---
title: "Node IAM Role use cases"
slug: "kubernetes-node-iam-role"
updated: 2026-10-08T06:52:21Z
published: 2026-10-08T06:52:21Z
canonical: "guide.ncloud-docs.com/kubernetes-node-iam-role"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://guide.ncloud-docs.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Node IAM Role use cases

Available in VPC

By assigning a Server Role type role to the worker nodes of Ncloud Kubernetes Service, you can use NAVER Cloud Platform APIs without configuring an AccessKey and SecretKey.

## Example of viewing Object Storage bucket list

To create a node pool that can access Object Storage and check whether the Object Storage bucket list can be viewed from POD, perform the following tasks:

### 1. Create Sub Account role

See the [Create role](/docs/en/subaccount-policy-role#%EC%97%AD%ED%95%A0-%EC%83%9D%EC%84%B1) guide to create a Server type role and add the NCP_OBJECT_STORAGE_VIEWER policy.

### 2. Create a node pool

When creating a node pool, select the role created in Step 1 as the Node IAM Role.

### 3. Verify role assignment

After you create a node pool, navigate to **Sub Account** > **Roles** - **Role name** > **Role target** to check if the node of the created node pool is added.

### 4. Verify role application

1. Copy the following code and save it as an alpine.yaml file.

```
apiVersion: v1
kind: Pod
metadata:
  name: alpine
spec:
  containers:
  - name: alpine
    image: alpine:3.12
    command:
      - sleep
      - "3600"
    imagePullPolicy: IfNotPresent
  restartPolicy: Always
```

1. Run the following command to deploy POD.

```
$ kubectl apply -f alpine.yaml
pod/node-iam-test created
```

1. Run the following command to access POD via shell.

```
$ kubectl exec -it alpine -- sh
/ #
```

1. Run the following command to install aws-cli.

```
/ # apk add aws-cli
fetch http://dl-cdn.alpinelinux.org/alpine/v3.12/main/x86_64/APKINDEX.tar.gz
(1/46) Installing libbz2 (1.0.8-r1)
(2/46) Installing expat (2.2.10-r4)
...
(46/46) Installing aws-cli (1.18.55-r0)
Executing busybox-1.31.1-r22.trigger
OK: 134 MiB in 60 packages
```

1. Run the following command to view the Bucket list of Object Storage.

```
/ # aws s3 ls --endpoint-url=https://kr.object.ncloudstorage.com
2020-09-01 07:58:31 bucket1
2020-12-08 14:52:07 bucket2
2020-07-20 06:37:20 bucket3
...
```

## Example of pulling images from Container Registry

You can create a node pool that can access Container Registry and pull images from Container Registry without a separate [authentication](https://guide.ncloud-docs.com/docs/en/container-ncr-1-3#kubernetes%EC%97%90%EC%84%9C-%EB%A1%9C%EA%B7%B8%EC%9D%B8) from POD. To use this feature, see [Using Container Registry](https://guide.ncloud-docs.com/docs/en/containerregistry-start) and prepare a registry and images.

### 1. Create Sub Account role

See the [Create role](/docs/en/subaccount-policy-role#%EC%97%AD%ED%95%A0-%EC%83%9D%EC%84%B1) guide to create a Server type role and add the NCP_CONTAINER_REGISTRY_VIEWER policy.

### 2. Create a node pool

When creating a node pool, select the role created in Step 1 as the Node IAM Role.

### 3. Verify role assignment

After you create a node pool, navigate to **Sub Account** > **Roles** - **Role name** > **Role target** to check if the node of the created node pool is added.

### 4. Verify role application

1. Copy the following code and save it as an alpine.yaml file.

```
apiVersion: v1
kind: Pod
metadata:
  name: alpine
spec:
  containers:
  - name: alpine
    image: <registry-name>.ncr.ntruss.com/alpine:3.12
    command:
      - sleep
      - "3600"
    imagePullPolicy: IfNotPresent
  restartPolicy: Always
```

1. Run the following command to deploy POD.

```
$ kubectl apply -f alpine.yaml
pod/node-iam-test created
```

1. Run the following command to check if the image is pulled properly and POD is running.

```
$ kubectl get pod
NAME                      READY   STATUS    RESTARTS   AGE
alpine                    1/1     Running   0          16s
```