huawei-cloud-cce-cluster-management

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Huawei Cloud CCE Cluster Management

华为云CCE集群管理

Overview

概述

Manage CCE (Cloud Container Engine) cluster lifecycle, including cluster creation/deletion/hibernation/awakening, node pool management, node scheduling control, and addon management.

The skill executes Huawei Cloud API calls through hcloud (KooCLI) and Kubernetes node operations (cordon/uncordon/drain/status) through kubectl cce (the kubectl-cce plugin). The plugin connects to the CCE API Gateway using AK/SK credentials — no cluster EIP or manual kubeconfig required. Two operations (create cluster, create node pool) fall back to the Python SDK because of a known hcloud metadata parsing defect — see cce-api-guide.md.

Dependency: This skill requires

kubectl

and the

kubectl-cce

plugin. Install them via the huawei-cloud-kubectl-cce-installer skill.

管理CCE（云容器引擎）集群生命周期，包括集群创建/删除/休眠/唤醒、节点池管理、节点调度控制以及插件管理。

本技能通过hcloud（KooCLI）执行华为云API调用，通过kubectl cce（kubectl-cce插件）执行Kubernetes节点操作（cordon/uncordon/drain/status）。该插件使用AK/SK凭证连接到CCE API网关——无需集群EIP或手动配置kubeconfig。由于已知的hcloud元数据解析缺陷，两项操作（创建集群、创建节点池）会回退使用Python SDK——详情请参考cce-api-guide.md。

依赖项：本技能需要

kubectl

和

kubectl-cce

插件。可通过huawei-cloud-kubectl-cce-installer技能进行安装。

⛔ Security Constraints

⛔ 安全约束

Dangerous Operation Confirmation Mechanism

危险操作确认机制

This skill strictly enforces a two-step confirmation mechanism for all dangerous operations to prevent accidental service disruption or data loss.

All dangerous operations require

confirm=true

parameter to execute. Otherwise, they return a preview and confirmation prompt.

本技能对所有危险操作严格执行两步确认机制，以防止意外中断服务或数据丢失。

所有危险操作需要传入

confirm=true

参数才能执行。否则，将返回操作预览和确认提示。

Operations Requiring Confirmation

需要确认的操作

Tool	Operation Type	Risk Level	Description
`huawei_delete_cce_cluster`	Delete	🔴 Critical	Deletes entire CCE cluster, irreversible
`huawei_hibernate_cce_cluster`	Hibernate	🟠 High	Stops all workloads, pauses control plane billing
`huawei_awake_cce_cluster`	Awake	🟠 High	Resumes cluster from hibernation
`huawei_resize_cce_nodepool`	Scale	🟡 Medium	Adjusts node pool size, affects capacity
`huawei_delete_cce_nodepool`	Delete	🟠 High	Deletes node pool, affects business capacity
`huawei_delete_cce_node`	Delete	🟠 High	Removes node from cluster, affects scheduling
`huawei_uninstall_cce_addon`	Uninstall	🟠 High	Removes addon, may affect cluster functionality
`huawei_cce_node_cordon`	Cordon	🟡 Medium	Marks node unschedulable, new pods won't be assigned
`huawei_cce_node_uncordon`	Uncordon	🟡 Medium	Marks node schedulable, new pods may be assigned immediately
`huawei_cce_node_drain`	Drain	🟠 High	Cordons + evicts all pods from node, affects running workloads

工具	操作类型	风险等级	描述
`huawei_delete_cce_cluster`	删除	🔴 严重	删除整个CCE集群，操作不可逆
`huawei_hibernate_cce_cluster`	休眠	🟠 高	停止所有工作负载，暂停控制面计费
`huawei_awake_cce_cluster`	唤醒	🟠 高	将集群从休眠状态恢复
`huawei_resize_cce_nodepool`	扩容/缩容	🟡 中等	调整节点池大小，影响集群容量
`huawei_delete_cce_nodepool`	删除	🟠 高	删除节点池，影响业务容量
`huawei_delete_cce_node`	删除	🟠 高	从集群移除节点，影响调度
`huawei_uninstall_cce_addon`	卸载	🟠 高	移除插件，可能影响集群功能
`huawei_cce_node_cordon`	标记不可调度	🟡 中等	标记节点为不可调度，新Pod不会被分配到该节点
`huawei_cce_node_uncordon`	标记可调度	🟡 中等	标记节点为可调度，新Pod可能立即被分配
`huawei_cce_node_drain`	驱逐Pod	🟠 高	标记节点不可调度并驱逐所有Pod，影响运行中的工作负载

Workflow

工作流程

Step 1: Preview Operation - Call without

confirm

parameter

bash

undefined

步骤1：预览操作 - 调用时不传入

confirm

参数

bash

undefined

Example: Preview cluster deletion

示例：预览集群删除操作

python3 huawei-cloud.py huawei_delete_cce_cluster
region=cn-north-4
cluster_id=xxx


Returns: operation preview, risk warning, confirmation example

**Step 2: Confirm Execution** - Call with `confirm=true`

```bash

python3 huawei-cloud.py huawei_delete_cce_cluster
region=cn-north-4
cluster_id=xxx


返回内容：操作预览、风险警告、确认示例

**步骤2：确认执行** - 调用时传入`confirm=true`

```bash

Example: Confirm and execute deletion

示例：确认并执行删除操作

python3 huawei-cloud.py huawei_delete_cce_cluster
region=cn-north-4
cluster_id=xxx
confirm=true

undefined

python3 huawei-cloud.py huawei_delete_cce_cluster
region=cn-north-4
cluster_id=xxx
confirm=true

undefined

Credential Security

凭证安全

✅ This skill strictly follows these security rules:

No persistent credential storage - Never saves AK/SK, tokens, or certificates to disk
No long-term memory cache - AK/SK exists only during API call, released afterward
Only project ID memory cache - Non-sensitive project ID cached in process memory
No credential leakage - Never includes AK/SK in logs, responses, or errors
Temporary file cleanup - Temporary kubeconfig files are deleted immediately after use
Config-first credential passing - If hcloud CLI config has credentials, AK/SK are not passed as CLI arguments (avoids
```
ps aux
```
exposure). Environment variables are only set for subprocesses if not already present in the parent environment.

Credentials are resolved from parameters or environment variables (process-level, never written to disk):

Permanent credentials:
```
HW_ACCESS_KEY
```
+
```
HW_SECRET_KEY
```
Temporary credentials (recommended for CI/CD / IAM temporary access keys):
```
HW_ACCESS_KEY
```
+
```
HW_SECRET_KEY
```
+
```
HW_SECURITY_TOKEN
```
```
HW_PROJECT_ID
```
is optional — auto-fetched via
```
hcloud IAM KeystoneListProjects
```
when not provided (only for hcloud API calls; kubectl-cce node operations do not need it)
Per-call
```
ak
```
/
```
sk
```
parameters override the environment variables for that single call

Security hardening tip: Set

HW_ACCESS_KEY

HW_SECRET_KEY

in the parent process environment (e.g.,

~/.bashrc

or systemd environment file) so they are inherited by subprocesses without explicit passing. The skill detects existing env vars and skips passing AK/SK as CLI arguments to hcloud, preventing credential exposure in process listings (

ps aux

). kubectl-cce reads these env vars directly from the process environment.

bash

undefined

✅ 本技能严格遵循以下安全规则：

不持久化存储凭证 - 绝不将AK/SK、令牌或证书保存到磁盘
无长期内存缓存 - AK/SK仅在API调用期间存在，调用后立即释放
仅缓存非敏感项目ID - 非敏感的项目ID缓存在进程内存中
不泄露凭证 - 绝不将AK/SK包含在日志、响应或错误信息中
清理临时文件 - 临时kubeconfig文件使用后立即删除
优先通过配置传递凭证 - 如果hcloud CLI配置中已有凭证，则不会将AK/SK作为CLI参数传递（避免在
```
ps aux
```
中暴露）。仅当父环境中不存在相关环境变量时，才会为子进程设置环境变量。

凭证通过参数或环境变量（进程级，绝不写入磁盘）解析：

永久凭证：
```
HW_ACCESS_KEY
```
+
```
HW_SECRET_KEY
```
临时凭证（推荐用于CI/CD / IAM临时访问密钥）：
```
HW_ACCESS_KEY
```
+
```
HW_SECRET_KEY
```
+
```
HW_SECURITY_TOKEN
```
```
HW_PROJECT_ID
```
为可选参数——未提供时，将通过
```
hcloud IAM KeystoneListProjects
```
自动获取（仅用于hcloud API调用；kubectl-cce节点操作不需要该参数）
单次调用中的
```
ak
```
/
```
sk
```
参数会覆盖本次调用的环境变量

安全加固提示：在父进程环境中设置

HW_ACCESS_KEY

HW_SECRET_KEY

（例如

~/.bashrc

或systemd环境文件），这样子进程会自动继承这些变量，无需显式传递。技能会检测现有环境变量，避免将AK/SK作为CLI参数传递给hcloud，防止凭证在进程列表（

ps aux

）中暴露。kubectl-cce直接从进程环境读取这些变量。

bash

undefined

Permanent

永久凭证

export HW_ACCESS_KEY="your-access-key-id" export HW_SECRET_KEY="your-secret-access-key" export HW_REGION_NAME="cn-north-4"

Temporary (add security token)

临时凭证（添加安全令牌）

export HW_SECURITY_TOKEN="your-security-token"

undefined

export HW_SECURITY_TOKEN="your-security-token"

undefined

Node Login Password Security

节点登录密码安全

When creating nodes or node pools, the login credential is resolved with the following three-level priority:

ssh_key
parameter — SSH key pair name (preferred when available). Mutually exclusive with password.
password
parameter — raw node login password passed per call (8–26 chars, ≥3 of: uppercase / lowercase / digits / special).
CCE_NODE_PASSWORD
environment variable — used when neither
```
ssh_key
```
nor
```
password
```
is provided.
Auto-generated random password — when none of the above is supplied, the skill generates a strong random password automatically.

⚠️ The auto-generated password is NEVER returned in the tool response (not in
data
, not in
message
, not in logs). To access the node afterwards, the user must reset the node password via the CCE console or the ECS API. The success message only contains a hint instructing the user to reset the password.

The raw password is never sent to the CCE API directly; the skill applies SHA-512 salted encryption + base64 encoding internally (see cce-cluster-parameters.md).

创建节点或节点池时，登录凭证按以下三级优先级解析：

ssh_key
参数 — SSH密钥对名称（优先使用，与密码互斥）。
password
参数 — 单次调用传入的节点登录明文密码（8–26字符，需包含大写/小写/数字/特殊字符中的至少3种）。
CCE_NODE_PASSWORD
环境变量 — 当未提供
```
ssh_key
```
和
```
password
```
时使用。
自动生成随机密码 — 当以上均未提供时，技能会自动生成强随机密码。

⚠️ 自动生成的密码绝不会在工具响应中返回（不在
data
、
message
或日志中）。后续如需访问节点，用户必须通过CCE控制台或ECS API重置节点密码。成功消息仅包含提示用户重置密码的内容。

明文密码不会直接发送到CCE API；技能内部会对其进行SHA-512加盐加密+base64编码（详情请参考cce-cluster-parameters.md）。

Prerequisites

前置条件

CLI Tools

CLI工具

hcloud
(Huawei Cloud KooCLI 7.2+) — drives all Huawei Cloud API calls. Install:

bash

curl -sSL https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/hcloud_install.sh -o ./hcloud_install.sh && bash ./hcloud_install.sh
hcloud version   # verify install

kubectl
+
kubectl-cce
plugin — required for node scheduling operations (cordon/uncordon/drain/status). Install via the huawei-cloud-kubectl-cce-installer skill:

bash

# Check if already installed
bash ../huawei-cloud-kubectl-cce-installer/scripts/install_kubectl_cce.sh --check

# Install (after confirming the plan)
sudo bash ../huawei-cloud-kubectl-cce-installer/scripts/install_kubectl_cce.sh --execute --bin-dir /usr/local/bin

The

kubectl cce

plugin connects through the CCE API Gateway using AK/SK credentials — no cluster EIP or manual kubeconfig needed.

hcloud
（华为云KooCLI 7.2+）——驱动所有华为云API调用。安装命令：

bash

curl -sSL https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/hcloud_install.sh -o ./hcloud_install.sh && bash ./hcloud_install.sh
hcloud version   # 验证安装

kubectl
+
kubectl-cce
插件——节点调度操作（cordon/uncordon/drain/status）必需。通过huawei-cloud-kubectl-cce-installer技能安装：

bash

# 检查是否已安装
bash ../huawei-cloud-kubectl-cce-installer/scripts/install_kubectl_cce.sh --check

# 安装（确认计划后执行）
sudo bash ../huawei-cloud-kubectl-cce-installer/scripts/install_kubectl_cce.sh --execute --bin-dir /usr/local/bin

kubectl cce

插件使用AK/SK凭证连接到CCE API网关——无需集群EIP或手动配置kubeconfig。

Python Environment

Python环境

Python 3.8+
Install SDK packages (retained for create-cluster / create-nodepool fallback) and helpers:
bash
```
pip install huaweicloudsdkcce huaweicloudsdkcore huaweicloudsdkiam passlib pyyaml
```
```
passlib
```
provides SHA-512 salting.
```
huaweicloudsdkcce
```
+
```
huaweicloudsdkcore
```
+
```
huaweicloudsdkiam
```
are used by the two SDK fallback functions (create cluster, create node pool) and IAM project-ID resolution.
```
pyyaml
```
parses hcloud JSON output.

Python 3.8+
安装SDK包（用于创建集群/创建节点池的回退逻辑）及辅助库：
bash
```
pip install huaweicloudsdkcce huaweicloudsdkcore huaweicloudsdkiam passlib pyyaml
```
```
passlib
```
提供SHA-512加盐功能。
```
huaweicloudsdkcce
```
+
```
huaweicloudsdkcore
```
+
```
huaweicloudsdkiam
```
用于两个SDK回退函数（创建集群、创建节点池）以及IAM项目ID解析。
```
pyyaml
```
用于解析hcloud的JSON输出。

Environment Variables

环境变量

The skill detects existing environment variables before passing credentials to subprocesses:

hcloud CLI calls: if
```
HW_ACCESS_KEY
```
/
```
HW_SECRET_KEY
```
are already in
```
os.environ
```
, the skill skips passing
```
--cli-access-key
```
/
```
--cli-secret-key
```
as CLI arguments, preventing exposure in
```
ps aux
```
.
kubectl-cce calls: the plugin reads
```
HW_ACCESS_KEY
```
/
```
HW_SECRET_KEY
```
from the process environment directly. If these variables are already set, the subprocess inherits them naturally — the skill does not set them again.

🔒 Security Tip: Set
HW_ACCESS_KEY
/
HW_SECRET_KEY
at the system or session level (e.g., in
~/.bashrc
or a systemd environment file) so the skill never needs to pass them as explicit CLI arguments. This eliminates the risk of credential exposure in process listings (
ps aux
) and shell history.

bash

undefined

技能在将凭证传递给子进程前，会检测现有环境变量：

hcloud CLI调用：如果
```
HW_ACCESS_KEY
```
/
```
HW_SECRET_KEY
```
已存在于
```
os.environ
```
中，技能会跳过传递
```
--cli-access-key
```
/
```
--cli-secret-key
```
作为CLI参数，避免在
```
ps aux
```
中暴露。
kubectl-cce调用：插件直接从进程环境读取
```
HW_ACCESS_KEY
```
/
```
HW_SECRET_KEY
```
。如果这些变量已设置，子进程会自动继承——技能不会重复设置。

🔒 安全提示：在系统或会话级别设置
HW_ACCESS_KEY
/
HW_SECRET_KEY
（例如
~/.bashrc
或systemd环境文件），这样技能永远不需要将它们作为显式CLI参数传递。这消除了凭证在进程列表（
ps aux
）和shell历史中暴露的风险。

bash

undefined

Set credentials at session level (the skill detects these and skips

在会话级别设置凭证（技能会检测到这些变量，跳过将其作为显式CLI参数传递给hcloud/kubectl-cce）

passing them as explicit CLI arguments to hcloud/kubectl-cce)

—

export HW_ACCESS_KEY="your-access-key-id" export HW_SECRET_KEY="your-secret-access-key" export HW_REGION_NAME="cn-north-4"

Optional, for temporary credentials:

可选，临时凭证使用：

export HW_SECURITY_TOKEN="your-security-token"

Optional, for node login when ssh_key is not used:

可选，未使用ssh_key时用于节点登录：

export CCE_NODE_PASSWORD="your-password"

undefined

export CCE_NODE_PASSWORD="your-password"

undefined

IAM Permission Policies

IAM权限策略

Ensure the IAM user has the minimum required permissions:

Permission	Description
`cce:cluster:list`	List clusters
`cce:cluster:get`	Get cluster details
`cce:cluster:create`	Create clusters
`cce:cluster:delete`	Delete clusters
`cce:cluster:update`	Update clusters (hibernate/awake/bind EIP)
`cce:node:list`	List nodes
`cce:node:get`	Get node details
`cce:node:create`	Create nodes
`cce:node:delete`	Delete nodes
`cce:node:update`	Update nodes (cordon/uncordon/drain)
`cce:nodepool:list`	List node pools
`cce:nodepool:create`	Create node pools
`cce:nodepool:delete`	Delete node pools
`cce:nodepool:update`	Update node pools (resize)
`cce:addon:list`	List addons
`cce:addon:get`	Get addon details
`cce:addon:create`	Install addons
`cce:addon:update`	Update addons
`cce:addon:delete`	Uninstall addons

确保IAM用户拥有以下最低必要权限：

权限	描述
`cce:cluster:list`	列出集群
`cce:cluster:get`	获取集群详情
`cce:cluster:create`	创建集群
`cce:cluster:delete`	删除集群
`cce:cluster:update`	更新集群（休眠/唤醒/绑定EIP）
`cce:node:list`	列出节点
`cce:node:get`	获取节点详情
`cce:node:create`	创建节点
`cce:node:delete`	删除节点
`cce:node:update`	更新节点（cordon/uncordon/drain）
`cce:nodepool:list`	列出节点池
`cce:nodepool:create`	创建节点池
`cce:nodepool:delete`	删除节点池
`cce:nodepool:update`	更新节点池（调整大小）
`cce:addon:list`	列出插件
`cce:addon:get`	获取插件详情
`cce:addon:create`	安装插件
`cce:addon:update`	更新插件
`cce:addon:delete`	卸载插件

参数确认

Before executing any command, confirm the following parameters with the user:

执行任何命令前，请与用户确认以下参数：

认证参数

Parameter	Env Variable	Required	Description
Access Key ID	`HW_ACCESS_KEY`	✅	Huawei Cloud AK, permanent or temporary credential
Secret Access Key	`HW_SECRET_KEY`	✅	Huawei Cloud SK, permanent or temporary credential
Region	`HW_REGION_NAME`	✅	Region, e.g. `cn-north-4`
Security Token	`HW_SECURITY_TOKEN`	❌	Temporary credential security token, STS only
Node Password	`CCE_NODE_PASSWORD`	❌	Node login password, auto-generated if not set

参数	环境变量	必填	描述
Access Key ID	`HW_ACCESS_KEY`	✅	华为云AK，永久或临时凭证
Secret Access Key	`HW_SECRET_KEY`	✅	华为云SK，永久或临时凭证
Region	`HW_REGION_NAME`	✅	区域，例如 `cn-north-4`
Security Token	`HW_SECURITY_TOKEN`	❌	临时凭证安全令牌，仅STS使用
Node Password	`CCE_NODE_PASSWORD`	❌	节点登录密码，未设置时自动生成

集群参数

Parameter	Required	Default	Description
`cluster_name`	✅	—	Cluster name, recommended `<env>-<app>-cluster`
`cluster_type`	❌	`Turbo`	Cluster type (Turbo/VirtualMachine)
`container_network_type`	❌	`eni`	Container network type, `eni` for Turbo clusters
`cluster_version`	❌	API latest	Kubernetes version, auto-select latest if omitted
`vpc_id`	✅	—	VPC ID
`subnet_id`	✅	—	Subnet ID
`flavor_id`	✅	—	Node flavor, e.g. `c7.large.2`
`confirm`	❌	`false`	Danger confirmation flag, required `true` for delete/hibernate/resize

参数	必填	默认值	描述
`cluster_name`	✅	—	集群名称，推荐格式 `<env>-<app>-cluster`
`cluster_type`	❌	`Turbo`	集群类型（Turbo/VirtualMachine）
`container_network_type`	❌	`eni`	容器网络类型，Turbo集群推荐使用 `eni`
`cluster_version`	❌	API最新版本	Kubernetes版本，省略时自动选择最新版本
`vpc_id`	✅	—	VPC ID
`subnet_id`	✅	—	子网ID
`flavor_id`	✅	—	节点规格，例如 `c7.large.2`
`confirm`	❌	`false`	危险操作确认标志，删除/休眠/调整大小操作需要设置为 `true`

节点池参数

Parameter	Required	Default	Description
`nodepool_name`	✅	—	Node pool name, recommended `<env>-<role>-pool`
`node_count`	❌	`2`	Initial node count, ≥2 recommended for HA
`min_node_count`	❌	—	Auto-scaling minimum
`max_node_count`	❌	—	Auto-scaling maximum
`ssh_key`	❌	—	SSH key pair name, takes priority over password
`root_volume_size`	❌	`40`	Root disk size (GB)
`data_volume_size`	❌	`100`	Data disk size (GB)

参数	必填	默认值	描述
`nodepool_name`	✅	—	节点池名称，推荐格式 `<env>-<role>-pool`
`node_count`	❌	`2`	初始节点数量，为了高可用性推荐≥2
`min_node_count`	❌	—	自动扩缩容最小值
`max_node_count`	❌	—	自动扩缩容最大值
`ssh_key`	❌	—	SSH密钥对名称，优先级高于密码
`root_volume_size`	❌	`40`	系统盘大小（GB）
`data_volume_size`	❌	`100`	数据盘大小（GB）

其他参数

Parameter	Required	Default	Description
`duration`	❌	`30`	Kubeconfig validity period (days), pass as integer
`eip_id`	❌	auto	EIP ID, auto-find or create if not provided
`addon_id`	❌	—	Addon ID (UID), required for detail query

参数	必填	默认值	描述
`duration`	❌	`30`	kubeconfig有效期（天），传入整数
`eip_id`	❌	auto	EIP ID，未提供时自动查找或创建
`addon_id`	❌	—	插件ID（UID），查询详情时必需

Core Commands

核心命令

Cluster Query

集群查询

Tool	Function	Parameters
`huawei_list_cce_clusters`	List all CCE clusters in region	`region`
`huawei_get_cce_nodes`	Get detailed node information	`region` , `cluster_id`
`huawei_get_cce_kubeconfig`	Get cluster kubeconfig	`region` , `cluster_id` , `duration`

工具	功能	参数
`huawei_list_cce_clusters`	列出区域内所有CCE集群	`region`
`huawei_get_cce_nodes`	获取节点详细信息	`region` , `cluster_id`
`huawei_get_cce_kubeconfig`	获取集群kubeconfig	`region` , `cluster_id` , `duration`

Cluster Management

集群管理

Tool	Function	Risk Level	Requires Confirmation
`huawei_create_cce_cluster`	Create CCE cluster	🟢 Low	No
`huawei_delete_cce_cluster`	Delete CCE cluster	🔴 Critical	Yes
`huawei_hibernate_cce_cluster`	Hibernate cluster	🟠 High	Yes
`huawei_awake_cce_cluster`	Awake cluster	🟠 High	No
`huawei_bind_cce_cluster_eip`	Bind cluster EIP (auto-find/create if no eip_id)	🟢 Low	No
`huawei_unbind_cce_cluster_eip`	Unbind cluster EIP	🟡 Medium	No

Dynamic EIP Binding:
huawei_bind_cce_cluster_eip
supports dynamic EIP assignment. If
eip_id
is not provided, the skill automatically: (1) lists existing EIPs and finds an unbound one (status=DOWN), (2) if none available, creates a new EIP (traffic billing, 5Mbps, PER share type), (3) binds it to the cluster. The response includes
eip_created
(true/false),
eip_id
,
eip_address
, and
public_endpoint
(the External API URL).

Recommended defaults:

Cluster type:
```
Turbo
```
(best performance with ENI network)
Container network:
```
eni
```
for Turbo clusters (default in this skill)
Cluster version: omit
cluster_version
to let the API pick the latest supported version; specify it only when the user requires a specific Kubernetes version
Naming format:
```
<env>-<app>-cluster
```
(e.g.,
```
prod-web-cluster
```
)

工具	功能	风险等级	是否需要确认
`huawei_create_cce_cluster`	创建CCE集群	🟢 低	否
`huawei_delete_cce_cluster`	删除CCE集群	🔴 严重	是
`huawei_hibernate_cce_cluster`	休眠集群	🟠 高	是
`huawei_awake_cce_cluster`	唤醒集群	🟠 高	否
`huawei_bind_cce_cluster_eip`	绑定集群EIP（未提供eip_id时自动查找/创建）	🟢 低	否
`huawei_unbind_cce_cluster_eip`	解绑集群EIP	🟡 中等	否

动态EIP绑定：
huawei_bind_cce_cluster_eip
支持动态分配EIP。如果未提供
eip_id
，技能会自动执行：(1) 列出现有EIP并找到未绑定的EIP（状态=DOWN）；(2) 如果没有可用EIP，创建新的EIP（流量计费，5Mbps，共享型）；(3) 将其绑定到集群。响应内容包含
eip_created
（true/false）、
eip_id
、
eip_address
和
public_endpoint
（外部API地址）。

推荐默认值：

集群类型：
```
Turbo
```
（搭配ENI网络性能最佳）
容器网络：Turbo集群使用
```
eni
```
（本技能默认值）
集群版本：省略
cluster_version
让API选择最新支持版本；仅当用户需要特定Kubernetes版本时才指定
命名格式：
```
<env>-<app>-cluster
```
（例如
```
prod-web-cluster
```
）

Node Pool Management

节点池管理

Tool	Function	Risk Level	Requires Confirmation
`huawei_list_cce_nodepools`	List node pools	🟢 Low	No
`huawei_create_cce_nodepool`	Create node pool	🟢 Low	No
`huawei_delete_cce_nodepool`	Delete node pool	🟠 High	Yes
`huawei_resize_cce_nodepool`	Resize node pool	🟡 Medium	Yes

Recommended defaults:

Naming format:
```
<env>-<role>-pool
```
(e.g.,
```
prod-worker-pool
```
)
Initial node count: 2 for HA, or 0 with autoscaling
Enable autoscaling for dynamic scaling
For Turbo clusters, use ENI-compatible flavors (e.g.,
```
c7.large.2
```
)

工具	功能	风险等级	是否需要确认
`huawei_list_cce_nodepools`	列出节点池	🟢 低	否
`huawei_create_cce_nodepool`	创建节点池	🟢 低	否
`huawei_delete_cce_nodepool`	删除节点池	🟠 高	是
`huawei_resize_cce_nodepool`	调整节点池大小	🟡 中等	是

推荐默认值：

命名格式：
```
<env>-<role>-pool
```
（例如
```
prod-worker-pool
```
）
初始节点数量：为了高可用性设置为2，或设置为0并启用自动扩缩容
启用自动扩缩容以实现动态调度
Turbo集群使用兼容ENI的规格（例如
```
c7.large.2
```
）

Node Management

节点管理

Tool	Function	Risk Level	Requires Confirmation
`huawei_list_cce_nodes`	List cluster nodes	🟢 Low	No
`huawei_create_cce_node`	Create nodes directly	🟢 Low	No
`huawei_delete_cce_node`	Delete node	🟠 High	Yes
`huawei_cce_node_cordon`	Mark node unschedulable	🟡 Medium	Yes
`huawei_cce_node_uncordon`	Mark node schedulable	🟡 Medium	Yes
`huawei_cce_node_drain`	Cordon + evict all pods from node	🟠 High	Yes
`huawei_cce_node_status`	Query node scheduling status	🟢 Low	No

Node scheduling operations (

cordon

uncordon

drain

status

) are executed via kubectl cce — the kubectl-cce plugin connects to the CCE API Gateway using AK/SK credentials. No cluster EIP or manual kubeconfig required. The plugin handles cordon, eviction, PodDisruptionBudget (PDB) compliance, and DaemonSet pod skipping natively.

huawei_cce_node_drain

follows standard drain semantics: it first cordons the node, then evicts all resident pods (excluding DaemonSet pods) via the k8s Eviction API, which respects

PodDisruptionBudget

(PDB). Pods blocked by PDB will be reported in the

failed_pods

field.

Note: Prefer node pools for managed scaling. Direct node creation is for special cases.

工具	功能	风险等级	是否需要确认
`huawei_list_cce_nodes`	列出集群节点	🟢 低	否
`huawei_create_cce_node`	直接创建节点	🟢 低	否
`huawei_delete_cce_node`	删除节点	🟠 高	是
`huawei_cce_node_cordon`	标记节点不可调度	🟡 中等	是
`huawei_cce_node_uncordon`	标记节点可调度	🟡 中等	是
`huawei_cce_node_drain`	标记不可调度并驱逐节点上所有Pod	🟠 高	是
`huawei_cce_node_status`	查询节点调度状态	🟢 低	否

节点调度操作（

cordon

、

uncordon

、

drain

、

status

）通过kubectl cce执行——kubectl-cce插件使用AK/SK凭证连接到CCE API网关。无需集群EIP或手动配置kubeconfig。插件原生支持cordon、驱逐、PodDisruptionBudget（PDB）合规性检查以及跳过DaemonSet Pod。

huawei_cce_node_drain

遵循标准驱逐语义：先标记节点不可调度，然后通过K8s Eviction API驱逐所有常驻Pod（排除DaemonSet Pod），并尊重

PodDisruptionBudget

（PDB）。被PDB阻止的Pod会在

failed_pods

字段中报告。

注意：优先使用节点池进行托管式扩缩容。直接创建节点仅适用于特殊场景。

Addon Management

插件管理

Tool	Function	Risk Level	Requires Confirmation
`huawei_list_cce_addons`	List cluster addons	🟢 Low	No
`huawei_get_cce_addon_detail`	Get addon details	🟢 Low	No
`huawei_install_cce_addon`	Install addon	🟢 Low	No
`huawei_uninstall_cce_addon`	Uninstall addon	🟠 High	Yes
`huawei_update_cce_addon`	Update addon	🟡 Medium	No

Common addons:

```
coredns
```
- DNS service
```
metrics-server
```
- Monitoring metrics
```
everest
```
- Storage driver

Addon notes (from E2E verification):
huawei_get_cce_addon_detail
and
huawei_uninstall_cce_addon
require the addon UID (from
huawei_list_cce_addons
→
metadata.uid
), not the addon name.
Addon status is in the
status.status
field (e.g.,
running
,
upgrading
,
abnormal
), not
spec.status
.
After
huawei_update_cce_addon
, the addon may enter
upgrading
state. Wait for it to return to
running
before performing subsequent operations (e.g., uninstall).

工具	功能	风险等级	是否需要确认
`huawei_list_cce_addons`	列出集群插件	🟢 低	否
`huawei_get_cce_addon_detail`	获取插件详情	🟢 低	否
`huawei_install_cce_addon`	安装插件	🟢 低	否
`huawei_uninstall_cce_addon`	卸载插件	🟠 高	是
`huawei_update_cce_addon`	更新插件	🟡 中等	否

常用插件：

```
coredns
```
- DNS服务
```
metrics-server
```
- 监控指标
```
everest
```
- 存储驱动

插件注意事项（来自端到端验证）：
huawei_get_cce_addon_detail
和
huawei_uninstall_cce_addon
需要插件UID（来自
huawei_list_cce_addons
→
metadata.uid
），而非插件名称。
插件状态位于
status.status
字段（例如
running
、
upgrading
、
abnormal
），而非
spec.status
。
huawei_update_cce_addon
执行后，插件可能进入
upgrading
状态。需等待其恢复到
running
状态后再执行后续操作（例如卸载）。

Network Prerequisites

网络前置条件

Tool	Function	Parameters
`huawei_list_vpc`	List VPCs with CIDR info	`region`
`huawei_list_vpc_subnets`	List subnets with AZ info	`region` , `vpc_id` (optional)
`huawei_list_eips`	List EIPs (shows bound/unbound status)	`region`
`huawei_delete_eip`	Delete an EIP (frees public IP)	`region` , `publicip_id`

Use these tools to find VPC/subnet IDs before cluster creation.

工具	功能	参数
`huawei_list_vpc`	列出包含CIDR信息的VPC	`region`
`huawei_list_vpc_subnets`	列出可用区信息的子网	`region` , `vpc_id` (可选)
`huawei_list_eips`	列出EIP（显示绑定/未绑定状态）	`region`
`huawei_delete_eip`	删除EIP（释放公网IP）	`region` , `publicip_id`

创建集群前，使用这些工具查找VPC/子网ID。

Supported Regions

支持的区域

Region Code	Region Name
cn-north-4	North China-Beijing 4
cn-north-1	North China-Beijing 1
cn-north-2	North China-Beijing 2
cn-east-3	East China-Shanghai 1
cn-south-1	South China-Guangzhou
cn-south-2	South China-Guangzhou Friendly
cn-east-4	East China II
cn-southwest-2	Guiyang 1
ap-southeast-1	Asia-Pacific-Hong Kong
ap-southeast-2	Asia-Pacific-Bangkok
ap-southeast-3	Asia-Pacific-Singapore

区域代码	区域名称
cn-north-4	华北-北京四
cn-north-1	华北-北京一
cn-north-2	华北-北京二
cn-east-3	华东-上海一
cn-south-1	华南-广州
cn-south-2	华南-广州友好区
cn-east-4	华东二区
cn-southwest-2	贵阳一
ap-southeast-1	亚太-香港
ap-southeast-2	亚太-曼谷
ap-southeast-3	亚太-新加坡

Output Format

输出格式

All tools return JSON-formatted results containing:

```
status
```
: operation result (
```
success
```
/
```
error
```
)
```
data
```
: operation-specific response (cluster info, node list, addon details, etc.)
```
message
```
: human-readable description of the result
```
warning
```
: risk warning for dangerous operations (preview mode only)

所有工具返回JSON格式的结果，包含：

```
status
```
: 操作结果（
```
success
```
/
```
error
```
）
```
data
```
: 操作特定响应（集群信息、节点列表、插件详情等）
```
message
```
: 结果的可读描述
```
warning
```
: 危险操作的风险警告（仅预览模式）

Verification

验证

See verification-method.md for detailed verification steps. Quick checklist:

```
hcloud version
```
(should be 7.2+)
```
kubectl version --client
```
Verify
```
HW_ACCESS_KEY
```
/
```
HW_SECRET_KEY
```
env vars are set (add
```
HW_SECURITY_TOKEN
```
for temporary credentials)

hcloud CCE ListClusters --cli-region=cn-north-4

(connectivity test)

Test dangerous operation preview (call without
```
confirm=true
```
)

详细验证步骤请参考verification-method.md。快速检查清单：

```
hcloud version
```
（版本应为7.2+）
```
kubectl version --client
```
验证
```
HW_ACCESS_KEY
```
/
```
HW_SECRET_KEY
```
环境变量已设置（临时凭证需添加
```
HW_SECURITY_TOKEN
```
）

hcloud CCE ListClusters --cli-region=cn-north-4

（连通性测试）

测试危险操作预览（调用时不传入
```
confirm=true
```
）

Best Practices

最佳实践

Use environment variables (
```
HW_ACCESS_KEY
```
/
```
HW_SECRET_KEY
```
) for credentials — avoid hardcoding; add
```
HW_SECURITY_TOKEN
```
for temporary credentials
Always preview dangerous operations before confirming with
```
confirm=true
```
Prefer Turbo clusters (
```
container_network_type=eni
```
) — the default — for high-performance workloads
Omit
```
cluster_version
```
unless the user requires a specific Kubernetes version
Resize node pools during low-traffic periods to minimize business impact
Keep node pools at ≥2 nodes for production workloads to ensure redundancy
Regularly check cluster health via
```
huawei_list_cce_clusters
```

使用环境变量（
```
HW_ACCESS_KEY
```
/
```
HW_SECRET_KEY
```
）存储凭证——避免硬编码；临时凭证添加
```
HW_SECURITY_TOKEN
```
执行危险操作前始终先预览，再传入
```
confirm=true
```
确认
优先使用Turbo集群（
```
container_network_type=eni
```
）——本技能默认值，适用于高性能工作负载
除非用户需要特定Kubernetes版本，否则省略
```
cluster_version
```
参数
在低流量时段调整节点池大小，以最小化对业务的影响
生产环境工作负载的节点池保持≥2个节点，确保冗余
通过
```
huawei_list_cce_clusters
```
定期检查集群健康状态

References

参考文档

Document	Description
task-cluster-management.md	Cluster lifecycle operations
task-nodepool-management.md	Node pool operations
task-node-management.md	Node scheduling operations
iam-policies.md	IAM permission policies
verification-method.md	Verification steps
troubleshooting.md	Troubleshooting guide
cce-api-guide.md	hcloud operation reference
cce-cluster-parameters.md	Cluster/nodepool creation parameters

文档	描述
task-cluster-management.md	集群生命周期操作
task-nodepool-management.md	节点池操作
task-node-management.md	节点调度操作
iam-policies.md	IAM权限策略
verification-method.md	验证步骤
troubleshooting.md	故障排查指南
cce-api-guide.md	hcloud操作参考
cce-cluster-parameters.md	集群/节点池创建参数

Notes

注意事项

Ensure AK/SK (and
```
HW_SECURITY_TOKEN
```
for temporary credentials) has correct IAM permissions
Different regions may have different resource availability
All dangerous operations require confirmation
Deletion operations are irreversible
Hibernate cluster stops all workloads - use during non-business hours
Node drain uses
```
kubectl drain
```
natively: handles cordon + eviction + PDB compliance + DaemonSet skip automatically. Use
```
--ignore-daemonsets --delete-emptydir-data
```
flags.
Turbo clusters recommended for best performance with ENI network
Create cluster / create node pool use the Python SDK fallback due to a known hcloud metadata parsing defect; all other operations use hcloud CLI

确保AK/SK（临时凭证需包含
```
HW_SECURITY_TOKEN
```
）拥有正确的IAM权限
不同区域的资源可用性可能不同
所有危险操作需要确认
删除操作不可逆
休眠集群会停止所有工作负载——建议在非业务时段使用
节点驱逐原生使用
```
kubectl drain
```
：自动处理标记不可调度+驱逐+PDB合规性+跳过DaemonSet。使用
```
--ignore-daemonsets --delete-emptydir-data
```
标志。
推荐使用Turbo集群搭配ENI网络以获得最佳性能
创建集群/创建节点池因已知的hcloud元数据解析缺陷回退使用Python SDK；其他所有操作使用hcloud CLI