npm - huaweicloud-devkit - Versions diffs - 1.0.2-dev.9 → 1.0.2-next.10 - Mend

huaweicloud-devkit 1.0.2-dev.9 → 1.0.2-next.10

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (99) hide show

package/plugins/huaweicloud-core/skills/huawei-vpc/SKILL.md CHANGED Viewed

@@ -1,84 +1,84 @@
----
-name: huawei-vpc
-description: "Use when creating, configuring, or managing VPC networks, subnets, security groups, EIPs, NAT gateways, VPN connections, or network ACLs on Huawei Cloud. Triggers on: VPC, subnet, security group, EIP, NAT, VPN, network ACL, route table, bandwidth. NOT for: DNS or CDN configuration."
-version: 1
----
-# Huawei Cloud VPC
-**STOP - Do not answer from general knowledge.** Follow the procedure below.
-Always run `hcloud <Service> <Operation> --help` before constructing commands to discover exact parameter names and requirements.
-> **Multi-version APIs**: KooCLI may print a warning like "ListVpcs有多个版本,默认使用该API版本v3" before the actual response. The text BEFORE the first `{` is the version selection notice — parse JSON starting from `{` only. This is normal behavior, not an error.
-## Overview
-Domain expertise for Huawei Cloud Virtual Private Cloud (VPC). Covers VPC/subnet lifecycle, security groups, EIP management, NAT gateways, VPN, and network ACLs.
-## Critical Warnings
-| Trap | Why |
-|------|-----|
-| VPC CIDR cannot change | Once set, VPC CIDR block is immutable |
-| Security group stateful | SG rules are stateful. Return traffic auto-allowed |
-| Network ACL stateless | ACL rules must allow both inbound AND outbound |
-| EIP bills when idle | Unbound EIP still charges. Release when unused |
-| Subnet AZ binding | Subnet tied to single AZ. Cross-AZ needs multiple subnets |
-| EIP PER type needs `--bandwidth.name` | PER bandwidth requires explicit name; `--help` marks it optional but it's required |
-| **VPC params need nested prefix** | KooCLI 7.x VPC API uses `--vpc.<param>`, `--subnet.<param>`, `--security_group.<param>`. Example: `--vpc.name=xxx` NOT `--name=xxx` |
-| **Security group needs no vpc_id** | VPC v3 API `CreateSecurityGroup` does NOT accept `vpc_id`. Security groups are region-level, not VPC-bound |
-| Subnet DNS empty → ECS no DNS | DNS params (`--subnet.primary_dns`, `--subnet.secondary_dns`) marked optional but empty default breaks cloud-init domain resolution — `yum`/`apt` installs fail silently. Always set both. Common DNS IPs: cn-north-4 (100.125.1.250 / 100.125.1.251), cn-north-1 (100.125.1.250 / 100.125.129.250), cn-east-3 (100.125.1.250 / 100.125.129.250), ap-southeast-3 (100.125.1.250 / 100.125.128.250) |
-| SCP blocks 0.0.0.0/0 SG rules | If `CreateSecurityGroupRule` with `--remote_ip_prefix=0.0.0.0/0` fails with `SYS.0403`, an org-level SCP policy is denying wide-open rules. Narrow to a specific CIDR range (e.g., your office IP) instead |
-| **VPC tags use `*` separator** | VPC tag format: `--vpc.tags.1=env*test` (asterisk between key and value). NOT `--vpc.tags.1.key=env` (ECS-style). This is different from ECS `--server.metadata.key=value` |
-## Common Workflows
-| Task | Command | Steps |
-|------|---------|-------|
-| Create VPC | hcloud VPC CreateVpc --vpc.name=<name> --vpc.cidr=<cidr> | CIDR must not conflict with existing VPCs. Run `hcloud VPC ListVpcs` first |
-| Create subnet | hcloud VPC CreateSubnet --subnet.name=<name> --subnet.vpc_id=<id> --subnet.cidr=<cidr> --subnet.gateway_ip=<gw> --subnet.primary_dns=<dns1> --subnet.secondary_dns=<dns2> --subnet.availability_zone=<az> | Subnet CIDR must be a subset of the VPC CIDR. DNS addresses vary by region — see Critical Warnings for common values |
-| Update subnet | hcloud VPC UpdateSubnet --subnet_id=<id> --subnet.dnsList.1=<dns1> --subnet.dnsList.2=<dns2> | Fix DNS after creation. Restart ECS after updating DNS for cloud-init to pick up changes |
-| Security group | hcloud VPC CreateSecurityGroup --security_group.name=<name> | references/security-group.md |
-| SG rule | hcloud VPC CreateSecurityGroupRule --security_group_rule.security_group_id=<id> --security_group_rule.direction=<direction> --security_group_rule.protocol=<protocol> --security_group_rule.multiport=<port> --security_group_rule.remote_ip_prefix=<cidr> | references/security-group.md |
-| Create EIP | hcloud EIP CreatePublicip --publicip.type=<type> --bandwidth.size=<size> --bandwidth.share_type=<share-type> --bandwidth.name=<name> | Run `hcloud EIP CreatePublicip --help` to confirm valid type values per region |
-| Bind EIP to ECS | hcloud EIP AssociatePublicips --publicip_id=<id> --publicip.associate_instance_id=<port-id> --publicip.associate_instance_type=PORT | Get port ID from `hcloud ECS ListServersDetails --server_id=<id>` → `OS-EXT-IPS:port_id` |
-| Unbind EIP | hcloud EIP DisassociatePublicip --publicip_id=<id> | references/eip.md |
-| Delete EIP | hcloud EIP DeletePublicip --publicip_id=<id> | references/eip.md |
-| List EIPs | hcloud EIP ListPublicips | |
-| NAT gateway | hcloud NAT CreateNatGateway --nat.name=<name> --nat.spec=<spec> --router_id=<vpc-id> --internal_network_id=<subnet-id> | Run `hcloud NAT CreateNatGateway --help` for available spec values |
-## Troubleshooting
-| Error | Root Cause -> Fix |
-|-------|------------------|
-| Cannot reach instance | SG missing rule or no EIP -> Add SG rule / Bind EIP |
-| Subnet CIDR conflict | Overlapping with existing subnets -> Choose non-overlapping CIDR |
-| NAT gateway no internet | Route table missing default route -> Add 0.0.0.0/0 via NAT |
-| EIP quota exceeded | Check actual quota: `hcloud EIP ListPublicips --cli-region=<r>` to see current usage. Default varies by account (typically 5-10) |
-| EIP.7905 | Run `hcloud EIP ListPublicips --cli-region=<r>` first to check current usage |
-| VPC.0301: Bandwidth name invalid | PER type requires `--bandwidth.name`, even though `--help` marks it optional |
-| EIP has no public IP after binding | May need AddIngressEipV2 for ELB-type resources (see huawei-apig) |
-| ECS cloud-init fails silently (port 80/443 closed) | Subnet likely has no DNS. Check `hcloud VPC ShowSubnet --subnet_id=<id>` → `dnsList` empty? Rebuild subnet with `--subnet.primary_dns=<dns1> --subnet.secondary_dns=<dns2>`. DNS addresses per region: `hcloud VPC CreateSubnet --help` |
-| VPC.0209: Subnet still used | Subnet has dependent resources (ECS/RDS) — delete instances first, then subnet |
-| SYS.0403 / SCP deny | Service Control Policy explicitly denies this operation — contact org admin to adjust SCP, or use an account/region without the restriction. If SSH is blocked, bootstrap via cloud-init user_data instead: see `huawei-ecs` — no SSH needed |
-## Security Considerations
-- MUST use security groups, NOT iptables
-- MUST scope SG rules to specific CIDRs, NOT 0.0.0.0/0
-- SHOULD use network ACLs as defense-in-depth
-- SHOULD place databases in private subnets (no EIP)
-- MUST enable VPC flow logs for audit
-## MCP Tools
-- huaweicloud_list_operations service=VPC
-- huaweicloud_run_readonly_command for VPC/subnet discovery
-- huaweicloud_run_approved_command for writes
-## References
-- VPC Docs: https://support.huaweicloud.com/vpc/
-- Subnet guide: references/subnet.md
-- Security group: references/security-group.md
+---
+name: huawei-vpc
+description: 'Use when creating, configuring, or managing VPC networks, subnets, security groups, EIPs, NAT gateways, VPN connections, or network ACLs on Huawei Cloud. Triggers on: VPC, subnet, security group, EIP, NAT, VPN, network ACL, route table, bandwidth. NOT for: DNS or CDN configuration.'
+version: 1
+---
+# Huawei Cloud VPC
+**STOP - Do not answer from general knowledge.** Follow the procedure below.
+Always run `hcloud <Service> <Operation> --help` before constructing commands to discover exact parameter names and requirements.
+> **Multi-version APIs**: KooCLI may print a warning like "ListVpcs有多个版本,默认使用该API版本v3" before the actual response. The text BEFORE the first `{` is the version selection notice — parse JSON starting from `{` only. This is normal behavior, not an error.
+## Overview
+Domain expertise for Huawei Cloud Virtual Private Cloud (VPC). Covers VPC/subnet lifecycle, security groups, EIP management, NAT gateways, VPN, and network ACLs.
+## Critical Warnings
+| Trap                                  | Why                                                                                                                                                                                                                                                                                                                                                                                                |
+| ------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| VPC CIDR cannot change                | Once set, VPC CIDR block is immutable                                                                                                                                                                                                                                                                                                                                                              |
+| Security group stateful               | SG rules are stateful. Return traffic auto-allowed                                                                                                                                                                                                                                                                                                                                                 |
+| Network ACL stateless                 | ACL rules must allow both inbound AND outbound                                                                                                                                                                                                                                                                                                                                                     |
+| EIP bills when idle                   | Unbound EIP still charges. Release when unused                                                                                                                                                                                                                                                                                                                                                     |
+| Subnet AZ binding                     | Subnet tied to single AZ. Cross-AZ needs multiple subnets                                                                                                                                                                                                                                                                                                                                          |
+| EIP PER type needs `--bandwidth.name` | PER bandwidth requires explicit name; `--help` marks it optional but it's required                                                                                                                                                                                                                                                                                                                 |
+| **VPC params need nested prefix**     | KooCLI 7.x VPC API uses `--vpc.<param>`, `--subnet.<param>`, `--security_group.<param>`. Example: `--vpc.name=xxx` NOT `--name=xxx`                                                                                                                                                                                                                                                                |
+| **Security group needs no vpc_id**    | VPC v3 API `CreateSecurityGroup` does NOT accept `vpc_id`. Security groups are region-level, not VPC-bound                                                                                                                                                                                                                                                                                         |
+| Subnet DNS empty → ECS no DNS         | DNS params (`--subnet.primary_dns`, `--subnet.secondary_dns`) marked optional but empty default breaks cloud-init domain resolution — `yum`/`apt` installs fail silently. Always set both. Common DNS IPs: cn-north-4 (100.125.1.250 / 100.125.1.251), cn-north-1 (100.125.1.250 / 100.125.129.250), cn-east-3 (100.125.1.250 / 100.125.129.250), ap-southeast-3 (100.125.1.250 / 100.125.128.250) |
+| SCP blocks 0.0.0.0/0 SG rules         | If `CreateSecurityGroupRule` with `--remote_ip_prefix=0.0.0.0/0` fails with `SYS.0403`, an org-level SCP policy is denying wide-open rules. Narrow to a specific CIDR range (e.g., your office IP) instead                                                                                                                                                                                         |
+| **VPC tags use `*` separator**        | VPC tag format: `--vpc.tags.1=env*test` (asterisk between key and value). NOT `--vpc.tags.1.key=env` (ECS-style). This is different from ECS `--server.metadata.key=value`                                                                                                                                                                                                                         |
+## Common Workflows
+| Task            | Command                                                                                                                                                                                                                                                    | Steps                                                                                                                |
+| --------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------- |
+| Create VPC      | hcloud VPC CreateVpc --vpc.name=<name> --vpc.cidr=<cidr>                                                                                                                                                                                                   | CIDR must not conflict with existing VPCs. Run `hcloud VPC ListVpcs` first                                           |
+| Create subnet   | hcloud VPC CreateSubnet --subnet.name=<name> --subnet.vpc_id=<id> --subnet.cidr=<cidr> --subnet.gateway_ip=<gw> --subnet.primary_dns=<dns1> --subnet.secondary_dns=<dns2> --subnet.availability_zone=<az>                                                  | Subnet CIDR must be a subset of the VPC CIDR. DNS addresses vary by region — see Critical Warnings for common values |
+| Update subnet   | hcloud VPC UpdateSubnet --subnet_id=<id> --subnet.dnsList.1=<dns1> --subnet.dnsList.2=<dns2>                                                                                                                                                               | Fix DNS after creation. Restart ECS after updating DNS for cloud-init to pick up changes                             |
+| Security group  | hcloud VPC CreateSecurityGroup --security_group.name=<name>                                                                                                                                                                                                | references/security-group.md                                                                                         |
+| SG rule         | hcloud VPC CreateSecurityGroupRule --security_group_rule.security_group_id=<id> --security_group_rule.direction=<direction> --security_group_rule.protocol=<protocol> --security_group_rule.multiport=<port> --security_group_rule.remote_ip_prefix=<cidr> | references/security-group.md                                                                                         |
+| Create EIP      | hcloud EIP CreatePublicip --publicip.type=<type> --bandwidth.size=<size> --bandwidth.share_type=<share-type> --bandwidth.name=<name>                                                                                                                       | Run `hcloud EIP CreatePublicip --help` to confirm valid type values per region                                       |
+| Bind EIP to ECS | hcloud EIP AssociatePublicips --publicip_id=<id> --publicip.associate_instance_id=<port-id> --publicip.associate_instance_type=PORT                                                                                                                        | Get port ID from `hcloud ECS ListServersDetails --server_id=<id>` → `OS-EXT-IPS:port_id`                             |
+| Unbind EIP      | hcloud EIP DisassociatePublicip --publicip_id=<id>                                                                                                                                                                                                         | references/eip.md                                                                                                    |
+| Delete EIP      | hcloud EIP DeletePublicip --publicip_id=<id>                                                                                                                                                                                                               | references/eip.md                                                                                                    |
+| List EIPs       | hcloud EIP ListPublicips                                                                                                                                                                                                                                   |                                                                                                                      |
+| NAT gateway     | hcloud NAT CreateNatGateway --nat.name=<name> --nat.spec=<spec> --router_id=<vpc-id> --internal_network_id=<subnet-id>                                                                                                                                     | Run `hcloud NAT CreateNatGateway --help` for available spec values                                                   |
+## Troubleshooting
+| Error                                              | Root Cause -> Fix                                                                                                                                                                                                                            |
+| -------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Cannot reach instance                              | SG missing rule or no EIP -> Add SG rule / Bind EIP                                                                                                                                                                                          |
+| Subnet CIDR conflict                               | Overlapping with existing subnets -> Choose non-overlapping CIDR                                                                                                                                                                             |
+| NAT gateway no internet                            | Route table missing default route -> Add 0.0.0.0/0 via NAT                                                                                                                                                                                   |
+| EIP quota exceeded                                 | Check actual quota: `hcloud EIP ListPublicips --cli-region=<r>` to see current usage. Default varies by account (typically 5-10)                                                                                                             |
+| EIP.7905                                           | Run `hcloud EIP ListPublicips --cli-region=<r>` first to check current usage                                                                                                                                                                 |
+| VPC.0301: Bandwidth name invalid                   | PER type requires `--bandwidth.name`, even though `--help` marks it optional                                                                                                                                                                 |
+| EIP has no public IP after binding                 | May need AddIngressEipV2 for ELB-type resources (see huawei-apig)                                                                                                                                                                            |
+| ECS cloud-init fails silently (port 80/443 closed) | Subnet likely has no DNS. Check `hcloud VPC ShowSubnet --subnet_id=<id>` → `dnsList` empty? Rebuild subnet with `--subnet.primary_dns=<dns1> --subnet.secondary_dns=<dns2>`. DNS addresses per region: `hcloud VPC CreateSubnet --help`      |
+| VPC.0209: Subnet still used                        | Subnet has dependent resources (ECS/RDS) — delete instances first, then subnet                                                                                                                                                               |
+| SYS.0403 / SCP deny                                | Service Control Policy explicitly denies this operation — contact org admin to adjust SCP, or use an account/region without the restriction. If SSH is blocked, bootstrap via cloud-init user_data instead: see `huawei-ecs` — no SSH needed |
+## Security Considerations
+- MUST use security groups, NOT iptables
+- MUST scope SG rules to specific CIDRs, NOT 0.0.0.0/0
+- SHOULD use network ACLs as defense-in-depth
+- SHOULD place databases in private subnets (no EIP)
+- MUST enable VPC flow logs for audit
+## MCP Tools
+- huaweicloud_list_operations service=VPC
+- huaweicloud_run_readonly_command for VPC/subnet discovery
+- huaweicloud_run_approved_command for writes
+## References
+- VPC Docs: https://support.huaweicloud.com/vpc/
+- Subnet guide: references/subnet.md
+- Security group: references/security-group.md

package/plugins/huaweicloud-core/skills/huawei-vpc/references/network.md CHANGED Viewed

@@ -1,76 +1,77 @@
-# VPC Network Management Reference
-## DNS Addresses by Region
-Subnets without DNS configuration will fail cloud-init. Use these DNS addresses:
-| Region | Primary DNS | Secondary DNS |
-|--------|------------|---------------|
-| cn-north-1 | 100.125.1.250 | 100.125.129.250 |
-| cn-north-4 | 100.125.1.250 | 100.125.129.250 |
-| cn-east-3 | 100.125.1.250 | 100.125.129.250 |
-| cn-south-1 | 100.125.1.250 | 100.125.129.250 |
-| ap-southeast-3 | 100.125.1.250 | 100.125.129.250 |
-**Subnet create with DNS**:
-```bash
-hcloud VPC CreateSubnet \
-  --subnet.name=<name> \
-  --subnet.vpc_id=<id> \
-  --subnet.cidr=10.50.1.0/24 \
-  --subnet.gateway_ip=10.50.1.1 \
-  --subnet.availability_zone=<az> \
-  --subnet.dnsList.1=100.125.1.250 \
-  --subnet.dnsList.2=100.125.129.250
-```
-## Nested Prefix Summary
-KooCLI 7.x VPC API requires nested prefixes:
-| Resource | Create Param Prefix | Example |
-|----------|---------------------|---------|
-| VPC | `--vpc.` | `--vpc.name=my-vpc --vpc.cidr=192.168.0.0/16` |
-| Subnet | `--subnet.` | `--subnet.name=web --subnet.vpc_id=<id> --subnet.cidr=192.168.1.0/24` |
-| Security Group | `--security_group.` | `--security_group.name=sg-web` |
-| SG Rule | `--security_group_rule.` | `--security_group_rule.direction=ingress` |
-## EIP Management
-```bash
-# Create EIP (pay-per-use)
-hcloud EIP CreatePublicip --publicip.type=<type> \
-  --bandwidth.size=<size> --bandwidth.share_type=<share-type> --bandwidth.name=<name>
-# Bind to ECS (PORT type, not ECS)
-hcloud EIP AssociatePublicips --publicip_id=<id> \
-  --publicip.associate_instance_id=<port-id> --publicip.associate_instance_type=PORT
-# Unbind
-hcloud EIP DisassociatePublicip --publicip_id=<id>
-# List
-hcloud EIP ListPublicips
-# Delete (unbind first)
-hcloud EIP DeletePublicip --publicip_id=<id>
-```
-> EIP bills even when not bound. Release unused EIPs.
-## Security Group Quick Reference
-```bash
-# Create SG (no vpc_id needed)
-hcloud VPC CreateSecurityGroup --security_group.name=<name>
-# Add SSH rule
-hcloud VPC CreateSecurityGroupRule \
-  --security_group_rule.security_group_id=<sg-id> \
-  --security_group_rule.direction=<direction> \
-  --security_group_rule.protocol=<protocol> \
-  --security_group_rule.multiport=<port> \
-  --security_group_rule.remote_ip_prefix=<cidr>
-```
-> SG is stateful — return traffic auto-allowed. Network ACL is stateless — need both directions.
+# VPC Network Management Reference
+## DNS Addresses by Region
+Subnets without DNS configuration will fail cloud-init. Use these DNS addresses:
+| Region         | Primary DNS   | Secondary DNS   |
+| -------------- | ------------- | --------------- |
+| cn-north-1     | 100.125.1.250 | 100.125.129.250 |
+| cn-north-4     | 100.125.1.250 | 100.125.129.250 |
+| cn-east-3      | 100.125.1.250 | 100.125.129.250 |
+| cn-south-1     | 100.125.1.250 | 100.125.129.250 |
+| ap-southeast-3 | 100.125.1.250 | 100.125.129.250 |
+**Subnet create with DNS**:
+```bash
+hcloud VPC CreateSubnet \
+  --subnet.name=<name> \
+  --subnet.vpc_id=<id> \
+  --subnet.cidr=10.50.1.0/24 \
+  --subnet.gateway_ip=10.50.1.1 \
+  --subnet.availability_zone=<az> \
+  --subnet.dnsList.1=100.125.1.250 \
+  --subnet.dnsList.2=100.125.129.250
+```
+## Nested Prefix Summary
+KooCLI 7.x VPC API requires nested prefixes:
+| Resource       | Create Param Prefix      | Example                                                               |
+| -------------- | ------------------------ | --------------------------------------------------------------------- |
+| VPC            | `--vpc.`                 | `--vpc.name=my-vpc --vpc.cidr=192.168.0.0/16`                         |
+| Subnet         | `--subnet.`              | `--subnet.name=web --subnet.vpc_id=<id> --subnet.cidr=192.168.1.0/24` |
+| Security Group | `--security_group.`      | `--security_group.name=sg-web`                                        |
+| SG Rule        | `--security_group_rule.` | `--security_group_rule.direction=ingress`                             |
+## EIP Management
+```bash
+# Create EIP (pay-per-use)
+hcloud EIP CreatePublicip --publicip.type=<type> \
+  --bandwidth.size=<size> --bandwidth.share_type=<share-type> --bandwidth.name=<name>
+# Bind to ECS (PORT type, not ECS)
+hcloud EIP AssociatePublicips --publicip_id=<id> \
+  --publicip.associate_instance_id=<port-id> --publicip.associate_instance_type=PORT
+# Unbind
+hcloud EIP DisassociatePublicip --publicip_id=<id>
+# List
+hcloud EIP ListPublicips
+# Delete (unbind first)
+hcloud EIP DeletePublicip --publicip_id=<id>
+```
+> EIP bills even when not bound. Release unused EIPs.
+## Security Group Quick Reference
+```bash
+# Create SG (no vpc_id needed)
+hcloud VPC CreateSecurityGroup --security_group.name=<name>
+# Add SSH rule
+hcloud VPC CreateSecurityGroupRule \
+  --security_group_rule.security_group_id=<sg-id> \
+  --security_group_rule.direction=<direction> \
+  --security_group_rule.protocol=<protocol> \
+  --security_group_rule.multiport=<port> \
+  --security_group_rule.remote_ip_prefix=<cidr>
+```
+> SG is stateful — return traffic auto-allowed. Network ACL is stateless — need both directions.

package/plugins/huaweicloud-core/skills/huawei-vpc/references/security-group.md CHANGED Viewed

@@ -1,59 +1,60 @@
-# Security Group Rules
-## Security Group is NOT bound to VPC
-VPC v3 API `CreateSecurityGroup` does NOT accept a `vpc_id` parameter. Security groups are region-level resources, not VPC-bound. They work across any VPC in the same region.
-```bash
-# CORRECT — no vpc_id needed
-hcloud VPC CreateSecurityGroup --security_group.name=<name>
-# WRONG
-hcloud VPC CreateSecurityGroup --security_group.vpc_id=<vpc-id>
-```
-## KooCLI 7.x Nested Parameter Format
-Security group params use `--security_group.` prefix. Rules use `--security_group_rule.` prefix.
-## Create Security Group Rule
-Complete example with nested prefix:
-```bash
-hcloud VPC CreateSecurityGroupRule \
-  --security_group_rule.security_group_id=<sg-id> \
-  --security_group_rule.direction=<direction> \
-  --security_group_rule.protocol=<protocol> \
-  --security_group_rule.multiport=<port> \
-  --security_group_rule.remote_ip_prefix=<cidr>
-```
-> Always run `hcloud VPC CreateSecurityGroupRule --help` to verify param names.
-## Stateful vs Stateless
-| Feature | Security Group | Network ACL |
-|---------|---------------|-------------|
-| Stateful? | Yes — return traffic auto-allowed | No — must allow both directions |
-| Applied to | ECS instance NIC | Subnet |
-| Rules | Allow only | Allow and Deny |
-| Default | Deny all inbound, allow all outbound | Allow all |
-## Common Rules Reference
-| Direction | Protocol | Port | Source | Purpose |
-|-----------|----------|------|--------|---------|
-| Ingress | TCP | 22 | <office-ip>/32 | SSH |
-| Ingress | TCP | 80 | 0.0.0.0/0 | HTTP |
-| Ingress | TCP | 443 | 0.0.0.0/0 | HTTPS |
-| Ingress | TCP | 3306 | <sg-app-id> | MySQL from app |
-| Ingress | TCP | 6379 | <sg-app-id> | Redis from app |
-| Egress | ALL | ALL | 0.0.0.0/0 | Outbound default |
-## Common Errors
-| Error | Root Cause -> Fix |
-|-------|-------------------|
-| Cannot SSH | Default SG denies all inbound. Add port 22 rule |
-| Rule not effective | SG assigned to wrong instance. Verify NIC attachment |
-| `[USE_ERROR]不正确的参数:vpc_id` | Security groups don't need vpc_id. Remove it |
+# Security Group Rules
+## Security Group is NOT bound to VPC
+VPC v3 API `CreateSecurityGroup` does NOT accept a `vpc_id` parameter. Security groups are region-level resources, not VPC-bound. They work across any VPC in the same region.
+```bash
+# CORRECT — no vpc_id needed
+hcloud VPC CreateSecurityGroup --security_group.name=<name>
+# WRONG
+hcloud VPC CreateSecurityGroup --security_group.vpc_id=<vpc-id>
+```
+## KooCLI 7.x Nested Parameter Format
+Security group params use `--security_group.` prefix. Rules use `--security_group_rule.` prefix.
+## Create Security Group Rule
+Complete example with nested prefix:
+```bash
+hcloud VPC CreateSecurityGroupRule \
+  --security_group_rule.security_group_id=<sg-id> \
+  --security_group_rule.direction=<direction> \
+  --security_group_rule.protocol=<protocol> \
+  --security_group_rule.multiport=<port> \
+  --security_group_rule.remote_ip_prefix=<cidr>
+```
+> Always run `hcloud VPC CreateSecurityGroupRule --help` to verify param names.
+## Stateful vs Stateless
+| Feature    | Security Group                       | Network ACL                     |
+| ---------- | ------------------------------------ | ------------------------------- |
+| Stateful?  | Yes — return traffic auto-allowed    | No — must allow both directions |
+| Applied to | ECS instance NIC                     | Subnet                          |
+| Rules      | Allow only                           | Allow and Deny                  |
+| Default    | Deny all inbound, allow all outbound | Allow all                       |
+## Common Rules Reference
+| Direction | Protocol | Port | Source         | Purpose          |
+| --------- | -------- | ---- | -------------- | ---------------- |
+| Ingress   | TCP      | 22   | <office-ip>/32 | SSH              |
+| Ingress   | TCP      | 80   | 0.0.0.0/0      | HTTP             |
+| Ingress   | TCP      | 443  | 0.0.0.0/0      | HTTPS            |
+| Ingress   | TCP      | 3306 | <sg-app-id>    | MySQL from app   |
+| Ingress   | TCP      | 6379 | <sg-app-id>    | Redis from app   |
+| Egress    | ALL      | ALL  | 0.0.0.0/0      | Outbound default |
+## Common Errors
+| Error                            | Root Cause -> Fix                                    |
+| -------------------------------- | ---------------------------------------------------- |
+| Cannot SSH                       | Default SG denies all inbound. Add port 22 rule      |
+| Rule not effective               | SG assigned to wrong instance. Verify NIC attachment |
+| `[USE_ERROR]不正确的参数:vpc_id` | Security groups don't need vpc_id. Remove it         |

package/plugins/huaweicloud-core/skills/huawei-vpc/references/subnet.md CHANGED Viewed

@@ -1,50 +1,50 @@
-# VPC Subnet Guide
-## Prerequisite: VPC CIDR is Immutable
-VPC CIDR block cannot be changed after creation. Plan carefully.
-## KooCLI 7.x Nested Parameter Format
-VPC API uses nested prefix: `--vpc.name`, `--subnet.vpc_id`, `--subnet.name`. NOT `--name` or `--vpc_id`.
-```bash
-# CORRECT
-hcloud VPC CreateVpc --vpc.name=<name> --vpc.cidr=192.168.0.0/16
-hcloud VPC CreateSubnet \
-  --subnet.name=<name> \
-  --subnet.vpc_id=<vpc-id> \
-  --subnet.cidr=192.168.1.0/24 \
-  --subnet.gateway_ip=192.168.1.1 \
-  --subnet.availability_zone=<az>
-# WRONG — will fail with [USE_ERROR]
-hcloud VPC CreateVpc --name=xxx
-hcloud VPC CreateSubnet --vpc_id=xxx
-```
-## Key Constraints
-| Constraint | Detail |
-|-----------|--------|
-| Subnet bound to single AZ | Cross-AZ needs multiple subnets. AZ code format: `cn-south-1a` |
-| CIDR must not overlap | Cannot overlap with other subnets in same VPC |
-| Gateway IP auto-assigned | Default is first IP in CIDR range (e.g., 192.168.1.1 for /24) |
-| 5 IPs reserved per subnet | First 4 + broadcast reserved by platform |
-## Common Errors
-| Error | Root Cause -> Fix |
-|-------|-------------------|
-| `[USE_ERROR]不正确的参数:name` | Missing nested prefix. Use `--vpc.name=` or `--subnet.name=` |
-| CIDR overlap | Subnet CIDR must be within VPC CIDR and not overlap others |
-| AZ not found | Use `hcloud ECS NovaListAvailabilityZones --cli-region=<r>` to list valid AZ codes |
-## CIDR Planning Reference
-| Environment | VPC CIDR | Subnet CIDR |
-|------------|----------|-------------|
-| Dev | 192.168.0.0/16 | 192.168.1.0/24 |
-| Staging | 10.0.0.0/16 | 10.0.1.0/24 |
-| Production | 172.16.0.0/16 | 172.16.1.0/24 (public) + 172.16.2.0/24 (private) |
+# VPC Subnet Guide
+## Prerequisite: VPC CIDR is Immutable
+VPC CIDR block cannot be changed after creation. Plan carefully.
+## KooCLI 7.x Nested Parameter Format
+VPC API uses nested prefix: `--vpc.name`, `--subnet.vpc_id`, `--subnet.name`. NOT `--name` or `--vpc_id`.
+```bash
+# CORRECT
+hcloud VPC CreateVpc --vpc.name=<name> --vpc.cidr=192.168.0.0/16
+hcloud VPC CreateSubnet \
+  --subnet.name=<name> \
+  --subnet.vpc_id=<vpc-id> \
+  --subnet.cidr=192.168.1.0/24 \
+  --subnet.gateway_ip=192.168.1.1 \
+  --subnet.availability_zone=<az>
+# WRONG — will fail with [USE_ERROR]
+hcloud VPC CreateVpc --name=xxx
+hcloud VPC CreateSubnet --vpc_id=xxx
+```
+## Key Constraints
+| Constraint                | Detail                                                         |
+| ------------------------- | -------------------------------------------------------------- |
+| Subnet bound to single AZ | Cross-AZ needs multiple subnets. AZ code format: `cn-south-1a` |
+| CIDR must not overlap     | Cannot overlap with other subnets in same VPC                  |
+| Gateway IP auto-assigned  | Default is first IP in CIDR range (e.g., 192.168.1.1 for /24)  |
+| 5 IPs reserved per subnet | First 4 + broadcast reserved by platform                       |
+## Common Errors
+| Error                          | Root Cause -> Fix                                                                  |
+| ------------------------------ | ---------------------------------------------------------------------------------- |
+| `[USE_ERROR]不正确的参数:name` | Missing nested prefix. Use `--vpc.name=` or `--subnet.name=`                       |
+| CIDR overlap                   | Subnet CIDR must be within VPC CIDR and not overlap others                         |
+| AZ not found                   | Use `hcloud ECS NovaListAvailabilityZones --cli-region=<r>` to list valid AZ codes |
+## CIDR Planning Reference
+| Environment | VPC CIDR       | Subnet CIDR                                      |
+| ----------- | -------------- | ------------------------------------------------ |
+| Dev         | 192.168.0.0/16 | 192.168.1.0/24                                   |
+| Staging     | 10.0.0.0/16    | 10.0.1.0/24                                      |
+| Production  | 172.16.0.0/16  | 172.16.1.0/24 (public) + 172.16.2.0/24 (private) |