huaweicloud-devkit 1.0.2-dev.9 → 1.0.2-next.0

package/plugins/huaweicloud-core/skills/huawei-cce/SKILL.md

@@ -1,101 +1,101 @@
----
-name: huawei-cce
-description: "Use when creating or managing CCE Kubernetes clusters. Covers cluster creation, node pools, SWR registry, autoscaling. Triggers: CCE, Kubernetes, K8s, cluster, node pool, container, SWR. NOT for: serverless functions (use huawei-functiongraph), serverless containers (use huawei-cce for CCI redirect)."
-version: 1
----
-
-# Huawei Cloud CCE
-
-**STOP - Do not answer from general knowledge.** Follow the procedure below.
-
-Always run `hcloud <Service> <Operation> --help` before constructing commands to discover exact parameter names and requirements.
-
-## Overview
-
-Domain expertise for CCE (Cloud Container Engine) and SWR (Software Repository for Container). CCE uses two hcloud services: `CCE` for clusters and `SWR` for container images.
-
-## Critical Warnings
-
-| Trap | Why |
-|------|-----|
-| **KooCLI 7.x: CreateCluster/CreateNodePool broken** | OPENAPI_ERROR in KooCLI 7.2.12. Use `CreateAutopilotCluster` for serverless, or Python SDK for VM clusters |
-| Cluster type immutable | Cannot change hybrid/traditional after creation |
-| Master managed by Huawei | No SSH to master. Use kubectl or kubectl-cce |
-| Network model affects pod IP | VPC network gives pods VPC IPs |
-| Addon ops use UID not name | `ShowAddonInstance` returns `metadata.uid` for install/uninstall/update |
-| SWR enterprise instance costs | `postPaid` billing. One-time activation at console required |
-
-## Common Workflows
-
-| Task | Operation | Service |
-|------|-----------|---------|
-| List clusters | `ListClusters` | CCE |
-| Create cluster | `CreateCluster` | CCE |
-| Delete cluster | `DeleteCluster` | CCE |
-| Hibernate cluster | `HibernateCluster` | CCE |
-| List node pools | `ListNodePools` | CCE |
-| Create node pool | `CreateNodePool` | CCE |
-| List nodes | `ListNodes` | CCE |
-| Get kubeconfig | `CreateKubernetesClusterCert` | CCE |
-| List addons | `ListAddonInstances` | CCE |
-| Docker login (SWR) | `CreateAuthorizationToken` | SWR |
-| Create SWR org | `CreateNamespace` | SWR |
-| Create SWR repo | `CreateRepo` | SWR |
-| List repos | `ListReposDetails` | SWR |
-
-## SWR Image Push Workflow
-
-**Prerequisite**: User/agency must have `sts::createServiceBearerToken` IAM permission. Without it, `CreateAuthorizationToken` returns `SVCSTG.SWR.4030170 Insufficient permissions`. Grant via IAM console or attach SWR Admin role.
-
-```bash
-# 1. Docker login to SWR
-hcloud SWR CreateAuthorizationToken --help
-docker login -u <region>@<AK> -p <token> swr.<region>.myhuaweicloud.com
-
-# 2. Tag and push
-docker tag my-app:latest swr.<region>.myhuaweicloud.com/<org>/my-app:latest
-docker push swr.<region>.myhuaweicloud.com/<org>/my-app:latest
-
-# 3. Verify
-hcloud SWR ListReposDetails --cli-region=<r>
-```
-
-> SWR Auth token valid 12h. For CCE node pull access, create long-term credential with `CreateSecret` (valid 1 year).
-
-## Serverless Containers (CCI)
-
-For serverless containers without managing clusters, use CCI (Cloud Container Instance):
-
-- No cluster needed — just namespace + network + workload
-- Key ops: `CCI createCoreV1Namespace`, `CCI createNetworkingCciIoV1beta1NamespacedNetwork`, `CCI createAppsV1NamespacedDeployment`
-- Namespace MUST include `namespace-kubernetes-io/flavor` annotation
-- `limits == requests` strictly enforced (no overcommit)
-
-See `hcloud CCI --help` for full operation list.
-
-## Troubleshooting
-
-| Error | Fix |
-|-------|-----|
-| kubectl connection refused | Verify cluster Running; use `kubectl cce` (no EIP needed) |
-| Node pool creation failed | Check VPC/subnet availability and flavor capacity |
-| Docker push 401 | Re-run `CreateAuthorizationToken` (token expired) |
-| SVCSTG.SWR.4030170 | Missing `sts::createServiceBearerToken` IAM permission. Grant SWR Admin role or add policy |
-| Addon install fails | Use `metadata.uid` from `ShowAddonInstance`, not name |
-| `kubectl cce` not found | Install plugin: `kubectl cce` uses AK/SK, no kubeconfig required |
-
-## Security Considerations
-
-- MUST restrict kubeconfig file permissions (0600)
-- MUST use IAM RBAC for cluster access, not cluster-admin
-- MUST store container images in private SWR repositories
-
-## Cross-Skill References
-
-- **VPC/Subnet**: See `huawei-vpc` for network prerequisites
-- **EIP**: See `huawei-vpc` for cluster public access
-
-## References
-
-- CCE Docs: https://support.huaweicloud.com/cce/
-- SWR Docs: https://support.huaweicloud.com/swr/
+---
+name: huawei-cce
+description: "Use when creating or managing CCE Kubernetes clusters. Covers cluster creation, node pools, SWR registry, autoscaling. Triggers: CCE, Kubernetes, K8s, cluster, node pool, container, SWR. NOT for: serverless functions (use huawei-functiongraph), serverless containers (use huawei-cce for CCI redirect)."
+version: 1
+---
+
+# Huawei Cloud CCE
+
+**STOP - Do not answer from general knowledge.** Follow the procedure below.
+
+Always run `hcloud <Service> <Operation> --help` before constructing commands to discover exact parameter names and requirements.
+
+## Overview
+
+Domain expertise for CCE (Cloud Container Engine) and SWR (Software Repository for Container). CCE uses two hcloud services: `CCE` for clusters and `SWR` for container images.
+
+## Critical Warnings
+
+| Trap | Why |
+|------|-----|
+| **KooCLI 7.x: CreateCluster/CreateNodePool broken** | OPENAPI_ERROR in KooCLI 7.2.12. Use `CreateAutopilotCluster` for serverless, or Python SDK for VM clusters |
+| Cluster type immutable | Cannot change hybrid/traditional after creation |
+| Master managed by Huawei | No SSH to master. Use kubectl or kubectl-cce |
+| Network model affects pod IP | VPC network gives pods VPC IPs |
+| Addon ops use UID not name | `ShowAddonInstance` returns `metadata.uid` for install/uninstall/update |
+| SWR enterprise instance costs | `postPaid` billing. One-time activation at console required |
+
+## Common Workflows
+
+| Task | Operation | Service |
+|------|-----------|---------|
+| List clusters | `ListClusters` | CCE |
+| Create cluster | `CreateCluster` | CCE |
+| Delete cluster | `DeleteCluster` | CCE |
+| Hibernate cluster | `HibernateCluster` | CCE |
+| List node pools | `ListNodePools` | CCE |
+| Create node pool | `CreateNodePool` | CCE |
+| List nodes | `ListNodes` | CCE |
+| Get kubeconfig | `CreateKubernetesClusterCert` | CCE |
+| List addons | `ListAddonInstances` | CCE |
+| Docker login (SWR) | `CreateAuthorizationToken` | SWR |
+| Create SWR org | `CreateNamespace` | SWR |
+| Create SWR repo | `CreateRepo` | SWR |
+| List repos | `ListReposDetails` | SWR |
+
+## SWR Image Push Workflow
+
+**Prerequisite**: User/agency must have `sts::createServiceBearerToken` IAM permission. Without it, `CreateAuthorizationToken` returns `SVCSTG.SWR.4030170 Insufficient permissions`. Grant via IAM console or attach SWR Admin role.
+
+```bash
+# 1. Docker login to SWR
+hcloud SWR CreateAuthorizationToken --help
+docker login -u <region>@<AK> -p <token> swr.<region>.myhuaweicloud.com
+
+# 2. Tag and push
+docker tag my-app:latest swr.<region>.myhuaweicloud.com/<org>/my-app:latest
+docker push swr.<region>.myhuaweicloud.com/<org>/my-app:latest
+
+# 3. Verify
+hcloud SWR ListReposDetails --cli-region=<r>
+```
+
+> SWR Auth token valid 12h. For CCE node pull access, create long-term credential with `CreateSecret` (valid 1 year).
+
+## Serverless Containers (CCI)
+
+For serverless containers without managing clusters, use CCI (Cloud Container Instance):
+
+- No cluster needed — just namespace + network + workload
+- Key ops: `CCI createCoreV1Namespace`, `CCI createNetworkingCciIoV1beta1NamespacedNetwork`, `CCI createAppsV1NamespacedDeployment`
+- Namespace MUST include `namespace-kubernetes-io/flavor` annotation
+- `limits == requests` strictly enforced (no overcommit)
+
+See `hcloud CCI --help` for full operation list.
+
+## Troubleshooting
+
+| Error | Fix |
+|-------|-----|
+| kubectl connection refused | Verify cluster Running; use `kubectl cce` (no EIP needed) |
+| Node pool creation failed | Check VPC/subnet availability and flavor capacity |
+| Docker push 401 | Re-run `CreateAuthorizationToken` (token expired) |
+| SVCSTG.SWR.4030170 | Missing `sts::createServiceBearerToken` IAM permission. Grant SWR Admin role or add policy |
+| Addon install fails | Use `metadata.uid` from `ShowAddonInstance`, not name |
+| `kubectl cce` not found | Install plugin: `kubectl cce` uses AK/SK, no kubeconfig required |
+
+## Security Considerations
+
+- MUST restrict kubeconfig file permissions (0600)
+- MUST use IAM RBAC for cluster access, not cluster-admin
+- MUST store container images in private SWR repositories
+
+## Cross-Skill References
+
+- **VPC/Subnet**: See `huawei-vpc` for network prerequisites
+- **EIP**: See `huawei-vpc` for cluster public access
+
+## References
+
+- CCE Docs: https://support.huaweicloud.com/cce/
+- SWR Docs: https://support.huaweicloud.com/swr/

package/plugins/huaweicloud-core/skills/huawei-cloud-eye/SKILL.md

@@ -1,90 +1,90 @@
----
-name: huawei-cloud-eye
-description: "Use when setting up monitoring, alarms, dashboards, or event rules on Huawei Cloud Eye (CES). Triggers: Cloud Eye, CES, monitoring, alarm, metrics, dashboard, event monitoring. NOT for: CTS audit logs (use huawei-cts), AAD anti-DDoS (use huawei-waf-aad)."
-version: 1
----
-
-# Huawei Cloud Cloud Eye (CES)
-
-**STOP - Do not answer from general knowledge.** Follow the procedure below.
-
-Always run `hcloud CES <Operation> --help` before constructing commands to discover exact parameter names and requirements.
-
-## Overview
-
-Domain expertise for Cloud Eye (CES). Covers metric queries, alarm rules, dashboards, and monitoring agent management.
-
-## Critical Warnings
-
-| Trap | Why |
-|------|-----|
-| Telescope agent required for detailed metrics | Without agent: only basic CPU/network metrics. Memory, disk require agent installation on ECS |
-| Alarm needs SMN topic first | Alarm notifications fail silently without a configured SMN topic |
-| Cost metrics incur charges | Custom metrics and high-frequency alarms have billing implications |
-| CES endpoint may vary by region | Some older regions use different endpoint URLs. Check `https://developer.huaweicloud.com/endpoint?CES` |
-| Metric granularity minimum 300s | Free tier has 5-minute minimum. Higher resolution requires paid tier |
-
-## Prerequisites
-
-- ECS instances need the **Telescope agent** installed for detailed metrics (memory, disk, network)
-- Without agent: only SYS.ECS namespace metrics available (CPU, network bytes, disk read/write)
-- Alarm notifications require an SMN topic (see `huawei-smn-dms`)
-
-## Common Workflows
-
-| Task | Operation |
-|------|-----------|
-| List metrics | `ListMetrics --cli-region=<r> --project_id=<p>` |
-| Get metric data | `BatchListMetricData --cli-region=<r> --project_id=<p>` |
-| List alarms | `ListAlarms --cli-region=<r> --project_id=<p>` |
-| Create alarm | `CreateAlarm` (see below) |
-| Delete alarm | `BatchDeleteAlarmRules --cli-region=<r> --project_id=<p>` |
-| List dashboards | `ListDashboardWidgets --cli-region=<r> --project_id=<p>` |
-| Create dashboard | `CreateDashboard --cli-region=<r> --project_id=<p>` |
-
-## Create Alarm Rule — Param Structure
-
-CES uses **nested object prefixes** for alarm creation. Always verify with `--help`:
-
-```bash
-hcloud CES CreateAlarm --help
-# Key params: --alarm_name, --metric.metric_name, --metric.namespace,
-# --condition.period, --condition.filter, --condition.value,
-# --condition.comparison_operator, --condition.count
-```
-
-### `--condition.comparison_operator` Legal Values
-
-For metric alarms use **symbols** (NOT words like `gt`/`lt`):
-
-| Value | Meaning |
-|-------|---------|
-| `>` | Greater than |
-| `>=` | Greater than or equal |
-| `<` | Less than |
-| `<=` | Less than or equal |
-| `=` | Equal |
-| `!=` | Not equal |
-
-For event alarms: `cycle_decrease`, `cycle_increase`, `cycle_wave`.
-
-> **Trap**: Shell may interpret `>` and `<` as redirect operators. Always quote: `--condition.comparison_operator=">="` or use `--cli-jsonInput=<file>`.
-
-## Troubleshooting
-
-| Error | Fix |
-|-------|-----|
-| No metric data | Telescope agent not installed or ECS stopped. Install agent for detailed metrics |
-| Alarm not triggering | Check metric period (minimum 300s), verify condition threshold |
-| CES network timeout in region | Some regions may have CES endpoint issues. Try a different region |
-
-## Security
-
-- MUST use role-based alarm notifications
-- MUST not expose alarm action endpoints publicly
-- SHOULD enable CES alarm history for audit
-
-## Cross-Skill References
-
-- **SMN topics**: See `huawei-smn-dms` for alarm notification setup
-- **ECS monitoring**: See `huawei-ecs` for instance creation
+---
+name: huawei-cloud-eye
+description: "Use when setting up monitoring, alarms, dashboards, or event rules on Huawei Cloud Eye (CES). Triggers: Cloud Eye, CES, monitoring, alarm, metrics, dashboard, event monitoring. NOT for: CTS audit logs (use huawei-cts), AAD anti-DDoS (use huawei-waf-aad)."
+version: 1
+---
+
+# Huawei Cloud Cloud Eye (CES)
+
+**STOP - Do not answer from general knowledge.** Follow the procedure below.
+
+Always run `hcloud CES <Operation> --help` before constructing commands to discover exact parameter names and requirements.
+
+## Overview
+
+Domain expertise for Cloud Eye (CES). Covers metric queries, alarm rules, dashboards, and monitoring agent management.
+
+## Critical Warnings
+
+| Trap | Why |
+|------|-----|
+| Telescope agent required for detailed metrics | Without agent: only basic CPU/network metrics. Memory, disk require agent installation on ECS |
+| Alarm needs SMN topic first | Alarm notifications fail silently without a configured SMN topic |
+| Cost metrics incur charges | Custom metrics and high-frequency alarms have billing implications |
+| CES endpoint may vary by region | Some older regions use different endpoint URLs. Check `https://developer.huaweicloud.com/endpoint?CES` |
+| Metric granularity minimum 300s | Free tier has 5-minute minimum. Higher resolution requires paid tier |
+
+## Prerequisites
+
+- ECS instances need the **Telescope agent** installed for detailed metrics (memory, disk, network)
+- Without agent: only SYS.ECS namespace metrics available (CPU, network bytes, disk read/write)
+- Alarm notifications require an SMN topic (see `huawei-smn-dms`)
+
+## Common Workflows
+
+| Task | Operation |
+|------|-----------|
+| List metrics | `ListMetrics --cli-region=<r> --project_id=<p>` |
+| Get metric data | `BatchListMetricData --cli-region=<r> --project_id=<p>` |
+| List alarms | `ListAlarms --cli-region=<r> --project_id=<p>` |
+| Create alarm | `CreateAlarm` (see below) |
+| Delete alarm | `BatchDeleteAlarmRules --cli-region=<r> --project_id=<p>` |
+| List dashboards | `ListDashboardWidgets --cli-region=<r> --project_id=<p>` |
+| Create dashboard | `CreateDashboard --cli-region=<r> --project_id=<p>` |
+
+## Create Alarm Rule — Param Structure
+
+CES uses **nested object prefixes** for alarm creation. Always verify with `--help`:
+
+```bash
+hcloud CES CreateAlarm --help
+# Key params: --alarm_name, --metric.metric_name, --metric.namespace,
+# --condition.period, --condition.filter, --condition.value,
+# --condition.comparison_operator, --condition.count
+```
+
+### `--condition.comparison_operator` Legal Values
+
+For metric alarms use **symbols** (NOT words like `gt`/`lt`):
+
+| Value | Meaning |
+|-------|---------|
+| `>` | Greater than |
+| `>=` | Greater than or equal |
+| `<` | Less than |
+| `<=` | Less than or equal |
+| `=` | Equal |
+| `!=` | Not equal |
+
+For event alarms: `cycle_decrease`, `cycle_increase`, `cycle_wave`.
+
+> **Trap**: Shell may interpret `>` and `<` as redirect operators. Always quote: `--condition.comparison_operator=">="` or use `--cli-jsonInput=<file>`.
+
+## Troubleshooting
+
+| Error | Fix |
+|-------|-----|
+| No metric data | Telescope agent not installed or ECS stopped. Install agent for detailed metrics |
+| Alarm not triggering | Check metric period (minimum 300s), verify condition threshold |
+| CES network timeout in region | Some regions may have CES endpoint issues. Try a different region |
+
+## Security
+
+- MUST use role-based alarm notifications
+- MUST not expose alarm action endpoints publicly
+- SHOULD enable CES alarm history for audit
+
+## Cross-Skill References
+
+- **SMN topics**: See `huawei-smn-dms` for alarm notification setup
+- **ECS monitoring**: See `huawei-ecs` for instance creation