Huawei Cloud Kubectl Cce Installer

Huawei Cloud CCE Kubectl Resource Query

Use this skill to retrieve specific CCE Kubernetes resources through kubectl cce. Resource access is the primary task. Local installation is only a prerequisite recovery step when kubectl or the kubectl-cce plugin is unavailable.

Overview And Safety

• Use kubectl cce; do not use a direct Kubernetes API client.
• Read-only commands only: get, describe, and logs.
• Never use -A, --all-namespaces, or another whole-cluster resource query.
• For namespaced resources, require --namespace <namespace> and, where feasible, a specific resource name.
• For cluster-scoped resources such as node, namespace, persistentvolume, and storageclass, require an exact resource name. Do not list every instance.
• Never run apply, create, delete, edit, patch, replace, scale, rollout, cordon, drain, or exec.
• Do not print credentials, tokens, kubeconfig content, or Secret data.

Prerequisites And Required Context

Credentials follow the plugin rules in plugin-usage.md. Use explicit --cli-access-key, --cli-secret-key, and optional --cli-security-token only when the caller supplies them. Do not fall back to other credentials in that case.

Workflow

1. Before any resource query, validate the target region and cluster ID. If either is missing, or the cluster ID cannot be resolved to one existing UUID in that region, do not run kubectl cce; ask the user to provide the correct region and cluster ID.

2. Confirm the resource kind, namespace, and exact resource name when required.

3. Check local prerequisites:

   bashCopy code
   bash scripts/install_kubectl_cce.sh --check
   

4. When both kubectl and kubectl-cce are available, query the requested resource.

5. When either executable is missing, read installation.md, then show the installer plan. Installation or replacement is an R1 local change and requires explicit confirmation:

   bashCopy code
   bash scripts/install_kubectl_cce.sh --bin-dir <directory>
   sudo bash scripts/install_kubectl_cce.sh --execute --bin-dir <directory>
   

6. Verify installation with kubectl version --client and kubectl plugin list, then run only the requested read-only resource query.

Core Commands

Use one explicit namespace per namespaced query:

bashCopy code
kubectl cce --cluster-id <cluster-id> --region <region> \
  get pod <pod-name> --namespace <namespace> -o yaml

kubectl cce --cluster-id <cluster-id> --region <region> \
  describe deployment <deployment-name> --namespace <namespace>

kubectl cce --cluster-id <cluster-id> --region <region> \
  get service <service-name> --namespace <namespace> -o yaml

For a cluster-scoped resource, use an exact name:

bashCopy code
kubectl cce --cluster-id <cluster-id> --region <region> \
  get node <node-name> -o yaml

For credential modes, command forms, and x509 retry behavior, read plugin-usage.md. For Windows usage and installation fallbacks, read installation.md. If a command fails with an x509 upstream TLS validation error, retry that same command once with --cce-insecure-upstream-tls=true immediately after cce.

Risk Levels

Output Format

Return the cluster ID, region, resource kind, namespace when applicable, resource name, and requested status or fields. State clearly whether the resource is not found, access is denied, prerequisites are missing, or an installation confirmation is needed.

Parameters And Confirmation

Confirm cluster_id, region, resource kind, namespace, and exact resource name before issuing a query. If cluster_id is missing or cannot be resolved in the supplied region, stop and ask the user for the correct region and cluster ID. Confirm the target installation directory before any --execute action.

Verification

After installation, run kubectl version --client and kubectl plugin list; after a query, verify that the returned resource identity matches the requested cluster, namespace, and name.

Best Practices

Use the narrowest requested resource query and avoid broad list operations even when the caller can access the whole cluster.

Notes

When the requested resource cannot be scoped to a namespace or exact name, ask the user to narrow the target instead of expanding to a cluster-wide query.

References