huawei-cloud-modelarts-resource-pool-management

Huawei Cloud ModelArts Resource Pool Management

Full lifecycle management for ModelArts dedicated resource pools and node pools via hcloud CLI — 53 operations across 10 functional domains.

---

Overview

This skill enables users to manage Huawei Cloud ModelArts dedicated resource pools (专属资源池) and node pools through the hcloud CLI. It covers the complete lifecycle including resource pool CRUD, node management, node pool management, network resources, tag management, plugin management, workloads, scheduled events, OS configuration, and resource flavor queries. BSS pricing inquiry is included for chargeable operations.

Architecture

User Request → Agent → hcloud ModelArts  --cli-region={region} [--params] → Huawei Cloud ModelArts API

Applicable Scenarios

• Resource Pool Management: Create, list, show, update, delete resource pools; monitor, statistics, node config, order management
• Pool Node Management: List/show nodes; batch delete, update, lock, unlock, reboot, reset, resize, migrate, bind
• Node Pool Management: Create, list, show, update, delete node pools within a resource pool
• Network Resources: Create, list, show, update, delete ModelArts networks; query available IPs
• Tag Management: List, show, batch create, batch delete resource pool tags
• Plugin Management: List plugin templates; list and create pool plugins
• Jobs & Workloads: List workloads, show workload statistics, list jobs
• Scheduled Events: List and accept scheduled events
• OS Configuration: Show OS user config and quotas
• Resource Flavors & Events: List resource flavors, events, node config templates

---

Prerequisites

1. hcloud CLI installed and authenticated — Reference: https://support.huaweicloud.com/qs-hcli/hcli_02_003.html
2. Huawei Cloud AK/SK configured via hcloud (see Security & Credential Check below)
3. ModelArts service enabled in the target region
4. IAM permissions — See references/iam-policies.md

Security & Credential Check

⚠️ CRITICAL: This section defines the agent's security boundary. Follow it strictly.

🔒 Security Rules (MANDATORY)

• 🚫 NEVER read, echo, or print AK/SK values (e.g., cat ~/.hcloud/config.json, echo $HW_ACCESS_KEY is FORBIDDEN)
• 🚫 NEVER read or cat credential files such as ~/.hcloud/config.json or any file that may contain secrets
• 🚫 NEVER ask the user to input AK/SK directly in the conversation or command line
• 🚫 NEVER execute hcloud configure set --cli-access-key=... --cli-secret-key=... — credential configuration is the user's responsibility, done outside the agent session
• 🚫 NEVER pass --cli-access-key/--cli-secret-key on every API call — they will be exposed in process listings (ps aux) for the entire request duration
• ✅ ALWAYS use hcloud configure list to check credential status (presence check only, not values)
• ✅ If no valid profile exists, STOP and instruct the user to configure credentials outside this session
• ✅ Recommend using IAM user with minimal permissions instead of main account

✅ Agent Credential Check (the ONLY acceptable check)

# Step 1: Check credential status — presence only, not values
hcloud configure list

• ✅ Expected: Shows a valid profile with mode: AKSK

• ❌ If empty/invalid → Guide the user with the 3-step process below:

  Step-by-step guidance (copy-paste for the user):

  "No valid credentials found. Please follow these 3 steps in your terminal:"

  ① Get your AK/SK Log in to Huawei Cloud Console → IAM → Access Keys. If you don't have one, click "Create Access Key" and save it securely.

  ② Run this in your terminal (one-time setup):

  hcloud configure set --cli-access-key= --cli-secret-key=
  

  (Replace and with the values from step ①)

  ③ Come back and tell me "configured", I'll verify it works.

  Note: The configure set command stores your credentials in ~/.hcloud/config.json. After that, all hcloud commands use them automatically — no need to pass AK/SK again.

  Agent: DO NOT execute any configure set command yourself.

🔧 User's Responsibility (for documentation, NOT agent execution)

The user configures credentials outside the agent session (in their own terminal):

# One-time setup — run this in your terminal, NOT in the agent chat
HISTCONTROL=ignorespace
 hcloud configure set --cli-access-key= --cli-secret-key=

⚠️ Note: hcloud CLI does NOT read HW_ACCESS_KEY/HW_SECRET_KEY environment variables (those are for Python SDK only). hcloud configure set is the only supported credential configuration method.

---

Workflow

Step 1: Identify the Operation

Determine which resource pool operation the user needs based on their request:

Step 2: Execute CLI Command

hcloud ModelArts  --cli-region={region} [--key=value ...]

{region} must be replaced with the actual region, e.g., cn-north-4. Do NOT hardcode the region.

Step 2.5: ⚠️ Pre-Flight Check (MANDATORY for Write Operations)

Before executing ANY write operation (Create/Update/Delete/Patch/Batch/Accept), you MUST:

1. Read references/known-issues.md — Scan the relevant section for the target API
2. Check the Pre-Flight Checklist at the bottom of that file — Verify all conditions are met
3. Apply documented workarounds — Especially for the following high-risk operations:

Operation	Critical Issue	Action Required
PatchPool, PatchNetwork, PatchNodePool	Content-Type must be application/merge-patch+json	Use --cli-jsonInput with header section
BatchUpdatePoolNodes	--action values are not true/false	Use --cli-jsonInput with string action
CreatePool	Network name must include project ID suffix	Query ListNetworks for exact name
CreateNodePool	count ≥ 1, maxCount ≤ count	Verify constraints before execution
ShowNetworkAvailableIp	network_id from status.subnets[0].networkId	Query ShowNetwork first
ListEvents	--resource must be pools (plural)	Use plural form
BatchResetPoolNodes	strategy not supported for VM pools	Known limitation, inform user
BatchResizePoolNodes	Only supports hyperinstance nodes	Known limitation, inform user
DeleteNetwork	Fails if network in use by pool	Delete pool first

Skipping this step will cause preventable failures. Every issue in the table was discovered through real API testing.

Step 3: Handle Write Operations

For all write operations (Create/Update/Delete/Patch/Batch/Accept), prompt the user for confirmation before execution. For chargeable operations (CreatePool, CreateNodePool, PatchNodePool, BatchResizePoolNodes, CreateOrderId), inquire BSS pricing first to inform the user of costs. See references/pricing-inquiry.md for the pricing inquiry workflow.

---

KooCLI Command Format Standard

hcloud ModelArts  --cli-region={region} [--key=value ...]

Note: --project_id is auto-resolved from authentication credentials if omitted. Include it explicitly only when targeting a specific project.

Complex parameters: For complex nested parameters (e.g., metadata, spec), use --cli-jsonInput=/path/to/file.json. The JSON file must wrap body in {"body": {...}} envelope.

---

Core Commands

All 53 CLI command examples across 10 functional domains are documented in a separate reference file.

📖 For detailed command syntax, parameters, and examples, read references/cli-command-examples.md

Quick Index

When executing any command, always refer to the reference file for exact parameter names, required/optional flags, and usage patterns.

---

Parameter Confirmation

---

SDK Fallback

If a CLI operation fails due to a CLI bug, fall back to SDK:

from huaweicloudsdkcore.auth.credentials import BasicCredentials
from huaweicloudsdkmodelarts.v2.modelarts_client import ModelArtsClient
from huaweicloudsdkmodelarts.v2.region.modelarts_region import ModelArtsRegion

credentials = BasicCredentials(ak="{AK}", sk="{SK}", project_id="{project_id}")
client = ModelArtsClient.new_builder() \
    .with_credentials(credentials) \
    .with_region(ModelArtsRegion.value_of("{region}")) \
    .build()

---

Reference Documents

---

Known Issues Summary

⚠️ Read references/known-issues.md BEFORE any write operation. All issues below were verified through real API testing.

Critical (will cause immediate failure):

• PATCH operations (PatchPool/PatchNetwork/PatchNodePool): Must use --cli-jsonInput with Content-Type: application/merge-patch+json header
• BatchUpdatePoolNodes: --action values are openHaRedundant/closeHaRedundant/createTags/deleteTags, NOT true/false; use --cli-jsonInput
• CreatePool: Network name must be full name with project ID suffix; pool type is Dedicate (no trailing d)
• CreateNodePool: count must be ≥ 1; maxCount must be ≤ count
• ShowNetworkAvailableIp: --network_id must come from status.subnets[0].networkId, not spec.subnets[0].id
• ListEvents: --resource must be pools (plural), not pool

Known API limitations:

• BatchResetPoolNodes: rollingConfig.strategy has no valid value for VM pools
• BatchResizePoolNodes: Only supports hyperinstance scaling, not regular VM nodes
• BatchMigratePoolNodes: Source and target cluster names must differ
• DeleteNetwork: Fails if network is in use by a resource pool (delete pool first)

Data field locations:

• Node tags: metadata.annotations["os.modelarts/tms.tags"] (JSON string, not metadata.labels)
• Node lock status: metadata.annotations["os.modelarts.node/lock.action"]

See references/known-issues.md for full details, workarounds, and the Pre-Flight Checklist.

---

Notes

• All write operations (Create/Update/Delete/Patch/Batch/Accept) require user confirmation before execution
• Chargeable operations (CreatePool, CreateNodePool, PatchNodePool, BatchResizePoolNodes, CreateOrderId) require BSS pricing inquiry to inform users of costs before execution
• Region is not hardcoded — uses {region} placeholder
• project_id is auto-resolved when omitted
• No hardcoded AK/SK in any file — credentials configured via hcloud configure set by the user outside the agent session
• Agent must use hcloud configure list for credential presence check only — NEVER read/echo AK/SK values
• If no valid credentials found, agent must STOP and guide user through the 3-step configuration process (see Prerequisites section)
• SDK fallback available when CLI encounters bugs
• Complex nested parameters use --cli-jsonInput with JSON file