizard gives you. Unlike AWS and Azure, Tencent does not fetch the issuer’s JWKS itself, so the wizard hands you the public key to paste. If Nuphos rotates its signing key, this provider has to be updated.

​
2. Create the role

Create a role that trusts the provider you just made, conditioned on the subject the wizard shows — that is what locks the role to your team, so no other Nuphos team can assume it. Attach a policy covering the work you want done (TKE and CVM, typically). Copy the role’s ARN; the last step asks for it.

​
3. Authorize cluster access (optional)

Tencent’s IAM only covers the control plane. To let the role act inside your TKE clusters, grant it access in each cluster as well. Skip this if you only want the agent to see cluster metadata.

​
4. Bind the role

Enter the role ARN and the provider name in Nuphos.

​
In the Nuphos app

  • CVM instances — the account’s compute instances.
  • Clusters — TKE clusters land in the shared cluster browser alongside EKS, GKE, and the rest.

​
What the agent can do for you

The agent operates the account within whatever policy you attached to the role, correlating it with your other connected accounts and proposing changes as plans.

​
Permissions & authorization

  • The role’s policy is the outer limit — Tencent enforces it.
  • Hard boundary — who can use it. Only team Administrators can bind or remove the account, and they can restrict it to specific members with a member allow-list.
  • Soft boundary — what the agent may do with it. Reads run freely; changes go through plan approvals and Auto-authorization.
See the IAM trust model for how the token exchange works.