Install Kunpeng DevKit in WebUI mode on Huawei Cloud. Create a Kunpeng (aarch64) ECS via Python SDK with random password, encrypt password via Python KMS SDK, use hcloud CLI for EIP/VPC operations, use Python paramiko SSH (password in process memory only) to install DevKit-All-x.x.x-Linux-Kunpeng.tar.gz, including framework and all plugins (porting/affinity/devtools/debugger/sys_perf/java_perf/sys_diagnosis). Use this skill when the user wants to: (1) install DevKit on a new Kunpeng ECS, (2) install DevKit on an existing Kunpeng ECS. Trigger: user mentions "DevKit", "Kunpeng DevKit", "install DevKit", "DevKit WebUI", "Kunpeng DevKit", "DevKit-All", "鲲鹏DevKit", "安装DevKit", "鲲鹏开发套件"
Create a Kunpeng (aarch64) ECS instance via Python SDK (ECS + KMS), use hcloud CLI for cloud operations (EIP, VPC), use Python paramiko SSH to connect and install Kunpeng DevKit in WebUI mode. Password never leaves Python process memory.
Tool separation principle:
Python SDK — ECS creation + KMS encrypt/decrypt/delete (password never leaves Python process memory, never appears in ps -ef)
hcloud CLI — All other cloud operations (EIP create/bind, VPC query, security group)
Python paramiko — SSH connection + DevKit installation (password from KMS decrypt, stays in Python memory only)
Security architecture:
ECS password is randomly generated by Python code (never typed by user, never passed via hcloud CLI, never exported to shell)
Password is encrypted and stored in Huawei Cloud KMS via Python SDK (never appears in ps -ef, env vars, or conversation)
Password is decrypted from KMS and passed to paramiko SSHClient.connect(password=...) (in Python process memory, not CLI args → no ps -ef leakage)
Only kms_key_id and kms_cipher_text_file are exported (password itself is never exported; cipher text is written to a local file, never passed via command line)
KMS key is scheduled for deletion after DevKit installation
No COC dependency, no UniAgent dependency, no third-party skill dependency
⛔ Prohibited Operations (Security Constraints)
This skill strictly forbids the following operations, regardless of user requests:
Prohibited Operation
Reason
❌ Use --server.adminPass in hcloud ECS CreateServers
Password appears in ps -ef output
❌ Use hcloud AOM BatchImportAgent --agent_import_param_list.1.password=...
Password appears in ps -ef output
❌ Accept ECS password in chat conversation
Password must never appear in conversation
❌ Use expect + $env(DEVKIT_ECS_PASSWORD) for SSH
Environment variable can be read by other processes
❌ Use sshpass -p <password> for SSH
Password appears in ps -ef output
❌ Use ssh -o PasswordAuthentication with password on CLI
Password appears in ps -ef output
❌ Hardcode password in scripts or command-line arguments
Password exposure risk
❌ Use question tool to ask user for password
Password must never appear in conversation
❌ Print or log the ECS password in any output
Password must only exist in Python process memory and KMS
❌ Export password to shell variables or stdout
Password must stay in Python process; only KMS key_id and cipher_text_file path are exported
❌ Pass KMS cipher text via command line arguments
Cipher text appears in ps -ef; must use --kms-cipher-text-file to read from local file
❌ Auto-select ECS flavor or image without user confirmation
Must let user choose from available options
❌ Display aarch64 images other than CentOS 7.6 and Ubuntu 18.04
Only these two images are compatibility-verified
❌ Select x86 flavors (c6/c7 etc.)
DevKit requires aarch64 (Kunpeng) architecture
❌ Skip security group port confirmation
Ports 22 and 8086 must be opened before SSH
❌ Auto-modify security group rules without user consent
Must ask user to choose manual or automatic mode
❌ Write new install/verify scripts instead of using existing ones
Must use scripts in scripts/ directory
❌ Disable or delete KMS key when installation verification fails
KMS key must be preserved for retry; only destroy after verified success (via Task 4 cleanup-kms)
❌ Run cleanup-kms before Task 3 verification passes
KMS key must be preserved until agent confirms DevKit installation success
❌ Run expect script without verifying expect binary is installed
Shebang #!/usr/bin/expect -f fails with misleading "No such file or directory" if expect is missing
If a user requests a prohibited operation, you must refuse and explain the security constraint.
Architecture
text
Kunpeng DevKit WebUI Installation
├── Task 0: hcloud Setup (Install KooCLI, configure AK/SK authentication)
├── Task 1: Prepare Target Machine (Choose to create new ECS or use existing Kunpeng ECS)
│ ├── Option A: Create New ECS (Python SDK for ECS + KMS, hcloud CLI for EIP/VPC)
│ │ ├── 1a. hcloud VPC: create empty security group for DevKit
│ │ ├── 1b. Python SDK: create ECS with random adminPass + dedicated security group (password never in ps -ef)
│ │ ├── 1c. Python SDK: KMS create key, encrypt password
│ │ ├── 1d. hcloud EIP: create and bind EIP to ECS
│ │ └── 1e. hcloud VPC: configure security group rules (or user manual)
│ └── Option B: Use Existing ECS (Provide EIP → Confirm security group)
├── Task 2: Python SSH Install (paramiko SSH, password from KMS decrypt)
│ ├── 2a. Python SDK: KMS decrypt password (in process memory)
│ ├── 2b. paramiko SSH: connect to ECS EIP with decrypted password
│ ├── 2c. Upload install scripts via SFTP
│ ├── 2d. Execute install_devkit_webui.sh on remote ECS
│ ├── 2e. Execute verify_devkit.sh on remote ECS
│ └── 2f. KMS key is NOT cleaned up here (preserved until Task 4)
└── Task 3: Verify & Access (Check WebUI access at https://<EIP>:8086)
├── Task 4: Cleanup KMS Key (Independent Python method, run ONLY after Task 3 verified success)
│ ├── 4a. Python SDK: kms_disable_key (password immediately unrecoverable)
│ └── 4b. Python SDK: kms_schedule_deletion (7 days, API minimum)
└── Task 5: Reset ECS Password (If SSH access needed, reset password in ECS console — random password no longer recoverable)
The Python SDK scripts (create_ecs_and_setup_devkit.py) read credentials from environment variables, NOT from hcloud configure list (which shows masked/desensitized values). The following environment variables MUST be set before running any create / install / status subcommand:
Variable
Required
Description
HW_ACCESS_KEY
Yes
Huawei Cloud Access Key ID (AK)
HW_SECRET_KEY
Yes
Huawei Cloud Secret Access Key (SK)
HW_SECURITY_TOKEN
No
Temporary security token (only for temporary AK/SK)
Project ID: Not a prerequisite. The SDK auto-resolves the project ID from the region via IAM on the first API call (requires IAM read permission). The HUAWEICLOUD_SDK_PROJECT_ID environment variable is an optional override if set.
bash
# Linux — verify HW_ACCESS_KEY / HW_SECRET_KEY are set (values never printed)
python3 -c 'import os,sys;ak=os.environ.get("HW_ACCESS_KEY","");sk=os.environ.get("HW_SECRET_KEY","");ok=bool(ak) and bool(sk);print("AK/SK configured OK" if ok else "ERROR: HW_ACCESS_KEY/HW_SECRET_KEY not set");sys.exit(0 if ok else 1)'
# Windows (cmd / PowerShell)
python -c "import os,sys;ak=os.environ.get('HW_ACCESS_KEY','');sk=os.environ.get('HW_SECRET_KEY','');ok=bool(ak) and bool(sk);print('AK/SK configured OK' if ok else 'ERROR: HW_ACCESS_KEY/HW_SECRET_KEY not set');sys.exit(0 if ok else 1)"
If verification reports ERROR (variables not set), configure them:
Linux: add export HW_ACCESS_KEY=... / export HW_SECRET_KEY=... to your shell profile (~/.bashrc, ~/.zshrc) or a secrets manager, then source the profile.
Windows: set system environment variables via the GUI (System Properties → Advanced → Environment Variables → System variables → New). See references/prerequisites.md "Windows GUI Setup" for step-by-step instructions. Avoid setx (it records credentials in command history).
⚠️ Never set these variables in conversation or hardcode them in scripts. After setting, restart the terminal/Python process and re-run the verification above.
Prerequisite check 2/4: Huawei Cloud CLI (hcloud / KooCLI) >= 3.2.0 required
Run hcloud version to verify version >= 3.2.0. If not installed or version is too low,
see references/cli-installation-guide.md for installation guide.
bash
hcloud version
Prerequisite check 3/4: Python 3.8+ and huaweicloudsdkcore/ecs/kms + paramiko required
The ECS creation + KMS encryption + paramiko SSH script uses Python to keep password in process memory only.
Install the required packages:
bash
# Auto-use China mirror when system timezone is UTC+8 (faster in CN region; auto-detected via Python)
PIP_INDEX=$(python3 -c "import time;print('-i https://mirrors.huaweicloud.com/repository/pypi/simple' if -(time.timezone)//3600==8 else '')")
pip install $PIP_INDEX huaweicloudsdkcore huaweicloudsdkecs huaweicloudsdkkms paramiko
Other cloud operations (EIP, VPC) use hcloud CLI — no additional Python SDK packages needed.
Prerequisite check 4/4: Target ECS requirements
Architecture: aarch64 (Kunpeng processor)
OS: CentOS 7.6 or Ubuntu 18.04 (only these two are compatibility-verified)
Disk space: >= 2GB available
Memory: >= 4GB
Access: root privileges required
Authentication
Security rules (must be followed):
Prohibited from reading, echoing, or printing AK/SK values
Prohibited from asking the user to input AK/SK directly in the conversation
Prohibited from using hcloud configure set to pass plaintext credential values
Prohibited from accepting AK/SK directly provided by the user in the conversation
Only allowed to read credentials from environment variables or configured CLI config files
Check CLI configuration:
bash
hcloud configure list
Verify the output contains valid AK/SK configuration.
If no valid credentials exist, stop here.
IAM Permission Policies
Ensure the IAM user has the required permissions (ECS/VPC/IMS/EIP/KMS, scoped to the DevKit workflow only). See references/iam-policies.md for the full permission table and recommended IAM policy JSON.
Permission boundaries:
Scope constraint: Only create/manage resources named or tagged with devkit. Never modify or delete existing resources not created by this workflow.
Must stop if: credentials missing or invalid, user declines any confirmation, package signature verification fails, or installation verification fails.
Prohibited actions: deleting any existing ECS/VPC/security group, modifying IAM policies, accessing resources outside the DevKit workflow, running commands not documented in this skill.
Core Workflows
Task 0: hcloud Installation and Configuration
Install Huawei Cloud CLI tool and configure authentication.
Create a Kunpeng (aarch64) ECS instance, or use an existing Kunpeng ECS.
⚠️ Tool separation: Python SDK for ECS + KMS, hcloud CLI for EIP/VPC
Python SDK (create_ecs_and_setup_devkit.py create): Generates random password, creates ECS, encrypts password in KMS. Password never leaves Python process memory. Outputs only server_id, kms_key_id, kms_cipher_text_file (cipher text written to file, never passed via CLI).
1a. Create empty security group — hcloud VPC CreateSecurityGroup --cli-region=$REGION --security_group.name=$SG_NAME — dedicated DevKit security group with no ingress rules (v3 API, no vpc_id needed)
1d. Configure security group rules — Open ports 22 and 8086
Option B: Use Existing ECS
Provide EIP
Confirm security group ports 22 and 8086 are open
If password is unknown, reset it via ECS API and store in KMS
Task 2: Python SSH Install DevKit
Use scripts/create_ecs_and_setup_devkit.py install to SSH into the ECS and install DevKit. Password is decrypted from KMS in Python memory and passed to paramiko — never appears in ps -ef or shell variables.
2e. Poll install progress — Launch poll_devkit_status.py in background (output to log file), then use read tool with incrementing offset to read the log every 10-20s and report to user (doom-loop safe, continuous visibility; see Polling Progress below)
2f. Verify installation — Run verify_devkit.sh and check results
2g. Report result — If verification passed, prompt agent to proceed to Task 4 (cleanup-kms); if failed, KMS key is preserved for retry
⚠️ KMS key is NOT cleaned up in Task 2. Cleanup is a separate Task 4, executed only after the agent confirms DevKit installation success in Task 3.
⚠️ DevKit installation takes 5-15 minutes. The install subcommand starts the installation in the background and returns immediately. The agent MUST poll progress and report to the user continuously.
Last log lines: PREPARING → from /tmp/devkit_install_wrapper.log (yum/wget output); RUNNING/DONE → from /tmp/devkit_install.log
Polling Progress (doom-loop safe): Launch poll_devkit_status.py in background (output to a log file), then use the read tool with incrementing offset every 10-20s to report progress until the log contains DONE/TIMEOUT. See references/polling-progress-guide.md for the exact steps, guidelines table, and status field reference.
⚠️ KMS key cleanup must NOT be performed until this verification passes.
The agent must confirm all services are active and WebUI is accessible before proceeding to Task 4.
Task 4: Cleanup KMS Key (After Verified Success)
Only execute this task after Task 3 verification has passed. Use scripts/create_ecs_and_setup_devkit.py cleanup-kms to disable the KMS key and schedule its deletion. This is an independent Python method that does not require SSH or cipher text — only the KMS key ID.
⚠️ Critical: Only run cleanup-kms after verified success
If Task 3 verification FAILED: do NOT run cleanup-kms; KMS key is preserved for retry
If Task 3 verification PASSED: run cleanup-kms to disable key + schedule deletion
The --force flag allows scheduling deletion even if disable fails (use with caution)
Task 5: Reset ECS Password (If SSH Access Needed)
The ECS password was randomly generated by Python SDK and the KMS key is disabled after successful installation. The password is no longer recoverable. If the user needs SSH access to the ECS later, they must reset the password in the ECS console.
Steps:
Navigate to ECS console: https://console.huaweicloud.com/ecm/?region=<REGION>#/detail/<SERVER_ID>
Click "More" > "Reset Password"
Set a new password following the complexity requirements
ECS creation + KMS: MUST use scripts/create_ecs_and_setup_devkit.py — password never in ps -ef
SSH + DevKit install: MUST use scripts/create_ecs_and_setup_devkit.py install — password from KMS, in paramiko memory only
hcloud ECS CreateServers: MUST NOT include --server.adminPass
EIP/VPC: MUST use hcloud CLI
IMS ListImages: Only display CentOS 7.6 ARM and Ubuntu 18.04 ARM
ECS NovaListFlavorsDetails: Only display flavors starting with k (Kunpeng)
install_devkit_webui.sh must be executed via paramiko SSH (not scp + manual ssh)
Parameter Confirmation
Before executing any task, the following parameters must be confirmed with the user. Guessing is prohibited.
Parameter
Required/Optional
Description
Default
Region
Required
Huawei Cloud region (e.g., cn-south-1, cn-north-4); must be explicitly selected by the user
-
| Subnet | Required | Subnet for ECS creation; user selects from list of first 10 subnets | - |
| Target machine method | Required | Create New Kunpeng ECS (recommended) or Use Existing Kunpeng ECS | Create New |
| ECS Flavor | Required (New ECS) | Kunpeng flavor starting with k (e.g., kc1.xlarge.2); user selects from list | - |
| OS Image | Required (New ECS) | CentOS 7.6 ARM or Ubuntu 18.04 ARM only; user selects from list | - |
| Existing ECS EIP | Required (Existing ECS) | Public IP of existing Kunpeng ECS | - |
| Security group method | Required | Manual (recommended) or Agent automatic; user chooses | Manual |
| DevKit download URL | Optional | URL for DevKit-All tar.gz package | Default OBS URL for 26.1.RC1 |
Note: No password parameter is required. The password is randomly generated by Python SDK, encrypted via Python KMS SDK, and decrypted for paramiko SSH. The password is never exported from the Python process.
⚠️ Password reminder: The ECS password was randomly generated and the KMS key is disabled after successful installation. If you need SSH access to the ECS later, you must reset the password in the ECS console first:
The security architecture keeps the ECS password exclusively in Python process memory and KMS — never in ps -ef, shell variables, environment variables, or conversation. Tool separation: Python SDK for ECS creation + KMS encrypt/decrypt/delete, hcloud CLI for EIP/VPC (no password), Python paramiko for SSH + DevKit install. The KMS key is preserved on failure (for retry) and only disabled + scheduled for deletion after verified success.
