Huawei Cloud CCE Cluster Management#

Overview#

Manage CCE (Cloud Container Engine) cluster lifecycle, including cluster creation/deletion/hibernation/awakening, node pool management, node scheduling control, and addon management.

⛔ Security Constraints#

Dangerous Operation Confirmation Mechanism#

This skill strictly enforces a two-step confirmation mechanism for all dangerous operations to prevent accidental service disruption or data loss.

All dangerous operations require confirm=true parameter to execute. Otherwise, they return a preview and confirmation prompt.

Operations Requiring Confirmation

ToolOperation TypeRisk LevelDescriptionhuawei_delete_cce_clusterDelete🔴 CriticalDeletes entire CCE cluster, irreversiblehuawei_hibernate_cce_clusterHibernate🟠 HighStops all workloads, pauses control plane billinghuawei_awake_cce_clusterAwake🟠 HighResumes cluster from hibernationhuawei_resize_cce_nodepoolScale🟡 MediumAdjusts node pool size, affects capacityhuawei_delete_cce_nodepoolDelete🟠 HighDeletes node pool, affects business capacityhuawei_delete_cce_nodeDelete🟠 HighRemoves node from cluster, affects schedulinghuawei_uninstall_cce_addonUninstall🟠 HighRemoves addon, may affect cluster functionalityhuawei_cce_node_cordonCordon🟡 MediumMarks node unschedulable, new pods won't be assignedhuawei_cce_node_uncordonUncordon🟡 MediumMarks node schedulable, new pods may be assigned immediatelyhuawei_cce_node_drainDrain🟠 HighEvicts all pods from node, affects running workloads

Workflow

Step 1: Preview Operation - Call without confirm parameter

bash

# Example: Preview cluster deletion
python3 scripts/huawei-cloud.py huawei_delete_cce_cluster \
  region=cn-north-4 \
  cluster_id=xxx

Returns: operation preview, risk warning, confirmation example

Step 2: Confirm Execution - Call with confirm=true

bash

# Example: Confirm and execute deletion
python3 scripts/huawei-cloud.py huawei_delete_cce_cluster \
  region=cn-north-4 \
  cluster_id=xxx \
  confirm=true

Credential Security#

✅ This skill strictly follows these security rules:

1. No persistent credential storage - Never saves AK/SK, tokens, or certificates to disk
2. No long-term memory cache - AK/SK exists only during API call, released afterward
3. Only project ID memory cache - Non-sensitive project ID cached in process memory
4. No credential leakage - Never includes AK/SK in logs, responses, or errors
5. Temporary file cleanup - If temporary cert files are created, they are deleted immediately after use

AK/SK usage methods:

• Environment variables HW_ACCESS_KEY / HW_SECRET_KEY / HW_REGION_NAME (process-level, not saved)
• Per-call parameter (valid only for that call)

---

Prerequisites#

Python Environment#

• Python 3.8+
• Install SDKs: pip install huaweicloudsdkcce huaweicloudsdkcore
• Optional for node operations: pip install kubernetes

Environment Variables (Recommended)#

bash

export HW_ACCESS_KEY="your-access-key-id"
export HW_SECRET_KEY="your-secret-access-key"
export HW_REGION_NAME="cn-north-4"

IAM Permission Policies#

Ensure the IAM user has the minimum required permissions:

PermissionDescriptioncce:cluster:listList clusterscce:cluster:getGet cluster detailscce:cluster:createCreate clusterscce:cluster:deleteDelete clusterscce:cluster:updateUpdate clusters (hibernate/awake/bind EIP)cce:node:listList nodescce:node:getGet node detailscce:node:createCreate nodescce:node:deleteDelete nodescce:node:updateUpdate nodes (cordon/uncordon/drain)cce:nodepool:listList node poolscce:nodepool:createCreate node poolscce:nodepool:deleteDelete node poolscce:nodepool:updateUpdate node pools (resize)cce:addon:listList addonscce:addon:getGet addon detailscce:addon:createInstall addonscce:addon:updateUpdate addonscce:addon:deleteUninstall addons

---

Core Commands#

Cluster Query#

ToolFunctionParametershuawei_list_cce_clustersList all CCE clusters in regionregion``huawei_get_cce_nodesGet detailed node informationregion, cluster_id, node_id``huawei_get_cce_kubeconfigGet cluster kubeconfigregion, cluster_id, duration

Cluster Management#

ToolFunctionRisk LevelRequires Confirmationhuawei_create_cce_clusterCreate CCE cluster🟢 LowNohuawei_delete_cce_clusterDelete CCE cluster🔴 CriticalYeshuawei_hibernate_cce_clusterHibernate cluster🟠 HighYeshuawei_awake_cce_clusterAwake cluster🟠 HighYeshuawei_bind_cce_cluster_eipBind cluster EIP🟢 LowNohuawei_unbind_cce_cluster_eipUnbind cluster EIP🟡 MediumNo

Recommended defaults:

• Cluster type: Turbo (best performance with ENI network)
• Container network: eni for Turbo clusters
• Naming format: <env>-<app>-cluster (e.g., prod-web-cluster)

Node Pool Management#

ToolFunctionRisk LevelRequires Confirmationhuawei_list_cce_nodepoolsList node pools🟢 LowNohuawei_create_cce_nodepoolCreate node pool🟢 LowNohuawei_delete_cce_nodepoolDelete node pool🟠 HighYeshuawei_resize_cce_nodepoolResize node pool🟡 MediumYes

Recommended defaults:

• Naming format: <env>-<role>-pool (e.g., prod-worker-pool)
• Initial node count: 2 for HA, or 0 with autoscaling
• Enable autoscaling for dynamic scaling

Node Management#

ToolFunctionRisk LevelRequires Confirmationhuawei_list_cce_nodesList cluster nodes🟢 LowNohuawei_create_cce_nodeCreate nodes directly🟢 LowNohuawei_delete_cce_nodeDelete node🟠 HighYeshuawei_cce_node_cordonMark node unschedulable🟡 MediumYeshuawei_cce_node_uncordonMark node schedulable🟡 MediumYeshuawei_cce_node_drainEvict all pods from node🟠 HighYeshuawei_cce_node_statusQuery node scheduling status🟢 LowNo

Note: Prefer node pools for managed scaling. Direct node creation is for special cases.

Addon Management#

ToolFunctionRisk LevelRequires Confirmationhuawei_list_cce_addonsList cluster addons🟢 LowNohuawei_get_cce_addon_detailGet addon details🟢 LowNohuawei_install_cce_addonInstall addon🟢 LowNohuawei_uninstall_cce_addonUninstall addon🟠 HighYeshuawei_update_cce_addonUpdate addon🟡 MediumNo

Common addons:

• coredns - DNS service
• metrics-server - Monitoring metrics
• everest - Storage driver

Network Prerequisites#

ToolFunctionParametershuawei_list_vpcList VPCs with CIDR inforegion``huawei_list_vpc_subnetsList subnets with AZ inforegion, vpc_id

Use these tools to find VPC/subnet IDs before cluster creation.

---

Supported Regions#

Region CodeRegion Namecn-north-4North China-Beijing 4cn-north-1North China-Beijing 1cn-north-2North China-Beijing 2cn-east-3East China-Shanghai 1cn-south-1South China-Guangzhoucn-south-2South China-Guangzhou Friendlycn-east-4East China IIcn-southwest-2Guiyang 1ap-southeast-1Asia-Pacific-Hong Kongap-southeast-2Asia-Pacific-Bangkokap-southeast-3Asia-Pacific-Singapore

---

Output Format#

All tools return JSON-formatted results containing:

• status: operation result ( success / error)
• data: operation-specific response (cluster info, node list, addon details, etc.)
• message: human-readable description of the result
• warning: risk warning for dangerous operations (preview mode only)

Verification#

See verification-method.md for detailed verification steps. Quick checklist:

1. Verify AK/SK credentials are configured via environment variables
2. Run huawei_list_cce_clusters to confirm API connectivity
3. Test dangerous operation preview (call without confirm=true)
4. Verify Turbo cluster ENI network configuration

Best Practices#

• Use environment variables ( HW_ACCESS_KEY / HW_SECRET_KEY) for credentials — avoid hardcoding
• Always preview dangerous operations before confirming with confirm=true
• Use Turbo clusters ( container_network_type=eni) for high-performance workloads
• Resize node pools during low-traffic periods to minimize business impact
• Keep node pools at ≥2 nodes for production workloads to ensure redundancy
• Regularly check cluster health via huawei_list_cce_clusters and huawei_show_cce_cluster

---

References#

DocumentDescriptiontask-cluster-management.mdCluster lifecycle operationstask-nodepool-management.mdNode pool operationstask-node-management.mdNode scheduling operationsiam-policies.mdIAM permission policiesverification-method.mdVerification stepstroubleshooting.mdTroubleshooting guidecce-api-guide.mdCCE Python SDK API referencecce-cluster-parameters.mdCluster/nodepool creation parameters

---

Notes#

• Ensure AK/SK has correct IAM permissions
• Different regions may have different resource availability
• All dangerous operations require confirmation
• Deletion operations are irreversible
• Hibernate cluster stops all workloads - use during non-business hours
• Node drain evicts all pods - ensure sufficient replicas
• Turbo clusters recommended for best performance with ENI network