huawei-cloud-devkit-webui-create

Kunpeng DevKit WebUI Installation Skill

Overview

Create a Kunpeng (aarch64) ECS instance via Python SDK (ECS + KMS), use hcloud CLI for cloud operations (EIP, VPC), use Python paramiko SSH to connect and install Kunpeng DevKit in WebUI mode. Password never leaves Python process memory.

Tool separation principle:

• Python SDK — ECS creation + KMS encrypt/decrypt/delete (password never leaves Python process memory, never appears in ps -ef)
• hcloud CLI — All other cloud operations (EIP create/bind, VPC query, security group)
• Python paramiko — SSH connection + DevKit installation (password from KMS decrypt, stays in Python memory only)

Security architecture:

• ECS password is randomly generated by Python code (never typed by user, never passed via hcloud CLI, never exported to shell)
• Password is encrypted and stored in Huawei Cloud KMS via Python SDK (never appears in ps -ef, env vars, or conversation)
• Password is decrypted from KMS and passed to paramiko SSHClient.connect(password=...) (in Python process memory, not CLI args → no ps -ef leakage)
• Only kms_key_id and kms_cipher_text_file are exported (password itself is never exported; cipher text is written to a local file, never passed via command line)
• KMS key is scheduled for deletion after DevKit installation
• No COC dependency, no UniAgent dependency, no third-party skill dependency

⛔ Prohibited Operations (Security Constraints)

This skill strictly forbids the following operations, regardless of user requests:

If a user requests a prohibited operation, you must refuse and explain the security constraint.

Architecture

Kunpeng DevKit WebUI Installation
├── Task 0: hcloud Setup          (Install KooCLI, configure AK/SK authentication)
├── Task 1: Prepare Target Machine (Choose to create new ECS or use existing Kunpeng ECS)
│   ├── Option A: Create New ECS  (Python SDK for ECS + KMS, hcloud CLI for EIP/VPC)
│   │   ├── 1a. hcloud VPC: create empty security group for DevKit
│   │   ├── 1b. Python SDK: create ECS with random adminPass + dedicated security group (password never in ps -ef)
│   │   ├── 1c. Python SDK: KMS create key, encrypt password
│   │   ├── 1d. hcloud EIP: create and bind EIP to ECS
│   │   └── 1e. hcloud VPC: configure security group rules (or user manual)
│   └── Option B: Use Existing ECS (Provide EIP → Confirm security group)
├── Task 2: Python SSH Install    (paramiko SSH, password from KMS decrypt)
│   ├── 2a. Python SDK: KMS decrypt password (in process memory)
│   ├── 2b. paramiko SSH: connect to ECS EIP with decrypted password
│   ├── 2c. Upload install scripts via SFTP
│   ├── 2d. Execute install_devkit_webui.sh on remote ECS
│   ├── 2e. Execute verify_devkit.sh on remote ECS
│   └── 2f. KMS key is NOT cleaned up here (preserved until Task 4)
└── Task 3: Verify & Access       (Check WebUI access at https://:8086)
├── Task 4: Cleanup KMS Key      (Independent Python method, run ONLY after Task 3 verified success)
│   ├── 4a. Python SDK: kms_disable_key (password immediately unrecoverable)
│   └── 4b. Python SDK: kms_schedule_deletion (7 days, API minimum)
└── Task 5: Reset ECS Password   (If SSH access needed, reset password in ECS console — random password no longer recoverable)

Prerequisites

Prerequisite check 1/4: Environment variables for Python SDK credentials (highest priority)

The Python SDK scripts (create_ecs_and_setup_devkit.py) read credentials from environment variables, NOT from hcloud configure list (which shows masked/desensitized values). The following environment variables MUST be set before running any create / install / status subcommand:

Variable	Required	Description
HW_ACCESS_KEY	Yes	Huawei Cloud Access Key ID (AK)
HW_SECRET_KEY	Yes	Huawei Cloud Secret Access Key (SK)
HW_SECURITY_TOKEN	No	Temporary security token (only for temporary AK/SK)

Project ID: Not a prerequisite. The SDK auto-resolves the project ID from the region via IAM on the first API call (requires IAM read permission). The HUAWEICLOUD_SDK_PROJECT_ID environment variable is an optional override if set.

# Linux — verify HW_ACCESS_KEY / HW_SECRET_KEY are set (values never printed)
python3 -c 'import os,sys;ak=os.environ.get("HW_ACCESS_KEY","");sk=os.environ.get("HW_SECRET_KEY","");ok=bool(ak) and bool(sk);print("AK/SK configured OK" if ok else "ERROR: HW_ACCESS_KEY/HW_SECRET_KEY not set");sys.exit(0 if ok else 1)'
# Windows (cmd / PowerShell)
python -c "import os,sys;ak=os.environ.get('HW_ACCESS_KEY','');sk=os.environ.get('HW_SECRET_KEY','');ok=bool(ak) and bool(sk);print('AK/SK configured OK' if ok else 'ERROR: HW_ACCESS_KEY/HW_SECRET_KEY not set');sys.exit(0 if ok else 1)"

If verification reports ERROR (variables not set), configure them:

• Linux: add export HW_ACCESS_KEY=... / export HW_SECRET_KEY=... to your shell profile (~/.bashrc, ~/.zshrc) or a secrets manager, then source the profile.
• Windows: set system environment variables via the GUI (System Properties → Advanced → Environment Variables → System variables → New). See references/prerequisites.md "Windows GUI Setup" for step-by-step instructions. Avoid setx (it records credentials in command history).

⚠️ Never set these variables in conversation or hardcode them in scripts. After setting, restart the terminal/Python process and re-run the verification above.

Prerequisite check 2/4: Huawei Cloud CLI (hcloud / KooCLI) >= 3.2.0 required Run hcloud version to verify version >= 3.2.0. If not installed or version is too low, see references/cli-installation-guide.md for installation guide.

hcloud version

Prerequisite check 3/4: Python 3.8+ and huaweicloudsdkcore/ecs/kms + paramiko required

The ECS creation + KMS encryption + paramiko SSH script uses Python to keep password in process memory only. Install the required packages:

# Auto-use China mirror when system timezone is UTC+8 (faster in CN region; auto-detected via Python)
PIP_INDEX=$(python3 -c "import time;print('-i https://mirrors.huaweicloud.com/repository/pypi/simple' if -(time.timezone)//3600==8 else '')")
pip install $PIP_INDEX huaweicloudsdkcore huaweicloudsdkecs huaweicloudsdkkms paramiko

Other cloud operations (EIP, VPC) use hcloud CLI — no additional Python SDK packages needed.

Prerequisite check 4/4: Target ECS requirements

• Architecture: aarch64 (Kunpeng processor)
• OS: CentOS 7.6 or Ubuntu 18.04 (only these two are compatibility-verified)
• Disk space: >= 2GB available
• Memory: >= 4GB
• Access: root privileges required

---

Authentication

Security rules (must be followed):

• Prohibited from reading, echoing, or printing AK/SK values
• Prohibited from asking the user to input AK/SK directly in the conversation
• Prohibited from using hcloud configure set to pass plaintext credential values
• Prohibited from accepting AK/SK directly provided by the user in the conversation
• Only allowed to read credentials from environment variables or configured CLI config files

Check CLI configuration:

hcloud configure list

Verify the output contains valid AK/SK configuration.

If no valid credentials exist, stop here.

---

IAM Permission Policies

Ensure the IAM user has the required permissions (ECS/VPC/IMS/EIP/KMS, scoped to the DevKit workflow only). See references/iam-policies.md for the full permission table and recommended IAM policy JSON.

Permission boundaries:

• Scope constraint: Only create/manage resources named or tagged with devkit. Never modify or delete existing resources not created by this workflow.
• Must stop if: credentials missing or invalid, user declines any confirmation, package signature verification fails, or installation verification fails.
• Prohibited actions: deleting any existing ECS/VPC/security group, modifying IAM policies, accessing resources outside the DevKit workflow, running commands not documented in this skill.

---

Core Workflows

Task 0: hcloud Installation and Configuration

Install Huawei Cloud CLI tool and configure authentication.

📄 Detailed steps → references/cli-installation-guide.md

Task 1: Prepare Target Machine

Create a Kunpeng (aarch64) ECS instance, or use an existing Kunpeng ECS.

⚠️ Tool separation: Python SDK for ECS + KMS, hcloud CLI for EIP/VPC

• Python SDK (create_ecs_and_setup_devkit.py create): Generates random password, creates ECS, encrypts password in KMS. Password never leaves Python process memory. Outputs only server_id, kms_key_id, kms_cipher_text_file (cipher text written to file, never passed via CLI).
• hcloud CLI: All remaining operations — EIP create/bind, VPC query, security group.

📄 Detailed steps → references/ecs-creation-guide.md

Option A: Create New ECS — Sub-tasks:

1. 1a. Create empty security group — hcloud VPC CreateSecurityGroup --cli-region=$REGION --security_group.name=$SG_NAME — dedicated DevKit security group with no ingress rules (v3 API, no vpc_id needed)
2. 1b. Create ECS + KMS encrypt — scripts/create_ecs_and_setup_devkit.py create --security-group-id — attaches dedicated security group. Password never exported.
3. 1c. Bind EIP — hcloud EIP CreatePublicip + hcloud VPC ListPorts + hcloud EIP UpdatePublicip
4. 1d. Configure security group rules — Open ports 22 and 8086

Option B: Use Existing ECS

• Provide EIP
• Confirm security group ports 22 and 8086 are open
• If password is unknown, reset it via ECS API and store in KMS

Task 2: Python SSH Install DevKit

Use scripts/create_ecs_and_setup_devkit.py install to SSH into the ECS and install DevKit. Password is decrypted from KMS in Python memory and passed to paramiko — never appears in ps -ef or shell variables.

📄 Detailed steps → references/ssh-connection-guide.md | references/devkit-installation-workflow.md | references/devkit-installation-guide.md

Sub-tasks:

1. 2a. KMS decrypt — Python SDK reads cipher text from file and decrypts password from kms_key_id
2. 2b. paramiko SSH connect — SSHClient.connect(password=decrypted) — password in Python memory only
3. 2c. Upload scripts — SFTP upload install_devkit_webui.sh, auto_install_devkit.expect, verify_devkit.sh to /tmp/
4. 2d. Start DevKit install — Execute nohup bash /tmp/install_devkit_webui.sh & on remote ECS (background)
5. 2e. Poll install progress — Launch poll_devkit_status.py in background (output to log file), then use read tool with incrementing offset to read the log every 10-20s and report to user (doom-loop safe, continuous visibility; see Polling Progress below)
6. 2f. Verify installation — Run verify_devkit.sh and check results
7. 2g. Report result — If verification passed, prompt agent to proceed to Task 4 (cleanup-kms); if failed, KMS key is preserved for retry

⚠️ KMS key is NOT cleaned up in Task 2. Cleanup is a separate Task 4, executed only after the agent confirms DevKit installation success in Task 3.

⚠️ DevKit installation takes 5-15 minutes. The install subcommand starts the installation in the background and returns immediately. The agent MUST poll progress and report to the user continuously.

• Install process status: PREPARING (early stages [1/6]-[4/6]: env check / dependency install / package download / extraction) / RUNNING ([5/6] expect install) / DONE / NOT_STARTED
• Current stage: e.g. [2/6] Install Dependencies (parsed from wrapper log during PREPARING; empty otherwise)
• Services: devkit_nginx, gunicorn_framework, gunicorn_plugin (active/failed/inactive)
• Plugins: porting, affinity, devtools, debugger, sys_perf, java_perf, sys_diagnosis (installed/missing)
• Ports: 8086, 8002, 7996 (listening or not)
• Last log lines: PREPARING → from /tmp/devkit_install_wrapper.log (yum/wget output); RUNNING/DONE → from /tmp/devkit_install.log

Polling Progress (doom-loop safe): Launch poll_devkit_status.py in background (output to a log file), then use the read tool with incrementing offset every 10-20s to report progress until the log contains DONE/TIMEOUT. See references/polling-progress-guide.md for the exact steps, guidelines table, and status field reference.

Task 3: Verify & Access

Check WebUI access at https://:8086.

📄 Acceptance criteria → references/acceptance-criteria.md

⚠️ KMS key cleanup must NOT be performed until this verification passes. The agent must confirm all services are active and WebUI is accessible before proceeding to Task 4.

Task 4: Cleanup KMS Key (After Verified Success)

Only execute this task after Task 3 verification has passed. Use scripts/create_ecs_and_setup_devkit.py cleanup-kms to disable the KMS key and schedule its deletion. This is an independent Python method that does not require SSH or cipher text — only the KMS key ID.

Sub-tasks:

1. 4a. Disable KMS key — kms_disable_key() — password immediately becomes unrecoverable
2. 4b. Schedule KMS key deletion — kms_schedule_deletion(delay_days=7) — key permanently deleted after 7 days (API minimum)

python scripts/create_ecs_and_setup_devkit.py cleanup-kms \
  --region $R \

  --kms-key-id $KID \
  --delay-days 7

⚠️ Critical: Only run cleanup-kms after verified success

• If Task 3 verification FAILED: do NOT run cleanup-kms; KMS key is preserved for retry
• If Task 3 verification PASSED: run cleanup-kms to disable key + schedule deletion
• The --force flag allows scheduling deletion even if disable fails (use with caution)

Task 5: Reset ECS Password (If SSH Access Needed)

The ECS password was randomly generated by Python SDK and the KMS key is disabled after successful installation. The password is no longer recoverable. If the user needs SSH access to the ECS later, they must reset the password in the ECS console.

Steps:

1. Navigate to ECS console: https://console.huaweicloud.com/ecm/?region=#/detail/
2. Click "More" > "Reset Password"
3. Set a new password following the complexity requirements
4. Confirm the password reset

---

Core Commands

Python SDK (ECS + KMS — password never in ps -ef)

hcloud CLI (EIP, VPC — no password involved)

⚠️ Key constraints on Core Commands:

• ECS creation + KMS: MUST use scripts/create_ecs_and_setup_devkit.py — password never in ps -ef
• SSH + DevKit install: MUST use scripts/create_ecs_and_setup_devkit.py install — password from KMS, in paramiko memory only
• hcloud ECS CreateServers: MUST NOT include --server.adminPass
• EIP/VPC: MUST use hcloud CLI
• IMS ListImages: Only display CentOS 7.6 ARM and Ubuntu 18.04 ARM
• ECS NovaListFlavorsDetails: Only display flavors starting with k (Kunpeng)
• install_devkit_webui.sh must be executed via paramiko SSH (not scp + manual ssh)

---

Parameter Confirmation

Before executing any task, the following parameters must be confirmed with the user. Guessing is prohibited.

| Subnet | Required | Subnet for ECS creation; user selects from list of first 10 subnets | - | | Target machine method | Required | Create New Kunpeng ECS (recommended) or Use Existing Kunpeng ECS | Create New | | ECS Flavor | Required (New ECS) | Kunpeng flavor starting with k (e.g., kc1.xlarge.2); user selects from list | - | | OS Image | Required (New ECS) | CentOS 7.6 ARM or Ubuntu 18.04 ARM only; user selects from list | - | | Existing ECS EIP | Required (Existing ECS) | Public IP of existing Kunpeng ECS | - | | Security group method | Required | Manual (recommended) or Agent automatic; user chooses | Manual | | DevKit download URL | Optional | URL for DevKit-All tar.gz package | Default OBS URL for 26.1.RC1 |

Note: No password parameter is required. The password is randomly generated by Python SDK, encrypted via Python KMS SDK, and decrypted for paramiko SSH. The password is never exported from the Python process.

---

Script Tools

⚠️ Script usage rules:

• Must use existing scripts; do not write new expect/shell scripts as replacements
• Do not split install_devkit_webui.sh internal logic into individual SSH commands
• Do not create new install/verify scripts

---

Verification Method

See references/verification-method.md for details. For common issues and solutions, see references/troubleshooting.md.

Quick validation:

hcloud version && hcloud configure list
python scripts/create_ecs_and_setup_devkit.py install \
  --region $R --eip $EIP --kms-key-id $KID --kms-cipher-text-file $CT_FILE

Post-installation access: https://:8086 (accept self-signed certificate; default account: devadmin)

⚠️ Password reminder: The ECS password was randomly generated and the KMS key is disabled after successful installation. If you need SSH access to the ECS later, you must reset the password in the ECS console first:

ECS console: https://console.huaweicloud.com/ecm/?region=#/detail/

---

Security Design

The security architecture keeps the ECS password exclusively in Python process memory and KMS — never in ps -ef, shell variables, environment variables, or conversation. Tool separation: Python SDK for ECS creation + KMS encrypt/decrypt/delete, hcloud CLI for EIP/VPC (no password), Python paramiko for SSH + DevKit install. The KMS key is preserved on failure (for retry) and only disabled + scheduled for deletion after verified success.

📄 Full details (tool separation table, password leakage risk elimination, password lifecycle) → references/security-design.md

---

References

| iam-policies.md | Required IAM permissions | | verification-method.md | Installation result verification method | | acceptance-criteria.md | Installation acceptance criteria | | troubleshooting.md | Common installation issues and solutions | | polling-progress-guide.md | Doom-loop safe progress polling detailed guide | | security-design.md | Security design: tool separation, password lifecycle | | install_devkit_webui.sh | One-click installation script | | auto_install_devkit.expect | expect automated interactive installation | | verify_devkit.sh | Installation verification script | | create_ecs_and_setup_devkit.py | ECS + KMS + paramiko SSH DevKit script (password never in ps -ef) | | poll_devkit_status.py | Doom-loop safe progress polling (background + read tool, 10-20s interval) |