Huawei Ecs

Huawei Cloud ECS

STOP - Do not answer from general knowledge. Follow the procedure below.

Always run hcloud <Service> <Operation> --help before constructing commands to discover exact parameter names and requirements.

Overview

Domain expertise for Huawei Cloud Elastic Cloud Server (ECS). Covers instance lifecycle, flavor selection, image management, networking, storage attachment, auto-scaling, and troubleshooting.

Prerequisites

Before creating an ECS instance from scratch, you MUST have:

• A VPC (see huawei-vpc)
• A subnet with DNS configured (see huawei-vpc)
• A security group with application ports open (see huawei-vpc)

Deployment routing guard: if this skill was reached via a DEPLOYMENT intent (creating resources to host an application), load the huawei-iac skill FIRST and follow its orchestration flow - UNCONDITIONALLY. Reusing an existing VPC does NOT make it single-resource: the purchase still involves billable resources (ECS, system disk, EIP, keypair, SG rules) that must pass the cost+balance gate, batch approval, and state tracking. Only create directly here if the user explicitly declines the orchestration flow or the user only wants a lifecycle operation on an EXISTING instance (query/reboot/resize/delete). Discovery already done (flavors, images, AZs) carries over.

Critical Warnings

Flavor Selection Guide

Flavor families are region-dependent. Always run hcloud ECS ListFlavors --cli-region=<r> to discover available flavors before recommending.

See references/flavors.md for discovery workflow. Do not hardcode flavor names — availability changes by region and over time.

Common Workflows

How to Search for Instances

ListServersDetails supports --name for exact match only. For fuzzy search:

1. List all instances: hcloud ECS ListServersDetails --cli-region=<region> --limit=100
2. Filter client-side by name substring, tag, or status
3. Use --server_tags filter if instances are tagged: hcloud ECS ListServersDetails --server_tags.1.key=Project

Return structure: ListServersDetails returns {"servers": [...]} (array), NOT {"server": ...}. Parse as .servers[0].status, NOT .server.status.

Abort if the result set is larger than --limit and ask the user to narrow the search.

Instance Status Polling

ECS creation is asynchronous. Status transitions: BUILD → ACTIVE (or ERROR). Wait times vary widely (20s–3min), never use fixed sleep.

Poll strategy:

bashCopy code
for i in $(seq 1 30); do
  status=$(hcloud ECS ListServersDetails --cli-region=<region> --server_id=<id> --cli-output=json | jq -r '.servers[0].status')
  if [ "$status" = "ACTIVE" ]; then break; fi
  if [ "$status" = "ERROR" ]; then echo "Creation failed"; exit 1; fi
  sleep 10
done

• Poll interval: 10 seconds
• Maximum wait: 5 minutes (30 iterations)
• Check for ERROR status to detect creation failures early

SSH Connection Verification

After ECS is ACTIVE and EIP is bound, verify SSH connectivity:

bashCopy code
hcloud ECS ListServersDetails --cli-region=<region> --server_id=<id>
# → addresses.<vpc-id>[].OS-EXT-IPS:addr

ssh -o StrictHostKeyChecking=accept-new -i <path-to-private-key> root@<eip-address>

SSH verification checklist: EIP bound → security group has port 22 ingress → keypair private key saved locally → known_hosts handled with StrictHostKeyChecking=accept-new (or delete stale entries with ssh-keygen -R <ip>).

Running Commands Inside the Instance

Use SSH for any in-instance operations (install software, check logs, start services):

bashCopy code
ssh -o StrictHostKeyChecking=accept-new -i <key> root@<eip> 'command'

Example — re-run failed cloud-init setup manually:

bashCopy code
ssh -o StrictHostKeyChecking=accept-new -i <key> root@<eip> 'dnf install -y nginx && systemctl enable --now nginx'

If SCP blocks SSH, use cloud-init --server.user_data for full deployment instead. See references/create-instance.md §Bootstrap.

Windows Login / Upload (standard paths)

Windows has NO working sshpass — password automation must go through paramiko; key automation uses the built-in OpenSSH ssh/scp. The first Connection refused on a fresh instance is usually just sshd not ready (retry with backoff before debugging the SG/EIP); a Permission denied while the server log shows "accepts key" is the local passphrase trap (-N '""' sets a literal "" passphrase). Full standard paths — sshd-ready retry, paramiko login/upload, and the cloud-init public-key injection path (KooCLI has no ImportKeypair): references/windows-ssh.md.

Deleting Instances

• Show the user the exact command and get explicit approval before running
• By default, --delete_publicip and --delete_volume are false — public IP and system disk survive deletion
• Set both to true to avoid orphaned resources and unexpected billing
• Data disks ARE deleted by default (unlike system disk)

Troubleshooting

Security Considerations

• MUST use security groups, not iptables
• MUST store SSH keys in DEW, never in user-data
• SHOULD enable CTS audit logging
• MUST NOT open 0.0.0.0/0 for SSH

MCP Tools

Prefer these tools over raw hcloud CLI — they enforce safety policies:

• huaweicloud_list_operations service=ECS
• huaweicloud_run_readonly_command for discovery (auto-redacts output)
• huaweicloud_plan_cli_command for command planning (returns command text + safety classification)
• huaweicloud_run_approved_command for writes (requires exact command approval)
• huaweicloud_check_cli to verify hcloud is available

approvedCommand trap: huaweicloud_run_approved_command validates that approvedCommand matches the planned command EXACTLY (including <redacted> placeholders). Always use the command field value returned by huaweicloud_plan_cli_command verbatim — never reconstruct or retype it. Mismatches cause rejection with "approvedCommand must exactly match the planned hcloud command."

Without MCP (Fallback)

If MCP tools are NOT available (new install, session not restarted):

• Raw hcloud commands WILL appear in shell history — passwords and secrets are at risk
• Always use key_name instead of adminPass
• Verify safety manually: no secret value reads, no credential file access
• Restart session as soon as possible to enable safety policies

Without MCP

Fall back to hcloud CLI. State: "MCP unavailable, using local hcloud CLI."

Flexus (Lightweight ECS)

Flexus is the lightweight ECS family. Two variants:

For Flexus X, use standard ECS CreateServers flow with x1.* flavors. For Flexus L, manual console provisioning is recommended — no KooCLI path exists.

References

• ECS Docs: https://support.huaweicloud.com/ecs/
• Flavor specs: references/flavors.md
• Create instance: references/create-instance.md
• Windows SSH login/upload: references/windows-ssh.md
• HC活动 ECS+Nginx部署: references/hc-activity.md