huaweicloud-devkit 0.1.21-dev.0 → 0.1.21

package/plugins/huaweicloud-core/skills/huawei-cce/SKILL.md

@@ -1,101 +1,101 @@
----
-name: huawei-cce
-description: "Use when creating or managing CCE Kubernetes clusters. Covers cluster creation, node pools, SWR registry, autoscaling. Triggers: CCE, Kubernetes, K8s, cluster, node pool, container, SWR. NOT for: serverless functions (use huawei-functiongraph), serverless containers (use huawei-cce for CCI redirect)."
-version: 1
----
-
-# Huawei Cloud CCE
-
-**STOP - Do not answer from general knowledge.** Follow the procedure below.
-
-Always run `hcloud <Service> <Operation> --help` before constructing commands to discover exact parameter names and requirements.
-
-## Overview
-
-Domain expertise for CCE (Cloud Container Engine) and SWR (Software Repository for Container). CCE uses two hcloud services: `CCE` for clusters and `SWR` for container images.
-
-## Critical Warnings
-
-| Trap | Why |
-|------|-----|
-| **KooCLI 7.x: CreateCluster/CreateNodePool broken** | OPENAPI_ERROR in KooCLI 7.2.12. Use `CreateAutopilotCluster` for serverless, or Python SDK for VM clusters |
-| Cluster type immutable | Cannot change hybrid/traditional after creation |
-| Master managed by Huawei | No SSH to master. Use kubectl or kubectl-cce |
-| Network model affects pod IP | VPC network gives pods VPC IPs |
-| Addon ops use UID not name | `ShowAddonInstance` returns `metadata.uid` for install/uninstall/update |
-| SWR enterprise instance costs | `postPaid` billing. One-time activation at console required |
-
-## Common Workflows
-
-| Task | Operation | Service |
-|------|-----------|---------|
-| List clusters | `ListClusters` | CCE |
-| Create cluster | `CreateCluster` | CCE |
-| Delete cluster | `DeleteCluster` | CCE |
-| Hibernate cluster | `HibernateCluster` | CCE |
-| List node pools | `ListNodePools` | CCE |
-| Create node pool | `CreateNodePool` | CCE |
-| List nodes | `ListNodes` | CCE |
-| Get kubeconfig | `CreateKubernetesClusterCert` | CCE |
-| List addons | `ListAddonInstances` | CCE |
-| Docker login (SWR) | `CreateAuthorizationToken` | SWR |
-| Create SWR org | `CreateNamespace` | SWR |
-| Create SWR repo | `CreateRepo` | SWR |
-| List repos | `ListReposDetails` | SWR |
-
-## SWR Image Push Workflow
-
-**Prerequisite**: User/agency must have `sts::createServiceBearerToken` IAM permission. Without it, `CreateAuthorizationToken` returns `SVCSTG.SWR.4030170 Insufficient permissions`. Grant via IAM console or attach SWR Admin role.
-
-```bash
-# 1. Docker login to SWR
-hcloud SWR CreateAuthorizationToken --help
-docker login -u <region>@<AK> -p <token> swr.<region>.myhuaweicloud.com
-
-# 2. Tag and push
-docker tag my-app:latest swr.<region>.myhuaweicloud.com/<org>/my-app:latest
-docker push swr.<region>.myhuaweicloud.com/<org>/my-app:latest
-
-# 3. Verify
-hcloud SWR ListReposDetails --cli-region=<r>
-```
-
-> SWR Auth token valid 12h. For CCE node pull access, create long-term credential with `CreateSecret` (valid 1 year).
-
-## Serverless Containers (CCI)
-
-For serverless containers without managing clusters, use CCI (Cloud Container Instance):
-
-- No cluster needed — just namespace + network + workload
-- Key ops: `CCI createCoreV1Namespace`, `CCI createNetworkingCciIoV1beta1NamespacedNetwork`, `CCI createAppsV1NamespacedDeployment`
-- Namespace MUST include `namespace-kubernetes-io/flavor` annotation
-- `limits == requests` strictly enforced (no overcommit)
-
-See `hcloud CCI --help` for full operation list.
-
-## Troubleshooting
-
-| Error | Fix |
-|-------|-----|
-| kubectl connection refused | Verify cluster Running; use `kubectl cce` (no EIP needed) |
-| Node pool creation failed | Check VPC/subnet availability and flavor capacity |
-| Docker push 401 | Re-run `CreateAuthorizationToken` (token expired) |
-| SVCSTG.SWR.4030170 | Missing `sts::createServiceBearerToken` IAM permission. Grant SWR Admin role or add policy |
-| Addon install fails | Use `metadata.uid` from `ShowAddonInstance`, not name |
-| `kubectl cce` not found | Install plugin: `kubectl cce` uses AK/SK, no kubeconfig required |
-
-## Security Considerations
-
-- MUST restrict kubeconfig file permissions (0600)
-- MUST use IAM RBAC for cluster access, not cluster-admin
-- MUST store container images in private SWR repositories
-
-## Cross-Skill References
-
-- **VPC/Subnet**: See `huawei-vpc` for network prerequisites
-- **EIP**: See `huawei-vpc` for cluster public access
-
-## References
-
-- CCE Docs: https://support.huaweicloud.com/cce/
-- SWR Docs: https://support.huaweicloud.com/swr/
+---
+name: huawei-cce
+description: "Use when creating or managing CCE Kubernetes clusters. Covers cluster creation, node pools, SWR registry, autoscaling. Triggers: CCE, Kubernetes, K8s, cluster, node pool, container, SWR. NOT for: serverless functions (use huawei-functiongraph), serverless containers (use huawei-cce for CCI redirect)."
+version: 1
+---
+
+# Huawei Cloud CCE
+
+**STOP - Do not answer from general knowledge.** Follow the procedure below.
+
+Always run `hcloud <Service> <Operation> --help` before constructing commands to discover exact parameter names and requirements.
+
+## Overview
+
+Domain expertise for CCE (Cloud Container Engine) and SWR (Software Repository for Container). CCE uses two hcloud services: `CCE` for clusters and `SWR` for container images.
+
+## Critical Warnings
+
+| Trap | Why |
+|------|-----|
+| **KooCLI 7.x: CreateCluster/CreateNodePool broken** | OPENAPI_ERROR in KooCLI 7.2.12. Use `CreateAutopilotCluster` for serverless, or Python SDK for VM clusters |
+| Cluster type immutable | Cannot change hybrid/traditional after creation |
+| Master managed by Huawei | No SSH to master. Use kubectl or kubectl-cce |
+| Network model affects pod IP | VPC network gives pods VPC IPs |
+| Addon ops use UID not name | `ShowAddonInstance` returns `metadata.uid` for install/uninstall/update |
+| SWR enterprise instance costs | `postPaid` billing. One-time activation at console required |
+
+## Common Workflows
+
+| Task | Operation | Service |
+|------|-----------|---------|
+| List clusters | `ListClusters` | CCE |
+| Create cluster | `CreateCluster` | CCE |
+| Delete cluster | `DeleteCluster` | CCE |
+| Hibernate cluster | `HibernateCluster` | CCE |
+| List node pools | `ListNodePools` | CCE |
+| Create node pool | `CreateNodePool` | CCE |
+| List nodes | `ListNodes` | CCE |
+| Get kubeconfig | `CreateKubernetesClusterCert` | CCE |
+| List addons | `ListAddonInstances` | CCE |
+| Docker login (SWR) | `CreateAuthorizationToken` | SWR |
+| Create SWR org | `CreateNamespace` | SWR |
+| Create SWR repo | `CreateRepo` | SWR |
+| List repos | `ListReposDetails` | SWR |
+
+## SWR Image Push Workflow
+
+**Prerequisite**: User/agency must have `sts::createServiceBearerToken` IAM permission. Without it, `CreateAuthorizationToken` returns `SVCSTG.SWR.4030170 Insufficient permissions`. Grant via IAM console or attach SWR Admin role.
+
+```bash
+# 1. Docker login to SWR
+hcloud SWR CreateAuthorizationToken --help
+docker login -u <region>@<AK> -p <token> swr.<region>.myhuaweicloud.com
+
+# 2. Tag and push
+docker tag my-app:latest swr.<region>.myhuaweicloud.com/<org>/my-app:latest
+docker push swr.<region>.myhuaweicloud.com/<org>/my-app:latest
+
+# 3. Verify
+hcloud SWR ListReposDetails --cli-region=<r>
+```
+
+> SWR Auth token valid 12h. For CCE node pull access, create long-term credential with `CreateSecret` (valid 1 year).
+
+## Serverless Containers (CCI)
+
+For serverless containers without managing clusters, use CCI (Cloud Container Instance):
+
+- No cluster needed — just namespace + network + workload
+- Key ops: `CCI createCoreV1Namespace`, `CCI createNetworkingCciIoV1beta1NamespacedNetwork`, `CCI createAppsV1NamespacedDeployment`
+- Namespace MUST include `namespace-kubernetes-io/flavor` annotation
+- `limits == requests` strictly enforced (no overcommit)
+
+See `hcloud CCI --help` for full operation list.
+
+## Troubleshooting
+
+| Error | Fix |
+|-------|-----|
+| kubectl connection refused | Verify cluster Running; use `kubectl cce` (no EIP needed) |
+| Node pool creation failed | Check VPC/subnet availability and flavor capacity |
+| Docker push 401 | Re-run `CreateAuthorizationToken` (token expired) |
+| SVCSTG.SWR.4030170 | Missing `sts::createServiceBearerToken` IAM permission. Grant SWR Admin role or add policy |
+| Addon install fails | Use `metadata.uid` from `ShowAddonInstance`, not name |
+| `kubectl cce` not found | Install plugin: `kubectl cce` uses AK/SK, no kubeconfig required |
+
+## Security Considerations
+
+- MUST restrict kubeconfig file permissions (0600)
+- MUST use IAM RBAC for cluster access, not cluster-admin
+- MUST store container images in private SWR repositories
+
+## Cross-Skill References
+
+- **VPC/Subnet**: See `huawei-vpc` for network prerequisites
+- **EIP**: See `huawei-vpc` for cluster public access
+
+## References
+
+- CCE Docs: https://support.huaweicloud.com/cce/
+- SWR Docs: https://support.huaweicloud.com/swr/

package/plugins/huaweicloud-core/skills/huawei-cloud-eye/SKILL.md

@@ -1,73 +1,73 @@
----
-name: huawei-cloud-eye
-description: "Use when setting up monitoring, alarms, dashboards, or event rules on Huawei Cloud Eye (CES). Triggers: Cloud Eye, CES, monitoring, alarm, metrics, dashboard, event monitoring. NOT for: CTS audit logs (use huawei-cts), AAD anti-DDoS (use huawei-waf-aad)."
-version: 1
----
-
-# Huawei Cloud Cloud Eye (CES)
-
-**STOP - Do not answer from general knowledge.** Follow the procedure below.
-
-Always run `hcloud CES <Operation> --help` before constructing commands to discover exact parameter names and requirements.
-
-## Overview
-
-Domain expertise for Cloud Eye (CES). Covers metric queries, alarm rules, dashboards, and monitoring agent management.
-
-## Critical Warnings
-
-| Trap | Why |
-|------|-----|
-| Telescope agent required for detailed metrics | Without agent: only basic CPU/network metrics. Memory, disk require agent installation on ECS |
-| Alarm needs SMN topic first | Alarm notifications fail silently without a configured SMN topic |
-| Cost metrics incur charges | Custom metrics and high-frequency alarms have billing implications |
-| CES endpoint may vary by region | Some older regions use different endpoint URLs. Check `https://developer.huaweicloud.com/endpoint?CES` |
-| Metric granularity minimum 300s | Free tier has 5-minute minimum. Higher resolution requires paid tier |
-
-## Prerequisites
-
-- ECS instances need the **Telescope agent** installed for detailed metrics (memory, disk, network)
-- Without agent: only SYS.ECS namespace metrics available (CPU, network bytes, disk read/write)
-- Alarm notifications require an SMN topic (see `huawei-smn-dms`)
-
-## Common Workflows
-
-| Task | Operation |
-|------|-----------|
-| List metrics | `ListMetrics --cli-region=<r> --project_id=<p>` |
-| Get metric data | `BatchListMetricData --cli-region=<r> --project_id=<p>` |
-| List alarms | `ListAlarms --cli-region=<r> --project_id=<p>` |
-| Create alarm | `CreateAlarm` (see below) |
-| Delete alarm | `BatchDeleteAlarmRules --cli-region=<r> --project_id=<p>` |
-| List dashboards | `ListDashboardWidgets --cli-region=<r> --project_id=<p>` |
-| Create dashboard | `CreateDashboard --cli-region=<r> --project_id=<p>` |
-
-## Create Alarm Rule — Param Structure
-
-CES uses **nested object prefixes** for alarm creation. Always verify with `--help`:
-
-```bash
-hcloud CES CreateAlarm --help
-# Key params: --alarm_name, --metric.metric_name, --metric.namespace,
-# --condition.period, --condition.filter, --condition.value,
-# --condition.comparison_operator, --condition.count
-```
-
-## Troubleshooting
-
-| Error | Fix |
-|-------|-----|
-| No metric data | Telescope agent not installed or ECS stopped. Install agent for detailed metrics |
-| Alarm not triggering | Check metric period (minimum 300s), verify condition threshold |
-| CES network timeout in region | Some regions may have CES endpoint issues. Try a different region |
-
-## Security
-
-- MUST use role-based alarm notifications
-- MUST not expose alarm action endpoints publicly
-- SHOULD enable CES alarm history for audit
-
-## Cross-Skill References
-
-- **SMN topics**: See `huawei-smn-dms` for alarm notification setup
-- **ECS monitoring**: See `huawei-ecs` for instance creation
+---
+name: huawei-cloud-eye
+description: "Use when setting up monitoring, alarms, dashboards, or event rules on Huawei Cloud Eye (CES). Triggers: Cloud Eye, CES, monitoring, alarm, metrics, dashboard, event monitoring. NOT for: CTS audit logs (use huawei-cts), AAD anti-DDoS (use huawei-waf-aad)."
+version: 1
+---
+
+# Huawei Cloud Cloud Eye (CES)
+
+**STOP - Do not answer from general knowledge.** Follow the procedure below.
+
+Always run `hcloud CES <Operation> --help` before constructing commands to discover exact parameter names and requirements.
+
+## Overview
+
+Domain expertise for Cloud Eye (CES). Covers metric queries, alarm rules, dashboards, and monitoring agent management.
+
+## Critical Warnings
+
+| Trap | Why |
+|------|-----|
+| Telescope agent required for detailed metrics | Without agent: only basic CPU/network metrics. Memory, disk require agent installation on ECS |
+| Alarm needs SMN topic first | Alarm notifications fail silently without a configured SMN topic |
+| Cost metrics incur charges | Custom metrics and high-frequency alarms have billing implications |
+| CES endpoint may vary by region | Some older regions use different endpoint URLs. Check `https://developer.huaweicloud.com/endpoint?CES` |
+| Metric granularity minimum 300s | Free tier has 5-minute minimum. Higher resolution requires paid tier |
+
+## Prerequisites
+
+- ECS instances need the **Telescope agent** installed for detailed metrics (memory, disk, network)
+- Without agent: only SYS.ECS namespace metrics available (CPU, network bytes, disk read/write)
+- Alarm notifications require an SMN topic (see `huawei-smn-dms`)
+
+## Common Workflows
+
+| Task | Operation |
+|------|-----------|
+| List metrics | `ListMetrics --cli-region=<r> --project_id=<p>` |
+| Get metric data | `BatchListMetricData --cli-region=<r> --project_id=<p>` |
+| List alarms | `ListAlarms --cli-region=<r> --project_id=<p>` |
+| Create alarm | `CreateAlarm` (see below) |
+| Delete alarm | `BatchDeleteAlarmRules --cli-region=<r> --project_id=<p>` |
+| List dashboards | `ListDashboardWidgets --cli-region=<r> --project_id=<p>` |
+| Create dashboard | `CreateDashboard --cli-region=<r> --project_id=<p>` |
+
+## Create Alarm Rule — Param Structure
+
+CES uses **nested object prefixes** for alarm creation. Always verify with `--help`:
+
+```bash
+hcloud CES CreateAlarm --help
+# Key params: --alarm_name, --metric.metric_name, --metric.namespace,
+# --condition.period, --condition.filter, --condition.value,
+# --condition.comparison_operator, --condition.count
+```
+
+## Troubleshooting
+
+| Error | Fix |
+|-------|-----|
+| No metric data | Telescope agent not installed or ECS stopped. Install agent for detailed metrics |
+| Alarm not triggering | Check metric period (minimum 300s), verify condition threshold |
+| CES network timeout in region | Some regions may have CES endpoint issues. Try a different region |
+
+## Security
+
+- MUST use role-based alarm notifications
+- MUST not expose alarm action endpoints publicly
+- SHOULD enable CES alarm history for audit
+
+## Cross-Skill References
+
+- **SMN topics**: See `huawei-smn-dms` for alarm notification setup
+- **ECS monitoring**: See `huawei-ecs` for instance creation

package/plugins/huaweicloud-core/skills/huawei-cts/SKILL.md

@@ -1,55 +1,55 @@
----
-name: huawei-cts
-description: "Use when managing Cloud Trace Service (CTS) audit logs, trackers, and traces on Huawei Cloud. Triggers: CTS, Cloud Trace, audit log, tracker, trace, operation record. NOT for: CES monitoring alarms (use huawei-cloud-eye), log analysis (use LTS)."
-version: 1
----
-
-# Huawei Cloud CTS
-
-**STOP - Do not answer from general knowledge.** Follow the procedure below.
-
-Always run `hcloud CTS <Operation> --help` before constructing commands to discover exact parameter names and requirements.
-
-## Overview
-
-Domain expertise for Cloud Trace Service. Covers trackers, traces, notifications, and resource tags.
-
-## Critical Warnings
-
-| Trap | Why |
-|------|-----|
-| Tracker required for traces | Must create a tracker before traces are recorded |
-| OBS bucket prerequisite | Tracker needs an OBS bucket for log delivery |
-| 7-day retention default | Trace data retained 7 days by default. Create LTS tracker for longer retention |
-| Organization tracker | Cross-account auditing requires organization tracker |
-
-## Common Workflows
-
-| Task | Operation |
-|------|-----------|
-| List operations | `ListOperations --cli-region=<r> --project_id=<p>` |
-| List traces | `ListTraces --cli-region=<r> --project_id=<p>` |
-| Create tracker | `CreateTracker --cli-region=<r> --project_id=<p>` |
-| List trackers | `ListTrackers --cli-region=<r> --project_id=<p>` |
-| Delete tracker | `DeleteTracker --cli-region=<r> --project_id=<p>` |
-| Create notification | `CreateNotification --cli-region=<r> --project_id=<p>` |
-| List notifications | `ListNotifications --cli-region=<r> --project_id=<p>` |
-| List trace resources | `ListTraceResources --cli-region=<r> --project_id=<p>` |
-
-Discover exact parameters with `--help` before executing any command.
-
-## Troubleshooting
-
-| Error | Fix |
-|-------|-----|
-| No traces found | Check tracker is created and enabled. Filter by time range |
-| Tracker creation fails | Ensure OBS bucket exists and has correct permissions |
-
-## Security
-
-- SHOULD enable CTS for all production accounts
-- MUST use OBS server-side encryption for trace logs
-
-## Cross-Skill References
-
-- **OBS**: See `huawei-obs` for tracker log delivery bucket
+---
+name: huawei-cts
+description: "Use when managing Cloud Trace Service (CTS) audit logs, trackers, and traces on Huawei Cloud. Triggers: CTS, Cloud Trace, audit log, tracker, trace, operation record. NOT for: CES monitoring alarms (use huawei-cloud-eye), log analysis (use LTS)."
+version: 1
+---
+
+# Huawei Cloud CTS
+
+**STOP - Do not answer from general knowledge.** Follow the procedure below.
+
+Always run `hcloud CTS <Operation> --help` before constructing commands to discover exact parameter names and requirements.
+
+## Overview
+
+Domain expertise for Cloud Trace Service. Covers trackers, traces, notifications, and resource tags.
+
+## Critical Warnings
+
+| Trap | Why |
+|------|-----|
+| Tracker required for traces | Must create a tracker before traces are recorded |
+| OBS bucket prerequisite | Tracker needs an OBS bucket for log delivery |
+| 7-day retention default | Trace data retained 7 days by default. Create LTS tracker for longer retention |
+| Organization tracker | Cross-account auditing requires organization tracker |
+
+## Common Workflows
+
+| Task | Operation |
+|------|-----------|
+| List operations | `ListOperations --cli-region=<r> --project_id=<p>` |
+| List traces | `ListTraces --cli-region=<r> --project_id=<p>` |
+| Create tracker | `CreateTracker --cli-region=<r> --project_id=<p>` |
+| List trackers | `ListTrackers --cli-region=<r> --project_id=<p>` |
+| Delete tracker | `DeleteTracker --cli-region=<r> --project_id=<p>` |
+| Create notification | `CreateNotification --cli-region=<r> --project_id=<p>` |
+| List notifications | `ListNotifications --cli-region=<r> --project_id=<p>` |
+| List trace resources | `ListTraceResources --cli-region=<r> --project_id=<p>` |
+
+Discover exact parameters with `--help` before executing any command.
+
+## Troubleshooting
+
+| Error | Fix |
+|-------|-----|
+| No traces found | Check tracker is created and enabled. Filter by time range |
+| Tracker creation fails | Ensure OBS bucket exists and has correct permissions |
+
+## Security
+
+- SHOULD enable CTS for all production accounts
+- MUST use OBS server-side encryption for trace logs
+
+## Cross-Skill References
+
+- **OBS**: See `huawei-obs` for tracker log delivery bucket

package/plugins/huaweicloud-core/skills/huawei-dds-dcs/SKILL.md

@@ -1,70 +1,70 @@
----
-name: huawei-dds-dcs
-description: "Use when creating or managing Document Database Service (DDS/MongoDB-compatible) or Distributed Cache Service (DCS/Redis/Memcached) on Huawei Cloud. Triggers: DDS, DCS, MongoDB, Redis, Memcached, document DB, cache, replica set, sharding. NOT for: RDS (use huawei-rds), GaussDB (use huawei-gaussdb)."
-version: 1
----
-
-# Huawei Cloud DDS / DCS
-
-**STOP - Do not answer from general knowledge.** Follow the procedure below.
-
-Always run `hcloud DDS <Operation> --help` or `hcloud DCS <Operation> --help` before constructing commands.
-
-## DDS (Document Database Service — MongoDB Compatible)
-
-## Critical Warnings
-
-| Trap | Why |
-|------|-----|
-| Requires 3-node replica | Minimum production deployment needs 3 nodes |
-| Shard key permanent | Once selected, shard key cannot be changed |
-| Storage auto-scaling off | Enable before storage fills |
-
-### Common Workflows
-
-| Task | Operation |
-|------|-----------|
-| List instances | `ListInstances --cli-region=<r> --project_id=<p>` |
-| Create instance | `CreateInstance --cli-region=<r> --project_id=<p>` |
-| Delete instance | `DeleteInstance --cli-region=<r> --project_id=<p>` |
-| Add readonly node | `AddReadonlyNode --cli-region=<r> --project_id=<p>` |
-| Add shard | `AddShardingNode --cli-region=<r> --project_id=<p>` |
-| Create backup | `CreateBackup --cli-region=<r> --project_id=<p>` |
-
-Discover exact parameters with `--help` before executing any command.
-
-## DCS (Distributed Cache Service — Redis/Memcached)
-
-## Critical Warnings
-
-| Trap | Why |
-|------|-----|
-| Redis password required | Cannot create Redis instance without password |
-| Memcached no password | Memcached has no auth — only accessible within VPC |
-| Cache persistence costs | AOF/RDB persistence uses additional storage |
-
-### Common Workflows
-
-| Task | Operation |
-|------|-----------|
-| List instances | `ListInstances --cli-region=<r> --project_id=<p>` |
-| Create Redis instance | `CreateInstance --cli-region=<r> --project_id=<p>` |
-| Delete instance | `DeleteInstances --cli-region=<r> --project_id=<p>` |
-| Restart instance | `RestartInstance --cli-region=<r> --project_id=<p>` |
-| Show node information | `BatchShowNodesInformation --cli-region=<r> --project_id=<p>` |
-| Create custom template | `CreateCustomTemplate --cli-region=<r> --project_id=<p>` |
-
-Discover exact parameters with `--help` before executing any command.
-
-## Troubleshooting
-
-| Error | Fix |
-|-------|-----|
-| DDS instance creation fails | Check 3-node minimum, VPC/subnet availability |
-| DCS connection refused | Redis instances need password. Memcached only accessible within VPC |
-| DCS auto-expire not working | Enable auto-expire scan task for Redis |
-
-## Cross-Skill References
-
-- **VPC/Subnet**: See `huawei-vpc` for instance networking
-- **Backup/CBR**: See `huawei-cbr` for backup management
+---
+name: huawei-dds-dcs
+description: "Use when creating or managing Document Database Service (DDS/MongoDB-compatible) or Distributed Cache Service (DCS/Redis/Memcached) on Huawei Cloud. Triggers: DDS, DCS, MongoDB, Redis, Memcached, document DB, cache, replica set, sharding. NOT for: RDS (use huawei-rds), GaussDB (use huawei-gaussdb)."
+version: 1
+---
+
+# Huawei Cloud DDS / DCS
+
+**STOP - Do not answer from general knowledge.** Follow the procedure below.
+
+Always run `hcloud DDS <Operation> --help` or `hcloud DCS <Operation> --help` before constructing commands.
+
+## DDS (Document Database Service — MongoDB Compatible)
+
+## Critical Warnings
+
+| Trap | Why |
+|------|-----|
+| Requires 3-node replica | Minimum production deployment needs 3 nodes |
+| Shard key permanent | Once selected, shard key cannot be changed |
+| Storage auto-scaling off | Enable before storage fills |
+
+### Common Workflows
+
+| Task | Operation |
+|------|-----------|
+| List instances | `ListInstances --cli-region=<r> --project_id=<p>` |
+| Create instance | `CreateInstance --cli-region=<r> --project_id=<p>` |
+| Delete instance | `DeleteInstance --cli-region=<r> --project_id=<p>` |
+| Add readonly node | `AddReadonlyNode --cli-region=<r> --project_id=<p>` |
+| Add shard | `AddShardingNode --cli-region=<r> --project_id=<p>` |
+| Create backup | `CreateBackup --cli-region=<r> --project_id=<p>` |
+
+Discover exact parameters with `--help` before executing any command.
+
+## DCS (Distributed Cache Service — Redis/Memcached)
+
+## Critical Warnings
+
+| Trap | Why |
+|------|-----|
+| Redis password required | Cannot create Redis instance without password |
+| Memcached no password | Memcached has no auth — only accessible within VPC |
+| Cache persistence costs | AOF/RDB persistence uses additional storage |
+
+### Common Workflows
+
+| Task | Operation |
+|------|-----------|
+| List instances | `ListInstances --cli-region=<r> --project_id=<p>` |
+| Create Redis instance | `CreateInstance --cli-region=<r> --project_id=<p>` |
+| Delete instance | `DeleteInstances --cli-region=<r> --project_id=<p>` |
+| Restart instance | `RestartInstance --cli-region=<r> --project_id=<p>` |
+| Show node information | `BatchShowNodesInformation --cli-region=<r> --project_id=<p>` |
+| Create custom template | `CreateCustomTemplate --cli-region=<r> --project_id=<p>` |
+
+Discover exact parameters with `--help` before executing any command.
+
+## Troubleshooting
+
+| Error | Fix |
+|-------|-----|
+| DDS instance creation fails | Check 3-node minimum, VPC/subnet availability |
+| DCS connection refused | Redis instances need password. Memcached only accessible within VPC |
+| DCS auto-expire not working | Enable auto-expire scan task for Redis |
+
+## Cross-Skill References
+
+- **VPC/Subnet**: See `huawei-vpc` for instance networking
+- **Backup/CBR**: See `huawei-cbr` for backup management