Huawei Query

SQL statement to run

Any DLI-supported SQL: SELECT, DDL, DML, and more.

Access Key (AK) used to authenticate with Huawei Cloud

Huawei Cloud access key used together with secretAccessKey to sign API requests. Required for AK/SK-based authentication; not required when providing a pre-obtained securityToken. Sensitive — always provide via {{ secret('NAME') }}.

Extra Spark/DLI configuration entries

Each entry is a key=value string, forwarded as-is to DLI's conf field.

Database to run the query against

Maps to DLI's currentdb. Optional if the query fully qualifies its table names.

Huawei Cloud Account Domain ID

Identifies the Huawei Cloud account (domain). Required when authenticating against global services such as IAM, or when requesting a domain-scoped IAM token.

DLI endpoint URL override

Overrides the default endpoint derived from region and endpointSuffix. Use this for private endpoints, non-standard deployments, or tests. When set, endpointSuffix is ignored.

Format: https://dli.<region>.myhuaweicloud.com (without trailing slash).

Huawei Cloud domain suffix

Controls the top-level domain used when deriving the DLI endpoint from region. Defaults to myhuaweicloud.com. Set to myhuaweicloud.eu for the Huawei Cloud European sovereign cloud.

Ignored when endpointOverride is set.

How to handle the query result set

STORE (default) exports the full result to outputLocation on OBS and downloads it as ION. FETCH and FETCH_ONE read directly from DLI's preview API (capped at 1000 rows) and are not supported on the shared default queue (see queue). NONE returns as soon as the job completes, without fetching a result set.

Polling interval while waiting for the job to complete

ISO-8601 duration (e.g. PT5S). Defaults to 5 seconds.

Maximum time to wait for the query (and, for STORE, the export job) to complete

ISO-8601 duration (e.g. PT1H). Defaults to 1 hour. The DLI job is not automatically cancelled on timeout.

OBS request-signing type for the read-back

Defaults to OBS. Set to V2 for MinIO or other S3-compatible endpoints.

OBS endpoint URL override for the STORE result read-back

Overrides the endpoint used to read the exported result back from OBS. This is a separate host from the DLI endpointOverride — never reuse the DLI endpoint here. Defaults to the OBS endpoint derived from region and endpointSuffix.

Use path-style access for the OBS read-back

Set to true for MinIO or other S3-compatible endpoints. Defaults to false.

OBS location the result set is exported to

An obs://bucket/prefix URI. Required when fetchType is STORE.

Reference (ref) of the pluginDefaults to apply to this task.

Huawei Cloud Project ID

Identifies the region-scoped project against which most regional services authenticate. Mutually exclusive with domainId for global services such as IAM.

DLI queue to run the job on

Maps to DLI's queue_name. When omitted, the account's shared default queue is used. The default queue does not support fetching results via the preview API: fetchType FETCH/FETCH_ONE on the default queue (or with queue omitted) fails fast. Use fetchType STORE or NONE on the default queue, or run the query on a dedicated DLI SQL queue to use FETCH/FETCH_ONE.

Huawei Cloud region

Region identifier such as eu-west-101, ap-southeast-1, or cn-north-4.

Secret Key (SK) used to authenticate with Huawei Cloud

Huawei Cloud secret key paired with accessKeyId. Required for AK/SK-based authentication. Sensitive — always provide via {{ secret('NAME') }}.

Pre-obtained Huawei Cloud IAM token used as bearer credential for downstream API calls

When set, downstream Huawei tasks send this value in the X-Auth-Token header instead of signing requests with AK/SK. Sensitive.

Tags to attach to the DLI job

Inline IAM credential exchange

When set, the connection layer calls the Huawei IAM STS API once per task execution and uses the returned temporary AK/SK + security token instead of the static accessKeyId and secretAccessKey properties.

Configure once via pluginDefaults to apply transparently to every task in a namespace without per-task credential wiring:

pluginDefaults: 
  - type: io.kestra.plugin.huawei.obs
    values: 
      region: eu-west-101
      temporaryCredentials: 
        authMethod: PASSWORD
        username: my-iam-user
        password: "{{ secret('HUAWEI_IAM_PASSWORD') }}"
        domainName: my-account-domain
        durationSeconds: 3600

**Long-running tasks: ** the exchange runs once at execution start. For RealtimeTrigger or long-running Consume tasks that outlive durationSeconds, credentials will expire mid-run. Use long-lived AK/SK properties or refresh externally in that case.