Huawei Trigger

Huawei Trigger
Certified
Trigger a flow when a Huawei Cloud CES metric query returns datapoints matching a threshold

Polls a CES metric on a configurable interval and fires an execution as soon as the query returns at least one new datapoint. Useful for reacting to metric thresholds without a dedicated CES alarm, e.g. to kick off a remediation flow.

A watermark (the timestamp of the most recent datapoint seen) is persisted in the flow's namespace KV Store between polls, so datapoints already seen in a previous overlapping window never fire the trigger twice.

The trigger outputs the same structure as the Query task, containing only the new datapoints that fired this execution.

On sovereign clouds (e.g. the EU myhuaweicloud.eu domain) set endpointOverride (or endpointSuffix) to reach the correct endpoint, and additionally set projectId — the CES v1 API embeds the project ID in the request path, and a custom endpoint bypasses the SDK's automatic project discovery.

yaml
type: io.kestra.plugin.huawei.ces.Trigger

Examples

Trigger a flow whenever new CPU utilization datapoints are available for an ECS instance.

yaml
id: ces_trigger
namespace: company.team

tasks:
  - id: process
    type: io.kestra.plugin.core.log.Log
    message: "{{ trigger.series | length }} new datapoints, latest={{ trigger.series | last }}"

triggers:
  - id: watch
    type: io.kestra.plugin.huawei.ces.Trigger
    accessKeyId: "{{ secret('HUAWEI_AK') }}"
    secretAccessKey: "{{ secret('HUAWEI_SK') }}"
    region: eu-west-101
    namespace: SYS.ECS
    metricName: cpu_util
    dimensions:
      - name: instance_id
        value: "abc123def456"
    statistic: AVERAGE
    period: FIVE_MINUTES
    window: PT10M
    interval: PT5M

Trigger a flow only when average CPU utilization exceeds 80%.

yaml
id: ces_trigger_threshold
namespace: company.team

tasks:
  - id: alert
    type: io.kestra.plugin.core.log.Log
    message: "High CPU usage detected: {{ trigger.series | last }}"

triggers:
  - id: watch_high_cpu
    type: io.kestra.plugin.huawei.ces.Trigger
    accessKeyId: "{{ secret('HUAWEI_AK') }}"
    secretAccessKey: "{{ secret('HUAWEI_SK') }}"
    region: eu-west-101
    namespace: SYS.ECS
    metricName: cpu_util
    dimensions:
      - name: instance_id
        value: "abc123def456"
    statistic: AVERAGE
    period: FIVE_MINUTES
    window: PT10M
    interval: PT5M
    threshold: 80
    comparisonOperator: GREATER_THAN

Properties

dimensions *array

Dimensions identifying the monitored resource

1 to 3 name/value pairs. CES requires at least one dimension to identify the exact resource instance.

Definitions

io.kestra.plugin.huawei.ces.Dimension

name*string

Dimension name

E.g. instance_id for an ECS instance dimension.

value*string

Dimension value

E.g. the ECS instance ID.

metricName *string

Metric name

namespace *string

Metric namespace

accessKeyId string

Access Key (AK) used to authenticate with Huawei Cloud

Huawei Cloud access key used together with secretAccessKey to sign API requests. Required for AK/SK-based authentication; not required when providing a pre-obtained securityToken. Sensitive — always provide via {{ secret('NAME') }}.

allowConcurrent boolean

Defaultfalse

Specifies whether a trigger is allowed to start a new execution even if a previous run is still in progress.

comparisonOperator string

DefaultGREATER_THAN

Possible Values

GREATER_THANGREATER_THAN_OR_EQUALLESS_THANLESS_THAN_OR_EQUALEQUAL

Comparison operator applied to threshold

Ignored when threshold is not set. Defaults to GREATER_THAN.

domainId string

Huawei Cloud Account Domain ID

Identifies the Huawei Cloud account (domain). Required when authenticating against global services such as IAM, or when requesting a domain-scoped IAM token.

endpointOverride string

CES endpoint URL override

Overrides the default endpoint derived from region and endpointSuffix. Use this for private endpoints, non-standard deployments, or tests. When set, endpointSuffix is ignored.

Format: https://ces.<region>.myhuaweicloud.com (without trailing slash).

endpointSuffix string

Huawei Cloud domain suffix

Controls the top-level domain used when deriving the CES endpoint from region. Defaults to myhuaweicloud.com. Set to myhuaweicloud.eu for the Huawei Cloud European sovereign cloud.

Ignored when endpointOverride is set.

interval string

DefaultPT5M

Formatduration

Polling interval

How often the trigger queries CES, as an ISO-8601 duration (e.g. PT5M). Defaults to 5 minutes.

period string

DefaultFIVE_MINUTES

Possible Values

RAWONE_MINUTEFIVE_MINUTESTWENTY_MINUTESONE_HOURFOUR_HOURSONE_DAY

Aggregation period

projectId string

Huawei Cloud Project ID

Identifies the region-scoped project against which most regional services authenticate. Mutually exclusive with domainId for global services such as IAM.

region string

Huawei Cloud region

Region identifier such as eu-west-101, ap-southeast-1, or cn-north-4.

secretAccessKey string

Secret Key (SK) used to authenticate with Huawei Cloud

Huawei Cloud secret key paired with accessKeyId. Required for AK/SK-based authentication. Sensitive — always provide via {{ secret('NAME') }}.

securityToken string

Pre-obtained Huawei Cloud IAM token used as bearer credential for downstream API calls

When set, downstream Huawei tasks send this value in the X-Auth-Token header instead of signing requests with AK/SK. Sensitive.

statistic string

DefaultAVERAGE

Possible Values

AVERAGEMAXMINSUMVARIANCE

Statistic to aggregate datapoints with

stopAfter array

SubTypestring

Possible Values

CREATEDSUBMITTEDRUNNINGPAUSEDRESTARTEDKILLINGSUCCESSWARNINGFAILEDKILLEDCANCELLEDQUEUEDRETRYINGRETRIEDSKIPPEDBREAKPOINTRESUBMITTED

List of execution states after which a trigger should be stopped (a.k.a. disabled).

temporaryCredentials string

Inline IAM credential exchange

When set, the connection layer calls the Huawei IAM STS API once per task execution and uses the returned temporary AK/SK + security token instead of the static accessKeyId and secretAccessKey properties.

Set it on each task that should exchange credentials, alongside the task's other connection properties:

temporaryCredentials: 
  authMethod: PASSWORD
  username: my-iam-user
  password: "{{ secret('HUAWEI_IAM_PASSWORD') }}"
  domainName: my-account-domain
  durationSeconds: 3600

**Long-running tasks: ** the exchange runs once at execution start. For RealtimeTrigger or long-running Consume tasks that outlive durationSeconds, credentials will expire mid-run. Use long-lived AK/SK properties or refresh externally in that case.

Definitions

io.kestra.plugin.huawei.TemporaryCredentialsConfig

authMethodstring

DefaultPASSWORD

Possible Values

PASSWORDTOKEN

Authentication method

Controls which credentials are used to obtain the session token before exchanging for temporary STS credentials.

PASSWORD (default): provide username, password, and domainName.
TOKEN: provide an existing iamToken (X-Auth-Token).

domainNamestring

Account domain name (PASSWORD method only)

The Huawei Cloud account name (domain name) that owns the IAM user. Required when authMethod is PASSWORD. Visible in the Huawei Cloud console under My Credentials → Domain Name.

durationSecondsintegerstring

Default900

Lifetime of the temporary credentials in seconds

How long the returned temporary AK/SK/security-token should remain valid. Huawei Cloud accepts values between 900 (15 minutes) and 86400 (24 hours). Defaults to 900 seconds.

endpointSuffixstring

Defaultmyhuaweicloud.com

Huawei Cloud IAM endpoint suffix

Domain suffix used to build the IAM endpoint URL when no explicit endpoint override is set. Defaults to myhuaweicloud.com. Set to myhuaweicloud.eu for the European sovereign cloud (region eu-west-101 / EU-Dublin).

iamTokenstring

IAM token to exchange (TOKEN method only)

An existing Huawei Cloud X-Auth-Token to exchange for temporary STS credentials. Required when authMethod is TOKEN. Sensitive — always provide via {{ secret('NAME') }}.

passwordstring

IAM password (PASSWORD method only)

Password for the IAM user identified by username. Required when authMethod is PASSWORD. Sensitive — always provide via {{ secret('NAME') }}.

projectNamestring

Project name for project-scoped tokens (PASSWORD method only)

Overrides the project name used for scope=PROJECT token requests. Defaults to the task's region value when omitted, which is correct for most regions.

scopestring

DefaultPROJECT

Possible Values

PROJECTDOMAIN

Token scope (PASSWORD method only)

Scope of the session token obtained during password authentication.

PROJECT (default): token is scoped to the project matching projectName (or the task's region when projectName is omitted). Use for most downstream tasks.
DOMAIN: token is scoped to the domain.

usernamestring

IAM username (PASSWORD method only)

Huawei Cloud IAM username. Required when authMethod is PASSWORD.

threshold numberstring

Threshold to compare datapoint values against

When set, the trigger only fires if at least one new datapoint's value satisfies value <comparisonOperator> threshold. When omitted (default), the trigger fires as soon as any new datapoint is found, regardless of its value.

when string

Defaulttrue

A condition that determines whether the trigger should run.

A Pebble expression evaluated at trigger time. The trigger fires only when the expression evaluates to a truthy value (true, a non-empty string, a non-zero number). Use this to gate trigger execution on dynamic runtime values such as execution labels, flow variables, or environment conditions.

window string

DefaultPT1H

Time window to query, ending now

Defaults to PT1H. Maximum: 30 days (P30D).

Outputs

count integer

Number of datapoints returned

series array

Datapoints sorted by timestamp ascending

Capped at 1440 datapoints (the most recent ones) to bound memory usage. Narrow window or increase period if you need finer-grained coverage over a longer range.

Definitions

io.kestra.plugin.huawei.ces.Query-Point

timestampstring

Formatdate-time

Datapoint timestamp

unitstring

Unit reported by CES for this datapoint

E.g. %, Count, Bytes.

valuenumber

Datapoint value for the requested statistic