Huawei Cloud Cli Guidance

huawei cloud cli guidance

Overview

Huawei Cloud KooCLI command-line tool guidance skill, providing comprehensive KooCLI usage guide. This skill covers core functionalities including KooCLI installation, authentication configuration, command construction, common error troubleshooting, helping users efficiently manage Huawei Cloud resources.

Attention

1. Any issues encountered during the use of koocli must be addressed by prioritizing the guidance steps provided in this skill. [MUST][IMPORTANT] 2. It is essential to read this document in its entirety and make full use of its guidance during the process.[MUST][IMPORTANT]

Prerequisites

• KooCLI Version: 7.2.2 or higher
• Huawei Cloud Account: Valid Huawei Cloud account with corresponding access permissions
• Authentication Credentials: Access Key (AK) and Secret Key (SK) or IAM user credentials
• Network Connection: Accessible Huawei Cloud service endpoints
• Operating System: Linux, macOS, or Windows (WSL supported)

KooCLI Command Format Standard

Huawei Cloud KooCLI adopts a unified command format:

hcloud <service> <operation> [parameters] [options]

Command Structure

• hcloud: Command-line tool name
• <service>: Cloud service name (e.g., ECS, VPC, OBS, etc.)
• <operation>: API operation name (e.g., ListInstances, CreateVpc, etc.)
• [parameters]: Operation parameters (e.g., instance_id, vpc_name, etc.)
• [options]: Global options (e.g., --cli-region, --cli-output, etc.)

Parameter Format Rules

1. Required parameters: Directly specified in the command, e.g., --instance_id i-12345678 2. Optional parameters: Represented with square brackets, e.g., [--description "instance description"] 3. Authentication parameters: Use --cli- prefix, e.g., --cli-profile, --cli-region 4. Output parameters: Use --cli-output to specify output format (json/table/tsv) 5. Query parameters: Use --cli-query to perform JMESPath query filtering

Scenario Routing

Installation Scenario

1. User asks about KooCLI installation → Jump to "1. Install KooCLI" 2. User needs to verify installation → Check version command hcloud version

Authentication Scenario

1. User needs to configure authentication → Jump to "2. Configure koocli" 2. User asks about different authentication modes → Choose Profile mode, explicit parameter mode, etc. based on requirements

Command Execution Scenario

1. User needs to execute specific operations → Guide to use hcloud <service> --help to query available operations 2. User encounters errors → Jump to "8. Common issues" for troubleshooting

Output Formatting Scenario

1. User needs specific format output → Use --cli-output=json/table/tsv 2. User needs to filter results → Use --cli-query for JMESPath querying

Core Commands

refer to '../references/core-commands.md'

Architecture:

Cloud Service OpenAPI
    |
    | ECS API / VPC API / RDS API / OBS API / IAM API ...
    v
Service Metadata JSON API Definition
    |
    | Description:
    | - Service name
    | - API version
    | - Request method GET / POST / PUT / DELETE...
    | - URI path
    | - Request parameters
    | - Response structure
    | - Authentication method
    | - Region and Endpoint
    v
KooCLI Core
    |
    | Read metadata
    | Generate commands
    | Validate parameters
    | Assemble HTTP requests
    | Signature authentication
    | Call OpenAPI
    v
Dynamically Generated Commands
    |
    | hcloud <service name> <API operation name> [parameters]
    v
Unified Execution Engine
    |
    | Execute requests
    | Return results
    v
Huawei Cloud Resource Operation Results

Understand the logic and process of KooCLI managing Huawei Cloud resources. Every time Huawei Cloud service is called or problems are encountered during the process, you must refer to and understand the architecture again, clarifying current steps and subsequent steps. [Required]

Applicable Scenarios

1. Install koocli 2. Configure IAM, AK, SK, region, profile 3. Manage Huawei Cloud resources

1. Install KooCLI

1. Check local version

hcloud version

Expected output: Current KooCLI version: 7.2.2 or higher.

2. One-click installation (skip this step if local version check passes)

# Universal for all platforms
curl -sSL https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/hcloud_install.sh -o ./hcloud_install.sh && bash ./hcloud_install.sh

# Non-interactive installation
curl -sSL https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/hcloud_install.sh -o ./hcloud_install.sh && bash ./hcloud_install.sh -y

After installation completes, check if local installation was successful.

Important: No additional operations allowed!!! Any file content changes must obtain user permission.

If more detailed installation guidance is needed, refer to `./references/installation-guide.md`

2. Configure koocli

Credential Configuration

*After koocli download is complete, ask the user which way they want to use koocli* [Required]

1. koocli provides a configuration-free usage method, only requiring passing current user authentication-related parameters directly in commands.

2. If the user chooses non-interactive method to add configuration items, execute hcloud configure init, guide the user to input each parameter value.

When using koocli to manage Huawei Cloud resources requires other permissions, refer to '../references/iam-policies.md'

3. ecsAgency

When the user has successfully established a delegation to Elastic Cloud Server (ECS), when using KooCLI within the ECS server, you can specify "--cli-mode=ecsAgency" in commands. KooCLI will automatically obtain temporary AK/SK and SecurityToken for authentication based on ECS delegation.

4. AssumeRole

When the delegator user creates a delegation and hands over resources to another account for management, the delegatee can add "--cli-agency-domain-id"/"--cli-agency-domain-name", "--cli-agency-name" and "--cli-source-profile" options to commands, using the configuration-free method to AssumeRole and call cloud service APIs, managing and using the delegator's resources:

hcloud VPC ListAddressGroup/v3 --cli-region="cn-north-4" --project_id="2cc60****************caefa5019ef" --cli-agency-domain-id=13534326******************5cf67b --cli-agency-name=****** --cli-source-profile=test
{
  "request_id": "29ec21****************6d6b4cdd82",
  "address_groups": [],
  "page_info": {
  "current_count": 0
   }
}

5. SSO Login

KooCLI's SSO login command stores user authentication information in configuration files by completing SSO login, avoiding frequent input of these fixed information during operation execution. SSO login can be performed with the following command: hcloud configure sso

# SSO profile name (configuration item name to save after SSO login, required), SSO start URL (user portal URL, required), SSO region (region where IAM Identity Center is opened, required), Region (default or commonly used region, optional)
hcloud configure sso
? Input SSO profile name [required]:  sso
? Input SSO start URL [required]:  https://idcenter.huaweicloud.com/d-3********6/portal
? Input SSO region [required]:  cn-north-4
? Input Region:  cn-north-4
Browser page has been opened, waiting for you to complete SSO login...
? Choose account name: ACCOUNT_01
? Choose permission set name: PERMISSION_01
SSO login successful

6. Authentication Modes

KooCLI configuration item authentication mode values are AKSK, ecsAgency, SSO, AssumeRole. AKSK is recommended. When the configuration item being used has multiple authentication mode-related parameters configured simultaneously, use the "--cli-mode" option to specify the configuration item's authentication mode: >When setting configuration items, you need to specify the configuration item name with "--cli-profile", and also add corresponding authentication parameters based on the authentication mode "--cli-mode": > >If the configuration item's authentication mode is "AKSK", then the values of "--cli-access-key" and "--cli-secret-key" in the configuration command cannot be empty; >If the configuration item's authentication mode is "ecsAgency", then specify "--cli-mode=ecsAgency" in the configuration command; >If the configuration item's authentication mode is "SSO", then the values of "--cli-sso-start-url" and "--cli-sso-region" in the configuration command cannot be empty; >If the configuration item's authentication mode is "AssumeRole", then the values of "--cli-agency-domain-id"/"--cli-agency-domain-name", "--cli-agency-name", "--cli-source-profile" in the configuration command cannot be empty.

7. Authentication Mode Selection

Use and only use one authentication method:

Profile Mode Configuration

# Create dedicated profile
hcloud configure init --cli-profile agent-profile

# View configuration
hcloud configure list

# Execute commands using profile
hcloud <service> <operation> \
  --cli-profile agent-profile \
  --cli-region cn-north-4 \
  --cli-output=json

Explicit Parameter Mode

# Using permanent AK/SK
hcloud <service> <operation> \
  --cli-access-key <AccessKeyId> \
  --cli-secret-key <SecretAccessKey> \
  --cli-region cn-north-4

# Using temporary credentials
hcloud <service> <operation> \
  --cli-access-key <AccessKeyId> \
  --cli-secret-key <SecretAccessKey> \
  --cli-security-token <SecurityToken> \
  --cli-region cn-north-4

Multi-Environment Management

Create independent profiles for different environments:

• dev: Development environment
• test: Test environment
• prod: Production environment

Explicitly specify when calling:

hcloud <service> <operation> \
  --cli-profile dev \
  --cli-region cn-north-4

3. Consult --help before constructing any command

Help output is the authoritative source. [Important]

Execute help output as follows: 1. Use hcloud --help command to query the list of cloud services supported by KooCLI. After obtaining accurate cloud service names, proceed to next step. 2. Use hcloud <service> --help command to query the service's operation list. Find out what operations the service has, obtain the operation the user needs, then continue. 3. Use hcloud <service> <operation> --help to query the help information for the specific cloud service operation. 4. After executing the API call command, print the output result to the user

4. Ensure service availability

When users ask about or want to execute corresponding service management, you should also execute the previous step's help query to ensure the service exists and is available.

5. OBS usage commands

In KooCLI, some functionality of the obsutil tool for managing OBS data via command line has been integrated. Specific functions and commands strictly refer to and execute according to the help output steps mentioned above. If the operation is not found, you need to prompt the user to install obsutil to obtain complete functionality and explain the reason.

* OBS Command Explanation: *

OBS-related commands in KooCLI may exist in two forms:
1. OpenAPI style:
   hcloud OBS <operation>
2. OBS integrated commands / obsutil style:
   hcloud obs <command>
The two have different parameter systems, must check help separately before execution:
hcloud OBS --help
hcloud OBS <operation> --help
hcloud obs help
hcloud obs help <command>

6. Filter and format output

KooCLI supports three output formats: json, table, tsv. Default output is in json format. You can use the "--cli-output" parameter to specify any of the aforementioned output formats, and you can also use the "--cli-query" option with JMESPath expression to perform JMESPath query on json results, filtering out information the user needs.

Output Format Control

# JSON format (recommended for Agent)
hcloud <service> <operation> \
  --cli-profile agent-profile \
  --cli-region cn-north-4 \
  --cli-output=json

# Table format (suitable for manual viewing)
hcloud <service> <operation> \
  --cli-profile agent-profile \
  --cli-region cn-north-4 \
  --cli-output=table

# Text format
hcloud <service> <operation> \
  --cli-profile agent-profile \
  --cli-region cn-north-4 \
  --cli-output=text

JMESPath Filtering

Use --cli-query to extract specific fields:

# Extract specific fields
hcloud <service> <list-operation> \
  --cli-profile agent-profile \
  --cli-region cn-north-4 \
  --cli-output=json \
  --cli-query "items[].{ID:id,Name:name,Status:status}"

# Filter specific status
hcloud <service> <list-operation> \
  --cli-profile agent-profile \
  --cli-region cn-north-4 \
  --cli-output=json \
  --cli-query "items[?status=='ACTIVE'].{ID:id,Name:name,Status:status}"

*Note:* JMESPath query fields must be written according to actual JSON return structure, cannot assume all list interfaces return items.

7. Debugging

When troubleshooting KooCLI command failures, first add --cli-debug=true after the specific execution command to view underlying requests, responses, endpoints, parameter parsing, and authentication-related information.

8. Common issues

KooCLI divides errors encountered during command calls into five types, declaring their specific type at the beginning of error prompt messages. The positioning methods for various errors are as follows:

1. [NETWORK_ERROR]: Usually HTTP request exceptions, please check network connection; 2. [CLI_ERROR]: Usually errors caused by KooCLI's own exceptions during command processing, please contact KooCLI oncall for assistance; 3. [USE_ERROR]: Usually errors caused by incorrect parameters in commands, please make corresponding modifications according to error prompts; 4. [OPENAPI_ERROR]: Usually errors occurring when calling cloud service APIs, please contact relevant cloud service oncall for assistance; 5. [APIE_ERROR]: Usually errors occurring when calling API Explorer to obtain metadata, please contact API Explorer cloud service oncall for assistance.

When encountering errors, query help based on error type and interact with users step by step to resolve.

9. Security

Credential Security

1. Never expose AK/SK values in conversations or commands (echo $ACCESS_KEY_ID is prohibited) 2. Never let users directly input AK/SK in conversations 3. Never use `hcloud configure set` to pass plaintext credentials 4. Only use `hcloud configure list` to check credential status 5. Cloud environments recommend using IAM users rather than main accounts 6. Enable MFA (Multi-Factor Authentication) for sensitive operations

Operation Security

1. Must obtain user confirmation before modification operations (security group rules, restart, deletion, etc.) 2. Prefer read-only APIs, avoid modifying resource status 3. Production environment operations require risk warnings 4. Sensitive information must never appear in report output (AK/SK, passwords, etc.)

Configuration Security

• Use independent profiles for different environments
• Regularly rotate credentials
• Use principle of least privilege
• Clean up temporary profiles
• Encrypt sensitive configuration information

Parameter Verification

Global Parameters

Authentication Parameters

Service-Specific Parameters

Use hcloud <service> <operation> --help to view parameter list for specific operations.

Output Format

KooCLI supports three output formats:

JSON Format (Default)

hcloud ECS ListInstances/v3 --cli-region=cn-north-4 --cli-output=json

Applicable Scenarios: Automated scripts, API integration, data extraction

Table Format

hcloud ECS ListInstances/v3 --cli-region=cn-north-4 --cli-output=table

Applicable Scenarios: Manual viewing, quick browsing

TSV Format

hcloud ECS ListInstances/v3 --cli-region=cn-north-4 --cli-output=tsv

Applicable Scenarios: Import to spreadsheets, data processing

JMESPath Query

hcloud ECS ListInstances/v3 --cli-region=cn-north-4 --cli-output=json --cli-query "servers[?status=='ACTIVE'].{ID:id,Name:name,Status:status}"

Verification Methods

Installation Verification

1. Version check: hcloud version should return 7.2.2 or higher 2. Help verification: hcloud --help should display available service list

Authentication Verification

1. Profile verification: hcloud configure list displays configured profile 2. Permission verification: hcloud IAM ListUsers/v3 --cli-profile <profile> tests IAM permissions

Command Verification

1. Help verification: Execute hcloud <service> --help for each service to confirm available operations 2. Parameter verification: Use --cli-debug=true to view parameter parsing results 3. Response verification: Check HTTP status codes and error messages returned by commands

Environment Verification

1. Network connectivity: curl -s https://ecs.cn-north-4.myhuaweicloud.com tests service endpoint 2. Certificate verification: Ensure system clock synchronization, certificates are valid

Best Practices

Authentication Management

1. Use Profile mode for long-term session management 2. Create independent Profiles for different environments (dev/test/prod) 3. Regularly rotate AK/SK, avoid using the same credentials long-term 4. Use IAM users instead of main account for daily operations

Command Construction

1. First query help: hcloud <service> --help → hcloud <service> <operation> --help 2. Use `--cli-debug=true` for initial command debugging 3. Gradually add parameters, avoid constructing complex commands at once 4. Use `--cli-query` to filter and format output

Error Handling

1. Read error type prefixes: [NETWORK_ERROR], [CLI_ERROR], [USE_ERROR], [OPENAPI_ERROR], [APIE_ERROR] 2. Check network connectivity: for [NETWORK_ERROR] 3. Verify parameter format: for [USE_ERROR] 4. Check API documentation: for [OPENAPI_ERROR]

Performance Optimization

1. Use `--cli-output=json` for automated processing 2. Properly use `--cli-query` to reduce data transfer 3. Use scripts instead of interactive commands for batch operations 4. Cache frequently used configurations to avoid repetitive input

Notes

Usage Limitations

1. Version compatibility: Ensure KooCLI version is compatible with service API versions 2. Regional restrictions: Some services are only available in specific regions 3. API quotas: Pay attention to API call frequency limits 4. Network requirements: Some operations require specific network environments

Common Pitfalls

1. Parameter order: Some services are sensitive to parameter order 2. JSON format: Complex parameters require correct JSON format 3. Region settings: Forgetting to set --cli-region results in operations in default region 4. Output parsing: Table format output may be truncated due to terminal width

Troubleshooting

1. Enable debugging: --cli-debug=true displays detailed request information 2. Check logs: View log files in ~/.hcloud/logs/ 3. Version check: Ensure KooCLI version is up to date 4. Network diagnostics: Use curl to test service endpoint reachability

Reference Documents

• ./references/installation-guide.md — Installation guide
• ./references/cli-troubleshooting.md — Error troubleshooting
• ./references/common-workflows.md — Common workflows
• ./references/parameter-format.md — Parameter format rules
• ./references/service-catalog.md — Service catalog
• ./references/iam-policies.md — IAM policies
• ./references/acceptance-criteria.md — Acceptance criteria
• ./references/core-commands.md — Core commands

Skill Testing Criteria

Overview: >This document explains the pass/fail criteria for testing this skill;

Applicable scope: skill testing

*If any of the following tests fail, it indicates that koocli status is in a partially unavailable state:*

1. ✅ KooCLI Version Check Passed: Confirm KooCLI is correctly installed and version is sufficiently new. Version number is fundamental; if command doesn't exist or version is too old, all subsequent checks are meaningless. 2. ✅ Configuration Check Passed: Example- Profile: default, Mode: AKSK, Region: cn-north-4. Confirm authentication configuration is valid. Without valid AKSK configuration, all API calls will fail. Check profile name, authentication mode, and region to ensure configuration is complete. 3. ✅ IAM Service Connectivity Check Passed: Successfully query user list. IAM is Huawei Cloud's core identity service; if IAM cannot be accessed, it indicates authentication or network issues. Successful user list query proves: >- Authentication is valid (AKSK correct) >- Network connectivity (can access Huawei Cloud API) >- Sufficient permissions (has IAM query permissions) 4. ✅ ECS Service Connectivity Check Passed: Successfully query instance specifications. ECS is the core compute service, testing project-level API. Unlike IAM, ECS requires project_id parameter, verifying: >- Project permission configuration correct >- Cross-service API calls normal >- Complex parameter passing normal 5. ✅ OBS Integration Component Check Passed: obsutil version 5.5.9. OBS is an independent component, verifying integration functionality. OBS uses independent authentication system, checking: >- obsutil component properly integrated >- OBS configuration status >- Component version compatibility

6. ✅ VPC Service Availability Check Passed: Service help normal. Verify service discovery mechanism. Check VPC service help to confirm: >- Service metadata loading normal >- New service APIs discoverable >- Help system working normally

7. ✅ Help System Check Passed: Help command normal. Help system is the foundation for using CLI. Confirm: >- Global help available >- Command syntax queryable >- Foundation for users to solve problems independently

8. ✅ Service Discovery Function Check Passed: Available service list normal. Verify KooCLI can discover all Huawei Cloud services. Ensure: >- Metadata cache normal >- Service list complete >- New services automatically discoverable

9. ✅ Output Format Control Check Passed: Table format output normal. Verify output formatting functionality. Table format is for human reading, confirm: >- Data formatting normal >- Terminal adaptation normal >- Output readability

10. ✅ JSON Output and JMESPath Query Check Passed: Data filtering functionality normal. Verify functionality required for automation scripts. JSON output and JMESPath are: >- Foundation for script processing >- Key for data extraction >- Core of automated operations

11. ✅ Debug Mode Check Passed: dry-run mode normal. Verify debugging and pre-check functionality. dry-run mode: >- Avoids accidental operations >- Checks parameter correctness >- Learns API usage

12. ✅ Skeleton Generation Function Check Passed: JSON parameter skeleton generation normal. Verify complex parameter construction assistance functionality. Skeleton generation: >- Helps understand API parameter structure >- Provides parameter templates >- Reduces usage barrier

13. ✅ Network Connectivity Check Passed: Huawei Cloud API endpoint accessible. Confirm basic network connection. Direct curl test: >- DNS resolution normal >- Network routing normal >- API endpoint reachable

14. ✅ OBS Connectivity Check Passed: OBS service connection normal. Verify OBS independent authentication system. OBS has independent configuration: >- OBS authentication configuration correct >- OBS service endpoint reachable >- OBS command execution normal

15. ✅ Metadata Function Check Passed: Metadata management functionality normal. Verify KooCLI core architecture. Metadata system: >- Is the foundation for KooCLI dynamic API loading >- Affects service discovery and parameter validation >- Requires regular updates

16. ✅ Update Function Check Passed: Currently at latest version. Verify maintenance and upgrade capability. Update function: >- Ensures latest features can be obtained >- Guarantees security patches can be applied >- Verifies version management mechanism

Testing Scope

1. Cover All Critical Paths

• Authentication Path: AKSK configuration → IAM verification
• Service Path: Core services (ECS/VPC) → Extended services (OBS)
• Function Path: Basic commands → Advanced features → Debugging tools
• Network Path: Local → Network → API endpoint → Service response

2. Verify All Usage Scenarios

• Interactive Use: Help, table output, dry-run
• Script Automation: JSON output, JMESPath filtering
• Problem Troubleshooting: Debug mode, network testing
• Learning Exploration: Skeleton generation, service discovery

3. Test All Dependent Components

• CLI Core: Version, help, command parsing
• Authentication System: AKSK, profile, region
• Service Integration: Metadata, API discovery, parameter validation
• Network Components: DNS, routing, endpoint connection
• Output System: Formatting, filtering, encoding

4. Layered Progressive Verification

Layer 1: CLI existence → Layer 2: Authentication validity → 
Layer 3: Core services → Layer 4: Extended services → 
Layer 5: Function features → Layer 6: Network connectivity → 
Layer 7: Maintenance capability

KooCLI Error Troubleshooting and FAQ

Overview

This document provides troubleshooting methods and solutions for common Huawei Cloud KooCLI errors, helping Agents quickly diagnose and resolve issues.

Error Categories and Solutions

1. Installation and Configuration Errors

2. Authentication Errors

Check authentication status:

hcloud configure list

Reconfigure authentication:

hcloud configure set

3. Parameter Errors

View operation help:

hcloud ECS CreateServers --help

4. Resource Errors

5. Network Errors

FAQ Common Questions

Q1: Why doesn't hcloud --version work?

A: This is a known issue with KooCLI. Use hcloud --help to view version information.

Q2: When do VPC operations need /v3 suffix?

A: Security group related operations need /v3 suffix (ListSecurityGroups/v3, ShowSecurityGroup/v3, etc.), VPC and subnet operations don't need it but can have it (ListVpcs/v3 is also valid). EIP operations also need /v3 suffix. ELB also supports /v3 suffix.

Q3: Is EIP a sub-service of VPC?

A: No. EIP is an independent service, use hcloud EIP ... not hcloud VPC ....

Q4: What is the batch operation parameter format?

A: Use --operation.resource_name.index.field=value format:

# Start multiple instances
hcloud ECS NovaStartServers --os-start.servers.1.id=<id1> --os-start.servers.2.id=<id2>

# Delete multiple instances
hcloud ECS DeleteServers --servers.1.id=<id1> --servers.2.id=<id2>

Q5: How to view all parameters for an operation?

A: Use --help:

hcloud ECS CreateServers --help

Q6: How to switch regions?

A: Specify --cli-region=<region> for each command, or set default region:

hcloud configure set --cli-region=cn-north-4

Q7: How to use multiple profiles?

A:

# Create new profile
hcloud configure set --cli-profile=prod

# Use specified profile
hcloud ECS ListServersDetails --cli-profile=prod --cli-region=cn-north-4

Q8: Use KooCLI or obsutil for OBS object storage?

A: Recommended to use obsutil, more complete functionality and better performance.

Q9: Does Ubuntu 22.04 instance allow root SSH by default?

A: Yes. Huawei Cloud Ubuntu 22.04 public images default to PermitRootLogin=yes, PasswordAuthentication=yes. Custom images may differ.

Q10: Can instance types as7/ac7 still be used?

A: No. as7/ac7 series are deprecated, use ac8/as8 series (e.g., ac8.large.2).

Q11: How to specify port range for security group rules?

A: Use multiport parameter to specify single port or port range:

# Single port
--security_group_rule.multiport=22

# Port range
--security_group_rule.multiport=8000-9000

Note: Earlier API versions may use port_range_min and port_range_max, but currently multiport is recommended.

Q13: How to get image ID and flavor ID required for ECS creation?

A: Use the following commands to query available resources:

# Query available images
hcloud ECS ListImages/v2 --cli-region=cn-north-4 --cli-output=json

# Query available flavors
hcloud ECS ListFlavors/v2 --cli-region=cn-north-4 --cli-output=json

# Query available VPCs
hcloud VPC ListVpcs/v3 --cli-region=cn-north-4 --cli-output=json

# Query available subnets
hcloud VPC ListSubnets/v3 --cli-region=cn-north-4 --cli-output=json

Q14: What is the CES monitoring timestamp format?

A: Unix timestamp (seconds) × 1000 (milliseconds):

# Last 1 hour
--from=$(date -d '1 hour ago' +%s)000 --to=$(date +%s)000

Q13: How to get VNC remote console?

A:

hcloud ECS ShowServerRemoteConsole \
  --server_id=<id> \
  --remote_console.protocol=vnc \
  --remote_console.type=novnc \
  --cli-region=<region>
# Open the returned URL in browser

Debugging Tips

1. View Detailed Logs

hcloud ECS ListServersDetails --cli-region=cn-north-4 --cli-debug=true

2. View API Requests

# Output raw HTTP request and response
hcloud ECS ShowServer --server_id=<id> --cli-region=cn-north-4 --cli-output=raw

3. JSON Output Processing

# Process JSON output with jq
hcloud ECS ListServersDetails --cli-region=cn-north-4 --cli-output json | jq '.servers[] | {id: .id, name: .name, status: .status}'

# Or process with Python
hcloud ECS ListServersDetails --cli-region=cn-north-4 --cli-output json | python3 -c "
import sys, json
data = json.load(sys.stdin)
for s in data.get('servers', []):
    print(f\"{s['id'][:12]}  {s['name']:20s}  {s['status']}\")
"

4. Retry Mechanism

# For intermittent errors, can retry
for i in 1 2 3; do
  result=$(hcloud ECS ShowServer --server_id=<id> --cli-region=cn-north-4 2>&1)
  if echo "$result" | grep -q "id"; then
    echo "$result"
    break
  fi
  echo "Retry $i..."
  sleep 2
done

5. Verify Command Format

# First check help to confirm parameters
hcloud <SERVICE> <OPERATION> --help

# Then execute command
hcloud <SERVICE> <OPERATION> --param1=value1 --param2=value2 --cli-region=cn-north-4 --cli-output=json

Error Troubleshooting Process

Step 1: Check Basic Configuration

# Check KooCLI version
hcloud --help

# Check authentication configuration
hcloud configure list

# Check network connection
ping cn-north-4.myhuaweicloud.com

Step 2: Check Command Syntax

# View service list
hcloud help

# View specific service operations
hcloud <SERVICE> help

# View specific operation parameters
hcloud <SERVICE> <OPERATION> --help

Step 3: Enable Debug Mode

# Enable detailed logs
hcloud <SERVICE> <OPERATION> --cli-debug=true --cli-region=cn-north-4

# View raw requests
hcloud <SERVICE> <OPERATION> --cli-output=raw --cli-region=cn-north-4

Step 4: Check Permissions and Resources

# Check IAM permissions
hcloud IAM KeystoneListPermissions --cli-region=cn-north-4

# Check if resource exists
hcloud <SERVICE> Show<Resource> --id=<resource-id> --cli-region=cn-north-4

Step 5: Contact Support

If the above steps cannot resolve the issue: 1. Collect error information and debug logs 2. Check Huawei Cloud service status page

Common Operation Workflows

Overview

This document provides complete CLI workflows for common Huawei Cloud operations, from start to finish. Each workflow includes complete command sequences and parameter explanations.

Workflow 1: Create ECS Instance (Complete Process)

Steps

# 1. View available flavors
hcloud ECS ListFlavors --cli-region=cn-north-4

# 2. View available images (via IMS service)
hcloud IMS ListImages --cli-region=cn-north-4 --limit=10

# 3. View VPC and subnets
hcloud VPC ListVpcs --cli-region=cn-north-4
hcloud VPC ListSubnets --cli-region=cn-north-4

# 4. View security groups
hcloud VPC ListSecurityGroups/v3 --cli-region=cn-north-4

# 5. Create instance
hcloud ECS CreateServers \
  --server.name=my-instance \
  --server.imageRef=<image-id> \
  --server.flavorRef=ac8.large.2 \
  --server.vpcid=<vpc-id> \
  --server.subnet_id=<subnet-id> \
  --server.security_groups.1.id=<sg-id> \
  --server.adminPass=MyP@ssw0rd123! \
  --server.publicip.eip.bandwidth.sharetype=PER \
  --server.publicip.eip.bandwidth.size=5 \
  --server.publicip.eip.bandwidth.charge_mode=bandwidth \
  --cli-region=cn-north-4

# 6. Wait for creation to complete (poll status)
hcloud ECS ShowServer --server_id=<new-id> --cli-region=cn-north-4
# Until status=ACTIVE

# 7. Verify SSH connection
sshpass -p 'MyP@ssw0rd123!' ssh -o StrictHostKeyChecking=no root@<public-ip> "echo OK"

Workflow 2: Create VPC + Subnet + Security Group + Instance

Steps

# 1. Create VPC
hcloud VPC CreateVpc --vpc.name=my-vpc --vpc.cidr=10.0.0.0/16 --cli-region=cn-north-4
# Record returned vpc.id

# 2. Create subnet
hcloud VPC CreateSubnet \
  --subnet.name=my-subnet \
  --subnet.cidr=10.0.1.0/24 \
  --subnet.vpc_id=<vpc-id> \
  --subnet.gateway_ip=10.0.1.1 \
  --cli-region=cn-north-4
# Record returned subnet.id

# 3. Create security group
hcloud VPC CreateSecurityGroup/v3 \
  --security_group.name=my-sg \
  --security_group.vpc_id=<vpc-id> \
  --cli-region=cn-north-4
# Record returned security_group.id

# 4. Add security group rules
# SSH inbound
hcloud VPC CreateSecurityGroupRule/v3 \
  --security_group_id=<sg-id> \
  --security_group_rule.direction=ingress \
  --security_group_rule.protocol=tcp \
  --security_group_rule.multiport=22 \
  --security_group_rule.remote_ip_prefix=0.0.0.0/0 \
  --security_group_rule.description="Allow SSH" \
  --cli-region=cn-north-4

# HTTP inbound
hcloud VPC CreateSecurityGroupRule/v3 \
  --security_group_id=<sg-id> \
  --security_group_rule.direction=ingress \
  --security_group_rule.protocol=tcp \
  --security_group_rule.multiport=80 \
  --security_group_rule.remote_ip_prefix=0.0.0.0/0 \
  --security_group_rule.description="Allow HTTP" \
  --cli-region=cn-north-4

# 5. Create ECS instance (using newly created resources)
hcloud ECS CreateServers \
  --server.name=my-instance \
  --server.imageRef=<image-id> \
  --server.flavorRef=ac8.large.2 \
  --server.vpcid=<vpc-id> \
  --server.subnet_id=<subnet-id> \
  --server.security_groups.1.id=<sg-id> \
  --server.adminPass=MyP@ssw0rd123! \
  --server.publicip.eip.bandwidth.sharetype=PER \
  --server.publicip.eip.bandwidth.size=5 \
  --server.publicip.eip.bandwidth.charge_mode=bandwidth \
  --cli-region=cn-north-4

Workflow 3: Add Security Group Rules to Instance

Steps

# 1. View instance's security groups
hcloud ECS ShowServer --server_id=<instance-id> --cli-region=cn-north-4
# Get sg-id from returned security_groups

# 2. View current rules
hcloud VPC ShowSecurityGroup/v3 --security_group_id=<sg-id> --cli-region=cn-north-4

# 3. Add rule (e.g., add HTTPS)
hcloud VPC CreateSecurityGroupRule/v3 \
  --security_group_id=<sg-id> \
  --security_group_rule.direction=ingress \
  --security_group_rule.protocol=tcp \
  --security_group_rule.multiport=443 \
  --security_group_rule.remote_ip_prefix=0.0.0.0/0 \
  --security_group_rule.description="Allow HTTPS" \
  --cli-region=cn-north-4

# 4. Verify rule is effective
hcloud VPC ShowSecurityGroup/v3 --security_group_id=<sg-id> --cli-region=cn-north-4

# 5. Test port connectivity
nc -zv <public-ip> 443

Workflow 4: Bind/Unbind Elastic Public IP

Bind EIP to Instance

# 1. Apply for EIP
hcloud EIP CreatePublicip/v3 \
  --publicip.type=EIP \
  --bandwidth.name=my-eip-bw \
  --bandwidth.size=5 \
  --bandwidth.share_type=PER \
  --bandwidth.charge_mode=bandwidth \
  --cli-region=cn-north-4
# Record returned publicip_id and publicip_address

# 2. Bind to instance
hcloud EIP AssociatePublicip/v3 \
  --publicip_id=<eip-id> \
  --publicip_associate.instance_id=<instance-id> \
  --publicip_associate.instance_type=ECS \
  --cli-region=cn-north-4

# 3. Verify binding
hcloud EIP ListPublicips/v3 --cli-region=cn-north-4

Unbind and Release EIP

# 1. Unbind
hcloud EIP DisassociatePublicip/v3 \
  --publicip_id=<eip-id> \
  --cli-region=cn-north-4

# 2. Release EIP
hcloud EIP DeletePublicip/v3 \
  --publicip_id=<eip-id> \
  --cli-region=cn-north-4

Workflow 5: Expand Cloud Disk

Steps

# 1. View current cloud disks
hcloud EVS ListVolumes --cli-region=cn-north-4

# 2. View disk details
hcloud EVS ShowVolume --volume_id=<vol-id> --cli-region=cn-north-4

# 3. Expand (online expansion, no downtime required)
hcloud EVS ExtendVolume \
  --volume_id=<vol-id> \
  --volume.size=<new-size-gb> \
  --cli-region=cn-north-4

# 4. SSH login to extend filesystem
sshpass -p '<password>' ssh root@<ip> "
  # View disks
  lsblk
  # Expand partition (e.g., /dev/vda1)
  growpart /dev/vda 1
  # Extend filesystem
  resize2fs /dev/vda1   # ext4
  # or xfs_growfs /       # xfs
"

Workflow 6: Clean Up Resources (Delete Instance + Release Resources)

Steps

# 1. List all instances
hcloud ECS ListServersDetails --cli-region=cn-north-4

# 2. Delete instance (simultaneously release EIP and cloud disk)
hcloud ECS DeleteServers \
  --servers.1.id=<instance-id> \
  --delete_publicip=true \
  --delete_volume=true \
  --cli-region=cn-north-4

# 3. Confirm deletion completed
hcloud ECS ListServersDetails --cli-region=cn-north-4

# 4. Clean up security group (if no longer needed)
hcloud VPC DeleteSecurityGroup/v3 \
  --security_group_id=<sg-id> \
  --cli-region=cn-north-4

# 5. Clean up VPC and subnet (if no longer needed)
hcloud VPC DeleteSubnet --vpc_id=<vpc-id> --subnet_id=<subnet-id> --cli-region=cn-north-4
hcloud VPC DeleteVpc --vpc_id=<vpc-id> --cli-region=cn-north-4

Workflow 7: View Monitoring Metrics

Steps

# 1. View available metrics
hcloud CES ListMetrics --namespace=SYS.ECS --cli-region=cn-north-4

# 2. View CPU utilization (last 1 hour)
hcloud CES ShowMetricData \
  --namespace=SYS.ECS \
  --metric_name=cpu_util \
  --dim.0=instance_id,<instance-id> \
  --from=$(date -d '1 hour ago' +%s)000 \
  --to=$(date +%s)000 \
  --period=300 \
  --filter=average \
  --cli-region=cn-north-4

# 3. View memory utilization
hcloud CES ShowMetricData \
  --namespace=SYS.ECS \
  --metric_name=mem_util \
  --dim.0=instance_id,<instance-id> \
  --from=$(date -d '1 hour ago' +%s)000 \
  --to=$(date +%s)000 \
  --period=300 \
  --filter=average \
  --cli-region=cn-north-4

# 4. View disk utilization
hcloud CES ShowMetricData \
  --namespace=SYS.ECS \
  --metric_name=disk_util_inband \
  --dim.0=instance_id,<instance-id> \
  --dim.1=name,/dev/vda1 \
  --from=$(date -d '1 hour ago' +%s)000 \
  --to=$(date +%s)000 \
  --period=300 \
  --filter=average \
  --cli-region=cn-north-4

# 5. View alarms
hcloud CES ListAlarms --cli-region=cn-north-4

Workflow 8: SSH Deep Diagnostics

Prerequisites

• Instance has public IP
• Security group allows port 22
• Know root password

Steps

# 1. Basic connection test
sshpass -p '<password>' ssh -o StrictHostKeyChecking=no root@<ip> "echo OK"

# 2. System overview
sshpass -p '<password>' ssh -o StrictHostKeyChecking=no root@<ip> "
  echo '=== System ===' && uname -a
  echo '=== Uptime ===' && uptime
  echo '=== Memory ===' && free -h
  echo '=== Disk ===' && df -h
  echo '=== CPU ===' && nproc
"

# 3. Network check
sshpass -p '<password>' ssh -o StrictHostKeyChecking=no root@<ip> "
  echo '=== Interfaces ===' && ip addr show
  echo '=== Routes ===' && ip route show
  echo '=== Listening ===' && ss -tlnp
  echo '=== Firewall ===' && (iptables -L -n 2>/dev/null || firewall-cmd --list-all 2>/dev/null)
"

# 4. Process check
sshpass -p '<password>' ssh -o StrictHostKeyChecking=no root@<ip> "
  echo '=== Top CPU ===' && ps aux --sort=-%cpu | head -10
  echo '=== Top Mem ===' && ps aux --sort=-%mem | head -10
  echo '=== Failed ===' && systemctl list-units --state=failed
"

# 5. Log check
sshpass -p '<password>' ssh -o StrictHostKeyChecking=no root@<ip> "
  echo '=== Errors ===' && (tail -200 /var/log/syslog 2>/dev/null || tail -200 /var/log/messages 2>/dev/null) | grep -i 'error\\|fail' | tail -20
"

Use VNC when SSH fails

# Get VNC console URL
hcloud ECS ShowServerRemoteConsole \
  --server_id=<instance-id> \
  --remote_console.protocol=vnc \
  --remote_console.type=novnc \
  --cli-region=cn-north-4
# Open URL in browser for console operations

Usage Instructions

Common Parameters

All commands require the following parameters:

• --cli-region=<region>: Specify region (e.g., cn-north-4)
• --cli-profile=<profile>: Specify configuration profile (optional)
• --cli-output=json: Specify JSON output format (recommended)

Variable Substitution

All <placeholder> need to be replaced with actual values:

• <image-id>: Image ID
• <vpc-id>: VPC ID
• <subnet-id>: Subnet ID
• <sg-id>: Security group ID
• <instance-id>: Instance ID
• <vol-id>: Cloud disk ID
• <eip-id>: Elastic public IP ID
• <ip>: Instance public IP
• <password>: Instance root password

Security Considerations

1. Use strong passwords (e.g., MyP@ssw0rd123!) 2. Restrict security group rule source IPs 3. Regularly rotate credentials 4. Delete unused resources

Huawei Cloud KooCLI Core Commands

Overview

This document provides comprehensive examples of Huawei Cloud KooCLI core commands for managing cloud resources. These commands follow the standard format: hcloud <service> <operation> [parameters] [options].

Command Structure Rules

Basic Command Format

hcloud <SERVICE> <OPERATION> [--parameter=value] [--cli-option=value]

Authentication Options

# Profile mode (recommended for repeated use)
hcloud <SERVICE> <OPERATION> --cli-profile=<profile> --cli-region=<region>

# Explicit parameter mode (one-time use)
hcloud <SERVICE> <OPERATION> --cli-access-key=<AK> --cli-secret-key=<SK> --cli-region=<region>

# ECS Agency mode (when running on ECS with agency)
hcloud <SERVICE> <OPERATION> --cli-mode=ecsAgency --cli-region=<region>

Output Format Options

# JSON format (default, recommended for automation)
hcloud <SERVICE> <OPERATION> --cli-output=json

# Table format (human readable)
hcloud <SERVICE> <OPERATION> --cli-output=table

# TSV format (for spreadsheet import)
hcloud <SERVICE> <OPERATION> --cli-output=tsv

# With JMESPath query filtering
hcloud <SERVICE> <OPERATION> --cli-output=json --cli-query="items[?status=='ACTIVE']"

Compute Services

ECS (Elastic Cloud Server)

Instance Management

# List all instances
hcloud ECS ListServersDetails --cli-region=cn-north-4 --cli-output=json

# Get instance details
hcloud ECS ShowServer --server_id=i-12345678 --cli-region=cn-north-4

# Create instance
hcloud ECS CreateServers \
  --server.name=my-instance \
  --server.imageRef=img-ubuntu-22-04 \
  --server.flavorRef=ac8.large.2 \
  --server.vpcid=vpc-12345678 \
  --server.subnet_id=subnet-12345678 \
  --server.adminPass=MySecurePass123! \
  --server.security_groups.1.id=sg-12345678 \
  --server.publicip.eip.bandwidth.sharetype=PER \
  --server.publicip.eip.bandwidth.size=5 \
  --server.publicip.eip.bandwidth.charge_mode=bandwidth \
  --cli-region=cn-north-4 \
  --cli-output=json

# Delete instance
hcloud ECS DeleteServers \
  --servers.1.id=i-12345678 \
  --delete_publicip=true \
  --delete_volume=true \
  --cli-region=cn-north-4

# Instance operations
hcloud ECS NovaStartServers --os-start.servers.1.id=i-12345678 --cli-region=cn-north-4
hcloud ECS NovaStopServers --os-stop.servers.1.id=i-12345678 --cli-region=cn-north-4
hcloud ECS NovaRebootServers --os-reboot.servers.1.id=i-12345678 --cli-region=cn-north-4

# Remote console access
hcloud ECS ShowServerRemoteConsole \
  --server_id=i-12345678 \
  --remote_console.protocol=vnc \
  --remote_console.type=novnc \
  --cli-region=cn-north-4

# List available flavors
hcloud ECS ListFlavors --cli-region=cn-north-4 --cli-output=json

CCE (Cloud Container Engine)

Cluster Management

# List clusters
hcloud CCE ListClusters --cli-region=cn-north-4 --cli-output=json

# Get cluster details
hcloud CCE ShowCluster --cluster_id=cluster-12345678 --cli-region=cn-north-4

# Create cluster
hcloud CCE CreateCluster \
  --metadata.name=my-cluster \
  --spec.type=VirtualMachine \
  --spec.version=v1.25 \
  --spec.flavor=cce.s2.small \
  --spec.hostNetwork.vpc_id=vpc-12345678 \
  --spec.hostNetwork.subnet_id=subnet-12345678 \
  --cli-region=cn-north-4 \
  --cli-output=json

# List nodes in cluster
hcloud CCE ListNodes --cluster_id=cluster-12345678 --cli-region=cn-north-4

Network Services

VPC (Virtual Private Cloud)

VPC Management

# List VPCs
hcloud VPC ListVpcs --cli-region=cn-north-4 --cli-output=json

# Get VPC details
hcloud VPC ShowVpc --vpc_id=vpc-12345678 --cli-region=cn-north-4

# List subnets
hcloud VPC ListSubnets --vpc_id=vpc-12345678 --cli-region=cn-north-4

# Get subnet details
hcloud VPC ShowSubnet --subnet_id=subnet-12345678 --cli-region=cn-north-4

Security Group Management

# List security groups (v3 API)
hcloud VPC ListSecurityGroups/v3 --cli-region=cn-north-4 --cli-output=json

# Get security group details
hcloud VPC ShowSecurityGroup/v3 --security_group_id=sg-12345678 --cli-region=cn-north-4

# List security group rules
hcloud VPC ListSecurityGroupRules/v3 --security_group_id.1=sg-12345678 --cli-region=cn-north-4

# Create security group rule
hcloud VPC CreateSecurityGroupRule/v3 \
  --security_group_id=sg-12345678 \
  --security_group_rule.direction=ingress \
  --security_group_rule.protocol=tcp \
  --security_group_rule.multiport=22 \
  --security_group_rule.remote_ip_prefix=0.0.0.0/0 \
  --security_group_rule.description="Allow SSH" \
  --cli-region=cn-north-4

# Delete security group rule
hcloud VPC DeleteSecurityGroupRule/v3 --security_group_rule_id=rule-12345678 --cli-region=cn-north-4

EIP (Elastic IP)

EIP Management

# List EIPs (v3 API)
hcloud EIP ListPublicips/v3 --cli-region=cn-north-4 --cli-output=json

# Create EIP
hcloud EIP CreatePublicip/v3 \
  --publicip.type=EIP \
  --bandwidth.name=my-eip \
  --bandwidth.size=5 \
  --bandwidth.share_type=PER \
  --bandwidth.charge_mode=bandwidth \
  --cli-region=cn-north-4

# Associate EIP with instance
hcloud EIP AssociatePublicip/v3 \
  --publicip_id=eip-12345678 \
  --publicip_associate.instance_id=i-12345678 \
  --publicip_associate.instance_type=ECS \
  --cli-region=cn-north-4

# Disassociate EIP
hcloud EIP DisassociatePublicip/v3 --publicip_id=eip-12345678 --cli-region=cn-north-4

# Delete EIP
hcloud EIP DeletePublicip/v3 --publicip_id=eip-12345678 --cli-region=cn-north-4

Storage Services

EVS (Elastic Volume Service)

Volume Management

# List volumes
hcloud EVS ListVolumes --cli-region=cn-north-4 --cli-output=json

# Get volume details
hcloud EVS ShowVolume --volume_id=vol-12345678 --cli-region=cn-north-4

# Create volume
hcloud EVS CreateVolume \
  --volume.name=my-volume \
  --volume.size=100 \
  --volume.volume_type=SSD \
  --volume.availability_zone=cn-north-4a \
  --cli-region=cn-north-4

# Attach volume to instance
hcloud EVS AttachVolume \
  --volume_id=vol-12345678 \
  --server_id=i-12345678 \
  --device=/dev/vdb \
  --cli-region=cn-north-4

# Detach volume
hcloud EVS DetachVolume \
  --volume_id=vol-12345678 \
  --server_id=i-12345678 \
  --cli-region=cn-north-4

# Extend volume size
hcloud EVS ExtendVolume \
  --volume_id=vol-12345678 \
  --volume.size=200 \
  --cli-region=cn-north-4

Database Services

RDS (Relational Database Service)

Instance Management

# List RDS instances
hcloud RDS ListInstances --cli-region=cn-north-4 --cli-output=json

# Get instance details
hcloud RDS ShowInstance --instance_id=rds-12345678 --cli-region=cn-north-4

# Create RDS instance
hcloud RDS CreateInstance \
  --name=my-rds \
  --datastore.type=MySQL \
  --datastore.version=8.0 \
  --flavor_ref=rds.mysql.s1.large \
  --volume.type=ULTRAHIGH \
  --volume.size=100 \
  --availability_zone=cn-north-4a,cn-north-4b \
  --vpc_id=vpc-12345678 \
  --subnet_id=subnet-12345678 \
  --security_group_id=sg-12345678 \
  --password=MySecurePass123! \
  --cli-region=cn-north-4

# List backups
hcloud RDS ListBackups --instance_id=rds-12345678 --cli-region=cn-north-4

Security Services

IAM (Identity and Access Management)

User Management

# List users
hcloud IAM KeystoneListUsers --cli-region=cn-north-4 --cli-output=json

# Get user details
hcloud IAM KeystoneShowUser --user_id=user-12345678 --cli-region=cn-north-4

# List policies
hcloud IAM ListPolicies --cli-region=cn-north-4 --cli-output=json

# Get policy details
hcloud IAM ShowPolicy --policy_id=policy-12345678 --cli-region=cn-north-4

# List roles
hcloud IAM ListRoles --cli-region=cn-north-4 --cli-output=json

# List groups
hcloud IAM ListGroups --cli-region=cn-north-4 --cli-output=json

Monitoring Services

CES (Cloud Eye Service)

Metric Management

# List metrics
hcloud CES ListMetrics --namespace=SYS.ECS --cli-region=cn-north-4 --cli-output=json

# Get metric data
hcloud CES ShowMetricData \
  --namespace=SYS.ECS \
  --metric_name=cpu_util \
  --dim.0=instance_id,i-12345678 \
  --from=1704067200000 \
  --to=1704153600000 \
  --period=300 \
  --filter=average \
  --cli-region=cn-north-4 \
  --cli-output=json

# List alarms
hcloud CES ListAlarms --cli-region=cn-north-4 --cli-output=json

# Get alarm details
hcloud CES ShowAlarm --alarm_id=alarm-12345678 --cli-region=cn-north-4

Best Practices for Core Commands

1. Always Use Help Command First

# Check available services
hcloud --help

# Check operations for a specific service
hcloud ECS --help

# Check parameters for a specific operation
hcloud ECS ListServersDetails --help

2. Use JSON Output for Automation

# Always use --cli-output=json for script processing
hcloud ECS ListServersDetails --cli-region=cn-north-4 --cli-output=json

3. Filter Results with JMESPath

# Filter active instances
hcloud ECS ListServersDetails \
  --cli-region=cn-north-4 \
  --cli-output=json \
  --cli-query="servers[?status=='ACTIVE'].{ID:id,Name:name,Status:status,Flavor:flavor.name}"

# Filter by tag
hcloud ECS ListServersDetails \
  --cli-region=cn-north-4 \
  --cli-output=json \
  --cli-query="servers[?tags[?Key=='Environment' && Value=='production']]"

4. Use Debug Mode for Troubleshooting

# Enable debug mode to see request/response details
hcloud ECS ListServersDetails --cli-region=cn-north-4 --cli-debug=true

5. Batch Operations

# Batch start instances
hcloud ECS NovaStartServers \
  --os-start.servers.1.id=i-12345678 \
  --os-start.servers.2.id=i-23456789 \
  --os-start.servers.3.id=i-34567890 \
  --cli-region=cn-north-4

# Batch stop instances
hcloud ECS NovaStopServers \
  --os-stop.servers.1.id=i-12345678 \
  --os-stop.servers.2.id=i-23456789 \
  --cli-region=cn-north-4

6. Parameter Validation

# Use --dry-run to validate parameters without execution
hcloud ECS CreateServers \
  --server.name=test-instance \
  --server.imageRef=img-ubuntu-22-04 \
  --server.flavorRef=ac8.large.2 \
  --cli-region=cn-north-4 \
  --dry-run

7. Script Examples

Create Instance with Variables

#!/bin/bash

# Define variables
INSTANCE_NAME="my-instance"
IMAGE_ID="img-ubuntu-22-04"
FLAVOR="ac8.large.2"
VPC_ID="vpc-12345678"
SUBNET_ID="subnet-12345678"
SG_ID="sg-12345678"
REGION="cn-north-4"

# Create instance
hcloud ECS CreateServers \
  --server.name="${INSTANCE_NAME}" \
  --server.imageRef="${IMAGE_ID}" \
  --server.flavorRef="${FLAVOR}" \
  --server.vpcid="${VPC_ID}" \
  --server.subnet_id="${SUBNET_ID}" \
  --server.security_groups.1.id="${SG_ID}" \
  --server.adminPass="$(openssl rand -base64 16)" \
  --cli-region="${REGION}" \
  --cli-output=json

Monitor Instance Status

#!/bin/bash

INSTANCE_ID="i-12345678"
REGION="cn-north-4"

# Get instance status
hcloud ECS ShowServer \
  --server_id="${INSTANCE_ID}" \
  --cli-region="${REGION}" \
  --cli-output=json \
  --cli-query="server.status"

Common Command Patterns

Resource Creation Pattern

1. Check prerequisites (VPC, subnet, security group) 2. Validate parameters using --help and --dry-run 3. Create resource with detailed configuration 4. Verify creation by querying resource status

Resource Update Pattern

1. Get current configuration 2. Prepare update parameters 3. Apply changes with validation 4. Verify update success

Resource Deletion Pattern

1. Check dependencies (attached resources) 2. Confirm deletion (use --dry-run) 3. Execute deletion with cleanup options 4. Verify deletion and cleanup

Error Handling Examples

Handle API Errors

# Use --cli-debug to see detailed error information
hcloud ECS ListServersDetails --cli-region=invalid-region --cli-debug=true

Validate Before Execution

# Check if instance exists before operations
INSTANCE_STATUS=$(hcloud ECS ShowServer --server_id=i-12345678 --cli-region=cn-north-4 --cli-output=json --cli-query="server.status" 2>/dev/null || echo "NOT_FOUND")

if [ "$INSTANCE_STATUS" = "ACTIVE" ]; then
    echo "Instance is active, proceeding with operation..."
    # Perform operation
elif [ "$INSTANCE_STATUS" = "NOT_FOUND" ]; then
    echo "Instance not found, cannot proceed."
    exit 1
else
    echo "Instance status: $INSTANCE_STATUS"
fi

Command Reference Quick Links

For complete command reference, see:

• ./references/service-catalog.md - Full service catalog with commands
• ./references/parameter-format.md - Parameter format rules
• ./references/common-workflows.md - Common operation workflows
• ./references/cli-troubleshooting.md - Error troubleshooting guide

IAM Permission Policies

Overview:

This document explains the permissions required for this skill based on IAM service;

Applicable scope: IAM permission policies, authentication, koocli, cli

Required Permissions

This skill guides users in using koocli to manage Huawei Cloud resources, including installation, configuration initialization, formatted output, etc. Installing koocli itself does not require IAM permissions. Using KooCLI to call Huawei Cloud APIs requires assigning permissions according to operation type. Specific permission assignment follows these steps: *Important:* 1. Prioritize using Huawei Cloud official skills to manage Huawei Cloud resources, read the corresponding ../references/iam-policies documents in Huawei Cloud official skills, and authorize as needed 2. When there is no corresponding Huawei Cloud skill, you must query help syntax to obtain corresponding command and service permission information, and authorize as needed according to help prompts.

*For all IAM function commands, you must first query help syntax to get corresponding commands, do not guess syntax structure*

# View all service help information
hcloud --help

# View all IAM service operations
hcloud IAM --help

# View detailed help for specific operation
hcloud IAM <operation> --help

# Generate parameter skeleton
hcloud IAM <operation> --skeleton

# Debug mode
hcloud IAM <operation> <parameters> --dryrun
hcloud IAM <operation> <parameters> --cli-debug

Permission failure handling process (MUST): 1. When any command fails due to permission error, read references/iam-policies-en.md 2. Show user the required permission list and policy JSON 3. Guide user to create custom policy and authorize in IAM console 4. Pause execution, wait for user confirmation that permissions have been granted

IAM Security Practices

To help you securely control access to Huawei Cloud resources, please follow recommendations for secure IAM usage.

1. Do not create access keys for Huawei account 2. Do not embed access keys in code 3. Create separate IAM users

If anyone needs to access resources in your Huawei account, do not share your account password with them. Instead, create separate IAM users in your account and assign appropriate permissions. Also, as the Huawei account owner, it is recommended that you do not use the account to access Huawei Cloud, but create an IAM user for yourself and grant administrative permissions to that user. Use this IAM user instead of the account for daily management work to protect account security.

4. Reasonably set access methods IAM supports setting programming access and management console access methods for users. Please refer to the following instructions to set access methods for IAM users:

• If IAM user only needs to log into management console to access cloud services, it is recommended to choose management console access, credential type as password.
• If IAM user only needs programming access to Huawei Cloud services, it is recommended to choose programming access, credential type as access key.
• If IAM user needs to use password as credential for programming access (some APIs require), it is recommended to choose programming access, credential type as password.
• If IAM user needs to verify access keys (entered by IAM user) in their console when using some cloud services, it is recommended to choose both programming access and management console access, credential type as password and access key. For example, when IAM user creates data migration using Cloud Data Migration (CDM) service in console, identity verification through access keys is required.

5. Grant minimum permissions 6. Enable virtual MFA function 7. Set strong password policy 8. Set sensitive operations 9. Regularly modify identity credentials 10. Delete unnecessary identity credentials 11. Use ECS delegation for applications running on ECS instances 12. Enable Cloud Trace Service

Secure Access

You can use IAM to generate identity credentials for users or applications, without sharing your account password with others. The system will allow users to securely access resources in your account through permission information carried in identity credentials.

Eventual Consistency

Eventual consistency means that operations you perform in IAM, such as creating users and user groups, authorizing user groups, etc., may have delayed effect due to IAM replicating data between various servers in Huawei Cloud data centers and implementing multi-region data synchronization. It is recommended that you confirm that submitted policy modifications have taken effect before performing operations.

Huawei Cloud KooCLI Installation Guide

Overview

Huawei Cloud KooCLI (hcloud) is the official Huawei Cloud command-line tool that supports managing 100+ cloud services. This guide provides complete installation, configuration, and verification processes.

Version Requirements

• Minimum version: One major version before the latest major version (e.g., if current is 7.x.x, then not lower than 6.x.x)
• Latest version: Refer to https://support.huaweicloud.com/wtsnew-hcli/index.html
• Verification command: hcloud version
• Update command: hcloud update

Quick Installation (All Platforms)

One-click Installation

# Download and run official installation script (interactive)
curl -sSL https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/hcloud_install.sh -o ./hcloud_install.sh && bash ./hcloud_install.sh

# Non-interactive installation (skip confirmation)
curl -sSL https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/hcloud_install.sh -o ./hcloud_install.sh && bash ./hcloud_install.sh -y

Verify Installation

# Check version
hcloud version
# Expected output: Current KooCLI version: 7.2.2

# Check help
hcloud --help

Installation Methods for Each Platform

1. Linux Systems

Detect System Architecture

echo $HOSTTYPE
# x86_64: AMD 64-bit system
# aarch64: ARM 64-bit system

Step-by-step Installation

# AMD 64-bit system
curl -LO "https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/huaweicloud-cli-linux-amd64.tar.gz"
tar -zxvf huaweicloud-cli-linux-amd64.tar.gz
sudo mv hcloud /usr/local/bin/

# ARM 64-bit system
curl -LO "https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/huaweicloud-cli-linux-arm64.tar.gz"
tar -zxvf huaweicloud-cli-linux-arm64.tar.gz
sudo mv hcloud /usr/local/bin/

2. macOS Systems

Detect System Architecture

echo $HOSTTYPE
# If empty, use:
uname -a
# x86_64: AMD 64-bit system (Intel chips)
# arm64: ARM 64-bit system (Apple Silicon)

Step-by-step Installation

# Intel chips (AMD 64-bit)
curl -LO "https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/huaweicloud-cli-mac-amd64.tar.gz"
tar -zxvf huaweicloud-cli-mac-amd64.tar.gz
sudo mv hcloud /usr/local/bin/

# Apple Silicon (ARM 64-bit)
curl -LO "https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/huaweicloud-cli-mac-arm64.tar.gz"
tar -zxvf huaweicloud-cli-mac-arm64.tar.gz
sudo mv hcloud /usr/local/bin/

3. Windows Systems

Installation Steps

1. Download: https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/huaweicloud-cli-windows-amd64.zip 2. Extract ZIP file to get hcloud.exe 3. Add the directory containing hcloud.exe to PATH environment variable

Verify Installation

hcloud version
# Expected output: Current KooCLI version: 7.2.2

4. Docker Environment

Using Official Image

# Pull and run
docker run --rm -it swr.cn-north-4.myhuaweicloud.com/huawei-cloud/koocli:latest version

Custom Image

FROM ubuntu:latest
RUN apt-get update -y && apt-get install curl -y
RUN curl -sSL https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/hcloud_install.sh -o ./hcloud_install.sh && bash ./hcloud_install.sh -y
WORKDIR /workspace
ENTRYPOINT ["/usr/local/bin/hcloud"]

Build and use:

# Build image
docker build -t hcloudcli .

# Run command
docker run --rm -it hcloudcli version

Post-installation Configuration

Auto-completion Configuration

# Enable auto-completion
hcloud auto-complete on

# Reload shell configuration
# Bash: source ~/.bashrc
# Zsh: source ~/.zshrc

Multi-environment Configuration

# Create development environment configuration
hcloud configure init --cli-profile dev

# Create test environment configuration
hcloud configure init --cli-profile test

# Create production environment configuration
hcloud configure init --cli-profile prod

# View all configurations
hcloud configure list

# Use specific configuration
hcloud ECS NovaListServers --cli-profile=dev --cli-region=cn-north-4

Troubleshooting

Common Installation Issues

Insufficient Permissions

# Linux/macOS: Use sudo
sudo bash ./hcloud_install.sh

# Or install to user directory
curl -sSL https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/hcloud_install.sh -o ./hcloud_install.sh && bash ./hcloud_install.sh -d ~/.local/bin

Command Not Found

# Check PATH
echo $PATH
which hcloud

# Manually add to PATH
export PATH=$PATH:/usr/local/bin
# Or
export PATH=$PATH:$(pwd)

sha256sum Command Not Found

# Ubuntu/Debian:
sudo apt-get install coreutils

# CentOS/RHEL:
sudo yum install coreutils

# macOS:
brew install coreutils

Network Issues

# Test network connection
ping cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com

# Use proxy
export http_proxy=http://proxy:port
export https_proxy=http://proxy:port

Updates and Maintenance

Update KooCLI

# Interactive update
hcloud update

# Or reinstall latest version
curl -sSL https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/hcloud_install.sh -o ./hcloud_install.sh && bash ./hcloud_install.sh -y

Uninstall KooCLI

# Linux/macOS manual uninstallation:
sudo rm -f /usr/local/bin/hcloud
sudo rm -rf /usr/local/hcloud/
rm -rf ~/.hcloud/

# Windows manual uninstallation:
# 1. Delete hcloud.exe file
# 2. Remove relevant directory from PATH
# 3. Delete C:\Users\{username}\.hcloud\ directory

Clean Cache

# Clean KooCLI cache
rm -rf ~/.hcloud/cache/

# Clean downloaded files
rm -f hcloud_install.sh huaweicloud-cli-*.tar.gz huaweicloud-cli-*.zip

Best Practices

Version Management

• Use fixed versions for production environments
• Use latest versions for test environments
• Record installed version numbers

Environment Isolation

• Create independent configurations for different environments
• Use environment variables to store sensitive information
• Regularly backup configuration files

Automated Deployment

#!/bin/bash
set -e

# Download installation script
curl -sSL https://cn-north-4-hdn-koocli.obs.cn-north-4.myhuaweicloud.com/cli/latest/hcloud_install.sh -o ./hcloud_install.sh

# Install KooCLI
bash ./hcloud_install.sh -y

# Verify installation
hcloud version

Docker Best Practices

# Use volume to persist configuration
docker run --rm -it \
  -v ~/.hcloud:/root/.hcloud \
  swr.cn-north-4.myhuaweicloud.com/huawei-cloud/koocli:latest \
  version

# Create alias to simplify usage
alias hcloud-docker='docker run --rm -it -v ~/.hcloud:/root/.hcloud swr.cn-north-4.myhuaweicloud.com/huawei-cloud/koocli:latest'

Version Compatibility

• KooCLI 7.2.2+: Supports --cli-x-project-id parameter
• KooCLI 6.2.4+: Supports --cli-auth-type parameter
• KooCLI 5.3.4+: Supports SSO configuration parameters

---

Tip: This guide provides complete KooCLI installation and configuration processes. Please strictly follow security rules to protect credential security.

KooCLI Parameter Format Rules and Examples

Overview

KooCLI parameter formats have strict rules, and format errors are the most common CLI usage issues. This document details various parameter formats.

Parameter Type Overview

1. Scalar Parameters

Most basic parameter type, directly --key=value format.

# String
--server_id=3d1537a9-9090-4045-8a83-cc6f2c5bc4ac
--name=my-instance
--description="My ECS instance"

# Number
--limit=10
--offset=0
--bandwidth.size=5

# Boolean
--delete_publicip=true
--delete_volume=false

⚠️ Note: When values contain spaces or special characters, wrap with quotes:

# Correct
--description="Allow SSH from office"

# Error (shell will split spaces)
--description=Allow SSH from office

2. Array Parameters

Array parameters use 1-based indexing (not 0!).

Basic Arrays

# Security group ID array (VPC rule query)
--security_group_id.1=sg-abc123
--security_group_id.1=sg-abc123 --security_group_id.2=sg-def456

# Instance ID array (batch operations)
--servers.1.id=i-001 --servers.2.id=i-002 --servers.3.id=i-003

# Batch start
hcloud ECS NovaStartServers \
  --os-start.servers.1.id=i-001 \
  --os-start.servers.2.id=i-002 \
  --cli-region=cn-north-4

# Batch stop
hcloud ECS NovaStopServers \
  --os-stop.servers.1.id=i-001 \
  --os-stop.servers.2.id=i-002 \
  --cli-region=cn-north-4

# Batch reboot
hcloud ECS NovaRebootServers \
  --os-reboot.servers.1.id=i-001 \
  --os-reboot.servers.2.id=i-002 \
  --cli-region=cn-north-4

Batch Delete

hcloud ECS DeleteServers \
  --servers.1.id=i-001 \
  --servers.2.id=i-002 \
  --delete_publicip=true \
  --delete_volume=true \
  --cli-region=cn-north-4

Dimension Arrays (CES monitoring)

# Single dimension
--dim.0=instance_id,i-001

# Double dimension (disk metrics need instance_id + name)
--dim.0=instance_id,i-001 --dim.1=name,/dev/vda1

3. Nested Object Parameters

Nested objects use dot-separated hierarchical paths.

VNC Remote Console

hcloud ECS ShowServerRemoteConsole \
  --server_id=i-001 \
  --remote_console.protocol=vnc \
  --remote_console.type=novnc \
  --cli-region=cn-north-4

Security Group Rule Creation

hcloud VPC CreateSecurityGroupRule/v3 \
  --security_group_id=sg-001 \
  --security_group_rule.direction=ingress \
  --security_group_rule.protocol=tcp \
  --security_group_rule.multiport=22 \
  --security_group_rule.remote_ip_prefix=0.0.0.0/0 \
  --security_group_rule.description="Allow SSH" \
  --cli-region=cn-north-4

Create Instance (server nested object)

hcloud ECS CreateServers \
  --server.name=my-instance \
  --server.imageRef=img-001 \
  --server.flavorRef=ac8.large.2 \
  --server.vpcid=vpc-001 \
  --server.subnet_id=subnet-001 \
  --server.adminPass=MyP@ssw0rd \
  --server.security_groups.1.id=sg-001 \
  --server.publicip.eip.bandwidth.sharetype=PER \
  --server.publicip.eip.bandwidth.size=5 \
  --server.publicip.eip.bandwidth.charge_mode=bandwidth \
  --cli-region=cn-north-4

EIP Binding

hcloud EIP AssociatePublicip/v3 \
  --publicip_id=eip-001 \
  --publicip_associate.instance_id=i-001 \
  --publicip_associate.instance_type=ECS \
  --cli-region=cn-north-4

4. V3 Operation Suffix

Some VPC service operations require /v3 suffix, which distinguishes API versions.

Operations Requiring /v3 Suffix

Operations Not Requiring /v3 Suffix

EIP Service Also Needs /v3

5. Enumeration Value Reference

Instance Status

EIP Status

Security Group Rule Direction

Security Group Rule Protocol

CES Metric Filter

CES Metric Period

Bandwidth Sharing Type

Bandwidth Billing Mode

6. Common Format Errors

7. Parameter Format Checklist

Check Steps

1. Service name uppercase: hcloud ECS not hcloud ecs 2. Operation name correct: ListServersDetails not ListServers 3. Parameter name correct: Use --help to view exact parameter names 4. Array indexing starts from 1: --servers.1.id not --servers.0.id 5. Nested objects use dots: --server.name not --server[name] 6. Boolean values explicit: --delete_publicip=true not --delete_publicip 7. Strings with quotes: --description="My instance" when containing spaces 8. V3 suffix: Security group and EIP operations need /v3

Verification Commands

# View operation help to confirm parameters
hcloud <SERVICE> <OPERATION> --help

# Test command (not actually executed)
hcloud <SERVICE> <OPERATION> --dry-run --cli-region=cn-north-4

# View parameter list
hcloud <SERVICE> <OPERATION> --list-parameters --cli-region=cn-north-4

8. Best Practices

Parameter Organization

# Organize parameters by functional groups
hcloud ECS CreateServers \
  # Basic parameters
  --server.name=my-instance \
  --server.imageRef=img-001 \
  --server.flavorRef=ac8.large.2 \
  --server.adminPass=MyP@ssw0rd \
  # Network parameters
  --server.vpcid=vpc-001 \
  --server.subnet_id=subnet-001 \
  --server.security_groups.1.id=sg-001 \
  # EIP parameters
  --server.publicip.eip.bandwidth.sharetype=PER \
  --server.publicip.eip.bandwidth.size=5 \
  --server.publicip.eip.bandwidth.charge_mode=bandwidth \
  # System parameters
  --cli-region=cn-north-4 \
  --cli-output=json

Variable Usage

# Use variables for better readability
INSTANCE_NAME="my-instance"
IMAGE_ID="img-001"
VPC_ID="vpc-001"
SUBNET_ID="subnet-001"
SG_ID="sg-001"

hcloud ECS CreateServers \
  --server.name="${INSTANCE_NAME}" \
  --server.imageRef="${IMAGE_ID}" \
  --server.vpcid="${VPC_ID}" \
  --server.subnet_id="${SUBNET_ID}" \
  --server.security_groups.1.id="${SG_ID}" \
  --cli-region=cn-north-4

Error Debugging

# Enable debug mode
hcloud <SERVICE> <OPERATION> \
  --cli-debug=true \
  --cli-region=cn-north-4

# View raw requests
hcloud <SERVICE> <OPERATION> \
  --cli-output=raw \
  --cli-region=cn-north-4

Huawei Cloud Full Service Catalog and Command Quick Reference

Overview

KooCLI v7.2.2+ supports the following 100+ cloud services. Categorized by functional domain, listing service codes and common operations.

🔲 Compute

ECS - Elastic Cloud Server

hcloud ECS ListServersDetails --cli-region=<r>          # List instances
hcloud ECS ShowServer --server_id=<id> --cli-region=<r>  # Instance details
hcloud ECS NovaShowServer --server_id=<id> --cli-region=<r>  # Nova details
hcloud ECS CreateServers --server.name=<n> ... --cli-region=<r>  # Create instance
hcloud ECS DeleteServers --servers.1.id=<id> --delete_publicip=true --delete_volume=true --cli-region=<r>  # Delete instance
hcloud ECS NovaStartServers --os-start.servers.1.id=<id> --cli-region=<r>  # Start
hcloud ECS NovaStopServers --os-stop.servers.1.id=<id> --cli-region=<r>   # Stop
hcloud ECS NovaRebootServers --os-reboot.servers.1.id=<id> --cli-region=<r>  # Reboot
hcloud ECS ShowServerRemoteConsole --server_id=<id> --remote_console.protocol=vnc --remote_console.type=novnc --cli-region=<r>  # VNC console
hcloud ECS ListFlavors --cli-region=<r>                  # Available flavors
hcloud ECS NovaListVersions --cli-region=<r>             # API versions

BMS - Bare Metal Server

hcloud BMS ListServersDetails --cli-region=<r>
hcloud BMS ShowServer --server_id=<id> --cli-region=<r>

AS - Auto Scaling

hcloud AS ListScalingGroups --cli-region=<r>
hcloud AS ShowScalingGroup --scaling_group_id=<id> --cli-region=<r>
hcloud AS CreateScalingGroup --cli-region=<r>

CCE - Cloud Container Engine

hcloud CCE ListClusters --cli-region=<r>
hcloud CCE ShowCluster --cluster_id=<id> --cli-region=<r>
hcloud CCE CreateCluster --cli-region=<r>
hcloud CCE ListNodes --cluster_id=<id> --cli-region=<r>

CCI - Cloud Container Instance

hcloud CCI ListNamespaces --cli-region=<r>

FunctionGraph - FunctionGraph

hcloud FunctionGraph ListFunctions --cli-region=<r>
hcloud FunctionGraph ShowFunction --function_urn=<urn> --cli-region=<r>

🌐 Network

VPC - Virtual Private Cloud

hcloud VPC ListVpcs --cli-region=<r>                     # List VPCs
hcloud VPC ShowVpc --vpc_id=<id> --cli-region=<r>        # VPC details
hcloud VPC ListSubnets --cli-region=<r>                   # List subnets
hcloud VPC ShowSubnet --subnet_id=<id> --cli-region=<r>   # Subnet details
hcloud VPC ListSecurityGroups/v3 --cli-region=<r>         # Security group list
hcloud VPC ShowSecurityGroup/v3 --security_group_id=<id> --cli-region=<r>  # Security group details
hcloud VPC ListSecurityGroupRules/v3 --security_group_id.1=<id> --cli-region=<r>  # Security group rules
hcloud VPC CreateSecurityGroupRule/v3 --security_group_id=<id> --security_group_rule.direction=ingress --security_group_rule.protocol=tcp --security_group_rule.multiport=<port> --security_group_rule.remote_ip_prefix=<cidr> --cli-region=<r>  # Add rule
hcloud VPC DeleteSecurityGroupRule/v3 --security_group_rule_id=<rule-id> --cli-region=<r>  # Delete rule

EIP - Elastic IP

hcloud EIP ListPublicips/v3 --cli-region=<r>
hcloud EIP CreatePublicip/v3 --publicip.type=EIP --bandwidth.name=<n> --bandwidth.size=5 --bandwidth.share_type=PER --bandwidth.charge_mode=bandwidth --cli-region=<r>
hcloud EIP AssociatePublicip/v3 --publicip_id=<eip> --publicip_associate.instance_id=<ecs> --publicip_associate.instance_type=ECS --cli-region=<r>
hcloud EIP DisassociatePublicip/v3 --publicip_id=<eip> --cli-region=<r>
hcloud EIP DeletePublicip/v3 --publicip_id=<eip> --cli-region=<r>

ELB - Elastic Load Balancer

hcloud ELB ListLoadBalancers --cli-region=<r>
hcloud ELB ShowLoadBalancer --loadbalancer_id=<id> --cli-region=<r>
hcloud ELB ListListeners --loadbalancer_id=<id> --cli-region=<r>
hcloud ELB ListPools --loadbalancer_id=<id> --cli-region=<r>

NAT - NAT Gateway

hcloud NAT ListNatGateways --cli-region=<r>
hcloud NAT ShowNatGateway --nat_gateway_id=<id> --cli-region=<r>

DNS - Domain Name Service

hcloud DNS ListPublicZones --cli-region=<r>
hcloud DNS ListPrivateZones --type=private --cli-region=<r>
hcloud DNS ShowPublicZone --zone_id=<id> --cli-region=<r>
hcloud DNS ListRecordSets --zone_id=<id> --cli-region=<r>

VPN - Virtual Private Network

hcloud VPN ListVpnGateways --cli-region=<r>
hcloud VPN ShowVpnGateway --vpn_gateway_id=<id> --cli-region=<r>

ER - Enterprise Router

hcloud ER ListInstances --cli-region=<r>
hcloud ER ShowInstance --instance_id=<id> --cli-region=<r>

CFW - Cloud Firewall

hcloud CFW ListFirewalls --cli-region=<r>

💾 Storage

EVS - Elastic Volume Service

hcloud EVS ListVolumes --cli-region=<r>
hcloud EVS ShowVolume --volume_id=<id> --cli-region=<r>
hcloud EVS CreateVolume --volume.name=<n> --volume.size=<gb> --volume.volume_type=SSD --volume.availability_zone=<az> --cli-region=<r>
hcloud EVS AttachVolume --volume_id=<id> --server_id=<ecs-id> --cli-region=<r>
hcloud EVS DetachVolume --volume_id=<id> --server_id=<ecs-id> --cli-region=<r>
hcloud EVS ExtendVolume --volume_id=<id> --volume.size=<new-gb> --cli-region=<r>

CBR - Cloud Backup and Recovery

hcloud CBR ListVaults --cli-region=<r>
hcloud CBR ShowVault --vault_id=<id> --cli-region=<r>

SFSTurbo - Scalable File Service

hcloud SFSTurbo ListShares --cli-region=<r>
hcloud SFSTurbo ShowShare --share_id=<id> --cli-region=<r>

🗄️ Database

RDS - Relational Database Service

hcloud RDS ListInstances --cli-region=<r>
hcloud RDS ShowInstance --instance_id=<id> --cli-region=<r>
hcloud RDS ListBackups --instance_id=<id> --cli-region=<r>
hcloud RDS CreateInstance --cli-region=<r>

GaussDB - Distributed Database

hcloud GaussDB ListInstances --cli-region=<r>
hcloud GaussDB ShowInstance --instance_id=<id> --cli-region=<r>

GaussDBforNoSQL - NoSQL Database

hcloud GaussDBforNoSQL ListInstances --cli-region=<r>

GaussDBforopenGauss - openGauss

hcloud GaussDBforopenGauss ListInstances --cli-region=<r>

DCS - Distributed Cache Service

hcloud DCS ListInstances --cli-region=<r>
hcloud DCS ShowInstance --instance_id=<id> --cli-region=<r>

DDS - Document Database Service

hcloud DDS ListInstances --cli-region=<r>

DRS - Data Replication Service

hcloud DRS ListJobs --cli-region=<r>

🔒 Security

IAM - Identity and Access Management

hcloud IAM KeystoneListUsers --cli-region=<r>
hcloud IAM KeystoneShowUser --user_id=<id> --cli-region=<r>
hcloud IAM ListPolicies --cli-region=<r>
hcloud IAM ShowPolicy --policy_id=<id> --cli-region=<r>
hcloud IAM ListRoles --cli-region=<r>
hcloud IAM ListGroups --cli-region=<r>

HSS - Host Security Service

hcloud HSS ListHosts --cli-region=<r>

WAF - Web Application Firewall

hcloud WAF ListInstances --cli-region=<r>

KMS - Key Management Service

hcloud KMS ListKeys --cli-region=<r>
hcloud KMS ShowKey --key_id=<id> --cli-region=<r>

Anti-DDoS - Anti-DDoS

hcloud Anti-DDoS ListConfigs --cli-region=<r>

CTS - Cloud Trace Service

hcloud CTS ListTraces --cli-region=<r>

CSMS - Cloud Secret Management Service

hcloud CSMS ListSecrets --cli-region=<r>

📊 Monitoring and Operations

CES - Cloud Eye Service

hcloud CES ListMetrics --namespace=SYS.ECS --cli-region=<r>
hcloud CES ShowMetricData --namespace=SYS.ECS --metric_name=cpu_util --dim.0=instance_id,<id> --from=<ts>000 --to=<ts>000 --period=300 --filter=average --cli-region=<r>
hcloud CES ListAlarms --cli-region=<r>
hcloud CES ShowAlarm --alarm_id=<id> --cli-region=<r>

LTS - Log Tank Service

hcloud LTS ListLogGroups --cli-region=<r>
hcloud LTS ListLogStreams --group_id=<id> --cli-region=<r>

AOM - Application Operations Management

hcloud AOM ListApplications --cli-region=<r>

Config - Config Audit

hcloud Config ListResources --cli-region=<r>

📨 Messaging and Notification

SMN - Simple Message Notification

hcloud SMN ListTopics --cli-region=<r>
hcloud SMN ShowTopic --topic_urn=<urn> --cli-region=<r>
hcloud SMN ListSubscriptions --topic_urn=<urn> --cli-region=<r>

Kafka - Distributed Message Kafka

hcloud Kafka ListInstances --cli-region=<r>

RabbitMQ - Distributed Message RabbitMQ

hcloud RabbitMQ ListInstances --cli-region=<r>

RocketMQ - Distributed Message RocketMQ

hcloud RocketMQ ListInstances --cli-region=<r>

🔧 Development Tools

APIG - API Gateway

hcloud APIG ListInstances --cli-region=<r>
hcloud APIG ListApis --instance_id=<id> --cli-region=<r>

CSE - Cloud Service Engine

hcloud CSE ListEngines --cli-region=<r>

CodeArts Series

hcloud CodeArtsRepo ListRepositories --cli-region=<r>
hcloud CodeArtsBuild ListBuildRecords --cli-region=<r>
hcloud CodeArtsPipeline ListPipelines --cli-region=<r>
hcloud CodeArtsDeploy ListDeployTasks --cli-region=<r>

🧠 Big Data and AI

ModelArts

hcloud ModelArts ListNotebooks --cli-region=<r>
hcloud ModelArts ListTrainingJobs --cli-region=<r>

DLI - Data Lake Insight

hcloud DLI ListQueues --cli-region=<r>

DWS - Data Warehouse Service

hcloud DWS ListClusters --cli-region=<r>

MRS - MapReduce Service

hcloud MRS ListClusters --cli-region=<r>

DIS - Data Ingestion Service

hcloud DIS ListStreams --cli-region=<r>

📺 Media

VOD - Video on Demand

hcloud VOD ListAssets --cli-region=<r>

Live - Live Streaming

hcloud Live ListDomains --cli-region=<r>

MPC - Media Processing Center

hcloud MPC ListTranscodingTasks --cli-region=<r>

🏢 Enterprise and Management

EPS - Enterprise Project

hcloud EPS ListEnterpriseProjects --cli-region=<r>

Organizations - Organization Management

hcloud Organizations ListAccounts --cli-region=<r>

TMS - Tag Management Service

hcloud TMS ListTags --resource_type=ecs --cli-region=<r>

RMS - Resource Management Service

hcloud RMS ListResources --cli-region=<r>

⚠️ Services Not Supported by KooCLI

The following services require console or other dedicated CLI tools:

Usage Instructions

Parameter Description

• <r>: Region (e.g., cn-north-4)
• <id>: Resource ID
• <n>: Name
• <urn>: Resource URN
• <az>: Availability Zone
• <ts>: Unix timestamp (seconds) ×1000

Common Parameters

All commands require the following parameters:

• --cli-region=<region>: Specify region
• --cli-profile=<profile>: Specify configuration profile (optional)
• --cli-output=json: Specify JSON output format (recommended)

Service Category Description

• Compute: Virtual machines, containers, functions, and other compute resources
• Network: VPC, EIP, load balancer, and other network services
• Storage: Cloud disks, backup, file storage, etc.
• Database: Relational, NoSQL, cache, and other databases
• Security: IAM, firewall, key management, etc.
• Monitoring and Operations: Monitoring, logging, auditing, etc.
• Messaging and Notification: Message queues, notification services
• Development Tools: API gateway, microservices, CI/CD
• Big Data and AI: Data lake, data warehouse, AI services
• Media: Video on demand, live streaming, media processing
• Enterprise and Management: Enterprise projects, organization management, tag management

Quick Search

• Use hcloud help to view all services
• Use hcloud <service> help to view service operations
• Use hcloud <service> <operation> --help to view operation parameters

Best Practices

1. Always use --cli-region parameter to specify region 2. Use --cli-output=json for easier program parsing 3. Use --help to view operation parameters 4. Use --cli-debug=true to debug errors 5. Use --cli-query to filter JSON output