huawei-cloud-cce-cluster-management

Call huawei_create_cce_cluster with region, cluster_name, flavor_id, vpc_id, and subnet_id. Omit cluster_version to let the API select the latest Kubernetes version; container_network_type defaults to eni for Turbo clusters. This operation uses the Python SDK due to a known hcloud metadata parsing defect.

Use huawei_cce_node_drain with region, cluster_id, node_name, and confirm=true. It follows standard kubectl drain semantics: cordons the node, then evicts pods while respecting PodDisruptionBudgets and skipping DaemonSet pods. Call it without confirm first to preview affected pods.

No. The kubectl cce plugin connects to the CCE API Gateway using AK/SK credentials, so node operations like cordon, uncordon, drain, and status work without a cluster EIP or manually downloaded kubeconfig. Only cluster-id, region, and project-id are needed.

It supports permanent AK/SK via HW_ACCESS_KEY and HW_SECRET_KEY, plus temporary STS credentials by adding HW_SECURITY_TOKEN. Credentials can come from environment variables or sandbox-injected CLI flags, and are never persisted to disk or included in logs.

All dangerous operations including cluster deletion, hibernation, node drain, and addon uninstall require a two-step confirmation. Calling without confirm=true returns a preview with risk warnings; the operation only executes when confirm=true is passed explicitly.

Turbo clusters using ENI networking require ENI-compatible flavors such as the c7 or s7 series, for example c7.large.2. Older s6 and c6 series flavors do not support ENI and will fail with a subeni quota error during node pool creation.