Huawei Cloud Ucs Policy Governor

Huawei Cloud UCS Policy Governor

Overview

This skill provides policy governance and compliance management capabilities for Huawei Cloud UCS (Universal Cloud Service) using the hcloud CLI, covering policy instance lifecycle, policy definitions, policy enforcement, and compliance auditing.

Architecture: hcloud CLI → UCS Service API → PolicyInstance/PolicyDefinition/PolicyJob resources

Related Skills:

• huawei-cloud-ucs-cluster-onboarding-manager - Cluster registration, lifecycle, fleet grouping, and access management

Capabilities:

• Create policy instances for clusters or fleet groups
• Update, query, and delete policy instances
• List and query policy definitions (templates)
• Enable and disable policies on clusters or fleet groups
• Check policy enforcement job status via ListPolicyJobs/ShowPolicyJob
• Audit fleet compliance and review policy enforcement results

Typical Use Cases:

• "Create a security policy instance for my production cluster"
• "Create a compliance policy for my fleet group"
• "List all available policy definitions"
• "Enable a policy on cluster 'prod-backend'"
• "Enable a policy on fleet group 'production-fleet'"
• "Disable a policy temporarily for maintenance"
• "Check policy enforcement job status"
• "Audit policy enforcement across all clusters"
• "Update a policy instance configuration"
• "Delete an obsolete policy instance"
• "Query policy definition details before applying"

Prerequisites

1. hcloud CLI Requirements (MANDATORY)

• hcloud CLI installed (version >= 7.2.2)
• Run hcloud version to verify installation
• First-time usage: printf "y\n" | hcloud version to accept privacy statement

2. Credential Configuration

hcloud CLI supports two credential modes via environment variables, automatically detected at runtime:

Mode A — Long-term AK/SK (permanent access):

export HUAWEI_CLOUD_AK=<your-ak>
export HUAWEI_CLOUD_SK=<your-sk>
export HUAWEI_CLOUD_REGION=cn-north-4

Mode B — Temporary AK/SK + SecurityToken (recommended for temporary or delegated access):

export HUAWEI_CLOUD_AK=<your-temp-ak>
export HUAWEI_CLOUD_SK=<your-temp-sk>
export HUAWEI_CLOUD_SECURITY_TOKEN=<your-security-token>
export HUAWEI_CLOUD_REGION=cn-north-4

When HUAWEI_CLOUD_SECURITY_TOKEN is present, hcloud CLI automatically uses temporary credential authentication. When only AK/SK are set, it uses long-term credential authentication.

• Security Rules:
• 🚫 Never expose AK/SK/SecurityToken values in code, conversation, or commands
• 🚫 Never use echo $HUAWEI_CLOUD_AK or echo $HUAWEI_CLOUD_SK to check credentials
• ✅ Use environment variables: HUAWEI_CLOUD_AK, HUAWEI_CLOUD_SK, HUAWEI_CLOUD_REGION, HUAWEI_CLOUD_SECURITY_TOKEN
• ✅ Prefer IAM users over root account for cloud operations
• ✅ Enable MFA for sensitive operations

⚠️ Important Security Notes:

• Never commit credentials to version control
• Use IAM users with minimal required permissions
• Enable MFA for sensitive operations
• Rotate AK/SK regularly

3. IAM Permission Requirements

See IAM Permission Policies for complete policy JSON.

Permission Failure Handling:

1. When any command fails due to permission errors, read references/iam-policies.md 2. Display the required permission list and policy JSON to the user 3. Guide the user to create a custom policy in the IAM console and grant authorization 4. Pause execution and wait for user confirmation that permissions have been granted

Core Commands

1. Policy Instance Management

See Task: Policy Management for detailed workflows.

# Create a cluster-level policy instance
hcloud UCS CreateClusterPolicyInstance --clusterid=<ucs-cluster-id> --constraintTemplateID=<template-id> --enforcementAction=deny --namespaces.1=default --namespaces.2=production --parameters='{"maxReplicas":"3"}' --cli-region=cn-north-4

# Create a fleet group-level policy instance
hcloud UCS CreateClusterGroupPolicyInstance --clustergroupid=<fleet-group-id> --constraintTemplateID=<template-id> --enforcementAction=warn --parameters='{"cpuLimit":"2"}' --cli-region=cn-north-4

# Update a policy instance
hcloud UCS UpdatePolicyInstance --policyinstanceid=<instance-id> --constraintTemplateID=<new-template-id> --enforcementAction=warn --parameters='{"cpuLimit":"4"}' --cli-region=cn-north-4

# Show policy instance details
hcloud UCS ShowPolicyInstance --policyinstanceid=<instance-id> --cli-region=cn-north-4

# Delete a policy instance
hcloud UCS DeletePolicyInstance --policyinstanceid=<instance-id> --cli-region=cn-north-4

# List all policy instances (no filter parameters available)
hcloud UCS ListPolicyInstances --cli-region=cn-north-4

2. Policy Definition Management

# List all available policy definitions (no filter parameters available)
hcloud UCS ListPolicyDefinitions --cli-region=cn-north-4

# Show policy definition details
hcloud UCS ShowPolicyDefinition --policydefinitionid=<definition-id> --cli-region=cn-north-4

3. Policy Enforcement (Enable/Disable)

# Enable a policy on a cluster
hcloud UCS EnableClusterPolicy --clusterid=<ucs-cluster-id> --cli-region=cn-north-4

# Enable a policy on a fleet group
hcloud UCS EnableClusterGroupPolicy --clustergroupid=<fleet-group-id> --cli-region=cn-north-4

# Enable a policy on a cluster with retry
hcloud UCS EnableClusterPolicy --clusterid=<ucs-cluster-id> --retry=true --cli-region=cn-north-4

# Disable a policy on a cluster
hcloud UCS DisableClusterPolicy --clusterid=<ucs-cluster-id> --cli-region=cn-north-4

# Disable a policy on a fleet group
hcloud UCS DisableClusterGroupPolicy --clustergroupid=<fleet-group-id> --cli-region=cn-north-4

4. Policy Enforcement Job Status

See Task: Compliance Audit for detailed workflows.

# List policy enforcement jobs
hcloud UCS ListPolicyJobs --cli-region=cn-north-4

# List policy enforcement jobs filtered by kind
hcloud UCS ListPolicyJobs --kind=EnablePolicy --cli-region=cn-north-4

# Show a specific policy enforcement job
hcloud UCS ShowPolicyJob --jobid=<job-id> --cli-region=cn-north-4

Parameter Reference

Common Parameters

Policy Instance Parameters

*Note: --clusterid is required for cluster-level operations (CreateClusterPolicyInstance, EnableClusterPolicy, DisableClusterPolicy). --clustergroupid is required for fleet group-level operations (CreateClusterGroupPolicyInstance, EnableClusterGroupPolicy, DisableClusterGroupPolicy).

Policy Definition Parameters

Policy Job Parameters

Output Format

CreateClusterPolicyInstance / CreateClusterGroupPolicyInstance

[to be verified — UCS responses follow k8s-style format based on verified ShowClusterList/ListPolicyDefinitions patterns]

UCS API returns Kubernetes-style objects, not flat JSON. Based on verified ShowClusterList and ListPolicyDefinitions responses, policy instance responses likely use a k8s-style object structure with kind, apiVersion, metadata, spec, and status fields rather than flat fields like id, constraintTemplateID, enforcementAction.

Key Fields (expected, format to be verified):

• Instance UUID: Likely in metadata.uid (not flat id)
• Constraint template reference: Likely in spec.constraintTemplateID
• Enforcement action: Likely in spec.enforcementAction (warn or deny)
• Status: Likely in status.phase (Enabled, Disabled, Pending)

ListPolicyDefinitions

Response Example (verified):

{
  "items": [
    {
      "kind": "ConstraintTemplate",
      "apiVersion": "templates.gatekeeper.sh/v1beta1",
      "metadata": {
        "name": "k8srequiredresources",
        "uid": "3b900254-0086-11ee-924e-0255ac1000d3",
        "creationTimestamp": "2023-06-01T14:11:41Z",
        "annotations": {
          "name-chinese": "K8sRequiredResources",
          "tag-chinese": "集群安全策略",
          "description-chinese": "..."
        }
      },
      "spec": {
        "type": "general",
        "officialTag": "ClusterSecurityPolicies",
        "level": "1",
        "targetKind": "Pod",
        "official": true,
        "description": "Requires containers to have defined resources set...",
        "constraintTemplate": {
          "kind": "ConstraintTemplate",
          "apiVersion": "templates.gatekeeper.sh/v1",
          "metadata": { "name": "k8srequiredresources" },
          "spec": {
            "crd": {
              "spec": {
                "names": { "kind": "K8sRequiredResources" },
                "validation": { "openAPIV3Schema": { "properties": {} } }
              }
            },
            "targets": [
              {
                "target": "admission.k8s.gatekeeper.sh",
                "rego": "...",
                "libs": []
              }
            ]
          }
        }
      }
    }
  ]
}

Key Fields:

• metadata.name: Constraint template name (used as constraintTemplateID in CreateClusterPolicyInstance, not flat id)
• metadata.uid: Definition UUID
• spec.officialTag: Policy category/tag (not flat category)
• spec.level: Severity level (not flat severity)
• spec.targetKind: Target resource type (e.g., Pod)
• spec.description: Policy description
• spec.constraintTemplate.spec.crd.spec.validation.openAPIV3Schema.properties: Parameter definitions (not flat parameters array)
• spec.type: Policy type (e.g., general)
• spec.official: Whether this is an official (built-in) policy

ListPolicyJobs

Response Example (verified for empty result):

When no jobs exist, returns { "items": null }. When populated, likely k8s-style objects based on verified UCS pattern:

{
  "items": null
}

[to be verified for populated response — likely k8s-style objects with kind, apiVersion, metadata, spec, status fields]

Key Fields (expected, format to be verified):

• Job UUID: Likely in metadata.uid (not flat jobid)
• Job type: Likely in spec.kind (EnablePolicy, etc.)
• Job status: Likely in status.phase (Success, Failed, InProgress)

Verification

See Verification Method for step-by-step verification.

Common Region IDs

Best Practices

1. Policy Parameters: Use --constraintTemplateID to reference constraint templates, not --policy_definition_id 2. Fleet-Level Policies: Apply policies to fleet groups using CreateClusterGroupPolicyInstance for consistent enforcement 3. Gradual Rollout: Enable policies on staging clusters first using EnableClusterPolicy, then roll out to production fleet groups using EnableClusterGroupPolicy 4. Compliance Monitoring: Use ListPolicyJobs and ShowPolicyJob to monitor enforcement task status 5. Enforcement Action: Choose warn for initial rollout (violations reported but not blocked), then switch to deny for strict enforcement 6. Disable Before Delete: Disable a policy using DisableClusterPolicy/DisableClusterGroupPolicy before deleting to prevent sudden enforcement gaps 7. Namespace Scoping: Use --namespaces.[N] to scope policy enforcement to specific namespaces

Reference Documents

Notes

• Policy deletion is irreversible — the enforcement configuration is permanently removed
• Disabling a policy suspends enforcement — violations are not checked while the policy is disabled
• Fleet group policies apply to all member clusters — ensure group membership is correct before applying
• AK/SK must never be hardcoded — credentials should only be obtained via environment variables
• hcloud CLI is the only supported method — all operations use hcloud UCS <Operation> format
• CreatePolicyInstance is TWO separate operations — use CreateClusterPolicyInstance for cluster-level and CreateClusterGroupPolicyInstance for fleet group-level policies
• Enable/Disable are scope-specific — use EnableClusterPolicy/DisableClusterPolicy for clusters and EnableClusterGroupPolicy/DisableClusterGroupPolicy for fleet groups
• GetPolicyAssignment does not exist — use ListPolicyJobs and ShowPolicyJob to check enforcement task status
• ListPolicyInstances and ListPolicyDefinitions have no filter parameters — only --cli-region is available

Common Pitfalls

See Common Pitfalls & Solutions for detailed troubleshooting guides.

Quick Reference:

Common Pitfalls & Solutions

This document contains detailed troubleshooting guides for common issues encountered when using the Huawei Cloud UCS Policy Governor skill.

Pitfall 1: Policy Definition/Template ID Not Found

Symptom: CreateClusterPolicyInstance or CreateClusterGroupPolicyInstance fails with PolicyDefinitionNotFound error

Root Cause: Using an invalid or non-existent constraint template ID

Solution: Always list available definitions before creating a policy instance:

# List all available policy definitions
hcloud UCS ListPolicyDefinitions --cli-region=cn-north-4

# Show specific definition details to verify it exists
hcloud UCS ShowPolicyDefinition --policydefinitionid=<definition-id> --cli-region=cn-north-4

Use the id field from ListPolicyDefinitions response as the --constraintTemplateID parameter.

Pitfall 2: Using Wrong Create Operation for the Scope

Symptom: CreatePolicyInstance fails or creates policy at wrong scope level

Root Cause: UCS has TWO separate create operations: CreateClusterPolicyInstance (for cluster-level) and CreateClusterGroupPolicyInstance (for fleet group-level). Using the wrong one or using a non-existent CreatePolicyInstance causes errors.

Solution: Choose the correct operation based on your target scope:

# ✅ CORRECT - Target a specific cluster
hcloud UCS CreateClusterPolicyInstance --clusterid=<ucs-cluster-id> --constraintTemplateID=<template-id> --enforcementAction=deny --cli-region=cn-north-4

# ✅ CORRECT - Target a fleet group
hcloud UCS CreateClusterGroupPolicyInstance --clustergroupid=<fleet-group-id> --constraintTemplateID=<template-id> --enforcementAction=warn --cli-region=cn-north-4

# ❌ WRONG - CreatePolicyInstance does not exist
hcloud UCS CreatePolicyInstance --name=my-policy --policy_definition_id=<def-id> --cli-region=cn-north-4

Pitfall 3: Cluster Not Registered in UCS

Symptom: EnableClusterPolicy fails with ClusterNotRegistered error

Root Cause: The target cluster has not been registered to UCS, or the cluster ID used is a CCE cluster ID instead of a UCS cluster ID

Solution:

1. Register the cluster to UCS first (use huawei-cloud-ucs-cluster-onboarding-manager skill):

hcloud UCS RegisterCluster --name=my-cluster --cluster_type=CCE --cluster_id=<cce-cluster-id> --cli-region=cn-north-4

2. Use the UCS-assigned cluster ID (not the CCE cluster ID) for policy operations:

# ✅ CORRECT - Use UCS cluster ID
hcloud UCS EnableClusterPolicy --clusterid=<ucs-cluster-id> --cli-region=cn-north-4

# ❌ WRONG - Using CCE cluster ID
hcloud UCS EnableClusterPolicy --clusterid=<cce-cluster-id> --cli-region=cn-north-4

Pitfall 4: Fleet Group Has No Member Clusters

Symptom: Policy created for a fleet group but enforcement shows no compliance results

Root Cause: The fleet group has no member clusters assigned. Policy governance applies to clusters that are part of the fleet group.

Solution: Ensure clusters are registered and assigned to the fleet group before applying group-level policies. Use the huawei-cloud-ucs-cluster-onboarding-manager skill to register clusters and create fleet groups.

Pitfall 5: Cannot Change Target Scope After Creation

Symptom: Attempting to change clusterid or clustergroupid via update fails

Root Cause: Target scope (clusterid/clustergroupid) is immutable after creation

Solution: To change the scope: 1. Delete the existing policy instance 2. Create a new policy instance with the desired scope

# 1. Delete old instance
hcloud UCS DeletePolicyInstance --policyinstanceid=<old-instance-id> --cli-region=cn-north-4

# 2. Create new instance with different scope
hcloud UCS CreateClusterGroupPolicyInstance --clustergroupid=<new-group-id> --constraintTemplateID=<template-id> --cli-region=cn-north-4

Pitfall 6: Policy Enforcement on Deregistered Cluster

Symptom: Policy enforcement status shows errors or Unavailable for a cluster

Root Cause: The cluster was deregistered from UCS after the policy instance was created. Policy governance requires the cluster to remain registered.

Solution:

• Re-register the cluster to restore policy enforcement
• Or delete the policy instance if the cluster should no longer be managed

Pitfall 7: Disabling Policy Does Not Remove Violations

Symptom: Compliance check still shows violations even after disabling the policy

Root Cause: Disabling a policy suspends enforcement (no new checks are performed), but existing violation records are preserved for audit purposes

Solution: This is expected behavior. Violation records from previous enforcement periods are retained. To remove them: 1. Fix the violations in the cluster 2. Re-enable the policy to trigger a fresh enforcement job 3. If no violations remain, the job status will show Success

Pitfall 8: Policy Instance Quota Exceeded

Symptom: CreateClusterPolicyInstance returns 403 Quota limit exceeded

Root Cause: UCS has limits on the number of policy instances that can be created

Solution: Check quotas (using huawei-cloud-ucs-cluster-onboarding-manager skill):

hcloud UCS ShowQuota --cli-region=cn-north-4

If quota is exceeded: 1. Delete unused or obsolete policy instances 2. Request a quota increase through Huawei Cloud support

Pitfall 9: Compliance Check Data Appears Stale

Symptom: Enforcement job data shows old timestamps or violation data that seems outdated

Root Cause: Enforcement jobs are performed periodically, not continuously. The data may be from the last job execution cycle.

Solution: Trigger a fresh enforcement check by:

# Re-trigger enforcement
hcloud UCS DisableClusterPolicy --clusterid=<ucs-cluster-id> --cli-region=cn-north-4
hcloud UCS EnableClusterPolicy --clusterid=<ucs-cluster-id> --retry=true --cli-region=cn-north-4

# Check new job status
hcloud UCS ListPolicyJobs --kind=EnablePolicy --cli-region=cn-north-4

Pitfall 10: Policy Instance ID vs Definition ID Confusion

Symptom: Using wrong ID type for operations (e.g., using definition ID where instance ID is expected)

Root Cause: Policy instances and policy definitions have different UUIDs. Using one type of ID for operations that expect the other type causes errors.

Solution: Keep track of both IDs separately:

• constraintTemplateID: Used in CreateClusterPolicyInstance, CreateClusterGroupPolicyInstance, and UpdatePolicyInstance
• policyinstanceid: Used in ShowPolicyInstance, UpdatePolicyInstance, DeletePolicyInstance
• policydefinitionid: Used in ShowPolicyDefinition

# ✅ CORRECT - Use policyinstanceid for instance operations
hcloud UCS ShowPolicyInstance --policyinstanceid=<instance-id> --cli-region=cn-north-4

# ✅ CORRECT - Use policydefinitionid for definition operations
hcloud UCS ShowPolicyDefinition --policydefinitionid=<definition-id> --cli-region=cn-north-4

# ❌ WRONG - Using definition ID for instance operation
hcloud UCS ShowPolicyInstance --policyinstanceid=<definition-id> --cli-region=cn-north-4

Pitfall 11: CreatePolicyInstance vs Scope-Specific Operations

Symptom: Command fails with "operation not found" or unexpected parameter errors when using CreatePolicyInstance

Root Cause: CreatePolicyInstance is NOT a single UCS API operation. It is TWO separate operations: CreateClusterPolicyInstance (for cluster-level) and CreateClusterGroupPolicyInstance (for fleet group-level). Using CreatePolicyInstance directly will fail.

Solution: Always use the scope-specific operation:

# ✅ CORRECT - Cluster-level
hcloud UCS CreateClusterPolicyInstance --clusterid=<ucs-cluster-id> --constraintTemplateID=<template-id> --cli-region=cn-north-4

# ✅ CORRECT - Fleet group-level
hcloud UCS CreateClusterGroupPolicyInstance --clustergroupid=<fleet-group-id> --constraintTemplateID=<template-id> --cli-region=cn-north-4

# ❌ WRONG - This operation does not exist
hcloud UCS CreatePolicyInstance --name=my-policy --policy_definition_id=<def-id> --cluster_id=<ucs-id> --cli-region=cn-north-4

Pitfall 12: --policyinstanceid vs --instance_id (Naming Convention)

Symptom: Command fails with "parameter not found" error when using --instance_id

Root Cause: UCS API uses concatenated camelCase parameter names without underscores. The correct parameter is --policyinstanceid, not --instance_id.

Solution: Use UCS parameter naming convention:

# ✅ CORRECT - UCS uses no underscore, concatenated
hcloud UCS ShowPolicyInstance --policyinstanceid=<instance-id> --cli-region=cn-north-4
hcloud UCS UpdatePolicyInstance --policyinstanceid=<instance-id> --cli-region=cn-north-4
hcloud UCS DeletePolicyInstance --policyinstanceid=<instance-id> --cli-region=cn-north-4

# ❌ WRONG - Underscore style is not used by UCS
hcloud UCS ShowPolicyInstance --instance_id=<instance-id> --cli-region=cn-north-4

Same rule applies to other parameters:

• --policydefinitionid (not --definition_id)
• --clusterid (not --cluster_id)
• --clustergroupid (not --cluster_group_id)
• --constraintTemplateID (not --policy_definition_id)

Pitfall 13: --constraintTemplateID vs --policy_definition_id

Symptom: Command fails with "parameter not found" when using --policy_definition_id

Root Cause: The UCS API uses --constraintTemplateID as the parameter name for referencing constraint templates, not --policy_definition_id.

Solution: Always use --constraintTemplateID:

# ✅ CORRECT - Use constraintTemplateID
hcloud UCS CreateClusterPolicyInstance --clusterid=<ucs-cluster-id> --constraintTemplateID=<template-id> --enforcementAction=deny --cli-region=cn-north-4

# ❌ WRONG - policy_definition_id is not a UCS parameter
hcloud UCS CreateClusterPolicyInstance --clusterid=<ucs-cluster-id> --policy_definition_id=<def-id> --cli-region=cn-north-4

Pitfall 14: GetPolicyAssignment Does Not Exist

Symptom: Command fails with "operation not found" when using GetPolicyAssignment

Root Cause: GetPolicyAssignment is NOT a UCS API operation. It does not exist in the hcloud UCS command set.

Solution: Use ListPolicyJobs and ShowPolicyJob to check policy enforcement status:

# ✅ CORRECT - List enforcement jobs
hcloud UCS ListPolicyJobs --kind=EnablePolicy --cli-region=cn-north-4

# ✅ CORRECT - Show specific job details
hcloud UCS ShowPolicyJob --jobid=<job-id> --cli-region=cn-north-4

# ❌ WRONG - This operation does not exist
hcloud UCS GetPolicyAssignment --instance_id=<instance-id> --cli-region=cn-north-4

Pitfall 15: ListPolicyInstances/ListPolicyDefinitions Filter Parameters Don't Exist

Symptom: Command runs but filter parameters like --name, --cluster_id, --category, --limit, --offset have no effect or cause unexpected behavior

Root Cause: ListPolicyInstances and ListPolicyDefinitions only accept --cli-region. They do NOT support any filter parameters.

Solution: List all instances/definitions and filter from the response manually:

# ✅ CORRECT - Only --cli-region is available
hcloud UCS ListPolicyInstances --cli-region=cn-north-4
hcloud UCS ListPolicyDefinitions --cli-region=cn-north-4

# ❌ WRONG - These filter parameters do not exist
hcloud UCS ListPolicyInstances --name=security --cluster_id=<id> --limit=20 --offset=0 --cli-region=cn-north-4
hcloud UCS ListPolicyDefinitions --category=security --limit=50 --offset=0 --cli-region=cn-north-4

Pitfall 16: Enable/Disable Must Use Scope-Specific Operations

Symptom: EnablePolicy or DisablePolicy fails with "operation not found" error

Root Cause: Enable and Disable are TWO separate scope-specific operations each: EnableClusterPolicy/EnableClusterGroupPolicy and DisableClusterPolicy/DisableClusterGroupPolicy.

Solution: Use the correct scope-specific operation:

# ✅ CORRECT - Enable on cluster
hcloud UCS EnableClusterPolicy --clusterid=<ucs-cluster-id> --cli-region=cn-north-4

# ✅ CORRECT - Enable on fleet group
hcloud UCS EnableClusterGroupPolicy --clustergroupid=<fleet-group-id> --cli-region=cn-north-4

# ✅ CORRECT - Disable on cluster
hcloud UCS DisableClusterPolicy --clusterid=<ucs-cluster-id> --cli-region=cn-north-4

# ✅ CORRECT - Disable on fleet group
hcloud UCS DisableClusterGroupPolicy --clustergroupid=<fleet-group-id> --cli-region=cn-north-4

# ❌ WRONG - These single operations do not exist
hcloud UCS EnablePolicy --instance_id=<id> --cluster_id=<id> --cli-region=cn-north-4
hcloud UCS DisablePolicy --instance_id=<id> --cli-region=cn-north-4

Common Error Response Reference

IAM Permission Policies - UCS Policy Governor Skill

Overview

This document declares the IAM permissions required by the Huawei Cloud UCS Policy Governor skill. All permissions follow the principle of least privilege.

Read-Only Operations

Write Operations (Require Additional Authorization)

Minimum Read-Only Policy (JSON)

{
  "Version": "1.1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ucs:policyInstance:get",
        "ucs:policyInstance:list",
        "ucs:policyDefinition:list",
        "ucs:policyDefinition:get",
        "ucs:policyJob:list",
        "ucs:policyJob:get"
      ],
      "Resource": ["*"]
    }
  ]
}

Full Governance Policy (JSON)

{
  "Version": "1.1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ucs:policyInstance:get",
        "ucs:policyInstance:list",
        "ucs:clusterPolicyInstance:create",
        "ucs:clusterGroupPolicyInstance:create",
        "ucs:policyInstance:update",
        "ucs:policyInstance:delete",
        "ucs:policyDefinition:list",
        "ucs:policyDefinition:get",
        "ucs:policyJob:list",
        "ucs:policyJob:get",
        "ucs:clusterPolicy:enable",
        "ucs:clusterPolicy:disable",
        "ucs:clusterGroupPolicy:enable",
        "ucs:clusterGroupPolicy:disable"
      ],
      "Resource": ["*"]
    }
  ]
}

Permission Assignment Steps

1. Log in to Huawei Cloud IAM console: https://console.huaweicloud.com/iam/ 2. Navigate to Policies → Create Custom Policy 3. Choose JSON mode and paste the policy JSON above 4. Navigate to Users / User Groups → Authorize 5. Select the custom policy and confirm

Permission Failure Handling

When a command fails with a permission error:

1. Read this document (references/iam-policies.md) 2. Display the required permission list and policy JSON to the user 3. Guide the user to create a custom policy in the IAM console 4. Pause execution and wait for user confirmation that permissions have been granted 5. Retry the failed command

Task: Compliance Audit

Overview

UCS compliance audit enables fleet-wide governance monitoring by reviewing policy enforcement job status, identifying violations, and tracking compliance across managed clusters. This task covers checking enforcement job status, violation review, and audit reporting using ListPolicyJobs and ShowPolicyJob (replacing the non-existent GetPolicyAssignment operation).

Operations Catalog

Workflows

W1: Fleet-Level Compliance Audit

Audit compliance across all clusters in a fleet group:

# 1. List all policy instances for the fleet group
hcloud UCS ListPolicyInstances --cli-region=cn-north-4

# 2. Check enforcement job status across the fleet
hcloud UCS ListPolicyJobs --kind=EnablePolicy --cli-region=cn-north-4

Policy Job Response Fields:

• jobid: Enforcement job UUID
• kind: Job type (e.g., EnablePolicy)
• status: Job execution status (Success, Failed, InProgress)

Audit Checklist:

• ✅ All jobs show status: Success — Policy enforcement deployed successfully
• ⚠️ Some jobs show status: Failed — Investigate specific failures with ShowPolicyJob
• ❌ Many jobs show status: Failed — Systemic issue, requires immediate action

W2: Cluster-Level Compliance Review

Review enforcement status for a specific cluster:

# 1. List all policy instances
hcloud UCS ListPolicyInstances --cli-region=cn-north-4

# 2. Check enforcement jobs for the cluster
hcloud UCS ListPolicyJobs --kind=EnablePolicy --cli-region=cn-north-4

# 3. Show specific job details for deeper inspection
hcloud UCS ShowPolicyJob --jobid=<job-id> --cli-region=cn-north-4

Job Status Values:

• Success: Policy enforcement deployed successfully, compliance checks active
• Failed: Policy enforcement failed, check job details for error information
• InProgress: Policy enforcement being deployed, compliance check pending

W3: Violation Analysis

When violations are detected, analyze the details:

# List enforcement jobs to find relevant job
hcloud UCS ListPolicyJobs --kind=EnablePolicy --cli-region=cn-north-4

# Show specific job details for violation information
hcloud UCS ShowPolicyJob --jobid=<job-id> --cli-region=cn-north-4

Violation Details: Each failed or partially successful enforcement job includes violation information. UCS responses follow k8s-style format based on verified ListPolicyDefinitions/ListPolicyJobs patterns:

[to be verified for populated response — verified empty ListPolicyJobs returns { "items": null }]

The exact violation detail structure has not been verified. Based on verified k8s-style UCS responses, violation information is likely in a structured status.conditions or similar field rather than flat fields like jobid, kind, details.cluster_id, details.violations.

Violation Resolution Steps: 1. Review each violation description from ShowPolicyJob 2. Identify the affected Kubernetes resource (namespace, deployment, pod) 3. Apply the required fix on the cluster 4. Re-enable the policy to trigger a fresh enforcement job 5. Verify the job status changes to Success

W4: Cross-Fleet Compliance Comparison

Compare enforcement status across different fleet groups:

# 1. List all policy instances
hcloud UCS ListPolicyInstances --cli-region=cn-north-4

# 2. List all enforcement jobs
hcloud UCS ListPolicyJobs --kind=EnablePolicy --cli-region=cn-north-4

# 3. Show specific job details for each fleet group
hcloud UCS ShowPolicyJob --jobid=<production-job-id> --cli-region=cn-north-4
hcloud UCS ShowPolicyJob --jobid=<staging-job-id> --cli-region=cn-north-4
hcloud UCS ShowPolicyJob --jobid=<development-job-id> --cli-region=cn-north-4

Comparison Framework:

W5: Compliance Trend Tracking

Track enforcement job status over time by periodically auditing:

# Audit 1: Initial baseline
hcloud UCS ListPolicyJobs --kind=EnablePolicy --cli-region=cn-north-4

# Audit 2: After remediation
hcloud UCS ListPolicyJobs --kind=EnablePolicy --cli-region=cn-north-4

# Audit 3: Verify sustained compliance
hcloud UCS ListPolicyJobs --kind=EnablePolicy --cli-region=cn-north-4

Key Metrics to Track:

• Job status trend (Success vs Failed vs InProgress)
• Violation details from ShowPolicyJob
• New failed jobs appearing (regression detection)
• Job completion timestamps

W6: Remediation Workflow

When violations are detected, follow this remediation workflow:

# 1. Identify violation details
hcloud UCS ListPolicyJobs --kind=EnablePolicy --cli-region=cn-north-4
hcloud UCS ShowPolicyJob --jobid=<job-id> --cli-region=cn-north-4

# 2. Access the cluster with kubeconfig
hcloud UCS CreateClusterKubeconfig --clusterid=<ucs-cluster-id> --cli-region=cn-north-4 > cluster-kubeconfig.yaml

# 3. Fix violations using kubectl
kubectl --kubeconfig=cluster-kubeconfig.yaml apply -f <fix-manifest>

# 4. Re-trigger enforcement
hcloud UCS DisableClusterPolicy --clusterid=<ucs-cluster-id> --cli-region=cn-north-4
hcloud UCS EnableClusterPolicy --clusterid=<ucs-cluster-id> --retry=true --cli-region=cn-north-4

# 5. Verify remediation
hcloud UCS ListPolicyJobs --kind=EnablePolicy --cli-region=cn-north-4
hcloud UCS ShowPolicyJob --jobid=<new-job-id> --cli-region=cn-north-4

Expected: Job status changes from Failed to Success.

Common Scenarios

S1: Production Fleet Compliance Report

Generate a complete compliance report for the production fleet:

# 1. List all policy instances
hcloud UCS ListPolicyInstances --cli-region=cn-north-4

# 2. List all enforcement jobs
hcloud UCS ListPolicyJobs --kind=EnablePolicy --cli-region=cn-north-4

# 3. For each job, show detailed status
for jobid in <job-ids>; do
  echo "=== Policy Job: $jobid ==="
  hcloud UCS ShowPolicyJob --jobid=$jobid --cli-region=cn-north-4
done

# 4. Identify all failed jobs
# 5. Create remediation plan

S2: New Cluster Compliance Validation

When a new cluster joins the fleet, verify it meets compliance standards:

# 1. Register the new cluster
hcloud UCS RegisterCluster --name=new-cluster --cluster_type=CCE --cluster_id=<cce-id> --cli-region=cn-north-4

# 2. Enable policy on the new cluster
hcloud UCS EnableClusterPolicy --clusterid=<new-ucs-id> --cli-region=cn-north-4

# 3. Check enforcement job status
hcloud UCS ListPolicyJobs --kind=EnablePolicy --cli-region=cn-north-4
hcloud UCS ShowPolicyJob --jobid=<job-id> --cli-region=cn-north-4

# 4. If job failed, remediate before deploying production workloads

S3: Compliance Audit for Regulatory Review

For regulatory compliance reviews, document the full audit trail:

# 1. List all policy definitions
hcloud UCS ListPolicyDefinitions --cli-region=cn-north-4

# 2. List all policy instances
hcloud UCS ListPolicyInstances --cli-region=cn-north-4

# 3. List all enforcement jobs for compliance evidence
hcloud UCS ListPolicyJobs --kind=EnablePolicy --cli-region=cn-north-4

# 4. Show detailed job information for each
hcloud UCS ShowPolicyJob --jobid=<job-id> --cli-region=cn-north-4

# 5. Document job status and violation details
# 6. Record remediation actions taken
# 7. Retain job timestamps for audit trail

Task: Policy Management

Overview

UCS policy instances enforce governance rules on managed clusters and fleet groups. Each policy instance is based on a constraint template and targets either a single cluster (via CreateClusterPolicyInstance) or a fleet group (via CreateClusterGroupPolicyInstance). This task covers creating, updating, querying, and deleting policy instances.

Operations Catalog

Workflows

W1: Discover Available Policy Definitions

Before creating a policy instance, review available definitions:

# List all policy definitions (no filter parameters available)
hcloud UCS ListPolicyDefinitions --cli-region=cn-north-4

# Show definition details to understand parameters
hcloud UCS ShowPolicyDefinition --policydefinitionid=<definition-id> --cli-region=cn-north-4

Policy Definition Categories:

• security: Security baseline, pod security standards, privileged container restrictions
• compliance: CIS benchmarks, regulatory compliance, audit logging
• resource: Resource quotas, resource limits, cost optimization
• network: Network policies, ingress/egress restrictions, service mesh rules

W2: Create a Policy Instance for a Cluster

Pre-creation Checklist: 1. Verify cluster is registered in UCS: hcloud UCS ShowClusterList --name=<cluster-name> --cli-region=cn-north-4 2. Identify the appropriate policy definition: hcloud UCS ListPolicyDefinitions --cli-region=cn-north-4 3. Verify definition details: hcloud UCS ShowPolicyDefinition --policydefinitionid=<id> --cli-region=cn-north-4

# Create a cluster-level policy instance
hcloud UCS CreateClusterPolicyInstance --clusterid=<ucs-cluster-id> --constraintTemplateID=<template-id> --enforcementAction=deny --namespaces.1=default --namespaces.2=production --parameters='{"maxReplicas":"3"}' --cli-region=cn-north-4

Post-creation Verification:

# Show policy instance details
hcloud UCS ShowPolicyInstance --policyinstanceid=<instance-id-from-response> --cli-region=cn-north-4

# Check enforcement job status
hcloud UCS ListPolicyJobs --kind=EnablePolicy --cli-region=cn-north-4

Expected: Policy instance created, enforcement job shows progress.

W3: Create a Policy Instance for a Fleet Group

Apply policies across an entire fleet group for consistent governance:

# Create a fleet group-level policy instance
hcloud UCS CreateClusterGroupPolicyInstance --clustergroupid=<fleet-group-id> --constraintTemplateID=<template-id> --enforcementAction=warn --parameters='{"cpuLimit":"2"}' --cli-region=cn-north-4

Post-creation Verification:

# Show policy instance details
hcloud UCS ShowPolicyInstance --policyinstanceid=<instance-id> --cli-region=cn-north-4

# Check enforcement job status
hcloud UCS ListPolicyJobs --kind=EnablePolicy --cli-region=cn-north-4

Expected: Enforcement job tracks policy deployment across fleet group.

W4: Update a Policy Instance

# Update policy instance parameters and enforcement action
hcloud UCS UpdatePolicyInstance --policyinstanceid=<instance-id> --enforcementAction=deny --parameters='{"cpuLimit":"4"}' --cli-region=cn-north-4

Note: You cannot change the target scope (clusterid/clustergroupid) via update. To change the scope, delete the instance and create a new one.

W5: List Policy Instances

# List all policy instances (no filter parameters available)
hcloud UCS ListPolicyInstances --cli-region=cn-north-4

Note: ListPolicyInstances does not support filter parameters like --name, --cluster_id, --cluster_group_id, --limit, --offset, or --status. To find specific instances, list all and filter from the response.

W6: Enable/Disable Policy Enforcement

Enable a policy (starts or resumes enforcement):

# Enable on a specific cluster
hcloud UCS EnableClusterPolicy --clusterid=<ucs-cluster-id> --cli-region=cn-north-4

# Enable on a fleet group
hcloud UCS EnableClusterGroupPolicy --clustergroupid=<fleet-group-id> --cli-region=cn-north-4

# Enable with retry (for retrying a failed enforcement)
hcloud UCS EnableClusterPolicy --clusterid=<ucs-cluster-id> --retry=true --cli-region=cn-north-4

Disable a policy (suspends enforcement):

# Disable on a specific cluster
hcloud UCS DisableClusterPolicy --clusterid=<ucs-cluster-id> --cli-region=cn-north-4

# Disable on a fleet group
hcloud UCS DisableClusterGroupPolicy --clustergroupid=<fleet-group-id> --cli-region=cn-north-4

Use Cases for Disabling:

• Temporary maintenance windows where violations are expected
• Testing policy impact before full rollout
• Debugging compliance issues

⚠️ Important: Disabling a policy suspends violation checks but preserves existing violation records for audit.

W7: Delete a Policy Instance

⚠️ CAUTION: Deleting a policy instance permanently removes the enforcement configuration. Violations will no longer be checked.

Recommended: Disable Before Delete:

# 1. Disable the policy first
hcloud UCS DisableClusterPolicy --clusterid=<ucs-cluster-id> --cli-region=cn-north-4

# 2. Confirm no dependencies exist
hcloud UCS ListPolicyInstances --cli-region=cn-north-4

# 3. Delete the policy instance
hcloud UCS DeletePolicyInstance --policyinstanceid=<instance-id> --cli-region=cn-north-4

Post-deletion Verification:

# Verify deletion
hcloud UCS ShowPolicyInstance --policyinstanceid=<instance-id> --cli-region=cn-north-4

Expected: Returns 404 error (policy instance not found).

Common Scenarios

S1: Apply Security Baseline to All Production Clusters

# 1. Ensure fleet group exists for production clusters
hcloud UCS CreateClusterGroup --name=production-fleet --description="Production fleet" --cli-region=cn-north-4

# 2. Find the security baseline definition
hcloud UCS ListPolicyDefinitions --cli-region=cn-north-4

# 3. Create policy instance for the fleet group
hcloud UCS CreateClusterGroupPolicyInstance --clustergroupid=<fleet-group-id> --constraintTemplateID=<security-template-id> --enforcementAction=deny --cli-region=cn-north-4

# 4. Enable and verify
hcloud UCS EnableClusterGroupPolicy --clustergroupid=<fleet-group-id> --cli-region=cn-north-4
hcloud UCS ListPolicyJobs --kind=EnablePolicy --cli-region=cn-north-4

S2: Gradual Policy Rollout (Staging First, Then Production)

# 1. Create policy for staging cluster first
hcloud UCS CreateClusterPolicyInstance --clusterid=<staging-ucs-id> --constraintTemplateID=<template-id> --enforcementAction=warn --cli-region=cn-north-4

# 2. Enable and validate on staging
hcloud UCS EnableClusterPolicy --clusterid=<staging-ucs-id> --cli-region=cn-north-4
hcloud UCS ListPolicyJobs --kind=EnablePolicy --cli-region=cn-north-4

# 3. If validation is acceptable, create for production fleet group
hcloud UCS CreateClusterGroupPolicyInstance --clustergroupid=<prod-fleet-id> --constraintTemplateID=<template-id> --enforcementAction=deny --cli-region=cn-north-4
hcloud UCS EnableClusterGroupPolicy --clustergroupid=<prod-fleet-id> --cli-region=cn-north-4

S3: Replace a Policy with a Different Definition

# 1. Disable and delete old policy
hcloud UCS DisableClusterPolicy --clusterid=<ucs-cluster-id> --cli-region=cn-north-4
hcloud UCS DeletePolicyInstance --policyinstanceid=<old-instance-id> --cli-region=cn-north-4

# 2. Find new definition
hcloud UCS ListPolicyDefinitions --cli-region=cn-north-4

# 3. Create new policy instance with new template
hcloud UCS CreateClusterPolicyInstance --clusterid=<ucs-cluster-id> --constraintTemplateID=<new-template-id> --enforcementAction=deny --cli-region=cn-north-4

# 4. Enable and verify
hcloud UCS EnableClusterPolicy --clusterid=<ucs-cluster-id> --cli-region=cn-north-4
hcloud UCS ListPolicyJobs --kind=EnablePolicy --cli-region=cn-north-4

S4: Audit All Active Policies

# List all policy instances
hcloud UCS ListPolicyInstances --cli-region=cn-north-4

# Check enforcement job status
hcloud UCS ListPolicyJobs --kind=EnablePolicy --cli-region=cn-north-4

# Review definitions being used
hcloud UCS ShowPolicyDefinition --policydefinitionid=<template-id> --cli-region=cn-north-4

UCS Policy API Reference Guide

Overview

This document provides API reference information for Huawei Cloud UCS (Universal Cloud Service) policy governance operations using hcloud CLI. All commands follow the standard format: hcloud UCS <Operation> --param=value --cli-region=<region>.

Authentication

Environment Variables

export HUAWEI_CLOUD_AK=<your-ak>
export HUAWEI_CLOUD_SK=<your-sk>

hcloud CLI Configuration

# Interactive configuration
hcloud configure

# Verify configuration (safe - does not expose values)
hcloud configure list

✅ Correct: Use hcloud configure list to verify credentials ❌ Incorrect: Never use echo $HUAWEI_CLOUD_AK to check credentials

Policy Instance Operations

1. Create Cluster Policy Instance

# Create a cluster-level policy instance
hcloud UCS CreateClusterPolicyInstance --clusterid=<ucs-cluster-id> --constraintTemplateID=<template-id> --enforcementAction=deny --namespaces.1=default --namespaces.2=production --parameters='{"maxReplicas":"3"}' --cli-region=cn-north-4

Parameters:

• --clusterid (required, path): Target UCS cluster ID
• --constraintTemplateID (optional, body): Constraint template ID to reference
• --enforcementAction (optional, body): Enforcement action, values: warn or deny
• --namespaces.[N] (optional, body array): Target namespaces, indexed from 1
• --parameters (optional, body object): Policy parameters as JSON object string
• --cli-region (required): Region ID

Important: This operation creates a policy instance scoped to a single cluster. For fleet group-level policies, use CreateClusterGroupPolicyInstance instead.

Response Example [to be verified — UCS responses follow k8s-style format based on verified ShowClusterList/ListPolicyDefinitions patterns]:

UCS API returns Kubernetes-style objects, not flat JSON. Based on verified ShowClusterList and ListPolicyDefinitions responses, CreateClusterPolicyInstance likely returns a k8s-style object with kind, apiVersion, metadata, spec, and status fields rather than flat fields like id, constraintTemplateID, enforcementAction.

Key Fields (expected, format to be verified):

• Instance UUID: Likely in metadata.uid (not flat id)
• Constraint template reference: Likely in spec.constraintTemplateID
• Enforcement action: Likely in spec.enforcementAction (warn or deny)
• Status: Likely in status.phase (Enabled, Disabled, Pending)

2. Create Cluster Group Policy Instance

# Create a fleet group-level policy instance
hcloud UCS CreateClusterGroupPolicyInstance --clustergroupid=<fleet-group-id> --constraintTemplateID=<template-id> --enforcementAction=warn --parameters='{"cpuLimit":"2"}' --cli-region=cn-north-4

Parameters:

• --clustergroupid (required, path): Target fleet group ID
• --constraintTemplateID (optional, body): Constraint template ID to reference
• --enforcementAction (optional, body): Enforcement action, values: warn or deny
• --namespaces.[N] (optional, body array): Target namespaces, indexed from 1
• --parameters (optional, body object): Policy parameters as JSON object string
• --cli-region (required): Region ID

Important: This operation creates a policy instance scoped to a fleet group. For cluster-level policies, use CreateClusterPolicyInstance instead.

Response Example [to be verified — UCS responses follow k8s-style format based on verified ShowClusterList/ListPolicyDefinitions patterns]:

UCS API returns Kubernetes-style objects, not flat JSON. Based on verified responses, CreateClusterGroupPolicyInstance likely returns a k8s-style object with kind, apiVersion, metadata, spec, and status fields rather than flat fields.

3. Update Policy Instance

hcloud UCS UpdatePolicyInstance --policyinstanceid=<instance-id> --enforcementAction=deny --parameters='{"cpuLimit":"4"}' --cli-region=cn-north-4

Parameters:

• --policyinstanceid (required, path): Policy instance UUID
• --constraintTemplateID (optional, body): New constraint template ID
• --enforcementAction (optional, body): New enforcement action (warn or deny)
• --namespaces.[N] (optional, body array): New target namespaces
• --parameters (optional, body object): New policy parameters as JSON object string
• --cli-region (required): Region ID

Note: You cannot change the target scope (clusterid/clustergroupid) after creation. To change the scope, delete the instance and create a new one.

4. Show Policy Instance Details

hcloud UCS ShowPolicyInstance --policyinstanceid=<instance-id> --cli-region=cn-north-4

Parameters:

• --policyinstanceid (required, path): Policy instance UUID
• --cli-region (required): Region ID

Response: Returns full policy instance details including status, template reference, and target scope.

5. Delete Policy Instance

hcloud UCS DeletePolicyInstance --policyinstanceid=<instance-id> --cli-region=cn-north-4

Parameters:

• --policyinstanceid (required, path): Policy instance UUID
• --cli-region (required): Region ID

⚠️ Warning: Deleting a policy instance permanently removes the enforcement configuration. Violations will no longer be checked. Consider disabling the policy first before deleting.

6. List Policy Instances

# List all policy instances (no filter parameters available)
hcloud UCS ListPolicyInstances --cli-region=cn-north-4

Parameters:

• --cli-region (required): Region ID

Important: ListPolicyInstances does NOT support filter parameters. The following parameters DO NOT EXIST: --name, --cluster_id, --cluster_group_id, --limit, --offset, --status. Only --cli-region is available. To find specific instances, list all and filter from the response.

Response Example (verified for empty result):

When no instances exist, returns { "items": null }. When populated, likely k8s-style objects based on verified UCS pattern:

{
  "items": null
}

[to be verified for populated response — likely k8s-style objects with kind, apiVersion, metadata, spec, status fields rather than flat fields like id, constraintTemplateID]

Policy Definition Operations

1. List Policy Definitions

# List all available policy definitions (no filter parameters available)
hcloud UCS ListPolicyDefinitions --cli-region=cn-north-4

Parameters:

• --cli-region (required): Region ID

Important: ListPolicyDefinitions does NOT support filter parameters. The following parameters DO NOT EXIST: --category, --limit, --offset. Only --cli-region is available. To find definitions by category, list all and filter from the response.

Response Example (verified):

{
  "items": [
    {
      "kind": "ConstraintTemplate",
      "apiVersion": "templates.gatekeeper.sh/v1beta1",
      "metadata": {
        "name": "k8srequiredresources",
        "uid": "3b900254-0086-11ee-924e-0255ac1000d3",
        "creationTimestamp": "2023-06-01T14:11:41Z",
        "annotations": {
          "name-chinese": "K8sRequiredResources",
          "tag-chinese": "集群安全策略",
          "description-chinese": "..."
        }
      },
      "spec": {
        "type": "general",
        "officialTag": "ClusterSecurityPolicies",
        "level": "1",
        "targetKind": "Pod",
        "official": true,
        "description": "Requires containers to have defined resources set...",
        "constraintTemplate": {
          "kind": "ConstraintTemplate",
          "apiVersion": "templates.gatekeeper.sh/v1",
          "metadata": { "name": "k8srequiredresources" },
          "spec": {
            "crd": {
              "spec": {
                "names": { "kind": "K8sRequiredResources" },
                "validation": { "openAPIV3Schema": { "properties": {} } }
              }
            },
            "targets": [
              {
                "target": "admission.k8s.gatekeeper.sh",
                "rego": "...",
                "libs": []
              }
            ]
          }
        }
      }
    }
  ]
}

Key Fields:

• metadata.name: Constraint template name (used as constraintTemplateID in CreateClusterPolicyInstance, not flat id) — this is the identifier you pass to --constraintTemplateID
• metadata.uid: Definition UUID
• spec.officialTag: Policy category/tag (not flat category) — values like ClusterSecurityPolicies
• spec.level: Severity level (not flat severity) — numeric string like "1"
• spec.targetKind: Target resource type (e.g., Pod)
• spec.description: Policy description
• spec.constraintTemplate.spec.crd.spec.validation.openAPIV3Schema.properties: Parameter definitions (not flat parameters array) — parameter types and defaults are defined in the OpenAPI V3 schema inside the constraint template CRD spec
• spec.type: Policy type (e.g., general)
• spec.official: Whether this is an official (built-in) policy

2. Show Policy Definition Details

hcloud UCS ShowPolicyDefinition --policydefinitionid=<definition-id> --cli-region=cn-north-4

Parameters:

• --policydefinitionid (required, path): Policy definition UUID
• --cli-region (required): Region ID

Response Example [to be verified — UCS responses follow k8s-style format based on verified ListPolicyDefinitions pattern]:

UCS API returns Kubernetes-style objects. Based on the verified ListPolicyDefinitions response (which returns ConstraintTemplate objects), ShowPolicyDefinition likely returns a single k8s-style ConstraintTemplate object with detailed spec.constraintTemplate.spec.crd.spec.validation.openAPIV3Schema.properties for parameter definitions.

Policy Enforcement Operations

1. Enable Cluster Policy

# Enable a policy on a cluster (starts enforcement)
hcloud UCS EnableClusterPolicy --clusterid=<ucs-cluster-id> --cli-region=cn-north-4

# Enable with retry (for retrying a failed enforcement)
hcloud UCS EnableClusterPolicy --clusterid=<ucs-cluster-id> --retry=true --cli-region=cn-north-4

Parameters:

• --clusterid (required, path): Target UCS cluster ID
• --retry (optional, query): Retry flag for re-attempting failed enforcement
• --cli-region (required): Region ID

2. Enable Cluster Group Policy

# Enable a policy on a fleet group (starts enforcement)
hcloud UCS EnableClusterGroupPolicy --clustergroupid=<fleet-group-id> --cli-region=cn-north-4

# Enable with retry
hcloud UCS EnableClusterGroupPolicy --clustergroupid=<fleet-group-id> --retry=true --cli-region=cn-north-4

Parameters:

• --clustergroupid (required, path): Target fleet group ID
• --retry (optional, query): Retry flag for re-attempting failed enforcement
• --cli-region (required): Region ID

3. Disable Cluster Policy

# Disable a policy on a cluster (suspends enforcement)
hcloud UCS DisableClusterPolicy --clusterid=<ucs-cluster-id> --cli-region=cn-north-4

Parameters:

• --clusterid (required, path): Target UCS cluster ID
• --cli-region (required): Region ID

Effect: Policy enforcement is suspended. Violations will not be checked while the policy is disabled. The policy instance configuration is preserved.

4. Disable Cluster Group Policy

# Disable a policy on a fleet group (suspends enforcement)
hcloud UCS DisableClusterGroupPolicy --clustergroupid=<fleet-group-id> --cli-region=cn-north-4

Parameters:

• --clustergroupid (required, path): Target fleet group ID
• --cli-region (required): Region ID

Policy Enforcement Job Operations

1. List Policy Jobs

# List all policy enforcement jobs
hcloud UCS ListPolicyJobs --cli-region=cn-north-4

# List enforcement jobs filtered by kind
hcloud UCS ListPolicyJobs --kind=EnablePolicy --cli-region=cn-north-4

Parameters:

• --kind (optional, query): Job type filter, default EnablePolicy
• --cli-region (required): Region ID

Response Example (verified for empty result):

When no jobs exist, returns { "items": null }. When populated, likely k8s-style objects based on verified UCS pattern:

{
  "items": null
}

[to be verified for populated response — likely k8s-style objects with kind, apiVersion, metadata, spec, status fields]

Key Fields (expected, format to be verified):

• Job UUID: Likely in metadata.uid (not flat jobid)
• Job type: Likely in spec.kind (EnablePolicy, etc.)
• Job status: Likely in status.phase (Success, Failed, InProgress)

2. Show Policy Job

# Show detailed policy enforcement job information
hcloud UCS ShowPolicyJob --jobid=<job-id> --cli-region=cn-north-4

Parameters:

• --jobid (required, path): Policy enforcement job UUID
• --cli-region (required): Region ID

Response Example [to be verified — UCS responses follow k8s-style format based on verified ListPolicyDefinitions/ListPolicyJobs patterns]:

UCS API returns Kubernetes-style objects. Based on verified responses, ShowPolicyJob likely returns a k8s-style object rather than flat fields like jobid, kind, status.

Key Fields (expected, format to be verified):

• Job UUID: Likely in metadata.uid
• Job type: Likely in spec.kind (EnablePolicy, etc.)
• Status: Likely in status.phase (Success, Failed, InProgress)
• Violation details: Likely in status.conditions or similar structured field

Important: GetPolicyAssignment does NOT exist as a UCS API operation. Use ListPolicyJobs and ShowPolicyJob to check policy enforcement status and compliance information.

Common Region IDs

Common Errors

Related Documentation

• Huawei Cloud UCS Documentation
• hcloud CLI Documentation
• Huawei Cloud API Explorer

Verification Method - UCS Policy Governor Skill

Overview

This document defines the verification steps for the UCS Policy Governor skill. Verification is divided into three levels: installation verification, configuration verification, and functional verification.

Level 1: Installation Verification

1.1 hcloud CLI Installation

1.2 hcloud CLI First Run

# Accept privacy statement (first time only)
printf "y\n" | hcloud version

Expected: Version number displayed without error.

Level 2: Configuration Verification

2.1 Credential Configuration

✅ Correct: Use hcloud configure list to verify ❌ Incorrect: Do NOT use echo $HUAWEI_CLOUD_AK to check credentials

2.2 Connectivity Test

# Test API connectivity with a read-only operation
hcloud UCS ListPolicyDefinitions --cli-region=cn-north-4

Expected: Returns HTTP 200 and list of policy definitions.

Level 3: Functional Verification

3.1 Policy Definition Query

# List all policy definitions (read-only, no filter params)
hcloud UCS ListPolicyDefinitions --cli-region=cn-north-4

Expected: Displays list of available policy definitions.

# Show a specific policy definition
hcloud UCS ShowPolicyDefinition --policydefinitionid=<definition-id> --cli-region=cn-north-4

Expected: Returns definition details including parameters and checks.

3.2 Policy Instance Management (Cluster-Level)

# Create a cluster-level test policy instance
hcloud UCS CreateClusterPolicyInstance --clusterid=<ucs-cluster-id> --constraintTemplateID=<template-id> --enforcementAction=warn --parameters='{"maxReplicas":"3"}' --cli-region=cn-north-4

Expected: Policy instance created successfully.

# Show policy instance details
hcloud UCS ShowPolicyInstance --policyinstanceid=<instance-id-from-response> --cli-region=cn-north-4

Expected: Returns policy instance details with status.

# Update policy instance
hcloud UCS UpdatePolicyInstance --policyinstanceid=<instance-id> --enforcementAction=deny --cli-region=cn-north-4

Expected: Policy instance updated successfully.

3.3 Policy Instance Management (Fleet Group-Level)

# Create a fleet group-level test policy instance
hcloud UCS CreateClusterGroupPolicyInstance --clustergroupid=<fleet-group-id> --constraintTemplateID=<template-id> --enforcementAction=warn --cli-region=cn-north-4

Expected: Policy instance created successfully.

3.4 Policy Enforcement (Cluster)

# Enable policy on cluster
hcloud UCS EnableClusterPolicy --clusterid=<ucs-cluster-id> --cli-region=cn-north-4

Expected: Policy enforcement enabled, enforcement job created.

# Disable policy on cluster (for testing)
hcloud UCS DisableClusterPolicy --clusterid=<ucs-cluster-id> --cli-region=cn-north-4

Expected: Policy enforcement suspended.

# Re-enable policy on cluster with retry
hcloud UCS EnableClusterPolicy --clusterid=<ucs-cluster-id> --retry=true --cli-region=cn-north-4

Expected: Policy enforcement resumed.

3.5 Policy Enforcement (Fleet Group)

# Enable policy on fleet group
hcloud UCS EnableClusterGroupPolicy --clustergroupid=<fleet-group-id> --cli-region=cn-north-4

Expected: Policy enforcement enabled across fleet group.

# Disable policy on fleet group
hcloud UCS DisableClusterGroupPolicy --clustergroupid=<fleet-group-id> --cli-region=cn-north-4

Expected: Policy enforcement suspended across fleet group.

3.6 Enforcement Job Status

# List policy enforcement jobs
hcloud UCS ListPolicyJobs --kind=EnablePolicy --cli-region=cn-north-4

Expected: Returns list of enforcement jobs with status.

# Show specific enforcement job details
hcloud UCS ShowPolicyJob --jobid=<job-id> --cli-region=cn-north-4

Expected: Returns detailed job information including status and any violations.

3.7 List Policy Instances

# List all policy instances (no filter params available)
hcloud UCS ListPolicyInstances --cli-region=cn-north-4

Expected: Displays list of all policy instances.

3.8 Clean Up

# Delete test policy instance (CAUTION: irreversible)
hcloud UCS DeletePolicyInstance --policyinstanceid=<instance-id> --cli-region=cn-north-4

Expected: Policy instance deleted successfully.

# Verify deletion
hcloud UCS ListPolicyInstances --cli-region=cn-north-4

Expected: Test policy no longer appears in list.

Verification Checklist