Tencent Cloud CLI In A venv Of Its Own

tccli

The Tencent Cloud CLI (tccli) on EL 10, pinned to a version, in a virtual environment of its own with a link in the PATH. Original role for EL 10, live-tested with podman on Rocky Linux 10.

There is no package; the documented install is pip. EL 10 carries no tccli, and pip install into the system Python ties the CLI's dependencies to whatever the OS ships. This role puts the CLI in /opt/tccli, a venv apart from the system Python: an OS update cannot break it, and it cannot break the OS. The live test asserts import tccli fails in /usr/bin/python3.

Pinned, and checked for consistency. tccli_version is what gets installed; the live test runs pip check inside the venv and expects no broken requirements.

pip verifies nothing beyond TLS. The index is PyPI over HTTPS; there is no signature to check. For a byte-for-byte pin, give tccli_pip_extra_args a requirements file with hashes and --require-hashes, or a private index.

Proven to run. The live test calls tccli cvm DescribeRegions without usable credentials and expects "AuthFailure.SecretIdNotFound" - the whole tree loaded and the Tencent Cloud client ran.

Without a key it never leaves the host. tccli with no SecretId stops at "secretId is invalid" before any request; the live test gives it a SecretId that is not one through TENCENTCLOUD_SECRET_ID and expects the API's AuthFailure.SecretIdNotFound, which proves the client reached Tencent Cloud and was refused there. Keys, region and output format are per user (tccli configure, or the TENCENTCLOUD_* variables).

License

Commercial - IaC Bazaar EULA. (c) IaC Bazaar.