Huawei Cloud CCE Cluster Management

Overview

Manage CCE (Cloud Container Engine) cluster lifecycle, including cluster creation/deletion/hibernation/awakening, node pool management, node scheduling control, and addon management.

⛔ Security Constraints

Dangerous Operation Confirmation Mechanism

This skill strictly enforces a two-step confirmation mechanism for all dangerous operations to prevent accidental service disruption or data loss.

All dangerous operations require confirm=true parameter to execute. Otherwise, they return a preview and confirmation prompt.

Operations Requiring Confirmation

Workflow

Step 1: Preview Operation - Call without confirm parameter

# Example: Preview cluster deletion
python3 scripts/huawei-cloud.py huawei_delete_cce_cluster \
  region=cn-north-4 \
  cluster_id=xxx

Returns: operation preview, risk warning, confirmation example

Step 2: Confirm Execution - Call with confirm=true

# Example: Confirm and execute deletion
python3 scripts/huawei-cloud.py huawei_delete_cce_cluster \
  region=cn-north-4 \
  cluster_id=xxx \
  confirm=true

Credential Security

✅ This skill strictly follows these security rules:

1. No persistent credential storage - Never saves AK/SK, tokens, or certificates to disk
2. No long-term memory cache - AK/SK exists only during API call, released afterward
3. Only project ID memory cache - Non-sensitive project ID cached in process memory
4. No credential leakage - Never includes AK/SK in logs, responses, or errors
5. Temporary file cleanup - If temporary cert files are created, they are deleted immediately after use

AK/SK usage methods:

• Environment variables HW_ACCESS_KEY / HW_SECRET_KEY / HW_REGION_NAME (process-level, not saved)
• Per-call parameter (valid only for that call)

Prerequisites

Python Environment

• Python 3.8+
• Install SDKs: pip install huaweicloudsdkcce huaweicloudsdkcore
• Optional for node operations: pip install kubernetes

Environment Variables (Recommended)

export HW_ACCESS_KEY="your-access-key-id"
export HW_SECRET_KEY="your-secret-access-key"
export HW_REGION_NAME="cn-north-4"

IAM Permission Policies

Ensure the IAM user has the minimum required permissions:

Core Commands

Cluster Query

Cluster Management

Recommended defaults:

• Cluster type: Turbo (best performance with ENI network)
• Container network: eni for Turbo clusters
• Naming format: \x3Cenv>-\x3Capp>-cluster (e.g., prod-web-cluster)

Node Pool Management

Recommended defaults:

• Naming format: \x3Cenv>-\x3Crole>-pool (e.g., prod-worker-pool)
• Initial node count: 2 for HA, or 0 with autoscaling
• Enable autoscaling for dynamic scaling

Node Management

Note: Prefer node pools for managed scaling. Direct node creation is for special cases.

Addon Management

Common addons:

• coredns - DNS service
• metrics-server - Monitoring metrics
• everest - Storage driver

Network Prerequisites

Use these tools to find VPC/subnet IDs before cluster creation.

Supported Regions

Output Format

All tools return JSON-formatted results containing:

• status: operation result (success / error)
• data: operation-specific response (cluster info, node list, addon details, etc.)
• message: human-readable description of the result
• warning: risk warning for dangerous operations (preview mode only)

Verification

See verification-method.md for detailed verification steps. Quick checklist:

1. Verify AK/SK credentials are configured via environment variables
2. Run huawei_list_cce_clusters to confirm API connectivity
3. Test dangerous operation preview (call without confirm=true)
4. Verify Turbo cluster ENI network configuration

Best Practices

• Use environment variables (HW_ACCESS_KEY / HW_SECRET_KEY) for credentials — avoid hardcoding
• Always preview dangerous operations before confirming with confirm=true
• Use Turbo clusters (container_network_type=eni) for high-performance workloads
• Resize node pools during low-traffic periods to minimize business impact
• Keep node pools at ≥2 nodes for production workloads to ensure redundancy
• Regularly check cluster health via huawei_list_cce_clusters and huawei_show_cce_cluster

References

Notes

• Ensure AK/SK has correct IAM permissions
• Different regions may have different resource availability
• All dangerous operations require confirmation
• Deletion operations are irreversible
• Hibernate cluster stops all workloads - use during non-business hours
• Node drain evicts all pods - ensure sufficient replicas
• Turbo clusters recommended for best performance with ENI network