Huawei Cloud IaC Orchestration
STOP - Do not answer from general knowledge. Follow the 8-stage workflow below in strict order.
Always run hcloud <Service> <Operation> --help before constructing commands to discover exact parameter names and requirements.
Scope and Routing Guard
- This skill orchestrates the purchase lifecycle of ALL supported resources: proposal → pricing → provisioning → destroy, across every service in the plugin catalog.
- Web app deployment keeps sandbox as the first choice (see
huaweicloud-coreDeployment Target Options). Route here only when the user wants billed, long-term, or multi-resource cloud infrastructure, or explicitly asks for an architecture + cost proposal. - Single-resource tasks go directly to the service skill. This skill adds value for multi-resource orchestration, mandatory cost gating, and ordered destroy.
- A user-specified hosting target (e.g. "部署到 ECS") does NOT exempt the flow: stages 1-5 (code inspection, cost estimate, balance check, risk warnings) still run in full - the user's target choice only narrows stage 2/3 options, it never skips the gates.
Workflow (strict order)
Proactive by design: any deployment intent ("部署一个博客", "搭一套环境", "买个服务器") automatically triggers stages 1-5 BEFORE anything is created. The user NEVER needs to ask for an architecture proposal, cost estimate, or risk warnings - they are built into the flow. Only stages 6-8 (create / verify / manage) wait for explicit user confirmation at the approval gates.
| Stage | What happens | Hard rule |
|---|---|---|
| 1. Scale assessment | FIRST inspect the project code (clone remote repos to a temp dir, or read the local path): tech stack, data services (Redis/MySQL/SQLite...), build artifacts, existing Dockerfile/k8s manifests → then classify or ask scale | NEVER present deployment options (sandbox/ECS/OBS...) before the codebase has been inspected - options without code analysis are guesses. If scale is not stated or clearly inferable, ASK - present the 3 tiers as options with what each includes and its monthly cost band (see references/architectures.md), and let the user choose. Never assume a tier. The scale question and the hosting-target question are SEPARATE questions on separate axes. FunctionGraph filesystem is ephemeral - never recommend SQLite/local files for persistent data |
| 2. Frontend hosting choice | Present BOTH options: (a) OBS+CDN+DNS custom domain, (b) ECS+EIP | For SPA/static frontends (Vue/React dist), OBS hosting must always appear as an option with cost comparison against same-host Nginx - do not silently merge the frontend into a compute node. For option (a) three prerequisites: domain ownership verification (CDN requires a DNS record or file upload first - CDN.00010185 otherwise), ICP filing check, DNS hosting check; domain registration link: https://www.huaweicloud.com/product/domain.html |
| 3. Architecture proposal | ASCII topology tree with dependencies | User confirms before continuing. Architecture decision points must be surfaced as explicit choices, never silently made: (a) app depends on Redis/MySQL/Kafka etc. → managed service (DCS/RDS/DMS, billed) vs same-host install (cheap, ops burden) - state the trade-off and ask; (b) repo ships a Dockerfile / SWR image / k8s manifests → offer container path (Docker on ECS or CCE) alongside source-build path; (c) frontend hosting layer (Nginx same-host vs OBS+CDN). Silent defaults here are a correctness failure |
| 4. Parameter discovery | ListFlavors / ListImages / huaweicloud_list_regions | Never hardcode flavor/image names |
| 5. Cost + balance gate | Price every resource via BSS ListOnDemandResourceRatings, then query balance | 前置拦截（实测 #922）：估算成本 > 余额（含余额为 0）时 STOP — 不要带着一份注定失败的下单继续 stage 6。第一条消息必须说明："您的余额不足以覆盖本次部署的按时长计费资源（预计首月 <估算>，当前余额 <余额>），下单将失败（Ecs.7000 Insufficient account balance）——已暂停，请先充值或领券，完成后回复"已充值/继续"即可从本阶段续跑原配置"。充值入口：https://account.huaweicloud.com/usercenter/?region=cn-north-4#/userindex/balanceRecharge 。Remedy priority: (1) FIRST claim the one-time incentive voucher (huaweicloud_voucher_status → huaweicloud_voucher_claim) to offset usage fees; (2) then instruct the user to top up balance (via the link above) — pause the flow and resume from stage 5 with the SAME configuration after the top-up, never walk a known-doomed order; (3) free-tier resources (FunctionGraph, small OBS) proceed without any balance. Balance >= 估算成本 → report how long it can sustain (balance ÷ monthly estimate). 权限降级（实测）：IAM 用户无 billing:balance:view 时余额查询报 CBC.0151 → 不阻塞流程，明确告知"余额无法程序化查询，请自行核对；若下单报 Ecs.7000 即余额不足"，领券后继续。定价编码逐服务查证，见 references/resource-catalog.md § Pricing。余额风控语义（实测 #935）：按量付费下单校验的是现金余额而非代金券（券只在账单结算时抵扣，不参与下单风控）；历史欠费（即使金额很小）同样触发 KPS.9004/Ecs.0067 拒单 —— 门禁检查项必须包含：现金余额充足 且 欠费已结清（查询：hcloud BSS ShowCustomerAccountBalances --cli-region=cn-north-1）。子网 DNS 前置修复（实测 #935 坑4）：模板/预置子网 dnsList 可能为空，会导致 cloud-init 域名解析与 yum/dnf 静默失败 —— 创建 ECS 前先执行 hcloud VPC UpdateSubnet 补充华为云内网 DNS 100.125.1.250、100.125.129.250：hcloud VPC UpdateSubnet --subnet_id=<subnet-id> --subnet.dnsList.1=100.125.1.250 --subnet.dnsList.2=100.125.129.250 |
| 6. Provision | deployment_id, session state, batch approval, ordered creation | See "Provisioning Rules" below |
| 7. Verify | curl -I the site / API; expect 200 | DNS CNAME may take minutes to propagate - not an error |
| 8. Manage | Session-scoped status query and destroy | See "Destroy Rules" below |
Provisioning Rules (Stage 6)
- Generate
deployment_id(d-xxx), initialize the session state file (path and schema:references/state-file.md). - Batch approval: show the RESOURCE LIST (name / type / purpose), never the raw commands. Present the numbered manifest BEFORE any
huaweicloud_plan_cli_commandcall and get ONE explicit list-level approval. After the user approves the manifest, execute each resource viahuaweicloud_plan_cli_command→huaweicloud_run_approved_commandwithout re-asking list-level consent (per-command approval tokens are still required by the tool gate). Never execute anything outside the approved list. - Create in dependency-topological order (network → compute/db → bindings). After each success, extract the resource ID and write it to state immediately.
- Any failure: stop immediately, mark state
partial, report the error, offer destroy of already-created resources. No automatic rollback.
Destroy Rules (Stage 8, current session only)
Preconditions - all required:
- Session state file exists and contains the deployment_id (state dies with the session; a fresh session cannot destroy past deployments - direct the user to the console instead).
- Status is
deployedorpartial(destroyedis terminal). - The user explicitly names the target deployment. Ambiguous "delete it" → list deployments and ask. Never guess.
- Every delete command still goes through plan → approve → run.
Execution: show the to-be-deleted list for final confirmation → delete in reverse creation order → a "resource not found" error counts as already deleted, continue → mark destroyed. OBS: recursive sweeps (OBS rm obs://<bucket>/ -r -f) are DENIED by the safety rule hwc-destructive-delete-force even after manifest approval - do not plan them. Instead list objects (hcloud OBS ls obs://<bucket>/ -s) and delete per-object (watch for folder-marker objects like assets/ that outlive the files), then delete the bucket (a non-empty bucket fails with 409 BucketNotEmpty). CDN: disable then delete. DNS: delete the record set (only if hosted in Huawei Cloud DNS).
Critical Warnings
| Trap | Why / Rule |
|---|---|
Stale securityToken poisons every hcloud call | Symptom: every API returns APIGW.0301 Incorrect IAM authentication information while OBS/obsutil still works. configure set refuses empty values and auth-sync never clears the field. Fix: hcloud configure delete --cli-profile=default, then re-run auth init with AK/SK only (no token) |
| OBS writes bypass the REST write-prefix policy | mb / cp / rm / chattri are obsutil-style commands. ALWAYS route them through huaweicloud_plan_cli_command → approval → huaweicloud_run_approved_command. Never treat them as read-only |
OBS mb flag rules differ from cp/rm | mb does NOT accept -f (flag parse error) and REQUIRES explicit -location=<region> even with a regional endpoint (else IllegalLocationConstraintException) |
Duplicate OBS mb is idempotent success | Same-account same-name bucket creation returns success, not an error - never treat a second create as failure. OBS deletes are also idempotent (deleting a nonexistent object succeeds) |
| Bucket ACL does not cascade to objects | Every uploaded object needs -acl=public-read at upload time (-f IS valid on cp/rm) |
| OBS static website bucket name must equal the domain | e.g. bucket www.example.com for domain www.example.com |
| VPC v3 API differs from older docs | v3 CreateSecurityGroup has NO vpc_id (account-scoped); CreateSecurityGroupRule uses multiport=80 not port_range_min/max; DeleteSubnet requires vpc_id too. Always --help first |
| Public exposure is auto-blocked | Risk rules deny 0.0.0.0/0 port rules at plan time. For test/dev use a narrower remote_ip_prefix (e.g. the VPC CIDR) or get user consent for a documented exception |
| ECS CreateServers hidden required params | Besides flavor/image/nics/az it also needs --server.vpcid and --server.root_volume.volumetype - order submission fails without them |
| FunctionGraph runtime/code enums are strict | runtime must be exact (Node.js18.15, Python3.9, Go1.x, ...); inline code is the PAIR --package=default --code_type=inline (--package=inline → FSS.1006); TIMER triggers use --event_data.schedule_type=Rate --event_data.schedule=1m (@every style → FSS.1109); DeleteFunction takes --function_urn WITHOUT :latest |
Keypairs: NovaCreateKeypair, not CreateKeypair | ECS CreateKeypair does NOT exist - use hcloud ECS NovaCreateKeypair; delete takes --keypair_name (not --keypair.name). The API-generated private_key is MASKED in tool output - for SSH access create the keypair in the console or import the user's own public key, then bind with --server.key_name=<n> |
| Long inline args break MCP JSON | Values >~2KB inline (e.g. --server.user_data=<base64 cloud-init>) fail JSON parsing silently. Write a local JSON file and pass --cli-jsonInput=<file> (see references/resource-catalog.md header note) |
| EIP quota fails at RUN stage, not at plan | EIP.7905 Quota exceeded appears only after plan+approval - pre-check quota during stage 5 (and count precisely: ListPublicips --limit=50 truncates, a "50/50" read on a 59-EIP account is wrong). Released quotas may lag minutes before EIP.7905 clears |
| Zero balance blocks order submission | ECS creation fails with Ecs.7000 Insufficient account balance when cash + voucher accounts are 0. This is the stage-5 gate materialized — and since #922 the gate INTERCEPTS before the order: when the estimate exceeds the balance, STOP at stage 5 (recharge entry + resume after top-up) instead of walking a known-doomed CreateServers. Free-tier resources (FunctionGraph, small OBS) DO work at 0 balance - the gate applies to order-submission resources only |
| Pay-per-use orders check CASH balance, not vouchers (#935) | 按量付费下单风控只校验现金余额：代金券不参与按量付费下单风控（券只在账单结算时抵扣）；历史欠费（即使金额很小）同样触发 KPS.9004/Ecs.0067 拒单。stage-5 门禁检查项必须包含：现金余额充足 且 欠费已结清（hcloud BSS ShowCustomerAccountBalances --cli-region=cn-north-1） |
Subnet dnsList may be empty on template/preset subnets (#935) | cloud-init 域名解析与 yum/dnf 静默失败。创建 ECS 前先 hcloud VPC UpdateSubnet --subnet_id=<id> --subnet.dnsList.1=100.125.1.250 --subnet.dnsList.2=100.125.129.250 补充华为云内网 DNS（详见 huawei-ecs/references/create-instance.md §4） |
| CDN mainland acceleration requires ICP filing | Unregistered domains cannot go live on CDN - check before stage 3. CDN create ALSO requires domain ownership verification first (CDN.00010185 Verify domain ownership failed - user must add a DNS record or upload a verification file) |
| CDN is a global service in KooCLI | CDN operations only accept --cli-region=cn-north-1 or ap-southeast-1 - never the resource region |
| OBS static website hosting has NO CLI path | chattri only sets ACL/storage-class; obsutil has no website command. Options: console setup, or CDN OBS-origin with --domain.sources.1.enable_obs_web_hosting=1. Without website hosting, verify via direct object URLs (still public HTTP 200) |
| DNS hosting location | hcloud DNS ListPublicZones decides: hosted in Huawei Cloud → auto-create CNAME record set; hosted elsewhere → output the CNAME value for manual setup at the user's DNS provider |
| EIP bills when idle; stopped ECS still bills | Include in cost estimate; destroy unattached EIPs |
| ECS delete defaults leak resources | --delete_publicip and --delete_volume are false by default - set true when tearing down |
| EIP binding type is non-obvious | --publicip.associate_instance_type=PORT (not INSTANCE) |
| State is session-only | Temp-dir file, dies with the session. Never promise cross-session deploy management |
| State file must be UTF-8 WITHOUT BOM | PowerShell Set-Content -Encoding utf8 adds a BOM that breaks JSON parsers - write state with Node or another BOM-less writer |
| HTTPS needs a certificate | CDN serves plain HTTP by default; SSL cert (upload or SCM) required for HTTPS |
MCP Tools
huaweicloud_plan_cli_command→ classify and plan each write commandhuaweicloud_run_approved_command→ execute after explicit approval (approvedCommand must match the planned command exactly - use thecommandfield verbatim, never retype it)huaweicloud_run_readonly_command→ discovery (flavors, images, zones, prices)huaweicloud_list_regions/huaweicloud_get_regional_availability→ region intenthuaweicloud_hook_check_deploy_plan→ risk-check the plan before approval- Balance and pricing:
huawei-billingskill. Balance operation (BSS is pinned to cn-north-1 in KooCLI):hcloud BSS ShowCustomerAccountBalances --cli-region=cn-north-1(domain-id auto-resolves from the AK/SK). If an IAM business param genuinely needs the account-id, runhcloud STS GetCallerIdentity --cli-region=<region>
Cross-Skill References
- Per-resource commands:
huawei-vpc(VPC / subnet / security group / EIP),huawei-ecs,huawei-rds,huawei-cloud-gaussdb-instance-management,huawei-cloud-dds-dcs-instance-management,huawei-cce,huawei-obs,huawei-functiongraph,huawei-cloud-apig-instance-management,huawei-cloud-smn-dms-message,huawei-cbr,huawei-cloud-eye,huawei-cloud-cts-trace-management,huawei-cloud-dew-key-management,huawei-modelarts,huawei-cloud-waf-aad-rule-management,huawei-iam - CDN and DNS have no dedicated skill - discover operations with
hcloud CDN <Operation> --helpandhcloud DNS <Operation> --help - Full purchase catalog:
references/resource-catalog.md - Architecture templates by scale:
references/architectures.md - State file spec:
references/state-file.md
