Huawei Cloud Eye CES Metric Threshold Health Gate with Kestra

id: huawei-ces-metric-threshold-health-gate
namespace: company.team

description: |
  Query a Huawei Cloud CES (Cloud Eye Service) metric for one resource, classify the latest
  datapoint against a warning and a critical threshold, alert Slack on breach, and log a
  governance audit trail. Optionally pushes the pass/fail result back to CES as a custom
  metric so the check itself has history.

inputs:
  - id: region
    type: STRING
    displayName: Huawei Cloud region
    description: Region identifier used to sign CES requests, for example
      eu-west-101 or cn-north-4.
    defaults: "eu-west-101"

  - id: metric_namespace
    type: STRING
    displayName: CES metric namespace
    description: The service.item namespace the metric belongs to. SYS.ECS for
      system ECS metrics, or a custom namespace for metrics pushed with the Push
      task.
    defaults: "SYS.ECS"

  - id: metric_name
    type: STRING
    displayName: CES metric name
    description: The metric to query inside the namespace, for example cpu_util for
      ECS CPU utilization.
    defaults: "cpu_util"

  - id: dimension_name
    type: STRING
    displayName: Dimension name
    description: Identifies which resource the metric belongs to, for example
      instance_id for an ECS instance.
    defaults: "instance_id"

  - id: dimension_value
    type: STRING
    displayName: Dimension value
    description: The resource identifier for the dimension above, for example an ECS
      instance ID.
    defaults: "<your-ecs-instance-id>"

  - id: statistic
    type: SELECT
    displayName: Aggregation statistic
    description: How CES aggregates datapoints inside each period.
    values:
      - "AVERAGE"
      - "MAX"
      - "MIN"
      - "SUM"
      - "VARIANCE"
    defaults: "AVERAGE"

  - id: period
    type: SELECT
    displayName: Aggregation period
    description: The CES bucket size datapoints are aggregated into.
    values:
      - "RAW"
      - "ONE_MINUTE"
      - "FIVE_MINUTES"
      - "TWENTY_MINUTES"
      - "ONE_HOUR"
      - "FOUR_HOURS"
      - "ONE_DAY"
    defaults: "FIVE_MINUTES"

  - id: window
    type: STRING
    displayName: Lookback window
    description: ISO-8601 duration to look back from now when querying datapoints.
      CES caps this at P30D.
    defaults: "PT1H"

  - id: warning_threshold
    type: FLOAT
    displayName: Warning threshold
    description: The latest datapoint value at or above this is reported as WARNING
      and alerted to Slack.
    defaults: 80

  - id: critical_threshold
    type: FLOAT
    displayName: Critical threshold
    description: The latest datapoint value at or above this is reported as CRITICAL
      and alerted to Slack.
    defaults: 95

  - id: publish_check_metric
    type: BOOL
    displayName: Publish check result to CES
    description: When true, pushes a threshold_breach custom metric (0 or 1) back to
      CES under the KestraGovernance.CES namespace so the gate's own history is
      queryable in CES.
    defaults: false

tasks:
  - id: query_metric
    type: io.kestra.plugin.huawei.ces.Query
    description: Read-only. Reads the datapoints CES already holds for this metric
      and dimension.
    accessKeyId: "{{ secret('HUAWEI_AK') }}"
    secretAccessKey: "{{ secret('HUAWEI_SK') }}"
    region: "{{ inputs.region }}"
    namespace: "{{ inputs.metric_namespace }}"
    metricName: "{{ inputs.metric_name }}"
    dimensions:
      - name: "{{ inputs.dimension_name }}"
        value: "{{ inputs.dimension_value }}"
    statistic: "{{ inputs.statistic }}"
    period: "{{ inputs.period }}"
    window: "{{ inputs.window }}"

  - id: evaluate
    type: io.kestra.plugin.core.output.OutputValues
    description: Classifies the most recent datapoint. No datapoints at all is
      treated as HIGH, same as an unreachable resource.
    values:
      latest_value: "{{ outputs.query_metric.count > 0 ? (outputs.query_metric.series
        | jq('.[-1].value') | first) : 'no data' }}"
      severity: "{{ outputs.query_metric.count == 0 ? 'HIGH' :
        ((outputs.query_metric.series | jq('.[-1].value') | first) >=
        inputs.critical_threshold ? 'CRITICAL' : ((outputs.query_metric.series |
        jq('.[-1].value') | first) >= inputs.warning_threshold ? 'WARNING' :
        'OK')) }}"

  - id: route
    type: io.kestra.plugin.core.flow.If
    condition: "{{ outputs.evaluate.values.severity != 'OK' }}"
    then:
      - id: alert
        type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
        url: "{{ secret('SLACK_WEBHOOK_URL') }}"
        payload: |
          {{ {'text': outputs.evaluate.values.severity ~ ': ' ~ inputs.metric_namespace ~ '/' ~ inputs.metric_name ~ ' (' ~ inputs.dimension_name ~ '=' ~ inputs.dimension_value ~ ') = ' ~ outputs.evaluate.values.latest_value ~ '. Warning at ' ~ inputs.warning_threshold ~ ', critical at ' ~ inputs.critical_threshold ~ '.'} | toJson }}
    else:
      - id: compliant
        type: io.kestra.plugin.core.log.Log
        message: "{{ inputs.metric_namespace }}/{{ inputs.metric_name }} ({{
          inputs.dimension_name }}={{ inputs.dimension_value }}) = {{
          outputs.evaluate.values.latest_value }}, below the {{
          inputs.warning_threshold }} warning threshold."

  - id: publish_check_gate
    type: io.kestra.plugin.core.flow.If
    description: Off by default. When enabled, records this check's own pass/fail as
      a CES custom metric, it does not change any Huawei Cloud resource.
    condition: "{{ inputs.publish_check_metric }}"
    then:
      - id: publish_check
        type: io.kestra.plugin.huawei.ces.Push
        accessKeyId: "{{ secret('HUAWEI_AK') }}"
        secretAccessKey: "{{ secret('HUAWEI_SK') }}"
        region: "{{ inputs.region }}"
        namespace: "KestraGovernance.CES"
        metrics:
          - metricName: threshold_breach
            value: "{{ outputs.evaluate.values.severity == 'OK' ? 0 : 1 }}"
            unit: Count
            dimensions:
              - name: "{{ inputs.dimension_name }}"
                value: "{{ inputs.dimension_value }}"

  - id: summary
    type: io.kestra.plugin.core.log.Log
    message: "Huawei CES health gate complete for {{ inputs.metric_namespace }}/{{
      inputs.metric_name }}: severity {{ outputs.evaluate.values.severity }},
      latest value {{ outputs.evaluate.values.latest_value }}, metric published
      {{ inputs.publish_check_metric }}."

errors:
  - id: alert_flow_failure
    type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
    url: "{{ secret('SLACK_WEBHOOK_URL') }}"
    payload: |
      {{ {'text': 'Huawei CES metric threshold health gate failed (execution ' ~ execution.id ~ '). Check the logs.'} | toJson }}

triggers:
  - id: schedule_every_6_hours
    type: io.kestra.plugin.core.trigger.Schedule
    description: Shipped disabled. Enable once HUAWEI_AK, HUAWEI_SK and
      SLACK_WEBHOOK_URL are set and the inputs below point at a real resource.
    cron: "0 */6 * * *"
    disabled: true
    inputs:
      region: "eu-west-101"
      metric_namespace: "SYS.ECS"
      metric_name: "cpu_util"
      dimension_name: "instance_id"
      dimension_value: "<your-ecs-instance-id>"
      statistic: "AVERAGE"
      period: "FIVE_MINUTES"
      window: "PT1H"
      warning_threshold: 80
      critical_threshold: 95
      publish_check_metric: false

Huawei Cloud CES (Cloud Eye Service) is Huawei's equivalent of CloudWatch: it already collects system metrics for ECS, EVS, OBS and other services, and accepts custom metrics pushed by your own workloads. Nothing in Huawei Cloud turns a CES datapoint into a Slack page on its own, teams either poll the console or wire up Huawei's own alarm rules per metric. This blueprint is a portable, auditable alternative: one flow, driven by inputs, that reads a metric, judges it against thresholds you control, and keeps a record of every run in Kestra's execution history.

This blueprint was created by Mohit Jeswani.

How it works

query_metric (io.kestra.plugin.huawei.ces.Query) reads the datapoints CES already has for the configured metric_namespace / metric_name / dimension, aggregated with statistic over period buckets inside the window. Read-only, no Huawei resource is touched.
evaluate (io.kestra.plugin.core.output.OutputValues) takes the most recent datapoint (datapoints are returned sorted oldest to newest, so the last entry is current) and classifies it: OK below warning_threshold, WARNING at or above it, CRITICAL at or above critical_threshold, and HIGH when CES returned zero datapoints at all, the same signal you would get from an unreachable or misconfigured resource.
route (io.kestra.plugin.core.flow.If):
- compliant: logs the value and moves on.
- alert: posts the severity, value, and both thresholds to Slack.
publish_check_gate (io.kestra.plugin.core.flow.If), off by default: when publish_check_metric is true, publish_check (io.kestra.plugin.huawei.ces.Push) writes a threshold_breach custom metric (0 or 1) back to CES under the KestraGovernance.CES namespace. This only ever adds a new CES datapoint, it never modifies the monitored resource.
summary logs the severity, value and whether the metric was published, closing out the governance cycle.
errors alerts Slack if the flow itself fails, for example on an expired AK/SK or an invalid namespace.

What you get

A Slack alert the moment a CES metric crosses a threshold you define, instead of only the fixed alarm rules configured in the Huawei Cloud console.
A single flow definition that works for any CES namespace and metric, system or custom, by changing inputs rather than writing a new integration.
An optional, append-only audit trail of every check's own result as a CES custom metric.

Who it's for

Teams running workloads on Huawei Cloud who want metric alerting that lives in version control next to their other Kestra flows, instead of only in per-metric console alarm rules.
SREs who already push custom application metrics into CES with the Push task and need a threshold gate on top of them.
Teams evaluating the Huawei Cloud plugin who want a worked example of ces.Query reading datapoints and ces.Push writing them back.

Why orchestrate this with Kestra

A CES alarm rule is static configuration hidden in a console: changing a threshold means clicking through the UI with no review and no history. Kestra keeps the thresholds as flow inputs, so every change is a diff, every run is logged with the exact value that triggered or didn't trigger an alert, and the same flow can be pointed at a different resource or metric just by changing inputs on a manual run, with no new code.

Prerequisites

A Huawei Cloud account with CES enabled. The free trial tier is sufficient to generate system ECS metrics.
An AK/SK pair (IAM access key and secret key) with at minimum CES ReadOnlyAccess, and CES FullAccess if publish_check_metric is enabled.
At least one resource already emitting a system metric (for example a running ECS instance reporting SYS.ECS/cpu_util), or a custom metric already pushed into CES.
A Slack incoming webhook URL.

This flow calls the Huawei Cloud CES API directly over HTTPS; there is no official local Huawei Cloud emulator, so query_metric and publish_check cannot be exercised against a local Docker container the way a self-hosted database or broker can. Point dimension_value at a real resource in a trial account to test it end to end.

Secrets

HUAWEI_AK: the IAM access key used by query_metric and publish_check. In Kestra OSS, provide it as the base64-encoded environment variable SECRET_HUAWEI_AK.
HUAWEI_SK: the IAM secret key paired with HUAWEI_AK. In Kestra OSS, provide it as the base64-encoded environment variable SECRET_HUAWEI_SK.
SLACK_WEBHOOK_URL: used by alert and the errors block. In Kestra OSS, provide it as the base64-encoded environment variable SECRET_SLACK_WEBHOOK_URL.

Inputs

Input	Type	Default	Purpose
`region`	STRING	`eu-west-101`	Huawei Cloud region used to sign CES requests
`metric_namespace`	STRING	`SYS.ECS`	CES `service.item` namespace
`metric_name`	STRING	`cpu_util`	Metric name inside the namespace
`dimension_name`	STRING	`instance_id`	Dimension key identifying the resource
`dimension_value`	STRING	`<your-ecs-instance-id>`	Dimension value, the actual resource ID
`statistic`	SELECT	`AVERAGE`	`AVERAGE`, `MAX`, `MIN`, `SUM` or `VARIANCE`
`period`	SELECT	`FIVE_MINUTES`	CES aggregation bucket size
`window`	STRING	`PT1H`	ISO-8601 lookback duration, max `P30D`
`warning_threshold`	FLOAT	`80`	Value at or above this is `WARNING`
`critical_threshold`	FLOAT	`95`	Value at or above this is `CRITICAL`
`publish_check_metric`	BOOL	`false`	Push the pass/fail result back to CES

Outputs

{{ outputs.query_metric.count }}: number of datapoints CES returned.
{{ outputs.query_metric.series }}: the datapoints themselves, each with timestamp, value and unit.
{{ outputs.evaluate.values.severity }}: OK, WARNING, CRITICAL or HIGH.
{{ outputs.evaluate.values.latest_value }}: the value that was judged.
{{ outputs.publish_check.count }}: datapoints written back to CES, only present when publish_check_metric is true.

Pitfalls

CES requires between 1 and 3 dimensions per query; this blueprint exposes exactly one. Add more by editing the dimensions list on query_metric directly.
window is capped at P30D by the CES API itself; a longer value fails the task rather than silently truncating.
The AK/SK pair must belong to a Huawei Cloud IAM user, not the root account credentials, and needs the CES permission matching what this flow does (ReadOnlyAccess, plus FullAccess only if you turn on publish_check_metric).
A brand-new ECS instance can take a few minutes before CES has its first cpu_util datapoint; an empty series right after boot is expected and reported as HIGH, not a flow bug.
Custom metric namespaces must not start with SYS., that prefix is reserved for Huawei system metrics and publish_check will fail validation if KestraGovernance.CES is changed to start with it.

Quick start

Add the HUAWEI_AK, HUAWEI_SK and SLACK_WEBHOOK_URL secrets.
Set dimension_value to a real resource ID in your account, for example an ECS instance ID.
Run the flow once with the default inputs and confirm summary logs a severity.
Lower warning_threshold below the current metric value to confirm the Slack alert fires.
Enable the schedule_every_6_hours trigger once the thresholds match what you actually want paged on.

How to extend

Add more dimensions to query_metric for metrics that need 2 or 3 to identify the resource.
Loop this flow over a list of instance IDs with io.kestra.plugin.core.flow.Loop to gate a whole fleet in one run instead of one resource at a time.
Replace the Slack alert task with a Huawei Cloud SMN Publish task to page through Huawei's own notification service instead.
Track latest_value over time by always setting publish_check_metric to true and graphing the KestraGovernance.CES namespace back in the Huawei Cloud console.

Huawei Cloud Eye (CES) Metric Threshold Health Gate

How it works

What you get

Who it's for

Why orchestrate this with Kestra

Prerequisites

Secrets

Inputs

Outputs

Pitfalls

Quick start

How to extend

Links

Tasks

Orchestrate with Kestra

Share this Blueprint

Create a Blueprint

New to Kestra?

Huawei Cloud Eye (CES) Metric Threshold Health Gate

How it works

What you get

Who it's for

Why orchestrate this with Kestra

Prerequisites

Secrets

Inputs

Outputs

Pitfalls

Quick start

How to extend

Links

Tasks

Orchestrate with Kestra

Share this Blueprint

Create a Blueprint

More Cloud Blueprints

Audit HTTP Security Headers Across URLs

Huawei DataArts Factory Job Run Health Gate

Jaeger Trace Spans Dropped and Storage Error Sentinel

Huawei GeminiDB TTL Hygiene Sentinel

Huawei OBS Stale Object Retention Sentinel

Huawei DLI Data Quality Assertion Gate

More Infrastructure Blueprints

Meilisearch Index Health Sentinel and Search Audit

Enforce default SSE-S3 encryption on a MinIO bucket

Incremental, idempotent lake ingestion from MinIO with DuckDB

Catch MinIO Replication Drift Before Objects Go Missing on the Target

Prune noncurrent object versions billed forever behind a versioned bucket

Enforce a MinIO bucket lifecycle expiry and noncurrent version policy

New to Kestra?