Huawei Cloud CCE Cluster

huawei-cce-cluster

A production-ready Huawei Cloud CCE (Cloud Container Engine) managed Kubernetes cluster. The module owns its network end to end — it creates the VPC and a DNS-enabled node subnet, stands up the CCE control plane, and attaches autoscaling worker node pools with KMS-encryptable disks.

Status: static-validated, live-test pending. Validated with tofu validate + tflint + checkov against the huaweicloud/huaweicloud provider. Not yet applied against a live Huawei Cloud account (no sandbox subscription; CCE clusters take ~10-15 min to create and bill a per-cluster fee), so it ships under live-test quarantine.

Design & secure defaults

• Private API server. No public EIP is bound by default (eip = null) — the Kubernetes API server is reachable only from inside the VPC (use a bastion, VPN, or Direct Connect). Bind an EIP explicitly only if you must reach it from the internet.
• Secrets envelope encryption. Pass kms_key_id to encrypt Kubernetes Secrets at rest in etcd via a customer-managed KMS key (encryption_config mode = KMS). Recommended for regulated workloads.
• Encrypted worker disks. Node-pool root and data volumes accept a kms_key_id for at-rest encryption; data volumes default to a 100 GB SSD.
• Storage retained on destroy. delete_all_on_destroy = "false" so a Terraform destroy cannot silently delete associated EVS/SFS/OBS volumes. Flip to "true"/"try" only when you intend a full cleanup.
• HA control plane. On the s2 flavors you can spread masters across three AZs (master_availability_zones) for an availability-zone-resilient control plane. The s2 family is the production default.
• RBAC by default (authentication_mode = "rbac") and ipvs kube-proxy for service scalability.
• Key-pair login only. Node pools authenticate via an SSH key_pair name — no plaintext passwords are accepted into Terraform state.
• Production CNI. vpc-router by default (VPC-routed pod IPs); choose eni (CCE Turbo) for per-pod ENIs and Kubernetes NetworkPolicy / security groups.

Cross-field invariants (HA masters need an s2 flavor; autoscaling needs min <= max; data volumes ≥ 10 GB; valid taint effects) are enforced with precondition/validation blocks, so misconfigurations fail at plan time.

Usage

module "cce" {
  source = "github.com/ITfreak/iacbazaar//artifacts/terraform/huawei-cce-cluster"

  name                   = "prod"
  region                 = "ap-southeast-3"
  cluster_version        = "v1.30"
  vpc_cidr               = "10.0.0.0/16"
  subnet_cidr            = "10.0.1.0/24"
  container_network_type = "vpc-router"

  node_pools = {
    default = {
      flavor_id      = "s6.large.2"
      min_node_count = 2
      max_node_count = 6
      key_pair       = "prod-keypair"
    }
  }
}

See examples/basic for a complete, runnable configuration.

Key inputs

Variable	Description	Default
name	Cluster + VPC/subnet name prefix	required
node_pools	Map of { flavor_id, min_node_count, max_node_count, … }	required
region	Huawei Cloud region	provider default
cluster_version	Kubernetes version (e.g. v1.30), or null	null
cluster_flavor	Control-plane flavor (cce.s2.* = HA-capable)	cce.s2.small
vpc_cidr / subnet_cidr	VPC / node-subnet CIDRs	10.0.0.0/16 / 10.0.1.0/24
container_network_type	vpc-router, overlay_l2, or eni (Turbo)	vpc-router
container_network_cidr	Pod CIDR (non-eni)	172.16.0.0/16
service_network_cidr	Service CIDR	10.247.0.0/16
eni_subnet_id	ENI subnet (eni/Turbo only)	module subnet
kube_proxy_mode	ipvs or iptables	ipvs
authentication_mode	rbac or authenticating_proxy	rbac
master_availability_zones	3 AZs for HA control plane, or []	[]
eip	Public API-server EIP address	null (private)
kms_key_id	KMS key for Secrets-at-rest encryption	null
delete_all_on_destroy	Delete associated storage on destroy	"false"
subnet_dns_servers	DNS resolvers on the node subnet	HW public resolvers
tags	Tags for VPC/subnet/cluster/nodes	{}

Outputs

cluster_id, cluster_name, cluster_status, cluster_category, vpc_id, subnet_id, subnet_ipv4_subnet_id, kube_config_raw (sensitive), certificate_clusters (sensitive), node_pool_ids (map), node_pool_status (map).

Provider

huaweicloud/huaweicloud >= 1.0, < 2.0. Requires Terraform/OpenTofu >= 1.6.

License

Commercial — LicenseRef-IaCBazaar-Commercial. See the IaC Bazaar terms.