仓库原始内容
按源仓库内容呈现，保留标题、案例、代码、表格、链接以及原文引用的演示图片。
Kunpeng DevKit WebUI Installation Skill
Overview
Create a Kunpeng (aarch64) ECS instance via Python SDK (ECS + KMS), use hcloud CLI for cloud operations (EIP, VPC), use Python paramiko SSH to connect and install Kunpeng DevKit in WebUI mode. Password never leaves Python process memory.
Tool separation principle:
- Python SDK — ECS creation + KMS encrypt/decrypt/delete (password never leaves Python process memory, never appears in `ps -ef`)
- hcloud CLI — All other cloud operations (EIP create/bind, VPC query, security group)
- Python paramiko — SSH connection + DevKit installation (password from KMS decrypt, stays in Python memory only)
Security architecture:
- ECS password is randomly generated by Python code (never typed by user, never passed via hcloud CLI, never exported to shell)
- Password is encrypted and stored in Huawei Cloud KMS via Python SDK (never appears in
ps -ef, env vars, or conversation) - Password is decrypted from KMS and passed to paramiko
SSHClient.connect(password=...)(in Python process memory, not CLI args → nops -efleakage) - Only
kms_key_idandkms_cipher_text_fileare exported (password itself is never exported; cipher text is written to a local file, never passed via command line) - KMS key is scheduled for deletion after DevKit installation
- No COC dependency, no UniAgent dependency, no third-party skill dependency
⛔ Prohibited Operations (Security Constraints)
This skill strictly forbids the following operations, regardless of user requests:
| Prohibited Operation | Reason |
|---|---|
❌ Use --server.adminPass in hcloud ECS CreateServers | Password appears in ps -ef output |
❌ Use hcloud AOM BatchImportAgent --agent_import_param_list.1.password=... | Password appears in ps -ef output |
| ❌ Accept ECS password in chat conversation | Password must never appear in conversation |
❌ Use expect + $env(DEVKIT_ECS_PASSWORD) for SSH | Environment variable can be read by other processes |
❌ Use sshpass -p <password> for SSH | Password appears in ps -ef output |
❌ Use ssh -o PasswordAuthentication with password on CLI | Password appears in ps -ef output |
| ❌ Hardcode password in scripts or command-line arguments | Password exposure risk |
❌ Use question tool to ask user for password | Password must never appear in conversation |
| ❌ Print or log the ECS password in any output | Password must only exist in Python process memory and KMS |
| ❌ Export password to shell variables or stdout | Password must stay in Python process; only KMS keyid and ciphertext_file path are exported |
| ❌ Pass KMS cipher text via command line arguments | Cipher text appears in ps -ef; must use --kms-cipher-text-file to read from local file |
| ❌ Auto-select ECS flavor or image without user confirmation | Must let user choose from available options |
| ❌ Display aarch64 images other than CentOS 7.6 and Ubuntu 18.04 | Only these two images are compatibility-verified |
| ❌ Select x86 flavors (c6/c7 etc.) | DevKit requires aarch64 (Kunpeng) architecture |
| ❌ Skip security group port confirmation | Ports 22 and 8086 must be opened before SSH |
| ❌ Auto-modify security group rules without user consent | Must ask user to choose manual or automatic mode |
| ❌ Write new install/verify scripts instead of using existing ones | Must use scripts in scripts/ directory |
| ❌ Disable or delete KMS key when installation verification fails | KMS key must be preserved for retry; only destroy after verified success (via Task 4 cleanup-kms) |
| ❌ Run cleanup-kms before Task 3 verification passes | KMS key must be preserved until agent confirms DevKit installation success |
❌ Run expect script without verifying expect binary is installed | Shebang #!/usr/bin/expect -f fails with misleading "No such file or directory" if expect is missing |
If a user requests a prohibited operation, you must refuse and explain the security constraint.
Architecture
Kunpeng DevKit WebUI Installation
├── Task 0: hcloud Setup (Install KooCLI, configure AK/SK authentication)
├── Task 1: Prepare Target Machine (Choose to create new ECS or use existing Kunpeng ECS)
│ ├── Option A: Create New ECS (Python SDK for ECS + KMS, hcloud CLI for EIP/VPC)
│ │ ├── 1a. hcloud VPC: create empty security group for DevKit
│ │ ├── 1b. Python SDK: create ECS with random adminPass + dedicated security group (password never in ps -ef)
│ │ ├── 1c. Python SDK: KMS create key, encrypt password
│ │ ├── 1d. hcloud EIP: create and bind EIP to ECS
│ │ └── 1e. hcloud VPC: configure security group rules (or user manual)
│ └── Option B: Use Existing ECS (Provide EIP → Confirm security group)
├── Task 2: Python SSH Install (paramiko SSH, password from KMS decrypt)
│ ├── 2a. Python SDK: KMS decrypt password (in process memory)
│ ├── 2b. paramiko SSH: connect to ECS EIP with decrypted password
│ ├── 2c. Upload install scripts via SFTP
│ ├── 2d. Execute install_devkit_webui.sh on remote ECS
│ ├── 2e. Execute verify_devkit.sh on remote ECS
│ └── 2f. KMS key is NOT cleaned up here (preserved until Task 4)
└── Task 3: Verify & Access (Check WebUI access at https://<EIP>:8086)
├── Task 4: Cleanup KMS Key (Independent Python method, run ONLY after Task 3 verified success)
│ ├── 4a. Python SDK: kms_disable_key (password immediately unrecoverable)
│ └── 4b. Python SDK: kms_schedule_deletion (7 days, API minimum)
└── Task 5: Reset ECS Password (If SSH access needed, reset password in ECS console — random password no longer recoverable)Prerequisites
Prerequisite check 1/4: Environment variables for Python SDK credentials (highest priority) The Python SDK scripts (create_ecs_and_setup_devkit.py) read credentials from environment variables, NOT from `hcloud configure list` (which shows masked/desensitized values). The following environment variables MUST be set before running anycreate/install/statussubcommand: | Variable | Required | Description | |----------|----------|-------------| |HW_ACCESS_KEY| Yes | Huawei Cloud Access Key ID (AK) | |HW_SECRET_KEY| Yes | Huawei Cloud Secret Access Key (SK) | |HW_SECURITY_TOKEN| No | Temporary security token (only for temporary AK/SK) | Project ID: Not a prerequisite. The SDK auto-resolves the project ID from the region via IAM on the first API call (requires IAM read permission). TheHUAWEICLOUD_SDK_PROJECT_IDenvironment variable is an optional override if set. ``bash # Linux — verify HW_ACCESS_KEY / HW_SECRET_KEY are set (values never printed) python3 -c 'import os,sys;ak=os.environ.get("HW_ACCESS_KEY","");sk=os.environ.get("HW_SECRET_KEY","");ok=bool(ak) and bool(sk);print("AK/SK configured OK" if ok else "ERROR: HW_ACCESS_KEY/HW_SECRET_KEY not set");sys.exit(0 if ok else 1)' # Windows (cmd / PowerShell) python -c "import os,sys;ak=os.environ.get('HW_ACCESS_KEY','');sk=os.environ.get('HW_SECRET_KEY','');ok=bool(ak) and bool(sk);print('AK/SK configured OK' if ok else 'ERROR: HW_ACCESS_KEY/HW_SECRET_KEY not set');sys.exit(0 if ok else 1)"**If verification reports ERROR (variables not set), configure them:** - **Linux**: addexport HWACCESSKEY=.../export HWSECRETKEY=...to your shell profile (~/.bashrc,~/.zshrc) or a secrets manager, thensourcethe profile. - **Windows**: set **system environment variables** via the GUI (System Properties → Advanced → Environment Variables → System variables → New). See [references/prerequisites.md](references/prerequisites.md) "Windows GUI Setup" for step-by-step instructions. Avoidsetx` (it records credentials in command history). ⚠️ Never set these variables in conversation or hardcode them in scripts. After setting, restart the terminal/Python process and re-run the verification above.
Prerequisite check 2/4: Huawei Cloud CLI (hcloud / KooCLI) >= 3.2.0 required Run hcloud version to verify version >= 3.2.0. If not installed or version is too low, see references/cli-installation-guide.md for installation guide.bash
hcloud versionPrerequisite check 3/4: Python 3.8+ and huaweicloudsdkcore/ecs/kms + paramiko required The ECS creation + KMS encryption + paramiko SSH script uses Python to keep password in process memory only. Install the required packages: ``bash # Auto-use China mirror when system timezone is UTC+8 (faster in CN region; auto-detected via Python) PIP_INDEX=$(python3 -c "import time;print('-i https://mirrors.huaweicloud.com/repository/pypi/simple' if -(time.timezone)//3600==8 else '')") pip install $PIP_INDEX huaweicloudsdkcore huaweicloudsdkecs huaweicloudsdkkms paramiko `` Other cloud operations (EIP, VPC) use hcloud CLI — no additional Python SDK packages needed.Prerequisite check 4/4: Target ECS requirements - Architecture: aarch64 (Kunpeng processor) - OS: CentOS 7.6 or Ubuntu 18.04 (only these two are compatibility-verified) - Disk space: >= 2GB available - Memory: >= 4GB - Access: root privileges required
Authentication
Security rules (must be followed): - Prohibited from reading, echoing, or printing AK/SK values - Prohibited from asking the user to input AK/SK directly in the conversation - Prohibited from usinghcloud configure setto pass plaintext credential values - Prohibited from accepting AK/SK directly provided by the user in the conversation - Only allowed to read credentials from environment variables or configured CLI config files Check CLI configuration: ``bash hcloud configure list`` Verify the output contains valid AK/SK configuration. If no valid credentials exist, stop here.
IAM Permission Policies
Ensure the IAM user has the required permissions (ECS/VPC/IMS/EIP/KMS, scoped to the DevKit workflow only). See references/iam-policies.md for the full permission table and recommended IAM policy JSON.
Permission boundaries:
- Scope constraint: Only create/manage resources named or tagged with
devkit. Never modify or delete existing resources not created by this workflow. - Must stop if: credentials missing or invalid, user declines any confirmation, package signature verification fails, or installation verification fails.
- Prohibited actions: deleting any existing ECS/VPC/security group, modifying IAM policies, accessing resources outside the DevKit workflow, running commands not documented in this skill.
Core Workflows
Task 0: hcloud Installation and Configuration
Install Huawei Cloud CLI tool and configure authentication.
📄 Detailed steps → references/cli-installation-guide.md
Task 1: Prepare Target Machine
Create a Kunpeng (aarch64) ECS instance, or use an existing Kunpeng ECS.
⚠️ Tool separation: Python SDK for ECS + KMS, hcloud CLI for EIP/VPC - Python SDK (create_ecs_and_setup_devkit.py create): Generates random password, creates ECS, encrypts password in KMS. Password never leaves Python process memory. Outputs onlyserver_id,kms_key_id,kms_cipher_text_file(cipher text written to file, never passed via CLI). - hcloud CLI: All remaining operations — EIP create/bind, VPC query, security group.
📄 Detailed steps → references/ecs-creation-guide.md
Option A: Create New ECS — Sub-tasks:
- 1a. Create empty security group —
hcloud VPC CreateSecurityGroup --cli-region=$REGION --security_group.name=$SG_NAME— dedicated DevKit security group with no ingress rules (v3 API, no vpc_id needed) - 1b. Create ECS + KMS encrypt —
scripts/create_ecs_and_setup_devkit.py create --security-group-id— attaches dedicated security group. Password never exported. - 1c. Bind EIP —
hcloud EIP CreatePublicip+hcloud VPC ListPorts+hcloud EIP UpdatePublicip - 1d. Configure security group rules — Open ports 22 and 8086
Option B: Use Existing ECS
- Provide EIP
- Confirm security group ports 22 and 8086 are open
- If password is unknown, reset it via ECS API and store in KMS
Task 2: Python SSH Install DevKit
Use scripts/create_ecs_and_setup_devkit.py install to SSH into the ECS and install DevKit. Password is decrypted from KMS in Python memory and passed to paramiko — never appears in `ps -ef` or shell variables.
📄 Detailed steps → references/ssh-connection-guide.md | references/devkit-installation-workflow.md | references/devkit-installation-guide.md
Sub-tasks:
- 2a. KMS decrypt — Python SDK reads cipher text from file and decrypts password from
kms_key_id - 2b. paramiko SSH connect —
SSHClient.connect(password=decrypted)— password in Python memory only - 2c. Upload scripts — SFTP upload
install_devkit_webui.sh,auto_install_devkit.expect,verify_devkit.shto/tmp/ - 2d. Start DevKit install — Execute
nohup bash /tmp/install_devkit_webui.sh <url> &on remote ECS (background) - 2e. Poll install progress — Launch
poll_devkit_status.pyin background (output to log file), then usereadtool with incrementing offset to read the log every 10-20s and report to user (doom-loop safe, continuous visibility; see Polling Progress below) - 2f. Verify installation — Run
verify_devkit.shand check results - 2g. Report result — If verification passed, prompt agent to proceed to Task 4 (cleanup-kms); if failed, KMS key is preserved for retry
⚠️ KMS key is NOT cleaned up in Task 2. Cleanup is a separate Task 4, executed only after the agent confirms DevKit installation success in Task 3.
⚠️ DevKit installation takes 5-15 minutes. Theinstallsubcommand starts the installation in the background and returns immediately. The agent MUST poll progress and report to the user continuously. - Install process status:PREPARING(early stages [1/6]-[4/6]: env check / dependency install / package download / extraction) /RUNNING([5/6] expect install) /DONE/NOT_STARTED- Current stage: e.g.[2/6] Install Dependencies(parsed from wrapper log during PREPARING; empty otherwise) - Services: devkitnginx, gunicornframework, gunicornplugin (active/failed/inactive) - **Plugins**: porting, affinity, devtools, debugger, sysperf, javaperf, sysdiagnosis (installed/missing) - Ports: 8086, 8002, 7996 (listening or not) - Last log lines: PREPARING → from/tmp/devkit_install_wrapper.log(yum/wget output); RUNNING/DONE → from/tmp/devkit_install.logPolling Progress (doom-loop safe): Launchpoll_devkit_status.pyin background (output to a log file), then use thereadtool with incrementing offset every 10-20s to report progress until the log containsDONE/TIMEOUT. See references/polling-progress-guide.md for the exact steps, guidelines table, and status field reference.
Task 3: Verify & Access
Check WebUI access at https://<EIP>:8086.
📄 Acceptance criteria → references/acceptance-criteria.md
⚠️ KMS key cleanup must NOT be performed until this verification passes. The agent must confirm all services are active and WebUI is accessible before proceeding to Task 4.
Task 4: Cleanup KMS Key (After Verified Success)
Only execute this task after Task 3 verification has passed. Use scripts/create_ecs_and_setup_devkit.py cleanup-kms to disable the KMS key and schedule its deletion. This is an independent Python method that does not require SSH or cipher text — only the KMS key ID.
Sub-tasks:
- 4a. Disable KMS key —
kms_disable_key()— password immediately becomes unrecoverable - 4b. Schedule KMS key deletion —
kms_schedule_deletion(delay_days=7)— key permanently deleted after 7 days (API minimum)
bash
python scripts/create_ecs_and_setup_devkit.py cleanup-kms \
--region $R \
--kms-key-id $KID \
--delay-days 7⚠️ Critical: Only run cleanup-kms after verified success - If Task 3 verification FAILED: do NOT run cleanup-kms; KMS key is preserved for retry - If Task 3 verification PASSED: run cleanup-kms to disable key + schedule deletion - The --force flag allows scheduling deletion even if disable fails (use with caution)Task 5: Reset ECS Password (If SSH Access Needed)
The ECS password was randomly generated by Python SDK and the KMS key is disabled after successful installation. The password is no longer recoverable. If the user needs SSH access to the ECS later, they must reset the password in the ECS console.
Steps:
- Navigate to ECS console:
https://console.huaweicloud.com/ecm/?region=<REGION>#/detail/<SERVER_ID> - Click "More" > "Reset Password"
- Set a new password following the complexity requirements
- Confirm the password reset
Core Commands
Python SDK (ECS + KMS — password never in ps -ef)
| Command | Description |
|---|---|
pip install huaweicloudsdkcore huaweicloudsdkecs huaweicloudsdkkms paramiko | Install Python SDK + paramiko (for UTC+8, add -i https://mirrors.huaweicloud.com/repository/pypi/simple) |
python scripts/create_ecs_and_setup_devkit.py create --region $R --vpc-id $V --subnet-id $S --flavor $F --image-id $I --az $A --ecs-name $N | Phase 1: Create ECS + KMS encrypt |
python scripts/create_ecs_and_setup_devkit.py install --region $R --eip $EIP --kms-key-id $KID --kms-cipher-text-file $CT_FILE | Phase 2: SSH start DevKit install in background, returns immediately (add --wait to poll+verify) |
python scripts/create_ecs_and_setup_devkit.py status --region $R --eip $EIP --kms-key-id $KID --kms-cipher-text-file $CT_FILE | Poll install progress (every 30s) |
python scripts/create_ecs_and_setup_devkit.py cleanup-kms --region $R --kms-key-id $KID --delay-days 7 | Phase 3: Disable + schedule KMS key deletion (after verified success) |
hcloud CLI (EIP, VPC — no password involved)
| Command | Description |
|---|---|
hcloud VPC ListVpcs --cli-region=$REGION | List VPCs for subnet selection |
hcloud VPC ListSubnets --cli-region=$REGION --limit=10 | List subnets (first 10) for user selection |
hcloud ECS NovaListAvailabilityZones --cli-region=$REGION | List all availability zones in the region |
hcloud ECS ListFlavors --cli-region=$REGION --availability_zone=<AZ> | Query flavors available in a specific AZ (filter for kc1/kx1 to find AZs with Kunpeng servers) |
hcloud ECS NovaListFlavorsDetails --cli-region=$REGION | Query ECS flavors (filter for kc1/kx1 Kunpeng flavors) |
hcloud IMS ListImages --cli-region=$REGION --__imagetype=gold --status=active | Query public images (filter for CentOS 7.6 ARM + Ubuntu 18.04 ARM only) |
hcloud EIP CreatePublicip --cli-region=$REGION --publicip.type=5_bgp --bandwidth.share_type=PER --bandwidth.name=$ECS_NAME-eip --bandwidth.size=300 --bandwidth.charge_mode=traffic | Create pay-per-use 300Mbit/s EIP (bandwidth.name required when share_type=PER) |
hcloud VPC ListPorts --cli-region=$REGION --device_id.1=$SERVER_ID | Get port_id for EIP binding |
hcloud EIP UpdatePublicip --cli-region=$REGION --publicip_id=$EIP_ID --publicip.associate_instance_type=PORT --publicip.associate_instance_id=$PORT_ID | Bind EIP to ECS port (v3 API) |
hcloud VPC CreateSecurityGroupRule --cli-region=$REGION ... | Add security group ingress rule (ports 22/8086) |
⚠️ Key constraints on Core Commands: - ECS creation + KMS: MUST use `scripts/create_ecs_and_setup_devkit.py` — password never inps -ef- SSH + DevKit install: MUST use `scripts/create_ecs_and_setup_devkit.py install` — password from KMS, in paramiko memory only -hcloud ECS CreateServers: MUST NOT include `--server.adminPass` - EIP/VPC: MUST use hcloud CLI -IMS ListImages: Only display CentOS 7.6 ARM and Ubuntu 18.04 ARM -ECS NovaListFlavorsDetails: Only display flavors starting withk(Kunpeng) -install_devkit_webui.shmust be executed via paramiko SSH (not scp + manual ssh)
Parameter Confirmation
Before executing any task, the following parameters must be confirmed with the user. Guessing is prohibited.
| Parameter | Required/Optional | Description | Default |
|---|---|---|---|
| Region | Required | Huawei Cloud region (e.g., cn-south-1, cn-north-4); must be explicitly selected by the user | - |
| Subnet | Required | Subnet for ECS creation; user selects from list of first 10 subnets | - | | Target machine method | Required | Create New Kunpeng ECS (recommended) or Use Existing Kunpeng ECS | Create New | | ECS Flavor | Required (New ECS) | Kunpeng flavor starting with k (e.g., kc1.xlarge.2); user selects from list | - | | OS Image | Required (New ECS) | CentOS 7.6 ARM or Ubuntu 18.04 ARM only; user selects from list | - | | Existing ECS EIP | Required (Existing ECS) | Public IP of existing Kunpeng ECS | - | | Security group method | Required | Manual (recommended) or Agent automatic; user chooses | Manual | | DevKit download URL | Optional | URL for DevKit-All tar.gz package | Default OBS URL for 26.1.RC1 |
Note: No password parameter is required. The password is randomly generated by Python SDK, encrypted via Python KMS SDK, and decrypted for paramiko SSH. The password is never exported from the Python process.
Script Tools
| Script | Description |
|---|---|
| create_ecs_and_setup_devkit.py | ECS creation + KMS encrypt/decrypt + paramiko SSH DevKit install (password never in ps -ef). Subcommands: create, install, status, cleanup-kms. See Core Commands above for usage. |
| install_devkit_webui.sh | One-click installation script, uploaded and executed on the remote ECS via paramiko. |
| auto_install_devkit.expect | Interactive installation automation, used by install_devkit_webui.sh. |
| verify_devkit.sh | Installation verification, executed on the remote ECS via paramiko. |
| poll_devkit_status.py | Doom-loop safe progress polling (background + read tool). See references/polling-progress-guide.md. |
⚠️ Script usage rules: - Must use existing scripts; do not write new expect/shell scripts as replacements - Do not split install_devkit_webui.sh internal logic into individual SSH commands - Do not create new install/verify scriptsVerification Method
See references/verification-method.md for details. For common issues and solutions, see references/troubleshooting.md.
Quick validation:
bash
hcloud version && hcloud configure list
python scripts/create_ecs_and_setup_devkit.py install \
--region $R --eip $EIP --kms-key-id $KID --kms-cipher-text-file $CT_FILEPost-installation access: https://<EIP>:8086 (accept self-signed certificate; default account: devadmin)
⚠️ Password reminder: The ECS password was randomly generated and the KMS key is disabled after successful installation. If you need SSH access to the ECS later, you must reset the password in the ECS console first: ``ECS console: https://console.huaweicloud.com/ecm/?region=<REGION>#/detail/<SERVER_ID>
Security Design
The security architecture keeps the ECS password exclusively in Python process memory and KMS — never in ps -ef, shell variables, environment variables, or conversation. Tool separation: Python SDK for ECS creation + KMS encrypt/decrypt/delete, hcloud CLI for EIP/VPC (no password), Python paramiko for SSH + DevKit install. The KMS key is preserved on failure (for retry) and only disabled + scheduled for deletion after verified success.
📄 Full details (tool separation table, password leakage risk elimination, password lifecycle) → references/security-design.md
References
| Document | Description |
|---|---|
| prerequisites.md | Prerequisites + Windows GUI env var setup |
| cli-installation-guide.md | hcloud (KooCLI) installation and configuration |
| ecs-creation-guide.md | Kunpeng ECS creation detailed steps (Python SDK + hcloud CLI) |
| ssh-connection-guide.md | Python paramiko SSH connection guide |
| devkit-installation-workflow.md | Task 2-3 installation detailed steps |
| devkit-installation-guide.md | Complete installation steps |
| iam-policies.md | Required IAM permissions | | verification-method.md | Installation result verification method | | acceptance-criteria.md | Installation acceptance criteria | | troubleshooting.md | Common installation issues and solutions | | polling-progress-guide.md | Doom-loop safe progress polling detailed guide | | security-design.md | Security design: tool separation, password lifecycle | | install_devkit_webui.sh | One-click installation script | | auto_install_devkit.expect | expect automated interactive installation | | verify_devkit.sh | Installation verification script | | create_ecs_and_setup_devkit.py | ECS + KMS + paramiko SSH DevKit script (password never in ps -ef) | | poll_devkit_status.py | Doom-loop safe progress polling (background + read tool, 10-20s interval) |
