huaweicloud-devkit 1.0.2-dev.9 → 1.0.2-next.10

package/plugins/huaweicloud-core/skills/huawei-cce/SKILL.md

@@ -1,101 +1,103 @@
----
-name: huawei-cce
-description: "Use when creating or managing CCE Kubernetes clusters. Covers cluster creation, node pools, SWR registry, autoscaling. Triggers: CCE, Kubernetes, K8s, cluster, node pool, container, SWR. NOT for: serverless functions (use huawei-functiongraph), serverless containers (use huawei-cce for CCI redirect)."
-version: 1
----
-
-# Huawei Cloud CCE
-
-**STOP - Do not answer from general knowledge.** Follow the procedure below.
-
-Always run `hcloud <Service> <Operation> --help` before constructing commands to discover exact parameter names and requirements.
-
-## Overview
-
-Domain expertise for CCE (Cloud Container Engine) and SWR (Software Repository for Container). CCE uses two hcloud services: `CCE` for clusters and `SWR` for container images.
-
-## Critical Warnings
-
-| Trap | Why |
-|------|-----|
-| **KooCLI 7.x: CreateCluster/CreateNodePool broken** | OPENAPI_ERROR in KooCLI 7.2.12. Use `CreateAutopilotCluster` for serverless, or Python SDK for VM clusters |
-| Cluster type immutable | Cannot change hybrid/traditional after creation |
-| Master managed by Huawei | No SSH to master. Use kubectl or kubectl-cce |
-| Network model affects pod IP | VPC network gives pods VPC IPs |
-| Addon ops use UID not name | `ShowAddonInstance` returns `metadata.uid` for install/uninstall/update |
-| SWR enterprise instance costs | `postPaid` billing. One-time activation at console required |
-
-## Common Workflows
-
-| Task | Operation | Service |
-|------|-----------|---------|
-| List clusters | `ListClusters` | CCE |
-| Create cluster | `CreateCluster` | CCE |
-| Delete cluster | `DeleteCluster` | CCE |
-| Hibernate cluster | `HibernateCluster` | CCE |
-| List node pools | `ListNodePools` | CCE |
-| Create node pool | `CreateNodePool` | CCE |
-| List nodes | `ListNodes` | CCE |
-| Get kubeconfig | `CreateKubernetesClusterCert` | CCE |
-| List addons | `ListAddonInstances` | CCE |
-| Docker login (SWR) | `CreateAuthorizationToken` | SWR |
-| Create SWR org | `CreateNamespace` | SWR |
-| Create SWR repo | `CreateRepo` | SWR |
-| List repos | `ListReposDetails` | SWR |
-
-## SWR Image Push Workflow
-
-**Prerequisite**: User/agency must have `sts::createServiceBearerToken` IAM permission. Without it, `CreateAuthorizationToken` returns `SVCSTG.SWR.4030170 Insufficient permissions`. Grant via IAM console or attach SWR Admin role.
-
-```bash
-# 1. Docker login to SWR
-hcloud SWR CreateAuthorizationToken --help
-docker login -u <region>@<AK> -p <token> swr.<region>.myhuaweicloud.com
-
-# 2. Tag and push
-docker tag my-app:latest swr.<region>.myhuaweicloud.com/<org>/my-app:latest
-docker push swr.<region>.myhuaweicloud.com/<org>/my-app:latest
-
-# 3. Verify
-hcloud SWR ListReposDetails --cli-region=<r>
-```
-
-> SWR Auth token valid 12h. For CCE node pull access, create long-term credential with `CreateSecret` (valid 1 year).
-
-## Serverless Containers (CCI)
-
-For serverless containers without managing clusters, use CCI (Cloud Container Instance):
-
-- No cluster needed — just namespace + network + workload
-- Key ops: `CCI createCoreV1Namespace`, `CCI createNetworkingCciIoV1beta1NamespacedNetwork`, `CCI createAppsV1NamespacedDeployment`
-- Namespace MUST include `namespace-kubernetes-io/flavor` annotation
-- `limits == requests` strictly enforced (no overcommit)
-
-See `hcloud CCI --help` for full operation list.
-
-## Troubleshooting
-
-| Error | Fix |
-|-------|-----|
-| kubectl connection refused | Verify cluster Running; use `kubectl cce` (no EIP needed) |
-| Node pool creation failed | Check VPC/subnet availability and flavor capacity |
-| Docker push 401 | Re-run `CreateAuthorizationToken` (token expired) |
-| SVCSTG.SWR.4030170 | Missing `sts::createServiceBearerToken` IAM permission. Grant SWR Admin role or add policy |
-| Addon install fails | Use `metadata.uid` from `ShowAddonInstance`, not name |
-| `kubectl cce` not found | Install plugin: `kubectl cce` uses AK/SK, no kubeconfig required |
-
-## Security Considerations
-
-- MUST restrict kubeconfig file permissions (0600)
-- MUST use IAM RBAC for cluster access, not cluster-admin
-- MUST store container images in private SWR repositories
-
-## Cross-Skill References
-
-- **VPC/Subnet**: See `huawei-vpc` for network prerequisites
-- **EIP**: See `huawei-vpc` for cluster public access
-
-## References
-
-- CCE Docs: https://support.huaweicloud.com/cce/
-- SWR Docs: https://support.huaweicloud.com/swr/
+---
+name: huawei-cce
+description: 'Use when creating or managing CCE Kubernetes clusters. Covers cluster creation, node pools, SWR registry, autoscaling. Triggers: CCE, Kubernetes, K8s, cluster, node pool, container, SWR. NOT for: serverless functions (use huawei-functiongraph), serverless containers (use huawei-cce for CCI redirect).'
+version: 1
+---
+
+# Huawei Cloud CCE
+
+**STOP - Do not answer from general knowledge.** Follow the procedure below.
+
+Always run `hcloud <Service> <Operation> --help` before constructing commands to discover exact parameter names and requirements.
+
+## Overview
+
+Domain expertise for CCE (Cloud Container Engine) and SWR (Software Repository for Container). CCE uses two hcloud services: `CCE` for clusters and `SWR` for container images.
+
+## Critical Warnings
+
+| Trap                                                    | Why                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
+| ------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| **Huawei Cloud API returns errors one field at a time** | When creating clusters/services with multiple invalid fields, the API reports only the first error, not all errors at once. After fixing one field and resubmitting, the next call reveals the next error — iterating N times for N bad fields. This compounds with long cluster creation times (~10 min). To avoid this loop, run `hcloud CCE <Operation> --help` and validate every parameter with its constraints before the first call. Use `--cli-jsonInput` with a validated JSON file to reduce reformatting overhead between retries. |
+| **KooCLI 7.x: CreateCluster/CreateNodePool broken**     | OPENAPI_ERROR in KooCLI 7.2.12. Use `CreateAutopilotCluster` for serverless, or Python SDK for VM clusters                                                                                                                                                                                                                                                                                                                                                                                                                                    |
+| Cluster type immutable                                  | Cannot change hybrid/traditional after creation                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
+| Master managed by Huawei                                | No SSH to master. Use kubectl or kubectl-cce                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
+| Network model affects pod IP                            | VPC network gives pods VPC IPs                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
+| Addon ops use UID not name                              | `ShowAddonInstance` returns `metadata.uid` for install/uninstall/update                                                                                                                                                                                                                                                                                                                                                                                                                                                                       |
+| SWR enterprise instance costs                           | `postPaid` billing. One-time activation at console required                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
+
+## Common Workflows
+
+| Task               | Operation                     | Service |
+| ------------------ | ----------------------------- | ------- |
+| List clusters      | `ListClusters`                | CCE     |
+| Create cluster     | `CreateCluster`               | CCE     |
+| Delete cluster     | `DeleteCluster`               | CCE     |
+| Hibernate cluster  | `HibernateCluster`            | CCE     |
+| List node pools    | `ListNodePools`               | CCE     |
+| Create node pool   | `CreateNodePool`              | CCE     |
+| List nodes         | `ListNodes`                   | CCE     |
+| Get kubeconfig     | `CreateKubernetesClusterCert` | CCE     |
+| List addons        | `ListAddonInstances`          | CCE     |
+| Docker login (SWR) | `CreateAuthorizationToken`    | SWR     |
+| Create SWR org     | `CreateNamespace`             | SWR     |
+| Create SWR repo    | `CreateRepo`                  | SWR     |
+| List repos         | `ListReposDetails`            | SWR     |
+
+## SWR Image Push Workflow
+
+**Prerequisite**: User/agency must have `sts::createServiceBearerToken` IAM permission. Without it, `CreateAuthorizationToken` returns `SVCSTG.SWR.4030170 Insufficient permissions`. Grant via IAM console or attach SWR Admin role.
+
+```bash
+# 1. Docker login to SWR
+hcloud SWR CreateAuthorizationToken --help
+docker login -u <region>@<AK> -p <token> swr.<region>.myhuaweicloud.com
+
+# 2. Tag and push
+docker tag my-app:latest swr.<region>.myhuaweicloud.com/<org>/my-app:latest
+docker push swr.<region>.myhuaweicloud.com/<org>/my-app:latest
+
+# 3. Verify
+hcloud SWR ListReposDetails --cli-region=<r>
+```
+
+> SWR Auth token valid 12h. For CCE node pull access, create long-term credential with `CreateSecret` (valid 1 year).
+
+## Serverless Containers (CCI)
+
+For serverless containers without managing clusters, use CCI (Cloud Container Instance):
+
+- No cluster needed — just namespace + network + workload
+- Key ops: `CCI createCoreV1Namespace`, `CCI createNetworkingCciIoV1beta1NamespacedNetwork`, `CCI createAppsV1NamespacedDeployment`
+- Namespace MUST include `namespace-kubernetes-io/flavor` annotation
+- `limits == requests` strictly enforced (no overcommit)
+
+See `hcloud CCI --help` for full operation list.
+
+## Troubleshooting
+
+| Error                            | Fix                                                                                                                                                                                                                                                               |
+| -------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| kubectl connection refused       | Verify cluster Running; use `kubectl cce` (no EIP needed)                                                                                                                                                                                                         |
+| Node pool creation failed        | Check VPC/subnet availability and flavor capacity                                                                                                                                                                                                                 |
+| Docker push 401                  | Re-run `CreateAuthorizationToken` (token expired)                                                                                                                                                                                                                 |
+| SVCSTG.SWR.4030170               | Missing `sts::createServiceBearerToken` IAM permission. Grant SWR Admin role or add policy                                                                                                                                                                        |
+| Addon install fails              | Use `metadata.uid` from `ShowAddonInstance`, not name                                                                                                                                                                                                             |
+| `kubectl cce` not found          | Install plugin: `kubectl cce` uses AK/SK, no kubeconfig required                                                                                                                                                                                                  |
+| Serial field-by-field API errors | The API reports errors one field at a time. Fix a field, retry, get the next error — each cycle ~10 min for cluster operations. Mitigation: validate all parameters against `--help` constraints before the first call; use `--cli-jsonInput` for faster retries. |
+
+## Security Considerations
+
+- MUST restrict kubeconfig file permissions (0600)
+- MUST use IAM RBAC for cluster access, not cluster-admin
+- MUST store container images in private SWR repositories
+
+## Cross-Skill References
+
+- **VPC/Subnet**: See `huawei-vpc` for network prerequisites
+- **EIP**: See `huawei-vpc` for cluster public access
+
+## References
+
+- CCE Docs: https://support.huaweicloud.com/cce/
+- SWR Docs: https://support.huaweicloud.com/swr/

package/plugins/huaweicloud-core/skills/huawei-cloud-eye/SKILL.md

@@ -1,90 +1,90 @@
----
-name: huawei-cloud-eye
-description: "Use when setting up monitoring, alarms, dashboards, or event rules on Huawei Cloud Eye (CES). Triggers: Cloud Eye, CES, monitoring, alarm, metrics, dashboard, event monitoring. NOT for: CTS audit logs (use huawei-cts), AAD anti-DDoS (use huawei-waf-aad)."
-version: 1
----
-
-# Huawei Cloud Cloud Eye (CES)
-
-**STOP - Do not answer from general knowledge.** Follow the procedure below.
-
-Always run `hcloud CES <Operation> --help` before constructing commands to discover exact parameter names and requirements.
-
-## Overview
-
-Domain expertise for Cloud Eye (CES). Covers metric queries, alarm rules, dashboards, and monitoring agent management.
-
-## Critical Warnings
-
-| Trap | Why |
-|------|-----|
-| Telescope agent required for detailed metrics | Without agent: only basic CPU/network metrics. Memory, disk require agent installation on ECS |
-| Alarm needs SMN topic first | Alarm notifications fail silently without a configured SMN topic |
-| Cost metrics incur charges | Custom metrics and high-frequency alarms have billing implications |
-| CES endpoint may vary by region | Some older regions use different endpoint URLs. Check `https://developer.huaweicloud.com/endpoint?CES` |
-| Metric granularity minimum 300s | Free tier has 5-minute minimum. Higher resolution requires paid tier |
-
-## Prerequisites
-
-- ECS instances need the **Telescope agent** installed for detailed metrics (memory, disk, network)
-- Without agent: only SYS.ECS namespace metrics available (CPU, network bytes, disk read/write)
-- Alarm notifications require an SMN topic (see `huawei-smn-dms`)
-
-## Common Workflows
-
-| Task | Operation |
-|------|-----------|
-| List metrics | `ListMetrics --cli-region=<r> --project_id=<p>` |
-| Get metric data | `BatchListMetricData --cli-region=<r> --project_id=<p>` |
-| List alarms | `ListAlarms --cli-region=<r> --project_id=<p>` |
-| Create alarm | `CreateAlarm` (see below) |
-| Delete alarm | `BatchDeleteAlarmRules --cli-region=<r> --project_id=<p>` |
-| List dashboards | `ListDashboardWidgets --cli-region=<r> --project_id=<p>` |
-| Create dashboard | `CreateDashboard --cli-region=<r> --project_id=<p>` |
-
-## Create Alarm Rule — Param Structure
-
-CES uses **nested object prefixes** for alarm creation. Always verify with `--help`:
-
-```bash
-hcloud CES CreateAlarm --help
-# Key params: --alarm_name, --metric.metric_name, --metric.namespace,
-# --condition.period, --condition.filter, --condition.value,
-# --condition.comparison_operator, --condition.count
-```
-
-### `--condition.comparison_operator` Legal Values
-
-For metric alarms use **symbols** (NOT words like `gt`/`lt`):
-
-| Value | Meaning |
-|-------|---------|
-| `>` | Greater than |
-| `>=` | Greater than or equal |
-| `<` | Less than |
-| `<=` | Less than or equal |
-| `=` | Equal |
-| `!=` | Not equal |
-
-For event alarms: `cycle_decrease`, `cycle_increase`, `cycle_wave`.
-
-> **Trap**: Shell may interpret `>` and `<` as redirect operators. Always quote: `--condition.comparison_operator=">="` or use `--cli-jsonInput=<file>`.
-
-## Troubleshooting
-
-| Error | Fix |
-|-------|-----|
-| No metric data | Telescope agent not installed or ECS stopped. Install agent for detailed metrics |
-| Alarm not triggering | Check metric period (minimum 300s), verify condition threshold |
-| CES network timeout in region | Some regions may have CES endpoint issues. Try a different region |
-
-## Security
-
-- MUST use role-based alarm notifications
-- MUST not expose alarm action endpoints publicly
-- SHOULD enable CES alarm history for audit
-
-## Cross-Skill References
-
-- **SMN topics**: See `huawei-smn-dms` for alarm notification setup
-- **ECS monitoring**: See `huawei-ecs` for instance creation
+---
+name: huawei-cloud-eye
+description: 'Use when setting up monitoring, alarms, dashboards, or event rules on Huawei Cloud Eye (CES). Triggers: Cloud Eye, CES, monitoring, alarm, metrics, dashboard, event monitoring. NOT for: CTS audit logs (use huawei-cts), AAD anti-DDoS (use huawei-waf-aad).'
+version: 1
+---
+
+# Huawei Cloud Cloud Eye (CES)
+
+**STOP - Do not answer from general knowledge.** Follow the procedure below.
+
+Always run `hcloud CES <Operation> --help` before constructing commands to discover exact parameter names and requirements.
+
+## Overview
+
+Domain expertise for Cloud Eye (CES). Covers metric queries, alarm rules, dashboards, and monitoring agent management.
+
+## Critical Warnings
+
+| Trap                                          | Why                                                                                                    |
+| --------------------------------------------- | ------------------------------------------------------------------------------------------------------ |
+| Telescope agent required for detailed metrics | Without agent: only basic CPU/network metrics. Memory, disk require agent installation on ECS          |
+| Alarm needs SMN topic first                   | Alarm notifications fail silently without a configured SMN topic                                       |
+| Cost metrics incur charges                    | Custom metrics and high-frequency alarms have billing implications                                     |
+| CES endpoint may vary by region               | Some older regions use different endpoint URLs. Check `https://developer.huaweicloud.com/endpoint?CES` |
+| Metric granularity minimum 300s               | Free tier has 5-minute minimum. Higher resolution requires paid tier                                   |
+
+## Prerequisites
+
+- ECS instances need the **Telescope agent** installed for detailed metrics (memory, disk, network)
+- Without agent: only SYS.ECS namespace metrics available (CPU, network bytes, disk read/write)
+- Alarm notifications require an SMN topic (see `huawei-smn-dms`)
+
+## Common Workflows
+
+| Task             | Operation                                                 |
+| ---------------- | --------------------------------------------------------- |
+| List metrics     | `ListMetrics --cli-region=<r> --project_id=<p>`           |
+| Get metric data  | `BatchListMetricData --cli-region=<r> --project_id=<p>`   |
+| List alarms      | `ListAlarms --cli-region=<r> --project_id=<p>`            |
+| Create alarm     | `CreateAlarm` (see below)                                 |
+| Delete alarm     | `BatchDeleteAlarmRules --cli-region=<r> --project_id=<p>` |
+| List dashboards  | `ListDashboardWidgets --cli-region=<r> --project_id=<p>`  |
+| Create dashboard | `CreateDashboard --cli-region=<r> --project_id=<p>`       |
+
+## Create Alarm Rule — Param Structure
+
+CES uses **nested object prefixes** for alarm creation. Always verify with `--help`:
+
+```bash
+hcloud CES CreateAlarm --help
+# Key params: --alarm_name, --metric.metric_name, --metric.namespace,
+# --condition.period, --condition.filter, --condition.value,
+# --condition.comparison_operator, --condition.count
+```
+
+### `--condition.comparison_operator` Legal Values
+
+For metric alarms use **symbols** (NOT words like `gt`/`lt`):
+
+| Value | Meaning               |
+| ----- | --------------------- |
+| `>`   | Greater than          |
+| `>=`  | Greater than or equal |
+| `<`   | Less than             |
+| `<=`  | Less than or equal    |
+| `=`   | Equal                 |
+| `!=`  | Not equal             |
+
+For event alarms: `cycle_decrease`, `cycle_increase`, `cycle_wave`.
+
+> **Trap**: Shell may interpret `>` and `<` as redirect operators. Always quote: `--condition.comparison_operator=">="` or use `--cli-jsonInput=<file>`.
+
+## Troubleshooting
+
+| Error                         | Fix                                                                              |
+| ----------------------------- | -------------------------------------------------------------------------------- |
+| No metric data                | Telescope agent not installed or ECS stopped. Install agent for detailed metrics |
+| Alarm not triggering          | Check metric period (minimum 300s), verify condition threshold                   |
+| CES network timeout in region | Some regions may have CES endpoint issues. Try a different region                |
+
+## Security
+
+- MUST use role-based alarm notifications
+- MUST not expose alarm action endpoints publicly
+- SHOULD enable CES alarm history for audit
+
+## Cross-Skill References
+
+- **SMN topics**: See `huawei-smn-dms` for alarm notification setup
+- **ECS monitoring**: See `huawei-ecs` for instance creation