Huawei Cloud Cce Cluster Management

"""Huawei Cloud service modules."""

"""CCE Addon management functions."""

from typing import Any, Dict, Optional

from huaweicloudsdkcore.exceptions.exceptions import ClientRequestException
from huaweicloudsdkcce.v3 import (
    ShowAddonInstanceRequest,
    ListAddonInstancesRequest,
    CreateAddonInstanceRequest,
    AddonInstance,
    InstanceSpec,
    AddonMetadata,
    UpdateAddonInstanceRequest,
    DeleteAddonInstanceRequest,
)

from .common import get_credentials, create_cce_client, SDK_AVAILABLE, IMPORT_ERROR


def get_cce_addon_detail(region: str, cluster_id: str, addon_name: str, ak: Optional[str] = None, sk: Optional[str] = None, project_id: Optional[str] = None) -> Dict[str, Any]:
    """Get detailed information of a specific CCE addon."""
    access_key, secret_key, proj_id = get_credentials(ak, sk, project_id)

    if not access_key or not secret_key:
        return {
            "success": False,
            "error": "Credentials not provided. Set HUAWEI_AK and HUAWEI_SK environment variables or pass as parameters."
        }

    if not cluster_id:
        return {
            "success": False,
            "error": "cluster_id is required"
        }

    if not SDK_AVAILABLE:
        return {
            "success": False,
            "error": f"Huawei Cloud SDK not installed: {IMPORT_ERROR}"
        }

    try:
        client = create_cce_client(region, access_key, secret_key, proj_id)

        request = ShowAddonInstanceRequest()
        request.cluster_id = cluster_id
        request.addon_name = addon_name

        response = client.show_addon(request)

        addon_info = {}
        if hasattr(response, 'spec') and response.spec:
            spec = response.spec
            addon_info["name"] = getattr(spec, 'name', None)
            addon_info["version"] = getattr(spec, 'version', None)
            addon_info["status"] = getattr(spec, 'status', None)
            addon_info["description"] = getattr(spec, 'description', None)

            if hasattr(spec, 'custom') and spec.custom:
                custom = spec.custom
                addon_info["custom_params"] = {}

                if hasattr(custom, 'aom_id'):
                    addon_info["custom_params"]["aom_id"] = custom.aom_id
                if hasattr(custom, 'aom_instance_id'):
                    addon_info["custom_params"]["aom_instance_id"] = custom.aom_instance_id
                if hasattr(custom, 'prom_instance_id'):
                    addon_info["custom_params"]["prom_instance_id"] = custom.prom_instance_id
                if hasattr(custom, 'remote_write_url'):
                    addon_info["custom_params"]["remote_write_url"] = custom.remote_write_url
                if hasattr(custom, 'remote_read_url'):
                    addon_info["custom_params"]["remote_read_url"] = custom.remote_read_url

                if isinstance(custom, dict):
                    addon_info["custom_params"] = custom
                    if 'aom_id' in custom:
                        addon_info["aom_id"] = custom['aom_id']
                    if 'aom_instance_id' in custom:
                        addon_info["aom_instance_id"] = custom['aom_instance_id']
                    if 'prom_instance_id' in custom:
                        addon_info["aom_instance_id"] = custom['prom_instance_id']

        if hasattr(response, 'metadata') and response.metadata:
            metadata = response.metadata
            addon_info["uid"] = getattr(metadata, 'uid', None)
            addon_info["creation_timestamp"] = str(getattr(metadata, 'creation_timestamp', None))

        return {
            "success": True,
            "region": region,
            "cluster_id": cluster_id,
            "action": "get_cce_addon_detail",
            "addon": addon_info
        }

    except ClientRequestException as e:
        return {
            "success": False,
            "error": f"{e.error_code} - {e.error_msg}",
            "request_id": getattr(e, 'request_id', None)
        }
    except Exception as e:
        return {
            "success": False,
            "error": str(e),
            "error_type": type(e).__name__
        }


def list_cce_addons(region: str, cluster_id: str, ak: Optional[str] = None, sk: Optional[str] = None, project_id: Optional[str] = None) -> Dict[str, Any]:
    """List addons (plugins) in a CCE cluster

    Args:
        region: Huawei Cloud region (e.g., cn-north-4)
        cluster_id: CCE cluster ID
        ak: Access Key ID (optional)
        sk: Secret Access Key (optional)
        project_id: Project ID (optional)

    Returns:
        Dictionary with addon list
    """
    access_key, secret_key, proj_id = get_credentials(ak, sk, project_id)

    if not access_key or not secret_key:
        return {
            "success": False,
            "error": "Credentials not provided. Set HUAWEI_AK and HUAWEI_SK environment variables or pass as parameters."
        }

    if not cluster_id:
        return {
            "success": False,
            "error": "cluster_id is required"
        }

    if not SDK_AVAILABLE:
        return {
            "success": False,
            "error": f"Huawei Cloud SDK not installed: {IMPORT_ERROR}"
        }

    try:
        client = create_cce_client(region, access_key, secret_key, proj_id)

        request = ListAddonInstancesRequest()
        request.cluster_id = cluster_id

        response = client.list_addon_instances(request)

        addons = []
        if hasattr(response, 'items') and response.items:
            for addon in response.items:
                addon_info = {
                    "name": addon.metadata.name if hasattr(addon, 'metadata') and hasattr(addon.metadata, 'name') else None,
                    "uid": addon.metadata.uid if hasattr(addon, 'metadata') and hasattr(addon.metadata, 'uid') else None,
                    "template_name": addon.spec.template_name if hasattr(addon, 'spec') and hasattr(addon.spec, 'template_name') else None,
                    "version": addon.spec.version if hasattr(addon, 'spec') and hasattr(addon.spec, 'version') else None,
                    "status": addon.status.status if hasattr(addon, 'status') and hasattr(addon.status, 'status') else None,
                    "description": addon.spec.description if hasattr(addon, 'spec') and hasattr(addon.spec, 'description') else None,
                    "created_at": str(addon.metadata.creation_timestamp) if hasattr(addon, 'metadata') and hasattr(addon.metadata, 'creation_timestamp') else None,
                }
                addons.append(addon_info)

        return {
            "success": True,
            "region": region,
            "cluster_id": cluster_id,
            "action": "list_cce_addons",
            "count": len(addons),
            "addons": addons
        }

    except ClientRequestException as e:
        return {
            "success": False,
            "error": f"{e.error_code} - {e.error_msg}",
            "request_id": getattr(e, 'request_id', None)
        }
    except Exception as e:
        return {
            "success": False,
            "error": str(e),
            "error_type": type(e).__name__
        }


def install_cce_addon(
    region: str,
    cluster_id: str,
    addon_template_name: str,
    addon_version: str,
    values: Dict[str, Any],
    ak: Optional[str] = None,
    sk: Optional[str] = None,
    project_id: Optional[str] = None
) -> Dict[str, Any]:
    """Install an addon to a CCE cluster

    Args:
        region: Huawei Cloud region (e.g., cn-north-4)
        cluster_id: CCE cluster ID
        addon_template_name: Addon template name (e.g., "coredns", "metrics-server")
        addon_version: Addon version to install
        values: Addon-specific configuration values
        ak: Access Key ID (optional)
        sk: Secret Access Key (optional)
        project_id: Project ID (optional)

    Returns:
        Dictionary with installation result
    """
    access_key, secret_key, proj_id = get_credentials(ak, sk, project_id)

    if not access_key or not secret_key:
        return {
            "success": False,
            "error": "Credentials not provided. Set HUAWEI_AK and HUAWEI_SK environment variables or pass as parameters."
        }

    if not cluster_id:
        return {
            "success": False,
            "error": "cluster_id is required"
        }

    if not addon_template_name:
        return {
            "success": False,
            "error": "addon_template_name is required"
        }

    if not addon_version:
        return {
            "success": False,
            "error": "addon_version is required"
        }

    if not SDK_AVAILABLE:
        return {
            "success": False,
            "error": f"Huawei Cloud SDK not installed: {IMPORT_ERROR}"
        }

    try:
        client = create_cce_client(region, access_key, secret_key, proj_id)

        metadata = AddonMetadata(
            annotations={"addon.install/type": "install"}
        )

        spec = InstanceSpec(
            cluster_id=cluster_id,
            version=addon_version,
            template_name=addon_template_name,
            values=values
        )

        body = AddonInstance(
            kind="Addon",
            api_version="v3",
            metadata=metadata,
            spec=spec
        )

        request = CreateAddonInstanceRequest()
        request.body = body

        response = client.create_addon_instance(request)

        addon_info = {}
        if hasattr(response, 'metadata') and response.metadata:
            addon_info["uid"] = getattr(response.metadata, 'uid', None)
            addon_info["name"] = getattr(response.metadata, 'name', None)

        return {
            "success": True,
            "region": region,
            "cluster_id": cluster_id,
            "action": "install_cce_addon",
            "addon_template_name": addon_template_name,
            "addon_version": addon_version,
            "addon": addon_info
        }

    except ClientRequestException as e:
        return {
            "success": False,
            "error": f"{e.error_code} - {e.error_msg}",
            "request_id": getattr(e, 'request_id', None)
        }
    except Exception as e:
        return {
            "success": False,
            "error": str(e),
            "error_type": type(e).__name__
        }


def uninstall_cce_addon(
    region: str,
    cluster_id: str,
    addon_id: str,
    confirm: bool,
    ak: Optional[str] = None,
    sk: Optional[str] = None,
    project_id: Optional[str] = None
) -> Dict[str, Any]:
    """Uninstall an addon from a CCE cluster

    Args:
        region: Huawei Cloud region (e.g., cn-north-4)
        cluster_id: CCE cluster ID
        addon_id: Addon ID (name or UID)
        confirm: Must be True to proceed with uninstallation
        ak: Access Key ID (optional)
        sk: Secret Access Key (optional)
        project_id: Project ID (optional)

    Returns:
        Dictionary with uninstallation result
    """
    if not confirm:
        return {
            "success": False,
            "error": "Uninstallation requires explicit confirmation. Set confirm=True to proceed."
        }

    access_key, secret_key, proj_id = get_credentials(ak, sk, project_id)

    if not access_key or not secret_key:
        return {
            "success": False,
            "error": "Credentials not provided. Set HUAWEI_AK and HUAWEI_SK environment variables or pass as parameters."
        }

    if not cluster_id:
        return {
            "success": False,
            "error": "cluster_id is required"
        }

    if not addon_id:
        return {
            "success": False,
            "error": "addon_id is required"
        }

    if not SDK_AVAILABLE:
        return {
            "success": False,
            "error": f"Huawei Cloud SDK not installed: {IMPORT_ERROR}"
        }

    try:
        client = create_cce_client(region, access_key, secret_key, proj_id)

        request = DeleteAddonInstanceRequest()
        request.cluster_id = cluster_id
        request.addon_name = addon_id

        client.delete_addon_instance(request)

        return {
            "success": True,
            "region": region,
            "cluster_id": cluster_id,
            "action": "uninstall_cce_addon",
            "addon_id": addon_id,
            "message": f"Addon {addon_id} uninstallation initiated"
        }

    except ClientRequestException as e:
        return {
            "success": False,
            "error": f"{e.error_code} - {e.error_msg}",
            "request_id": getattr(e, 'request_id', None)
        }
    except Exception as e:
        return {
            "success": False,
            "error": str(e),
            "error_type": type(e).__name__
        }


def update_cce_addon(
    region: str,
    cluster_id: str,
    addon_id: str,
    addon_version: str,
    values: Dict[str, Any],
    ak: Optional[str] = None,
    sk: Optional[str] = None,
    project_id: Optional[str] = None
) -> Dict[str, Any]:
    """Update an addon in a CCE cluster

    Args:
        region: Huawei Cloud region (e.g., cn-north-4)
        cluster_id: CCE cluster ID
        addon_id: Addon ID (name or UID)
        addon_version: New addon version
        values: Addon-specific configuration values
        ak: Access Key ID (optional)
        sk: Secret Access Key (optional)
        project_id: Project ID (optional)

    Returns:
        Dictionary with update result
    """
    access_key, secret_key, proj_id = get_credentials(ak, sk, project_id)

    if not access_key or not secret_key:
        return {
            "success": False,
            "error": "Credentials not provided. Set HUAWEI_AK and HUAWEI_SK environment variables or pass as parameters."
        }

    if not cluster_id:
        return {
            "success": False,
            "error": "cluster_id is required"
        }

    if not addon_id:
        return {
            "success": False,
            "error": "addon_id is required"
        }

    if not addon_version:
        return {
            "success": False,
            "error": "addon_version is required"
        }

    if not SDK_AVAILABLE:
        return {
            "success": False,
            "error": f"Huawei Cloud SDK not installed: {IMPORT_ERROR}"
        }

    try:
        client = create_cce_client(region, access_key, secret_key, proj_id)

        metadata = AddonMetadata(
            annotations={"addon.upgrade/type": "upgrade"}
        )

        spec = InstanceSpec(
            cluster_id=cluster_id,
            version=addon_version,
            values=values
        )

        body = AddonInstance(
            kind="Addon",
            api_version="v3",
            metadata=metadata,
            spec=spec
        )

        request = UpdateAddonInstanceRequest()
        request.addon_name = addon_id
        request.body = body

        response = client.update_addon_instance(request)

        addon_info = {}
        if hasattr(response, 'metadata') and response.metadata:
            addon_info["uid"] = getattr(response.metadata, 'uid', None)
            addon_info["name"] = getattr(response.metadata, 'name', None)

        return {
            "success": True,
            "region": region,
            "cluster_id": cluster_id,
            "action": "update_cce_addon",
            "addon_id": addon_id,
            "addon_version": addon_version,
            "addon": addon_info
        }

    except ClientRequestException as e:
        return {
            "success": False,
            "error": f"{e.error_code} - {e.error_msg}",
            "request_id": getattr(e, 'request_id', None)
        }
    except Exception as e:
        return {
            "success": False,
            "error": str(e),
            "error_type": type(e).__name__
        }

"""CCE Cluster management functions."""

import hashlib
import hmac
import time as time_module
import urllib.parse
from urllib.parse import quote, unquote
from typing import Any, Dict, List, Optional
import requests

from huaweicloudsdkcce.v3 import (
    CreateClusterRequest,
    DeleteClusterRequest,
    ListClustersRequest,
    ShowClusterRequest,
    HibernateClusterRequest,
    AwakeClusterRequest,
    Cluster,
    ClusterMetadata,
    ClusterSpec,
    ContainerNetwork,
    HostNetwork,
    ServiceNetwork,
    EniNetwork,
    NetworkSubnet,
)
from huaweicloudsdkcce.v3.region.cce_region import CceRegion
from huaweicloudsdkcore.auth.credentials import BasicCredentials
from huaweicloudsdkcore.exceptions.exceptions import ClientRequestException
from huaweicloudsdkvpc.v2 import ShowSubnetRequest
from huaweicloudsdkvpc.v2.region.vpc_region import VpcRegion
from .common import (
    get_credentials,
    get_credentials_with_region,
    create_cce_client,
    SDK_AVAILABLE,
    IMPORT_ERROR,
    _register_cert_file,
    _safe_delete_file,
)


def _resolve_neutron_subnet_id(region: str, vpc_subnet_id: str, ak: str, sk: str, project_id: Optional[str] = None) -> Optional[str]:
    """Resolve the Neutron subnet UUID from a VPC subnet UUID.

    CCE Turbo (ENI) clusters require the Neutron subnet UUID in the
    eniNetwork.subnets[].subnetID field, while HostNetwork.subnet uses
    the VPC subnet UUID. This helper queries the VPC API to obtain the
    neutron_subnet_id for a given VPC subnet.

    Args:
        region: Huawei Cloud region
        vpc_subnet_id: VPC subnet UUID (e.g., b8a2c56a-...)
        ak: Access Key
        sk: Secret Key
        project_id: Project ID (optional, will be resolved from region if not provided)

    Returns:
        Neutron subnet UUID string, or None if lookup fails
    """
    try:
        # Resolve project ID from region if not provided
        access_key, secret_key, proj_id = get_credentials_with_region(region, ak, sk, project_id)
        if not proj_id:
            return None
        from huaweicloudsdkvpc.v2 import VpcClient
        creds = BasicCredentials(ak=access_key, sk=secret_key, project_id=proj_id)
        vpc_client = VpcClient.new_builder() \
            .with_credentials(creds) \
            .with_endpoint(f'vpc.{region}.myhuaweicloud.com') \
            .build()
        req = ShowSubnetRequest(subnet_id=vpc_subnet_id)
        resp = vpc_client.show_subnet(req)
        if hasattr(resp, 'subnet') and hasattr(resp.subnet, 'neutron_subnet_id'):
            return resp.subnet.neutron_subnet_id
    except Exception:
        pass
    return None


def list_cce_clusters(region: str, ak: Optional[str] = None, sk: Optional[str] = None, project_id: Optional[str] = None, limit: int = 100, offset: int = 0) -> Dict[str, Any]:
    """List CCE clusters in the specified region with pagination"""
    access_key, secret_key, proj_id = get_credentials(ak, sk, project_id)

    if not access_key or not secret_key:
        return {
            "success": False,
            "error": "Credentials not provided. Set HUAWEI_AK and HUAWEI_SK environment variables or pass as parameters."
        }

    if not SDK_AVAILABLE:
        return {
            "success": False,
            "error": f"Huawei Cloud SDK not installed: {IMPORT_ERROR}"
        }

    try:
        client = create_cce_client(region, access_key, secret_key, proj_id)

        request = ListClustersRequest()

        response = client.list_clusters(request)

        clusters = []
        if hasattr(response, 'items') and response.items:
            for cluster in response.items:
                cluster_info = {
                    "id": cluster.metadata.uid,
                    "name": cluster.metadata.name,
                    "status": cluster.status.phase if hasattr(cluster, 'status') and hasattr(cluster.status, 'phase') else 'Unknown',
                    "type": cluster.spec.type if hasattr(cluster, 'spec') and hasattr(cluster.spec, 'type') else 'Unknown',
                    "version": cluster.spec.version if hasattr(cluster, 'spec') and hasattr(cluster.spec, 'version') else 'Unknown',
                    "created_at": str(cluster.metadata.creation_timestamp) if hasattr(cluster, 'metadata') and hasattr(cluster.metadata, 'creation_timestamp') else None,
                }
                if hasattr(cluster, 'spec') and hasattr(cluster.spec, 'network'):
                    cluster_info["network"] = {
                        "vpc_id": getattr(cluster.spec.network, 'vpc_id', None),
                        "subnet_id": getattr(cluster.spec.network, 'subnet_id', None),
                    }
                if hasattr(cluster, 'spec') and hasattr(cluster.spec, 'node'):
                    cluster_info["node_config"] = {
                        "flavor": getattr(cluster.spec.node, 'flavor', None),
                        "count": getattr(cluster.spec.node, 'initial_node_count', None),
                    }
                clusters.append(cluster_info)

        return {
            "success": True,
            "region": region,
            "action": "list_cce_clusters",
            "count": len(clusters),
            "clusters": clusters
        }

    except ClientRequestException as e:
        return {
            "success": False,
            "error": f"{e.error_code} - {e.error_msg}",
            "request_id": getattr(e, 'request_id', None)
        }
    except Exception as e:
        return {
            "success": False,
            "error": str(e),
            "error_type": type(e).__name__
        }


def get_cce_nodes(region: str, cluster_id: str, node_name: Optional[str] = None, ak: Optional[str] = None, sk: Optional[str] = None, project_id: Optional[str] = None) -> Dict[str, Any]:
    """Get detailed information about CCE cluster nodes
    
    Args:
        region: Huawei Cloud region (e.g., cn-north-4)
        cluster_id: CCE cluster ID
        node_name: Node name (optional, if not provided, returns all nodes)
        ak: Access Key ID (optional)
        sk: Secret Access Key (optional)
        project_id: Project ID (optional)

    Returns:
        Dictionary with node details
    """
    access_key, secret_key, proj_id = get_credentials(ak, sk, project_id)

    if not access_key or not secret_key:
        return {
            "success": False,
            "error": "Credentials not provided. Set HUAWEI_AK and HUAWEI_SK environment variables or pass as parameters."
        }

    if not cluster_id:
        return {
            "success": False,
            "error": "cluster_id is required"
        }

    if not SDK_AVAILABLE:
        return {
            "success": False,
            "error": f"Huawei Cloud SDK not installed: {IMPORT_ERROR}"
        }

    try:
        client = create_cce_client(region, access_key, secret_key, proj_id)

        request = ListNodesRequest()
        request.cluster_id = cluster_id

        response = client.list_nodes(request)

        nodes = []
        if hasattr(response, 'items') and response.items:
            for node in response.items:
                if node_name and node.metadata.name != node_name:
                    continue
                
                node_info = {
                    "id": node.metadata.uid,
                    "name": node.metadata.name,
                    "status": node.status.phase if hasattr(node, 'status') and hasattr(node.status, 'phase') else 'Unknown',
                    "created_at": str(node.metadata.creation_timestamp) if hasattr(node, 'metadata') and hasattr(node.metadata, 'creation_timestamp') else None,
                }
                if hasattr(node, 'spec'):
                    node_info["flavor"] = getattr(node.spec, 'flavor', None)
                    node_info["server_id"] = getattr(node.status, 'server_id', None)
                    node_info["availability_zone"] = getattr(node.spec, 'az', None)
                if hasattr(node, 'status') and hasattr(node.status, 'conditions'):
                    conditions = []
                    for cond in node.status.conditions:
                        conditions.append({
                            "type": cond.type,
                            "status": cond.status,
                            "reason": getattr(cond, 'reason', None),
                            "message": getattr(cond, 'message', None),
                        })
                    node_info["conditions"] = conditions
                if hasattr(node, 'status'):
                    node_info["allocatable"] = getattr(node.status, 'allocatable', None)
                    node_info["capacity"] = getattr(node.status, 'capacity', None)
                nodes.append(node_info)

        return {
            "success": True,
            "region": region,
            "cluster_id": cluster_id,
            "action": "get_cce_nodes",
            "node_name": node_name,
            "count": len(nodes),
            "nodes": nodes
        }

    except ClientRequestException as e:
        return {
            "success": False,
            "error": f"{e.error_code} - {e.error_msg}",
            "request_id": getattr(e, 'request_id', None)
        }
    except Exception as e:
        return {
            "success": False,
            "error": str(e),
            "error_type": type(e).__name__
        }


def get_cce_kubeconfig(region: str, cluster_id: str, ak: Optional[str] = None, sk: Optional[str] = None, project_id: Optional[str] = None, duration: int = 30) -> Dict[str, Any]:
    """Get kubeconfig for a CCE cluster

    Args:
        region: Huawei Cloud region (e.g., cn-north-4)
        cluster_id: CCE cluster ID
        ak: Access Key ID (optional)
        sk: Secret Access Key (optional)
        project_id: Project ID (optional)
        duration: Certificate validity duration in days (default: 30)

    Returns:
        Dictionary with kubeconfig content
    """
    access_key, secret_key, proj_id = get_credentials_with_region(region, ak, sk, project_id)

    if not access_key or not secret_key:
        return {
            "success": False,
            "error": "Credentials not provided. Set HUAWEI_AK and HUAWEI_SK environment variables or pass as parameters."
        }

    if not proj_id:
        return {
            "success": False,
            "error": "Project ID not found. Please provide project_id parameter."
        }

    if not cluster_id:
        return {
            "success": False,
            "error": "cluster_id is required"
        }

    if not SDK_AVAILABLE:
        return {
            "success": False,
            "error": f"Huawei Cloud SDK not installed: {IMPORT_ERROR}"
        }

    try:
        client = create_cce_client(region, access_key, secret_key, proj_id)
        
        cert_duration = ClusterCertDuration(duration=duration)
        request = CreateKubernetesClusterCertRequest(cluster_id=cluster_id)
        request.body = cert_duration
        
        response = client.create_kubernetes_cluster_cert(request)
        
        result = {
            "success": True,
            "region": region,
            "cluster_id": cluster_id,
            "action": "get_cce_kubeconfig",
            "duration_days": duration,
        }
        
        if hasattr(response, 'to_dict'):
            resp_dict = response.to_dict()
            
            result["kubeconfig"] = resp_dict
            
            if 'clusters' in resp_dict:
                result["cluster_endpoints"] = []
                for cluster in resp_dict['clusters']:
                    endpoint_info = {
                        "name": cluster.get('name'),
                        "server": cluster.get('cluster', {}).get('server')
                    }
                    result["cluster_endpoints"].append(endpoint_info)
            
            if 'current_context' in resp_dict:
                result["current_context"] = resp_dict['current_context']
            
            import yaml
            result["kubeconfig_yaml"] = yaml.dump(resp_dict, default_flow_style=False, allow_unicode=True)
        
        return result
        
    except Exception as e:
        return {
            "success": False,
            "error": str(e),
            "error_type": type(e).__name__
        }


def delete_cce_cluster(region: str, cluster_id: str, confirm: bool = False, delete_evs: bool = False, delete_net: bool = False, delete_obs: bool = False, ak: Optional[str] = None, sk: Optional[str] = None, project_id: Optional[str] = None) -> Dict[str, Any]:
    """Delete a CCE cluster

    IMPORTANT: This operation will delete the cluster and all its resources.
    User confirmation is required before deletion.

    Args:
        region: Huawei Cloud region (e.g., cn-north-4)
        cluster_id: CCE cluster ID to delete
        confirm: Must be set to True to confirm deletion (required)
        delete_evs: Whether to delete associated EVS volumes (default: False)
        delete_net: Whether to delete associated network resources (default: False)
        delete_obs: Whether to delete associated OBS buckets (default: False)
        ak: Access Key ID (optional)
        sk: Secret Access Key (optional)
        project_id: Project ID (optional)

    Returns:
        Dictionary with deletion result
    """
    access_key, secret_key, proj_id = get_credentials(ak, sk, project_id)

    if not access_key or not secret_key:
        return {
            "success": False,
            "error": "Credentials not provided. Set HUAWEI_AK and HUAWEI_SK environment variables or pass as parameters."
        }

    if not cluster_id:
        return {
            "success": False,
            "error": "cluster_id is required"
        }

    if not confirm:
        return {
            "success": False,
            "error": "Deletion not confirmed. To delete the cluster, please set confirm=true parameter.",
            "warning": "This operation will delete the cluster and all its resources (nodes, workloads, etc.). Are you sure you want to delete this cluster?",
            "hint": "Add confirm=true parameter to confirm deletion. Example: delete_cce_cluster region=cn-north-4 cluster_id=xxx confirm=true"
        }

    if not SDK_AVAILABLE:
        return {
            "success": False,
            "error": f"Huawei Cloud SDK not installed: {IMPORT_ERROR}"
        }

    try:
        client = create_cce_client(region, access_key, secret_key, proj_id)

        request = DeleteClusterRequest()
        request.cluster_id = cluster_id
        request.delete_evs = delete_evs
        request.delete_net = delete_net
        request.delete_obs = delete_obs

        response = client.delete_cluster(request)

        return {
            "success": True,
            "region": region,
            "cluster_id": cluster_id,
            "action": "delete_cce_cluster",
            "message": f"Cluster deletion request submitted successfully",
            "delete_evs": delete_evs,
            "delete_net": delete_net,
            "delete_obs": delete_obs,
            "response": response.to_dict() if hasattr(response, 'to_dict') else str(response)
        }

    except ClientRequestException as e:
        return {
            "success": False,
            "error": f"{e.error_code} - {e.error_msg}",
            "request_id": getattr(e, 'request_id', None)
        }
    except Exception as e:
        return {
            "success": False,
            "error": str(e),
            "error_type": type(e).__name__
        }


def hibernate_cce_cluster(
    region: str,
    cluster_id: str,
    ak: Optional[str] = None,
    sk: Optional[str] = None,
    project_id: Optional[str] = None,
    confirm: bool = False,
) -> Dict[str, Any]:
    """Hibernate a CCE cluster (pause billing + workloads)

    Puts the cluster into hibernated state. Billing for control plane is paused.
    Workloads are stopped. Use awake_cce_cluster to resume.

    Args:
        region: Huawei Cloud region (e.g., cn-north-4)
        cluster_id: CCE cluster ID
        ak: Access Key ID (optional)
        sk: Secret Access Key (optional)
        project_id: Project ID (optional)
        confirm: Must be True to confirm the operation

    Returns:
        Dictionary with result
    """
    access_key, secret_key, proj_id = get_credentials(ak, sk, project_id)

    if not access_key or not secret_key:
        return {
            "success": False,
            "error": "Credentials not provided. Set HUAWEI_AK and HUAWEI_SK environment variables or pass as parameters."
        }

    if not cluster_id:
        return {"success": False, "error": "cluster_id is required"}

    if not SDK_AVAILABLE:
        return {"success": False, "error": f"Huawei Cloud SDK not installed: {IMPORT_ERROR}"}

    if not confirm:
        return {
            "success": False,
            "requires_confirmation": True,
            "operation": "hibernate_cce_cluster",
            "cluster_id": cluster_id,
            "error": f"Hibernate will pause cluster {cluster_id} and stop all workloads. Billing for control plane is paused.",
            "hint": f"Add confirm=true to confirm. Example: huawei_hibernate_cce_cluster region=cn-north-4 cluster_id=xxx confirm=true"
        }

    try:
        client = create_cce_client(region, access_key, secret_key, proj_id)
        request = HibernateClusterRequest()
        request.cluster_id = cluster_id
        response = client.hibernate_cluster(request)

        return {
            "success": True,
            "region": region,
            "cluster_id": cluster_id,
            "action": "hibernate_cce_cluster",
            "message": "Cluster hibernation request submitted successfully",
            "status_code": response.status_code if hasattr(response, "status_code") else None,
        }

    except ClientRequestException as e:
        return {
            "success": False,
            "error": f"{e.error_code} - {e.error_msg}",
            "request_id": getattr(e, "request_id", None),
        }
    except Exception as e:
        return {
            "success": False,
            "error": str(e),
            "error_type": type(e).__name__,
        }


def awake_cce_cluster(
    region: str,
    cluster_id: str,
    ak: Optional[str] = None,
    sk: Optional[str] = None,
    project_id: Optional[str] = None,
    confirm: bool = False,
) -> Dict[str, Any]:
    """Awake a hibernated CCE cluster (resume billing + workloads)

    Wakes up a previously hibernated cluster. Billing for control plane resumes
    and workloads will be restarted.

    Args:
        region: Huawei Cloud region (e.g., cn-north-4)
        cluster_id: CCE cluster ID
        ak: Access Key ID (optional)
        sk: Secret Access Key (optional)
        project_id: Project ID (optional)
        confirm: Must be True to confirm the operation

    Returns:
        Dictionary with result
    """
    access_key, secret_key, proj_id = get_credentials(ak, sk, project_id)

    if not access_key or not secret_key:
        return {
            "success": False,
            "error": "Credentials not provided. Set HUAWEI_AK and HUAWEI_SK environment variables or pass as parameters."
        }

    if not cluster_id:
        return {"success": False, "error": "cluster_id is required"}

    if not SDK_AVAILABLE:
        return {"success": False, "error": f"Huawei Cloud SDK not installed: {IMPORT_ERROR}"}

    if not confirm:
        return {
            "success": False,
            "requires_confirmation": True,
            "operation": "awake_cce_cluster",
            "cluster_id": cluster_id,
            "error": f"Awake will resume cluster {cluster_id}. Control plane billing resumes and workloads restart.",
            "hint": f"Add confirm=true to confirm. Example: huawei_awake_cce_cluster region=cn-north-4 cluster_id=xxx confirm=true"
        }

    try:
        client = create_cce_client(region, access_key, secret_key, proj_id)
        request = AwakeClusterRequest()
        request.cluster_id = cluster_id
        response = client.awake_cluster(request)

        return {
            "success": True,
            "region": region,
            "cluster_id": cluster_id,
            "action": "awake_cce_cluster",
            "message": "Cluster awake request submitted successfully",
            "status_code": response.status_code if hasattr(response, "status_code") else None,
        }

    except ClientRequestException as e:
        return {
            "success": False,
            "error": f"{e.error_code} - {e.error_msg}",
            "request_id": getattr(e, "request_id", None),
        }
    except Exception as e:
        return {
            "success": False,
            "error": str(e),
            "error_type": type(e).__name__,
        }


def bind_cce_cluster_eip(
    region: str,
    cluster_id: str,
    eip_id: str,
    ak: Optional[str] = None,
    sk: Optional[str] = None,
    project_id: Optional[str] = None,
) -> Dict[str, Any]:
    """Bind an EIP to a CCE cluster master node for public API access

    Associates an existing Elastic IP with the cluster's control plane,
    enabling public access to the Kubernetes API server.

    Args:
        region: Huawei Cloud region (e.g., cn-north-4)
        cluster_id: CCE cluster ID
        eip_id: EIP resource ID to bind (use huawei_list_eip to find available EIPs)
        ak: Access Key ID (optional)
        sk: Secret Access Key (optional)
        project_id: Project ID (optional)

    Returns:
        Dictionary with result including the public endpoint URL
    """
    access_key, secret_key, proj_id = get_credentials(ak, sk, project_id)

    if not access_key or not secret_key:
        return {
            "success": False,
            "error": "Credentials not provided. Set HUAWEI_AK and HUAWEI_SK environment variables or pass as parameters."
        }

    if not cluster_id:
        return {"success": False, "error": "cluster_id is required"}

    if not eip_id:
        return {"success": False, "error": "eip_id is required"}

    if not SDK_AVAILABLE:
        return {"success": False, "error": f"Huawei Cloud SDK not installed: {IMPORT_ERROR}"}

    try:
        client = create_cce_client(region, access_key, secret_key, proj_id)

        spec_spec = MasterEIPRequestSpecSpec(id=eip_id)
        spec = MasterEIPRequestSpec(action="bind", spec=spec_spec)
        body = MasterEIPRequest(spec=spec)
        request = UpdateClusterEipRequest(cluster_id=cluster_id, body=body)

        client.update_cluster_eip(request)

        resp = client.show_cluster(ShowClusterRequest(cluster_id=cluster_id))
        public_url = None
        if hasattr(resp, 'status') and hasattr(resp.status, 'endpoints'):
            for ep in resp.status.endpoints:
                if ep.type == "External":
                    public_url = ep.url
                    break

        result = {
            "success": True,
            "region": region,
            "cluster_id": cluster_id,
            "action": "bind_cce_cluster_eip",
            "eip_id": eip_id,
            "message": "EIP bound to cluster master successfully",
        }
        if public_url:
            result["public_endpoint"] = public_url

        return result

    except ClientRequestException as e:
        return {
            "success": False,
            "error": f"{e.error_code} - {e.error_msg}",
            "request_id": getattr(e, "request_id", None),
        }
    except Exception as e:
        return {
            "success": False,
            "error": str(e),
            "error_type": type(e).__name__,
        }


def unbind_cce_cluster_eip(
    region: str,
    cluster_id: str,
    ak: Optional[str] = None,
    sk: Optional[str] = None,
    project_id: Optional[str] = None,
) -> Dict[str, Any]:
    """Unbind the EIP from a CCE cluster master node

    Removes the Elastic IP association from the cluster's control plane,
    disabling public access to the Kubernetes API server.

    Args:
        region: Huawei Cloud region (e.g., cn-north-4)
        cluster_id: CCE cluster ID
        ak: Access Key ID (optional)
        sk: Secret Access Key (optional)
        project_id: Project ID (optional)

    Returns:
        Dictionary with result
    """
    access_key, secret_key, proj_id = get_credentials(ak, sk, project_id)

    if not access_key or not secret_key:
        return {
            "success": False,
            "error": "Credentials not provided. Set HUAWEI_AK and HUAWEI_SK environment variables or pass as parameters."
        }

    if not cluster_id:
        return {"success": False, "error": "cluster_id is required"}

    if not SDK_AVAILABLE:
        return {"success": False, "error": f"Huawei Cloud SDK not installed: {IMPORT_ERROR}"}

    try:
        client = create_cce_client(region, access_key, secret_key, proj_id)

        spec = MasterEIPRequestSpec(action="unbind")
        body = MasterEIPRequest(spec=spec)
        request = UpdateClusterEipRequest(cluster_id=cluster_id, body=body)

        client.update_cluster_eip(request)

        return {
            "success": True,
            "region": region,
            "cluster_id": cluster_id,
            "action": "unbind_cce_cluster_eip",
            "message": "EIP unbound from cluster master successfully",
        }

    except ClientRequestException as e:
        return {
            "success": False,
            "error": f"{e.error_code} - {e.error_msg}",
            "request_id": getattr(e, "request_id", None),
        }
    except Exception as e:
        return {
            "success": False,
            "error": str(e),
            "error_type": type(e).__name__,
        }


def create_cce_cluster(
    region: str,
    cluster_name: str,
    vpc_id: str,
    subnet_id: str,
    cluster_version: Optional[str] = None,
    cluster_type: str = "VirtualMachine",
    container_network_type: str = "overlay_l2",
    container_network_cidr: Optional[str] = None,
    service_network_cidr: Optional[str] = None,
    flavor_id: Optional[str] = None,
    description: Optional[str] = None,
    eni_subnet_id: Optional[str] = None,
    ak: Optional[str] = None,
    sk: Optional[str] = None,
    project_id: Optional[str] = None,
) -> Dict[str, Any]:
    """Create a new CCE cluster

    Creates a Cloud Container Engine cluster with specified configuration.
    If cluster_version is not specified, CCE will use the latest supported version.

    Args:
        region: Huawei Cloud region (e.g., cn-north-4)
        cluster_name: Name of the cluster to create
        vpc_id: VPC ID where the cluster will be created
        subnet_id: Subnet ID for the cluster
        cluster_version: Kubernetes version (optional, defaults to latest if not specified)
        cluster_type: Cluster type (default: "VirtualMachine", use "VirtualMachine" + eni network for Turbo)
        container_network_type: Container network type (default: "overlay_l2", use "eni" for Turbo clusters)
        container_network_cidr: Container network CIDR (optional, e.g., "172.16.0.0/16")
        service_network_cidr: Service network CIDR (optional, e.g., "10.247.0.0/16")
        flavor_id: Cluster flavor ID (optional, determines control plane specs)
        description: Cluster description (optional)
        eni_subnet_id: ENI subnet ID for Turbo clusters (required when container_network_type="eni")
        ak: Access Key ID (optional)
        sk: Secret Access Key (optional)
        project_id: Project ID (optional)

    Returns:
        Dictionary with cluster creation result
    """
    access_key, secret_key, proj_id = get_credentials(ak, sk, project_id)

    if not access_key or not secret_key:
        return {
            "success": False,
            "error": "Credentials not provided. Set HUAWEI_AK and HUAWEI_SK environment variables or pass as parameters."
        }

    if not cluster_name:
        return {"success": False, "error": "cluster_name is required"}

    if not vpc_id:
        return {"success": False, "error": "vpc_id is required"}

    if not subnet_id:
        return {"success": False, "error": "subnet_id is required"}

    if not SDK_AVAILABLE:
        return {"success": False, "error": f"Huawei Cloud SDK not installed: {IMPORT_ERROR}"}

    try:
        client = create_cce_client(region, access_key, secret_key, proj_id)

        cluster_metadata = ClusterMetadata(name=cluster_name)
        if description:
            cluster_metadata.annotations = {"description": description}

        host_network = HostNetwork(vpc=vpc_id, subnet=subnet_id)
        container_network = ContainerNetwork(mode=container_network_type)
        if container_network_cidr:
            container_network.cidr = container_network_cidr

        cluster_spec = ClusterSpec(
            type=cluster_type,
            host_network=host_network,
            container_network=container_network,
        )

        if cluster_version:
            cluster_spec.version = cluster_version

        if flavor_id:
            cluster_spec.flavor_id = flavor_id

        # Set eni_network for Turbo clusters (container_network_type="eni")
        # IMPORTANT: CCE Turbo (ENI) clusters require the **Neutron subnet UUID**
        # in eniNetwork.subnets[].subnetID, NOT the VPC subnet UUID.
        # The HostNetwork.subnet field uses the VPC subnet UUID, but the ENI
        # subnet validation checks against Neutron subnet IDs. If the VPC
        # subnet ID is provided, we automatically resolve its Neutron UUID.
        if container_network_type == "eni":
            eni_net_subnet_id = eni_subnet_id or subnet_id
            # If eni_net_subnet_id looks like a VPC subnet UUID (not a Neutron one),
            # resolve the Neutron subnet UUID via the VPC API.
            neutron_id = _resolve_neutron_subnet_id(
                region, eni_net_subnet_id, access_key, secret_key, proj_id
            )
            if neutron_id:
                cluster_spec.eni_network = EniNetwork(
                    subnets=[NetworkSubnet(subnet_id=neutron_id)]
                )
            else:
                # Fallback: use the provided ID directly (may be a Neutron UUID already)
                cluster_spec.eni_network = EniNetwork(
                    subnets=[NetworkSubnet(subnet_id=eni_net_subnet_id)]
                )

        if service_network_cidr:
            cluster_spec.service_network = ServiceNetwork(i_pv4_cidr=service_network_cidr)

        cluster_body = Cluster(
            kind="Cluster",
            api_version="v3",
            metadata=cluster_metadata,
            spec=cluster_spec,
        )

        request = CreateClusterRequest(body=cluster_body)

        response = client.create_cluster(request)

        cluster_id = None
        cluster_name_result = cluster_name
        actual_version = cluster_version or "latest (API default)"
        if hasattr(response, 'metadata'):
            cluster_id = getattr(response.metadata, 'uid', None)
            cluster_name_result = getattr(response.metadata, 'name', cluster_name)
        if hasattr(response, 'spec') and hasattr(response.spec, 'version'):
            actual_version = response.spec.version

        return {
            "success": True,
            "region": region,
            "action": "create_cce_cluster",
            "cluster_id": cluster_id,
            "cluster_name": cluster_name_result,
            "cluster_version": actual_version,
            "cluster_type": cluster_type,
            "vpc_id": vpc_id,
            "subnet_id": subnet_id,
            "container_network_type": container_network_type,
            "container_network_cidr": container_network_cidr,
            "service_network_cidr": service_network_cidr,
            "flavor_id": flavor_id,
            "message": "Cluster creation request submitted successfully",
            "response": response.to_dict() if hasattr(response, 'to_dict') else str(response),
        }

    except ClientRequestException as e:
        return {
            "success": False,
            "error": f"{e.error_code} - {e.error_msg}",
            "request_id": getattr(e, "request_id", None),
        }
    except Exception as e:
        return {
            "success": False,
            "error": str(e),
            "error_type": type(e).__name__,
        }

"""CCE Node management functions."""

from typing import Any, Dict, List, Optional
from .common import (
    get_credentials,
    create_cce_client,
    SDK_AVAILABLE,
    IMPORT_ERROR,
    K8S_AVAILABLE,
    K8S_IMPORT_ERROR,
)
from huaweicloudsdkcore.exceptions.exceptions import ClientRequestException


def list_cce_nodes(
    region: str,
    cluster_id: str,
    ak: Optional[str] = None,
    sk: Optional[str] = None,
    project_id: Optional[str] = None,
    limit: int = 100,
    offset: int = 0,
) -> Dict[str, Any]:
    """List nodes in a CCE cluster with pagination"""
    access_key, secret_key, proj_id = get_credentials(ak, sk, project_id)

    if not access_key or not secret_key:
        return {
            "success": False,
            "error": "Credentials not provided. Set HUAWEI_AK and HUAWEI_SK environment variables or pass as parameters.",
        }

    if not cluster_id:
        return {"success": False, "error": "cluster_id is required"}

    if not SDK_AVAILABLE:
        return {"success": False, "error": f"Huawei Cloud SDK not installed: {IMPORT_ERROR}"}

    try:
        from huaweicloudsdkcce.v3 import ListNodesRequest

        client = create_cce_client(region, access_key, secret_key, proj_id)

        request = ListNodesRequest()
        request.cluster_id = cluster_id

        response = client.list_nodes(request)

        nodes = []
        if hasattr(response, "items") and response.items:
            for node in response.items:
                node_info = {
                    "id": node.metadata.uid,
                    "name": node.metadata.name,
                    "status": node.status.phase
                    if hasattr(node, "status") and hasattr(node.status, "phase")
                    else "Unknown",
                    "created_at": str(node.metadata.creation_timestamp)
                    if hasattr(node, "metadata") and hasattr(node.metadata, "creation_timestamp")
                    else None,
                    "labels": dict(node.metadata.labels)
                    if hasattr(node.metadata, "labels") and node.metadata.labels
                    else {},
                }
                if hasattr(node, "spec"):
                    node_info["flavor"] = getattr(node.spec, "flavor", None)
                    node_info["server_id"] = getattr(node.status, "server_id", None)
                    node_info["availability_zone"] = getattr(node.spec, "az", None)
                if hasattr(node, "status") and hasattr(node.status, "conditions"):
                    conditions = []
                    for cond in node.status.conditions:
                        conditions.append({
                            "type": cond.type,
                            "status": cond.status,
                            "reason": getattr(cond, "reason", None),
                        })
                    node_info["conditions"] = conditions
                nodes.append(node_info)

        return {
            "success": True,
            "region": region,
            "cluster_id": cluster_id,
            "action": "list_cce_nodes",
            "count": len(nodes),
            "nodes": nodes,
        }

    except ClientRequestException as e:
        return {
            "success": False,
            "error": f"{e.error_code} - {e.error_msg}",
            "request_id": getattr(e, "request_id", None),
        }
    except Exception as e:
        return {"success": False, "error": str(e), "error_type": type(e).__name__}


def delete_cce_node(
    region: str,
    cluster_id: str,
    node_id: str,
    confirm: bool = False,
    scale_down: bool = True,
    ak: Optional[str] = None,
    sk: Optional[str] = None,
    project_id: Optional[str] = None,
) -> Dict[str, Any]:
    """Delete a node from CCE cluster

    IMPORTANT: This operation will delete the node and all its pods.
    User confirmation is required before deletion.

    Args:
        region: Huawei Cloud region (e.g., cn-north-4)
        cluster_id: CCE cluster ID
        node_id: Node ID to delete
        confirm: Must be set to True to confirm deletion (required)
        scale_down: Whether to scale down pods before deleting (default: True)
        ak: Access Key ID (optional)
        sk: Secret Access Key (optional)
        project_id: Project ID (optional)

    Returns:
        Dictionary with deletion result
    """
    access_key, secret_key, proj_id = get_credentials(ak, sk, project_id)

    if not access_key or not secret_key:
        return {
            "success": False,
            "error": "Credentials not provided. Set HUAWEI_AK and HUAWEI_SK environment variables or pass as parameters.",
        }

    if not cluster_id:
        return {"success": False, "error": "cluster_id is required"}

    if not node_id:
        return {"success": False, "error": "node_id is required"}

    if not confirm:
        return {
            "success": False,
            "error": "Deletion not confirmed. To delete the node, please set confirm=true parameter.",
            "warning": f"This operation will delete the node '{node_id}' from cluster '{cluster_id}'. All pods on this node will be terminated. Are you sure?",
            "hint": "Add confirm=true parameter to confirm deletion. Example: delete_cce_node region=cn-north-4 cluster_id=xxx node_id=yyy confirm=true",
        }

    if not SDK_AVAILABLE:
        return {"success": False, "error": f"Huawei Cloud SDK not installed: {IMPORT_ERROR}"}

    try:
        from huaweicloudsdkcce.v3 import DeleteNodeRequest

        client = create_cce_client(region, access_key, secret_key, proj_id)

        request = DeleteNodeRequest()
        request.cluster_id = cluster_id
        request.node_id = node_id
        request.nodepool_scale_down = scale_down

        response = client.delete_node(request)

        return {
            "success": True,
            "region": region,
            "cluster_id": cluster_id,
            "node_id": node_id,
            "action": "delete_cce_node",
            "message": "Node deletion request submitted successfully",
            "scale_down": scale_down,
            "response": response.to_dict() if hasattr(response, "to_dict") else str(response),
        }

    except ClientRequestException as e:
        return {
            "success": False,
            "error": f"{e.error_code} - {e.error_msg}",
            "request_id": getattr(e, "request_id", None),
        }
    except Exception as e:
        return {"success": False, "error": str(e), "error_type": type(e).__name__}


def _node_operation(
    region: str,
    cluster_id: str,
    node_name: str,
    operation: str,
    confirm: bool = False,
    ak: Optional[str] = None,
    sk: Optional[str] = None,
    project_id: str = None,
) -> Dict[str, Any]:
    """Internal helper for CCE node operations (cordon/uncordon/drain/status)

    Args:
        region: Huawei Cloud region
        cluster_id: CCE cluster ID
        node_name: Node name or IP address
        operation: One of 'cordon', 'uncordon', 'drain', 'status'
        confirm: Required for write operations (cordon/uncordon/drain)
        ak: Access Key ID (optional)
        sk: Secret Access Key (optional)
        project_id: Project ID (optional)

    Returns:
        Dictionary with operation result
    """
    access_key, secret_key, proj_id = get_credentials(ak, sk, project_id)

    if not access_key or not secret_key:
        return {"success": False, "error": "Credentials not provided."}

    if not K8S_AVAILABLE:
        return {"success": False, "error": f"Kubernetes SDK not installed: {K8S_IMPORT_ERROR}"}

    ca_cert_file = client_cert_file = client_key_file = None

    try:
        cce_client = create_cce_client(region, access_key, secret_key, proj_id)
        from huaweicloudsdkcce.v3 import CreateKubernetesClusterCertRequest, ClusterCertDuration

        cert_req = CreateKubernetesClusterCertRequest(cluster_id=cluster_id)
        cert_req.body = ClusterCertDuration(duration=1)
        kubeconfig_data = cce_client.create_kubernetes_cluster_cert(cert_req).to_dict()

        import tempfile
        import os
        import yaml
        import base64
        import kubernetes as k8s
        from kubernetes.client import Configuration, CoreV1Api

        raw_kc = kubeconfig_data.get("kubeconfig") or kubeconfig_data.get("content", "") or kubeconfig_data
        kc = yaml.safe_load(raw_kc) if isinstance(raw_kc, str) and raw_kc else raw_kc
        current_ctx = kc.get("current_context", "")
        ctx_entry = next((c for c in kc.get("contexts", []) if c["name"] == current_ctx), None)
        if not ctx_entry:
            return {"success": False, "error": f"Context '{current_ctx}' not found in kubeconfig"}
        cluster_name = ctx_entry["context"]["cluster"]
        user_name = ctx_entry["context"]["user"]

        cluster_entry = next((c for c in kc.get("clusters", []) if c["name"] == cluster_name), None)
        if not cluster_entry:
            return {"success": False, "error": f"Cluster '{cluster_name}' not found in kubeconfig"}
        cluster_cfg = cluster_entry["cluster"]

        user_entry = next((u for u in kc.get("users", []) if u["name"] == user_name), None)
        if not user_entry:
            return {"success": False, "error": f"User '{user_name}' not found in kubeconfig"}
        user_cfg = user_entry["user"]

        server = cluster_cfg.get("server", "")

        ca_data = cluster_cfg.get("certificate_authority_data")
        if ca_data:
            with tempfile.NamedTemporaryFile(mode="w", suffix=".crt", delete=False) as f:
                f.write(base64.b64decode(ca_data).decode())
                ca_cert_file = f.name

        cert_data = user_cfg.get("client_certificate_data")
        key_data = user_cfg.get("client_key_data")
        if cert_data and key_data:
            with tempfile.NamedTemporaryFile(mode="w", suffix=".crt", delete=False) as f:
                f.write(base64.b64decode(cert_data).decode())
                client_cert_file = f.name
            with tempfile.NamedTemporaryFile(mode="w", suffix=".key", delete=False) as f:
                f.write(base64.b64decode(key_data).decode())
                client_key_file = f.name

        skip_tls = cluster_cfg.get("insecure_skip_tls_verify", False)

        config = Configuration()
        config.host = server
        config.verify_ssl = not skip_tls
        if ca_cert_file:
            config.ssl_ca_cert = ca_cert_file
        if client_cert_file:
            config.cert_file = client_cert_file
        if client_key_file:
            config.key_file = client_key_file

        api_client = k8s.client.ApiClient(config)
        core_v1 = CoreV1Api(api_client)

        if operation == "status":
            node = core_v1.read_node(node_name)
            conditions = {c.type: c.status for c in node.status.conditions}
            node_labels = dict(node.metadata.labels) if node.metadata.labels else {}
            return {
                "success": True,
                "operation": "status",
                "node": node_name,
                "schedulable": node.spec.unschedulable is None,
                "ready": conditions.get("Ready") == "True",
                "conditions": conditions,
                "os_version": node_labels.get("node.kubernetes.io/os_version", ""),
                "kernel_version": node_labels.get("node.kubernetes.io/kernel_version", ""),
            }
        elif operation == "cordon":
            if not confirm:
                return {
                    "success": False,
                    "requires_confirmation": True,
                    "operation": "cordon",
                    "node": node_name,
                    "error": f"Cordon will mark node {node_name} as unschedulable.",
                    "hint": f"Add confirm=true to confirm. Example: cce_node_cordon region=cn-north-4 cluster_id=xxx node_name=192.168.x.x confirm=true",
                }
            core_v1.patch_node(node_name, {"spec": {"unschedulable": True}})
            return {
                "success": True,
                "operation": "cordon",
                "node": node_name,
                "message": "Node marked as unschedulable",
            }
        elif operation == "uncordon":
            if not confirm:
                return {
                    "success": False,
                    "requires_confirmation": True,
                    "operation": "uncordon",
                    "node": node_name,
                    "error": f"Uncordon will mark node {node_name} as schedulable. New pods may be immediately assigned.",
                    "hint": f"Add confirm=true to confirm. Example: cce_node_uncordon region=cn-north-4 cluster_id=xxx node_name=192.168.x.x confirm=true",
                }
            core_v1.patch_node(node_name, {"spec": {"unschedulable": None}})
            return {
                "success": True,
                "operation": "uncordon",
                "node": node_name,
                "message": "Node marked as schedulable",
            }
        elif operation == "drain":
            if not confirm:
                pods_preview = core_v1.list_pod_for_all_namespaces(
                    field_selector=f"spec.nodeName={node_name}"
                ).items
                affected = [
                    f"{p.metadata.namespace}/{p.metadata.name}"
                    for p in pods_preview
                    if p.metadata.namespace not in ("kube-system", "hss", "monitoring")
                ]
                return {
                    "success": False,
                    "requires_confirmation": True,
                    "operation": "drain",
                    "node": node_name,
                    "affected_pods": affected,
                    "error": f"Drain will delete {len(affected)} non-system pods on node {node_name}.",
                    "hint": f"Add confirm=true to confirm. Example: cce_node_drain region=cn-north-4 cluster_id=xxx node_name=192.168.x.x confirm=true",
                }
            skip_ns = set(["kube-system", "hss", "monitoring"])
            grace = 30
            pods = core_v1.list_pod_for_all_namespaces(
                field_selector=f"spec.nodeName={node_name}"
            ).items
            deleted, skipped = [], []
            for p in pods:
                ns, pname = p.metadata.namespace, p.metadata.name
                if ns in skip_ns:
                    skipped.append(f"{ns}/{pname}")
                    continue
                try:
                    body = k8s.client.V1DeleteOptions(grace_period_seconds=grace)
                    core_v1.delete_namespaced_pod(pname, ns, body=body)
                    deleted.append(f"{ns}/{pname}")
                except Exception as e:
                    skipped.append(f"{ns}/{pname} ({e})"[:100])
            return {
                "success": True,
                "operation": "drain",
                "node": node_name,
                "deleted": deleted,
                "skipped": skipped,
            }
        else:
            return {"success": False, "error": f"Unknown operation: {operation}"}
    except ClientRequestException as e:
        return {
            "success": False,
            "error": f"{e.error_code} - {e.error_msg}",
            "request_id": getattr(e, "request_id", None),
        }
    except Exception as e:
        return {"success": False, "error": str(e), "error_type": type(e).__name__}
    finally:
        for f in [ca_cert_file, client_cert_file, client_key_file]:
            if f and os.path.exists(f):
                try:
                    os.unlink(f)
                except Exception:
                    pass


def cce_node_cordon(
    region: str,
    cluster_id: str,
    node_name: str,
    confirm: bool = False,
    ak: Optional[str] = None,
    sk: Optional[str] = None,
    project_id: str = None,
) -> Dict[str, Any]:
    """Mark CCE node as unschedulable (cordon)

    Args:
        region: Huawei Cloud region
        cluster_id: CCE cluster ID
        node_name: Node name or IP address
        confirm: Must be True to confirm the operation
        ak: Access Key ID (optional)
        sk: Secret Access Key (optional)
        project_id: Project ID (optional)

    Returns:
        Dictionary with operation result
    """
    return _node_operation(
        region,
        cluster_id,
        node_name,
        "cordon",
        confirm=confirm,
        ak=ak,
        sk=sk,
        project_id=project_id,
    )


def cce_node_uncordon(
    region: str,
    cluster_id: str,
    node_name: str,
    confirm: bool = False,
    ak: Optional[str] = None,
    sk: Optional[str] = None,
    project_id: str = None,
) -> Dict[str, Any]:
    """Mark CCE node as schedulable (uncordon)

    Args:
        region: Huawei Cloud region
        cluster_id: CCE cluster ID
        node_name: Node name or IP address
        confirm: Must be True to confirm the operation
        ak: Access Key ID (optional)
        sk: Secret Access Key (optional)
        project_id: Project ID (optional)

    Returns:
        Dictionary with operation result
    """
    return _node_operation(
        region,
        cluster_id,
        node_name,
        "uncordon",
        confirm=confirm,
        ak=ak,
        sk=sk,
        project_id=project_id,
    )


def cce_node_drain(
    region: str,
    cluster_id: str,
    node_name: str,
    confirm: bool = False,
    ak: Optional[str] = None,
    sk: Optional[str] = None,
    project_id: str = None,
) -> Dict[str, Any]:
    """Drain CCE node (evict all non-system pods)

    Args:
        region: Huawei Cloud region
        cluster_id: CCE cluster ID
        node_name: Node name or IP address
        confirm: Must be True to confirm the operation
        ak: Access Key ID (optional)
        sk: Secret Access Key (optional)
        project_id: Project ID (optional)

    Returns:
        Dictionary with operation result
    """
    return _node_operation(
        region,
        cluster_id,
        node_name,
        "drain",
        confirm=confirm,
        ak=ak,
        sk=sk,
        project_id=project_id,
    )


def cce_node_status(
    region: str,
    cluster_id: str,
    node_name: str,
    ak: Optional[str] = None,
    sk: Optional[str] = None,
    project_id: str = None,
) -> Dict[str, Any]:
    """Query CCE node schedulability status

    Args:
        region: Huawei Cloud region
        cluster_id: CCE cluster ID
        node_name: Node name or IP address
        ak: Access Key ID (optional)
        sk: Secret Access Key (optional)
        project_id: Project ID (optional)

    Returns:
        Dictionary with node status (schedulable, ready, conditions)
    """
    return _node_operation(
        region,
        cluster_id,
        node_name,
        "status",
        confirm=True,
        ak=ak,
        sk=sk,
        project_id=project_id,
    )


def create_cce_node(
    region: str,
    cluster_id: str,
    flavor: str,
    availability_zone: str,
    root_volume_size: int = 40,
    root_volume_type: str = "SSD",
    node_count: int = 1,
    os_type: str = "EulerOS 2.9",
    ssh_key: Optional[str] = None,
    password: Optional[str] = None,
    data_volumes: Optional[List[Dict[str, Any]]] = None,
    subnet_id: Optional[str] = None,
    ak: Optional[str] = None,
    sk: Optional[str] = None,
    project_id: Optional[str] = None,
) -> Dict[str, Any]:
    """Create nodes in a CCE cluster

    Args:
        region: Huawei Cloud region (e.g., cn-north-4)
        cluster_id: CCE cluster ID
        flavor: Node flavor (e.g., c6.large.2)
        availability_zone: Availability zone (e.g., cn-north-4a)
        root_volume_size: Root volume size in GB (default: 40)
        root_volume_type: Root volume type (default: SSD)
        node_count: Number of nodes to create (default: 1)
        os_type: Operating system type (default: EulerOS 2.9)
        ssh_key: SSH key pair name for login
        password: Password for login (used if ssh_key not provided)
        data_volumes: List of data volume configs [{"size": 100, "type": "SSD"}]
        subnet_id: Subnet ID for the node
        ak: Access Key ID (optional)
        sk: Secret Access Key (optional)
        project_id: Project ID (optional)

    Returns:
        Dictionary with creation result
    """
    access_key, secret_key, proj_id = get_credentials(ak, sk, project_id)

    if not access_key or not secret_key:
        return {
            "success": False,
            "error": "Credentials not provided. Set HUAWEI_AK and HUAWEI_SK environment variables or pass as parameters.",
        }

    if not cluster_id:
        return {"success": False, "error": "cluster_id is required"}

    if not flavor:
        return {"success": False, "error": "flavor is required"}

    if not availability_zone:
        return {"success": False, "error": "availability_zone is required"}

    if not SDK_AVAILABLE:
        return {"success": False, "error": f"Huawei Cloud SDK not installed: {IMPORT_ERROR}"}

    try:
        from huaweicloudsdkcce.v3 import (
            CreateNodeRequest,
            CreateNodeRequestBody,
            NodeMetadata,
            NodeSpec,
            Volume,
            Login,
            UserPassword,
            NodeNicSpec,
        )

        client = create_cce_client(region, access_key, secret_key, proj_id)

        root_volume = Volume(size=root_volume_size, volumetype=root_volume_type)

        data_volume_list = []
        if data_volumes:
            for vol in data_volumes:
                data_volume_list.append(
                    Volume(
                        size=vol.get("size", 100),
                        volumetype=vol.get("type", "SSD"),
                    )
                )

        login = None
        if ssh_key:
            login = Login(sshkey=ssh_key)
        elif password:
            login = Login(userPassword=UserPassword(username="root", password=password))

        node_spec = NodeSpec(
            flavor=flavor,
            az=availability_zone,
            os=os_type,
            login=login,
            rootVolume=root_volume,
            dataVolumes=data_volume_list if data_volume_list else None,
            nodeNicSpec=NodeNicSpec(subnetId=subnet_id) if subnet_id else None,
        )

        node_metadata = NodeMetadata(name=f"node-{cluster_id[:8]}")

        request_body = CreateNodeRequestBody(
            metadata=node_metadata,
            spec=node_spec,
            count=node_count,
        )

        request = CreateNodeRequest(cluster_id=cluster_id)
        request.body = request_body

        response = client.create_node(request)

        return {
            "success": True,
            "region": region,
            "cluster_id": cluster_id,
            "action": "create_cce_node",
            "node_count": node_count,
            "flavor": flavor,
            "availability_zone": availability_zone,
            "message": f"Node creation request submitted for {node_count} node(s)",
            "response": response.to_dict() if hasattr(response, "to_dict") else str(response),
        }

    except ClientRequestException as e:
        return {
            "success": False,
            "error": f"{e.error_code} - {e.error_msg}",
            "request_id": getattr(e, "request_id", None),
        }
    except Exception as e:
        return {"success": False, "error": str(e), "error_type": type(e).__name__}