python3 scripts/huawei-cloud.py

hcloud

Execution Method: All Huawei Cloud operations must go through the bundled Python dispatcher. The dispatcher invokes the local

hcloud

CLI. Direct SDK imports, hand-written API signing, curl IAM flows, openstack commands, or out-of-band cloud access paths are prohibited.

• huawei-cloud-cce-metric-analyzer

  - CCE, AOM, and cloud-resource metric checks

• huawei-cloud-cce-kubernetes-event-analyzer

  - Kubernetes warning event analysis

• huawei-cloud-cce-pod-failure-diagnoser

  - Pod failure diagnosis

• huawei-cloud-cce-node-failure-diagnoser

  - Node failure diagnosis

• huawei-cloud-cce-auto-remediation-runner

  - Remediation preview and execution

• Query active AOM alarms, historical AOM alarms, and merged active+historical views
• Analyze alarm deduplication, severity grouping, burst alarms, attention alarms, and chronic alarms
• Inspect CCE alarm health and produce risk items for follow-up diagnosis
• Query AOM alarm rules with optional

  cluster_id

  filtering
• Resolve the AOM Prometheus instance bound to a CCE cluster
• Create metric alarm rules and event alarm rules
• Create notification action rules from a user-provided SMN topic
• Batch configure CCE recommended alarm rules from the cloud-side CCE alarm template
• Batch clean CCE alarm rules matching the cloud-side CCE alarm template
• Update, delete, enable, and disable AOM alarm rules
• Query AOM action rules and mute rules

• "List AOM alarms for this CCE cluster"
• "Analyze active and historical alarms for alarm storms"
• "Show current alarm rules for cluster

  <cluster_id>

  "
• "Create CCE recommended alarm rules with this notification rule"
• "Clean CCE template alarm rules for this cluster"
• "Create a notification action rule using this SMN topic"
• "Disable this noisy alarm rule after I confirm"

• Python 3.8+ for the dispatcher and result processing
• hcloud (KooCLI) 7.2.2+ in

  PATH

• A local hcloud profile configured with

  hcloud configure

• Run environment checks before first use when available in the skill package

• Valid Huawei Cloud credentials via explicit tool parameters, local hcloud profile, or environment variable fallback
• Credential priority for hcloud calls is: explicit tool parameters > local hcloud profile > environment variables
• Tools that need

  project_id

  resolve it internally where possible: explicit

  project_id

  parameter first, then active hcloud profile/IAM project lookup for the target region, then environment fallback

• Never expose AK/SK, tokens, or credential-derived secrets in code, commands, logs, or responses
• Never run

  echo $HUAWEI_AK

  or

  echo $HUAWEI_SK

• Never write credentials to files
• Prefer hcloud profile for normal use
• Use IAM users with least privilege

export HUAWEI_AK=<your-ak>
export HUAWEI_SK=<your-sk>
export HUAWEI_REGION=cn-north-4
export HUAWEI_PROJECT_ID=<project-id>
export HUAWEI_SECURITY_TOKEN=<security-token>

aom:event:list

aom:alarmRule:list

aom:alarmRule:create

aom:alarmRule:update

aom:alarmRule:delete

aom:actionRule:list

aom:actionRule:create

aom:actionRule:delete

aom:muteRule:list

cce:cluster:get

1. Show the failed operation and required permission.
2. Ask the user to grant the missing IAM permission.
3. Pause mutation work until the user confirms permissions are ready.

hcloud

python3 scripts/huawei-cloud.py <tool-name> key=value key=value

hcloud <service> <operation> --cli-region=<region> --cli-output=json [--cli-jsonInput=<file>]

• Use

  key=value

  parameters; quote values that contain spaces,

  >

  ,

  <

  ,

  |

  , JSON, or PromQL.
• Do not print or persist AK/SK, security tokens, or generated JSON input files.
• Use dispatcher preview output first for R2/R1/R0 tools; add

  confirm=true

  only after explicit user confirmation.
• Prefer hcloud profile credentials; explicit tool parameters override profile and environment fallback.
• See CLI Installation Guide for setup and validation.

• success

  : command success status

• error

  : failure reason when

  success=false

• preview

  : mutation preview when

  confirm=true

  is not provided

• requires_confirmation

  : whether user confirmation is required

• report

  : alarm-correlation summary

• issues

  : inspection risk items

• alarms

  ,

  rules

  ,

  action_rules

  ,

  mute_rules

  : queried resources

1. Read the alarm name, resource, time window, and severity level from the user.
2. Default to the last 1 hour unless the user gives a different incident window.
3. Query active + historical alarms with

   huawei_list_aom_alarms

   .
4. Analyze alarm groups with

   huawei_analyze_aom_alarms

   .
5. Query alarm rules, action rules, and mute rules when notification gaps or suppression are suspected.
6. Group findings by resource, namespace, node, workload, and alarm type.
7. Hand off to diagnosis skills for Pod, Node, Network, Storage, or Workload root cause analysis.

python3 scripts/huawei-cloud.py huawei_list_aom_alarms region=cn-north-4
python3 scripts/huawei-cloud.py huawei_list_aom_alarm_rules region=cn-north-4
python3 scripts/huawei-cloud.py huawei_list_aom_action_rules region=cn-north-4

python3 scripts/huawei-cloud.py huawei_aom_alarm_inspection \
  region=cn-north-4 cluster_id=<cluster-id>

1. Run the command without

   confirm=true

   .
2. Review

   preview

   , affected resources, and expected impact.
3. Wait for explicit user confirmation.
4. Re-run with

   confirm=true

   .
5. Verify with the corresponding list/query command.

1. Use active + historical alarms for diagnosis - active-only views can miss recently recovered issues.
2. Filter by

   cluster_id

   - use exact cluster ID for cluster-scoped alarm rule and alarm analysis tasks.
3. Preview every mutation - never skip the preview step for R2/R1/R0 tools.
4. Do not auto-select notification rules - always wait for user selection of

   bind_notification_rule_id

   .
5. Keep notification setup explicit - create notification action rules only from a user-provided SMN topic.
6. Separate analysis from remediation - recommend remediation, then hand off to remediation skills.
7. Protect observability - avoid disabling or deleting rules unless impact is understood and confirmed.

• Alarm diagnosis must consider both active and historical alarms; do not conclude the cluster is healthy only because there are no active alarms.
• R2/R1/R0 tools must use preview-first execution and wait for explicit user confirmation before applying changes.
• Do not automatically select notification rules, SMN topics, clusters, or templates for the user.
• Do not modify alarm resources outside the tools provided by this skill.
• Use

  cluster_id

  for cluster-scoped filtering; cluster names are not accepted by

  huawei_list_aom_alarm_rules

  .

• This skill does not modify CCE, ECS, ELB, EIP, VPC, security group, node, workload, or Kubernetes resources.
• This skill must not create, update, or delete mute rules.
• This skill must not use out-of-band cloud commands to modify alarm resources.
• This skill cannot safely infer a notification rule for the user.

• huawei_list_aom_alarm_rules

  filters by

  cluster_id

  , not cluster name.