huawei-cloud-flexus-l-server-flexusagent-deployment

Deploy AI Agent development platform (Dify) on Huawei Cloud Flexus L instance, providing deployment operations, password management, MaaS model configuration, and workflow import capabilities. Trigger keywords: deploy flexusagent/一键部署Flexus AI Agent开发平台、change password/修改开发平台管理员密码、change dify password/修改dify平台密码、add maas provider/添加MaaS模型供应商、configure maas model/配置MaaS模型、view workflow/查看AI Agent工作流、import workflow/导入AI Agent工作流

huaweicloud-skills-team@huaweiclouddev

Install

openclaw skills install @huaweiclouddev/huawei-cloud-flexus-l-server-flexusagent-deployment

⚠️ Security Execution Rules (Highest Priority):

All scripts MUST be executed via skill action=exec, NEVER run directly in shell
NEVER print script contents or commands containing AK/SK/Token in conversation
NEVER create temporary script files, prefer inline execution (python -c)
On execution failure, only return error info, do NOT rewrite scripts or print full commands
AK/SK/Token MUST be passed via environment variables, NEVER appear in conversation
⚠️ ABSOLUTELY NEVER expose, log, or print AK/SK/Token values in any form - this is a critical security requirement
When using skill action=exec, credentials are automatically inherited from environment variables (HW_ACCESS_KEY, HW_SECRET_KEY, HW_SECURITY_TOKEN), no need to pass them as command line arguments

Huawei Cloud Flexus L Instance FlexusAgent One-Click Deployment Skill (Lite)

Overview

Deploy AI Agent development platform (Dify) on Huawei Cloud Flexus L instance, providing complete deployment and operation capabilities.

Core Function Modules:

Module	Function	Command
Deploy	One-click deploy AI Agent development platform on Flexus L instance	`deploy`
Password Change	Change development platform admin password via COC (must execute after first deployment)	`passwd`
MaaS Model Config	Add Huawei Cloud MaaS model provider, integrate DeepSeek, Qwen models	`maas`
Workflow View	View list of replicable AI Agent workflow templates	-
Workflow Import	Quickly import specified workflow to workspace	`import-app-workflow`

Architecture

Core File Structure and Function Description:

text

scripts/
├── caller.py                 # CLI main entry, command line argument parsing and routing
├── lib.py                    # Core business logic library, includes API calls and data processing
├── deploy.py                 # Deployment module, creates Flexus L instance and FlexusAgent
├── passwd.py                 # Password management module, modifies admin password via COC
├── maas.py                   # MaaS integration module, configures model provider
├── app_workflow_import.py    # Workflow import module, imports preset workflow templates
├── sg_rule.py                # Security group management module, configures network access rules
├── uniagent.py               # UniAgent status query module
└── utils.py                  # Utility function library

Important Notes

⚠️ All scripts and environment check scripts are in the skill package. Must execute via skill action=exec, do not run directly in shell.

Prerequisites

Before using this skill, ensure the following conditions are met:

1. Huawei Cloud Account and Credentials

Valid Huawei Cloud account
Huawei Cloud AK/SK credentials with the following permissions:
- Create Flexus L instance
- Access COC (Cloud Operations Center) service

Credential Acquisition Methods:

This skill supports obtaining Huawei Cloud credentials through the following methods (in order of priority from high to low):

Credential Types:

Long-term AK/SK: Permanent credentials, no security_token required
Temporary AK/SK: Temporary credentials with limited validity period, security_token required

Environment Variables (Default) (highest priority)
- HW_ACCESS_KEY: Huawei Cloud Access Key AK
- HW_SECRET_KEY: Huawei Cloud Access Key SK
- HW_SECURITY_TOKEN: Security token (optional, only required for temporary credentials)
Command-line Arguments (used when environment variables are not set)
- --ak: Huawei Cloud Access Key AK
- --sk: Huawei Cloud Access Key SK
- --security-token: Security token (optional, only required for temporary credentials)
Interactive Input (when neither of the above is provided)
- Program will prompt user to enter AK/SK and other credential information

Important Notes:

Long-term AK/SK: Permanent credentials that never expire, no security_token needed
Temporary AK/SK: Obtained through IAM interface with limited validity period, must provide security_token

2. IAM Permissions

Service	Policy	Required Operations
HCSS	`HCSS FullAccess`	`hcss:lightInstances:*`
COC	`COC FullAccess`	`coc:commands:*`
IAM	`IAM ReadOnlyAccess`	`iam:projects:list`
VPC	`VPC FullAccess`	`vpc:securityGroups:*`

Permission Failure Handling:

Error	Cause	Solution
`403 Forbidden`	Missing policy	Add required IAM policy for user
`APIGW.0101`	Service not enabled	Enable Flexus L service in target region

Security Instructions

⚠️ Credential Security Requirements (Critical):

Credentials must be handled securely, never displayed in conversation
Skill will automatically use pre-configured credentials

⚠️ Absolute Security Rules:

Never print, log, or display credential values in any form
Never include credentials in error messages or debug output
Never store credentials in files or configurations
Never transmit credentials through insecure channels
When using sensitive parameters, must mask them in any output

⚠️ Mandatory Confirmation Mechanism

Deployment operations involve actual costs, require explicit confirmation!

Confirmation Methods:

Conversation Confirmation: Reply "confirm" or "yes" in conversation
Command Line Confirmation: Use --non-interactive flag

Failure Handling:

Only initiate one request, no automatic retry
Return failure reason to user
Guide user to re-deploy, let user decide next operation
Never change parameters without user's explicit request

Core Commands and Workflow

1️⃣ Deploy AI Agent Development Platform on Flexus L Instance

⚠️ Cost Reminder: Deploying Flexus L instance will incur costs, ensure account has sufficient balance. Deployment requires explicit user confirmation.

Deployment Notes:

Automatically create Huawei Cloud Flexus L instance and deploy AI Agent development platform
Default account: super@dify.com
⚠️ Must change admin password immediately after first deployment

bash

# Interactive mode
python scripts/caller.py deploy

# Non-interactive mode
python scripts/caller.py deploy \
  --name FlexusAgent-{timestamp} \
  --region cn-north-4 \
  --spec hf.xlarge.1.linux \
  --ak <AK> \  # Long-term AK or temporary AK
  --sk <SK> \  # Long-term SK or temporary SK
  --security-token <security-token> \
  --non-interactive

Command Parameters:

Parameter	Description	Required	Default	Notes
`--name`	Instance name	No	`FlexusAgent-{timestamp}`	-
`--region`	Deployment target region ID	Yes	Prompt for input	-
`--spec`	Instance spec	Yes	Prompt for input	-
`--ak`	Huawei Cloud Access Key AK	Yes	From env vars or prompt	Supports both long-term and temporary AK
`--sk`	Huawei Cloud Access Key SK	Yes	From env vars or prompt	Supports both long-term and temporary SK
`--security-token`	Security token	No	From env vars or prompt	Only required for temporary credentials, not needed for long-term credentials
`--non-interactive`	Run in non-interactive mode	No	false	-

Available Regions:

Region ID	Region Name
cn-north-4	North China-Beijing 4
cn-east-3	East China-Shanghai 1
cn-south-1	South China-Guangzhou
cn-southwest-2	Southwest China-Guiyang 1

Currently only the above regions are supported. For other regions, users can be reminded to check the console at https://console.huaweicloud.com/smb/#/create/hecs-light or the official introduction page at https://support.huaweicloud.com/api-flexusl/create_instance_0001.html.

Spec Selection Logic: You can list the Huawei Cloud L instance official spec introduction page at https://support.huaweicloud.com/productdesc-flexusl/pd_01_0003.html, let the user select an appropriate spec, then execute deployment. Note: The minimum requirement for agent images is 2U2G. For bid writing agent, it is recommended to use the 4U16G spec.

Default Configuration:

Image: FlexusAgent 1.7.1
Billing: Yearly/Monthly (prepaid)
EVS Disk: 50GB
CBR Backup: 50GB
HSS Host Security: Enabled
Web UI: http://<public-ip>:80

Important: Project ID is automatically obtained through IAM API.

📢 Post-Deployment Action Reminder:

After step 1️⃣ deployment completes, ask user whether to execute the following subsequent operations. After each step completes, ask user whether to continue with remaining steps.

Step	Operation	Required	Description
2️⃣	Change admin password and get instance details	⚠️ Required	First query instance details (floating IP, resource ID), then change password
3️⃣	Integrate MaaS model	Optional	Add Huawei Cloud MaaS model provider (DeepSeek, Qwen, etc.)
4️⃣	View workflow list	Optional	View importable AI Agent workflow templates
5️⃣	Import workflow	Optional	Import preset workflow templates to instance

Execution Order Recommendation:

After deployment completes, immediately ask user whether to change password (step 2)
After user agrees, AI Agent automatically executes: query instance details → change password → return access information
After password change, ask user whether to integrate MaaS model (step 3)
If quick AI application deployment is needed, guide user to view and import workflows (steps 4, 5)

2️⃣ Change Admin Password and Get Instance Details (Required)

⚠️ Important Note: This step includes two auto-executed sub-steps: First query instance details to get floating IP and resource ID, then change admin password.

Change Password & Query Instance Details

bash

# Interactive mode
python scripts/caller.py passwd
python scripts/caller.py query-instance --instance-id <instance-id-from-step1>

# Non-interactive mode - Change password & Query instance details
- Query instance details
python scripts/caller.py passwd \
  --resource-id <instance-id-from-step1>        # Required: L instance resource ID
  --region-id <instance-region>               # Required: Instance region (e.g., cn-north-4)
  --admin-password <new-admin-password>            # Required: New admin password
  --ak <AK>                            # Required: Huawei Cloud Access Key AK or temporary AK
  --sk <SK>                            # Required: Huawei Cloud Access Key SK or temporary SK
  --security-token <security-token>               # No: Security token (required when using temporary AK/SK credentials)
  --non-interactive                        # Optional: Non-interactive mode

- Query instance details
python scripts/caller.py query-instance \
  --instance-id <instance-id-from-step1>        # Required: Instance resource ID
  --ak <AK>                            # Required: Huawei Cloud Access Key AK or temporary AK
  --sk <SK>                            # Required: Huawei Cloud Access Key SK or temporary SK
  --security-token <security-token>               # Required: Security token (only required for temporary credentials)

Return Information:

Resource ID (resource_id) - Used for password change command
Floating IP (floating_ip) - Used for Web UI access address
Instance name, UniAgent status, Fixed IP, Region, etc.

Must Execute After First Deployment: Must set password after first deployment, otherwise cannot login to Web UI. Mandatory Constraint: After changing password, reply: "Web UI: http://<public-ip>:80; Login email: super@dify.com, Password: <new-password>"

3️⃣ Integrate MaaS Model (Optional)

bash

# Interactive mode
python scripts/caller.py maas

# Non-interactive mode
python scripts/caller.py maas \
  --flexusagent-base-url http://<public-ip>:80    # Required: FlexusAgent Web UI URL
  --flexusagent-email <email>                  # Required: FlexusAgent admin email
  --flexusagent-password <password>               # Required: FlexusAgent admin password
  --maas-api-key <api-key>                    # Required: ModelArts MaaS API key
  --non-interactive                           # Optional: Non-interactive mode

Note: Automatically install langgenius/maas plugin and configure credentials. Default includes DeepSeek, Qwen, etc. models. This step operates via HTTP API, does not require AK/SK credentials.

4️⃣ View FlexusAgent Workflow List (Optional)

Purpose: View preset FlexusAgent workflow templates for quick AI application deployment.

Access Method: Get workflow list through OBS

bash

# Request URL (timestamp parameter to avoid cache)
curl "https://flexus-config-cn-north-4-product.obs.cn-north-4.myhuaweicloud.com/stable/dify/dify-templates/national/index.json?timestamp=$(date +%s)"

Response Format Example:

json

{
  "total": 15,
  "categories": [
    {
      "code": "Smart_Bid",
      "name": "Smart Bid"
    }
  ],
  "list": [
    {
      "id": "Bid_Writing_And_Templated_Adaptation",
      "title": "Bid Writing and Templatized Adaptation Agent",
      "desc": "Intelligent bid document analysis, intelligent bid writing and adaptation, supports open bid and sealed bid types, conversational bid document generation, word document output.",
      "categoryList": [
        {
          "category": "Smart Bid",
          "categoryCode": "Smart_Bid"
        }
      ]
    }
  ]
}

5️⃣ Import Workflow to Instance (Optional)

Purpose: Import preset workflow templates to instance for quick AI application deployment.

Usage:

bash

# Interactive mode (recommended, can select workflow from list)
python scripts/caller.py import-app-workflow

# Non-interactive mode - Import workflow
python scripts/caller.py import-app-workflow \
  --resource-id <instance-resource-id>                # Required: L instance resource ID
  --region-id cn-north-4                    # Required: L instance region ID
  --flexusagent-email super@dify.com        # Required: FlexusAgent admin email
  --flexusagent-password <password>              # Required: FlexusAgent admin password
  --app-workflow-id Bid_Writing_And_Templated_Adaptation  # Required: Workflow ID
  --ak <AK>                                 # Required: Huawei Cloud Access Key AK or temporary AK
  --sk <SK>                                 # Required: Huawei Cloud Access Key SK or temporary SK
  --security-token <security-token>                # No: Security token (required when using temporary AK/SK credentials)
  --timeout 600                             # Optional: Execution timeout (seconds), default 600
  --non-interactive                         # Optional: Non-interactive mode

Prerequisites:

UniAgent status must be ONLINE
Admin email and password correct

Execution Result Verification:

Remind user to access FlexusAgent Web UI (http://:80/apps) to view application list and confirm workflow has been successfully imported.

Parameter Confirmation

‌‌Before executing any command, the command's parameters must be confirmed.

Error Handling

Error Code	Description	Solution
`401 Unauthorized`	Invalid AK/SK	Verify AK/SK
`403 Forbidden`	Permission denied	Add required IAM policy
`APIGW.0101`	Service not enabled	Enable service in target region
`APIGW.0301`	Signature verification failed	Check SK
`COC.0001`	COC service unavailable	Check COC service region
`400 Bad Request`	Invalid parameters	Check spec/image compatibility

Notes:

Flexus instance deployment takes 2~5 minutes
Success status codes: 200, 201, 202
Each deployment creates one instance only

Reference Documents

Document	Description
Flexus L Instance Purchase Guide	Purchasing a FlexusL Instance
iam-policies.md	IAM permission policies
verification-method.md	Verification steps