Huawei Cloud CCE Container Migration Planner#

⚠️ Execution Method (Must Read): This skill executes queries via the local Python dispatcher script. Using hcloud, openstack, or other CLI tools or direct API calls is prohibited.

• The dispatcher script is located at scripts/huawei-cloud.py within the skill directory
• All scripts and environment check scripts are inside the skill package. You must use skill action=exec to execute them. Do not run them directly in a shell.
• Do not attempt hcloud, openstack, curl IAM, or any other CLI/API methods. This skill does not depend on those tools.
• All paths are relative to the skill directory, which is the directory where this SKILL.md is located.

Overview#

This skill plans Huawei Cloud CCE container migrations by inventorying source clusters, mapping dependencies, designing migration batches, and generating risk assessments with rollback strategies. It performs read-only resource discovery and planning only — it does NOT create target resources, modify networks, migrate data, or delete source resources.

Architecture: Python dispatcher ( scripts/huawei-cloud.py) → Huawei Cloud Python SDK + Kubernetes client → CCE clusters, node pools, addons, workloads, Services, Ingresses, PVCs, PVs, ConfigMaps, Secrets, VPC, subnets, security groups, ELB, EIP, EVS, SFS/SFS Turbo → Dependency matrix → Migration batches → Risk assessment → Rollback & validation plans → Output report

Related Skills:

SkillPurposehuawei-cloud-cce-availability-risk-scannerScan availability risks before migrationhuawei-cloud-cce-dependency-impact-analyzerAnalyze dependency impact for changeshuawei-cloud-cce-change-impact-analyzerAssess change impact before migrationhuawei-cloud-cce-daily-cluster-inspectorPre-migration cluster health inspectionhuawei-cloud-cce-cost-optimization-advisorCost analysis for migration sizing

Capabilities:

1. CCE cluster inventory: clusters, node pools, addons, network model, key configurations
2. Workload inventory: Deployments, StatefulSets, DaemonSets, Services, Ingresses, PVCs, PVs, ConfigMaps, Secrets
3. Cloud resource inventory: VPC, subnets, security groups, ELB, EIP, EVS, SFS/SFS Turbo
4. Dependency matrix construction: ingress traffic, service dependencies, storage dependencies, configuration dependencies, external system dependencies
5. Migration batch design with validation points, rollback strategies, and downtime windows
6. Risk assessment with severity classification and manual confirmation checklists
7. Structured output following the migration planning schema

Typical Use Cases:

• "Plan migration from my CCE cluster to another region"
• "Inventory all workloads and dependencies in my CCE cluster"
• "Design migration batches for a multi-cluster migration"
• "Assess risks for a CCE version upgrade migration"
• "Build a dependency matrix for my container workloads"
• "Generate a rollback plan for cluster migration"
• "Plan hybrid cloud migration from CCE"
• "Create a migration assessment report with risk classification"

Prerequisites#

1. Python Requirements (MANDATORY)#

• Python >= 3.6 installed
• Required packages: huaweicloudsdkcore, huaweicloudsdkcce, huaweicloudsdkvpc, huaweicloudsdkecs, huaweicloudsdkevs, huaweicloudsdkeip, huaweicloudsdkelb, huaweicloudsdkiam, kubernetes
• Verify: python3 --version
• Install packages: pip3 install huaweicloudsdkcore huaweicloudsdkcce huaweicloudsdkvpc huaweicloudsdkecs huaweicloudsdkevs huaweicloudsdkeip huaweicloudsdkelb huaweicloudsdkiam kubernetes

2. Credential Configuration#

• Valid Huawei Cloud credentials (AK/SK mode)

• Security Rules:

  • 🚫 Never expose AK/SK values in code, conversation, or commands
  • 🚫 Never use echo $HUAWEI_AK or echo $HUAWEI_SK to check credentials
  • 🚫 Never write credentials to files, logs, or responses
  • ✅ Use environment variables: HUAWEI_AK, HUAWEI_SK, HUAWEI_REGION
  • ✅ Credentials exist only in the current request call stack and are released after each invocation
  • ✅ Prefer IAM users over root account for cloud operations

Configuration Method (Environment Variables Only):

bash

export HUAWEI_AK=<your-ak>
export HUAWEI_SK=<your-sk>
export HUAWEI_REGION=cn-north-4

Additional Variables:

VariableRequiredDescriptionHUAWEI_AKYesHuawei Cloud Access KeyHUAWEI_SKYesHuawei Cloud Secret KeyHUAWEI_REGIONNoDefault region (overrides region param if set)HUAWEI_PROJECT_IDNoProject ID (auto-obtained via IAM API when not set)HUAWEI_SECURITY_TOKENNoRequired when using temporary AK/SK

3. IAM Permission Requirements#

API ActionServicePurposeCCE cluster readCCEhuawei_list_cce_clustersCCE node readCCEhuawei_list_cce_nodesCCE nodepool readCCEhuawei_list_cce_nodepoolsCCE addon readCCEhuawei_list_cce_addonsCCE workload readCCEhuawei_get_cce_deploymentsCCE Service readCCEhuawei_get_cce_servicesCCE Ingress readCCEhuawei_get_cce_ingressesCCE PVC readCCEhuawei_get_cce_pvcsCCE PV readCCEhuawei_get_cce_pvsCCE ConfigMap readCCEhuawei_list_cce_configmapsCCE Secret readCCEhuawei_list_cce_secretsVPC readVPChuawei_list_vpc, huawei_list_vpc_subnets, huawei_list_security_groupsELB readELBhuawei_list_elbEIP readEIPhuawei_list_eipEVS readEVShuawei_list_evsSFS readSFShuawei_list_sfs, huawei_list_sfs_turbo

Permission Failure Handling:

1. When any action fails due to permission errors, display the required permission list
2. Guide the user to create a custom policy in the IAM console
3. Pause execution and wait for user confirmation that permissions have been granted
4. Retry the failed action

Core Commands#

All actions are invoked via the dispatcher script:

bash

python3 scripts/huawei-cloud.py <action> region=<region> cluster_id=<cluster_id> [key=value ...]

1. CCE Cluster Inventory#

ActionRequired ParamsDescriptionhuawei_list_cce_clusters``regionList CCE clusters in the regionhuawei_list_cce_nodes``region, cluster_idList cluster nodeshuawei_list_cce_nodepools``region, cluster_idList node poolshuawei_list_cce_addons``region, cluster_idList installed addons

2. Workload Inventory#

ActionRequired ParamsDescriptionhuawei_get_cce_deployments``region, cluster_idList Deploymentshuawei_get_cce_services``region, cluster_idList Serviceshuawei_get_cce_ingresses``region, cluster_idList Ingresseshuawei_get_cce_pvcs``region, cluster_idList PersistentVolumeClaimshuawei_get_cce_pvs``region, cluster_idList PersistentVolumeshuawei_list_cce_configmaps``region, cluster_idList ConfigMapshuawei_list_cce_secrets``region, cluster_idList Secrets (existence only, no values)

3. Cloud Resource Inventory#

ActionRequired ParamsDescriptionhuawei_list_vpc``regionList VPCshuawei_list_vpc_subnets``region, vpc_idList subnets in a VPChuawei_list_security_groups``regionList security groupshuawei_list_elb``regionList Elastic Load Balancershuawei_list_eip``regionList Elastic IPshuawei_list_evs``regionList EVS diskshuawei_list_sfs``regionList SFS file systemshuawei_list_sfs_turbo``regionList SFS Turbo file systems

4. Example Commands#

bash

# List clusters for migration scope
python3 scripts/huawei-cloud.py huawei_list_cce_clusters region=cn-north-4

# Inventory cluster workloads
python3 scripts/huawei-cloud.py huawei_get_cce_deployments region=cn-north-4 cluster_id=<cluster_id>

# Inventory networking resources
python3 scripts/huawei-cloud.py huawei_get_cce_services region=cn-north-4 cluster_id=<cluster_id>
python3 scripts/huawei-cloud.py huawei_get_cce_ingresses region=cn-north-4 cluster_id=<cluster_id>

# Inventory storage resources
python3 scripts/huawei-cloud.py huawei_get_cce_pvcs region=cn-north-4 cluster_id=<cluster_id>
python3 scripts/huawei-cloud.py huawei_get_cce_pvs region=cn-north-4 cluster_id=<cluster_id>

# Inventory cloud resources
python3 scripts/huawei-cloud.py huawei_list_vpc region=cn-north-4
python3 scripts/huawei-cloud.py huawei_list_elb region=cn-north-4
python3 scripts/huawei-cloud.py huawei_list_evs region=cn-north-4

Parameter Reference#

Common Parameters#

ParameterRequiredDescriptionDefaultregionYesHuawei Cloud region (e.g., cn-north-4)-cluster_idYes (most actions)CCE cluster ID-namespaceContext-dependentKubernetes namespace-vpc_idYes (subnet listing)VPC ID for subnet queries-

Common Region IDs#

Region NameRegion IDNorth China - Beijing 4cn-north-4North China - Beijing 1cn-north-1East China - Shanghai 1cn-east-3East China - Shanghai 2cn-east-2South China - Guangzhoucn-south-1South China - Shenzhencn-south-4Southwest China - Guiyang 1cn-southwest-2Asia Pacific - Bangkokap-southeast-2Asia Pacific - Singaporeap-southeast-1Asia Pacific - Hong Kongap-southeast-3Europe - Pariseu-west-0

Output Format#

See Output Schema for the complete JSON response structure.

Key Output Fields:

FieldDescriptionsummaryMigration planning summary with scope descriptionsourceSource region and cluster IDinventory.clustersCCE cluster inventoryinventory.nodepoolsNode pool inventoryinventory.workloadsWorkload inventory (Deployments, Services, Ingresses, etc.)inventory.networkingNetworking inventory (VPC, subnets, security groups, ELB, EIP)inventory.storageStorage inventory (PVC/PV, EVS, SFS/SFS Turbo)inventory.configurationConfiguration inventory (ConfigMaps, Secrets existence only)dependency_matrixDependency relationships (ingress traffic, service calls, storage bindings, config references, external systems)migration_batchesMigration batch design with validation points and downtime windowsrisksRisk list with severity classification and mitigation strategiesrollback_planRollback strategy per batchvalidation_planValidation steps per batch

Verification#

To verify this skill is working correctly:

1. Credential check: Run python3 scripts/huawei-cloud.py huawei_list_cce_clusters region=cn-north-4 and confirm it returns cluster data
2. Workload inventory: Run python3 scripts/huawei-cloud.py huawei_get_cce_deployments region=cn-north-4 cluster_id=<cluster_id> and confirm it returns deployment data
3. Cloud resource inventory: Run python3 scripts/huawei-cloud.py huawei_list_vpc region=cn-north-4 and confirm it returns VPC data
4. Read-only boundary: Verify that no create, delete, scale, migrate, bind, unbind, or modify actions are invoked

Best Practices#

1. Start with scope confirmation: Confirm migration goal (same-region, cross-region, multi-cluster, hybrid cloud, version upgrade, or architecture adjustment) before inventory
2. Full inventory first: Always inventory all resource categories (cluster, workloads, networking, storage, configuration) before building dependency matrix
3. Secret handling: Only record Secret existence, name, and purpose — never output sensitive values
4. Desensitization: All project_id, AK/SK, tokens, and certificates in output must be masked or omitted
5. Dependency matrix: Build dependency matrix covering ingress traffic, service dependencies, storage dependencies, configuration dependencies, and external system dependencies
6. Batch design: Design migration batches with clear validation points, rollback strategies, and downtime windows per batch
7. Manual confirmation: All execution actions must be placed in a manual confirmation checklist — this skill does NOT execute changes
8. Risk assessment: Use huawei-cloud-cce-availability-risk-scanner as a pre-migration health check before finalizing the migration plan

Reference Documents#

DocumentDescriptionWorkflowMigration planning workflow, inventory steps, dependency mapping, and batch design processRisk RulesSafety constraints, prohibited actions, and authorization boundariesOutput SchemaComplete JSON response format for migration planning results

Notes#

• Read-only by design — this skill does NOT create target resources, modify networks, migrate data, or delete source resources
• Secret safety — Secret inventory only records existence, name, and purpose; sensitive values are never exposed
• Desensitization — all project_id, AK/SK, tokens, and certificates in output are masked or omitted
• Manual confirmation — all execution actions are placed in a confirmation checklist; no auto-execution
• All actions are executed via python3 scripts/huawei-cloud.py <action>; do not use hcloud CLI or direct API calls
• Never expose or log AK/SK or environment variable values

Common Pitfalls#

PitfallSymptomQuick FixSkipping dependency mappingMigration batches miss cross-service dependenciesAlways build dependency matrix before batch designExposing Secret valuesOutput contains sensitive Secret dataOnly record Secret existence and name; never output valuesUnmasked credentialsOutput contains project_id, AK/SK, or tokensMask or omit all credential fields in outputMissing cloud resource inventoryMigration plan ignores VPC/ELB/EVS dependenciesInclude all cloud resource categories in inventoryNo rollback strategyMigration batch has no rollback planEvery batch must include a rollback strategy and validation stepsIgnoring downtime windowsMigration plan schedules batches during peak hoursAlign batch design with business downtime windowsAssuming migration can executeSkill attempts to create target resourcesThis skill is read-only; all execution goes to manual confirmation checklistWrong cluster_idAPI returns 404 or empty resultsVerify cluster ID via huawei_list_cce_clustersCredential permission deniedAPI returns 403Check IAM permissions for CCE/VPC/ELB/EVS/SFS read access