Full lifecycle management for ModelArts dedicated resource pools and node pools via hcloud CLI — 53 operations across 10 functional domains.
Overview
This skill enables users to manage Huawei Cloud ModelArts dedicated resource pools (专属资源池) and node pools through the hcloud CLI. It covers the complete lifecycle including resource pool CRUD, node management, node pool management, network resources, tag management, plugin management, workloads, scheduled events, OS configuration, and resource flavor queries. Pricing inquiry for chargeable operations is included via scripts/query-pricing.sh (KooCLI 7.3.12 no longer supports BSS, so the script fails loudly and a console/API Explorer fallback is documented).
⚠️ Scope boundary: This skill is used ONLY for ModelArts dedicated resource pool / node pool / network / tag / plugin management. It does NOT handle OBS buckets, ECS instances, or any other Huawei Cloud service operations. For non-ModelArts requests (e.g., "query my OBS bucket"), decline and point the user to the appropriate service-specific skill.
Known Capability Limitations (verified by real testing)
CreatePool flavors must carry the .d suffix: Only flavors like modelarts.vm.cpu.16u64g.d can create a dedicated pool. Flavors WITHOUT the .d suffix (e.g., modelarts.vm.cpu.8ud) fail with ModelArts.50004000 Invalid flavor ... is not available for your project. Always verify the targeted flavor with ListResourceFlavors before CreatePool.
BatchResetPoolNodes is NOT available for regular VM pools: rollingConfig.strategy has no valid value for VM pools, so batch reset only works when the pool supports a valid strategy. For regular VM nodes, resets must be done by deleting and recreating the nodes instead.
BatchResizePoolNodes only supports hyperinstance nodes: resizing is not supported for regular VM nodes; use delete-recreate as the fallback for VM pools.
Architecture
text
User Request → Agent → hcloud ModelArts <Operation> --cli-region={region} [--params] → Huawei Cloud ModelArts API
Applicable Scenarios
Resource Pool Management: Create, list, show, update, delete resource pools; monitor, statistics, node config, order management
⚠️ CRITICAL: This section defines the agent's security boundary. Follow it strictly.
🔒 Security Rules (MANDATORY)
🚫 NEVER read, echo, or print AK/SK values (e.g., cat ~/.hcloud/config.json, echo $HW_ACCESS_KEY is FORBIDDEN)
🚫 NEVER read or cat credential files such as ~/.hcloud/config.json or any file that may contain secrets
🚫 NEVER ask the user to input AK/SK directly in the conversation or command line
🚫 NEVER execute hcloud configure set --cli-access-key=... --cli-secret-key=... — credential configuration is the user's responsibility, done outside the agent session
🚫 NEVER pass --cli-access-key/--cli-secret-key on every API call — they will be exposed in process listings (ps aux) for the entire request duration
✅ ALWAYS use hcloud configure list to check credential status (presence check only, not values)
✅ If no valid profile exists, STOP and instruct the user to configure credentials outside this session
✅ Recommend using IAM user with minimal permissions instead of main account
✅ Agent Credential Check (the ONLY acceptable check)
bash
# Step 1: Check credential status — presence only, not values
hcloud configure list
✅ Expected: Shows a valid profile with mode: AKSK
❌ If empty/invalid → Guide the user with the 3-step process below:
Step-by-step guidance (copy-paste for the user):
"No valid credentials found. Please follow these 3 steps in your terminal:"
① Get your AK/SK
Log in to Huawei Cloud Console → IAM → Access Keys. If you don't have one, click "Create Access Key" and save it securely.
② Run this in your terminal (one-time setup):
bash
hcloud configure set --cli-access-key=<YOUR_AK> --cli-secret-key=<YOUR_SK>
(Replace <YOUR_AK> and <YOUR_SK> with the values from step ①)
③ Come back and tell me "configured", I'll verify it works.
Note: The configure set command stores your credentials in ~/.hcloud/config.json. After that, all hcloud commands use them automatically — no need to pass AK/SK again.
Agent: DO NOT execute any configure set command yourself.
🔧 User's Responsibility (for documentation, NOT agent execution)
The user configures credentials outside the agent session (in their own terminal):
bash
# One-time setup — run this in your terminal, NOT in the agent chat
HISTCONTROL=ignorespace
hcloud configure set --cli-access-key=<YOUR_AK> --cli-secret-key=<YOUR_SK>
⚠️ Note: hcloud CLI does NOT read HW_ACCESS_KEY/HW_SECRET_KEY environment variables (those are for Python SDK only). For environment-variable auth, KooCLI supports HUAWEICLOUD_SDK_AK/HUAWEICLOUD_SDK_SK (or HUAWEI_ACCESS_KEY/HUAWEI_SECRET_KEY) or the --cli-access-key/--cli-secret-key parameters; the recommended persistent method is hcloud configure (stores credentials in ~/.hcloud/config.json). See references/cli-installation-guide.md for details.
Workflow
Step 1: Identify the Operation
Determine which resource pool operation the user needs based on their request:
{region} must be replaced with the actual region, e.g., cn-north-4. Do NOT hardcode the region.
⚠️ MANDATORY: check the response body, not just the exit code.hcloud returns exit code 0 even for business/parameter errors — the error is only visible in the response body.
After every call, inspect the output for:
a top-level error_code / error_msg (API business error), or
a [USE_ERROR] prefix (CLI parameter/usage error, e.g. [USE_ERROR]Invalid parameter: limit).
If either is present, treat the call as FAILED: stop, report error_code + error_msg to the user, and do not continue to dependent steps (especially write operations). Never infer success from exit code 0 alone.
bash
OUT=$(hcloud ModelArts ListPools --cli-region={region} 2>&1); RC=$?
if [ $RC -ne 0 ] || printf '%s' "$OUT" | grep -qE '\[USE_ERROR\]|"error_code"[[:space:]]*:[[:space:]]*"'; then
echo "FAILED: $OUT" >&2; exit 1
fi
Step 2.5: ⚠️ Pre-Flight Check (MANDATORY for Write Operations)
Before executing ANY write operation (Create/Update/Delete/Patch/Batch/Accept), you MUST:
Check the Pre-Flight Checklist at the bottom of that file — Verify all conditions are met
Apply documented workarounds — Especially for the following high-risk operations:
Operation
Critical Issue
Action Required
PatchPool, PatchNetwork, PatchNodePool
Content-Type must be application/merge-patch+json
Use --cli-jsonInput with header section
BatchUpdatePoolNodes
--action values are not true/false
Use --cli-jsonInput with string action
CreatePool
Network name must include project ID suffix
Query ListNetworks for exact name
CreateNodePool
count ≥ 1, maxCount ≤ count
Verify constraints before execution
ShowNetworkAvailableIp
network_id from status.subnets[0].networkId
Query ShowNetwork first
ListEvents
--resource must be pools (plural)
Use plural form
BatchResetPoolNodes
strategy not supported for VM pools
Known limitation, inform user
BatchResizePoolNodes
Only supports hyperinstance nodes
Known limitation, inform user
DeleteNetwork
Fails if network in use by pool
Delete pool first
Skipping this step will cause preventable failures. Every issue in the table was discovered through real API testing.
Step 3: Handle Write Operations
For all write operations (Create/Update/Delete/Patch/Batch/Accept), prompt the user for confirmation before execution. For chargeable operations (CreatePool, CreateNodePool, PatchNodePool, BatchResizePoolNodes, CreateOrderId), inquire pricing first to inform the user of costs. See references/pricing-inquiry.md for the pricing inquiry workflow.
⚠️ BSS pricing is unavailable on KooCLI 7.3.12 — hcloud BSS ... fails with [USE_ERROR]Unsupported service: BSS. (and still exits 0). Therefore:
Prefer scripts/query-pricing.sh, which fails loudly (non-zero exit) instead of reporting a misleading 0.00 元;
If the script reports pricing unavailable, stop and tell the user pricing could not be verified, and direct them to the BSS API Explorer or the console 费用中心 to confirm the price manually;
Never present 0 元 / empty pricing as "free". The "user must confirm cost before any write" guardrail stays in force — only the inquiry mechanism is degraded.
See references/pricing-inquiry.md for details.
Pagination reminder: ListPools is not paginated and takes no --limit/--offset/--pool_name; ListPoolNodes uses --limit + --continue. See references/cli-command-examples.md.
Note: --project_id is auto-resolved from authentication credentials if omitted. Include it explicitly only when targeting a specific project.
Complex parameters: For complex nested parameters (e.g., metadata, spec), use --cli-jsonInput=/path/to/file.json. The JSON file must wrap body in {"body": {...}} envelope.
Core Commands
All 53 CLI command examples across 10 functional domains are documented in a separate reference file.
When executing any command, always refer to the reference file for exact parameter names, required/optional flags, and usage patterns.
Parameter Confirmation
Parameter
Required
Description
Example
{region}
Yes
Huawei Cloud region
cn-north-4, cn-east-2
{pool_name}
Pool ops
Resource pool metadata.name (returned by ListPools, e.g. pool-74d9fd1a-xxx) — NOT the user-facing label name (os.modelarts/name). Run ListPools first to obtain it
pool-74d9fd1a-xxx（from ListPools）
{node_name}
Node ops
Pool node name
node-xxx
{nodepool_name}
NodePool ops
Node pool name
my-nodepool
{network_name}
Network ops
Network name
my-network
{flavor_id}
Create/Resize
Resource flavor ID (CreatePool requires a flavor with .d suffix, e.g. modelarts.vm.cpu.16u64g.d; flavors without .d like 8ud cannot create pools)
modelarts.vm.cpu.16u64g.d
{project_id}
No (auto)
Project ID, auto-resolved if omitted
Omit for default
{order_name}
ShowOrder
Order name
order-xxx
SDK Fallback
If a CLI operation fails due to a CLI bug, fall back to SDK:
python
from huaweicloudsdkcore.auth.credentials import BasicCredentials
from huaweicloudsdkmodelarts.v2.modelarts_client import ModelArtsClient
from huaweicloudsdkmodelarts.v2.region.modelarts_region import ModelArtsRegion
credentials = BasicCredentials(ak="{AK}", sk="{SK}", project_id="{project_id}")
client = ModelArtsClient.new_builder() \
.with_credentials(credentials) \
.with_region(ModelArtsRegion.value_of("{region}")) \
.build()
All write operations (Create/Update/Delete/Patch/Batch/Accept) require user confirmation before execution
Chargeable operations (CreatePool, CreateNodePool, PatchNodePool, BatchResizePoolNodes, CreateOrderId) require a pricing inquiry so costs are shown before execution. KooCLI 7.3.12 no longer supports BSS (hcloud BSS ... → [USE_ERROR]Unsupported service: BSS.), so use scripts/query-pricing.sh (which exits non-zero on failure) and fall back to the console 费用中心 / BSS API Explorer for manual price confirmation. User confirmation of cost remains mandatory; never report 0 元 as "free".
Check the response body of every hcloud call — hcloud returns exit code 0 even on business/parameter errors. Treat any non-empty error_code/error_msg or a [USE_ERROR] prefix as failure and stop.
--pool_name must be the resource metadata.name (from ListPools), NOT the user-facing label name (metadata.labels.os.modelarts/name). Always query ListPools first to obtain the correct metadata.name before Show/Delete/List-node operations; using the label name will fail with ModelArts.50015001 pool not found
Region is not hardcoded — uses {region} placeholder
project_id is auto-resolved when omitted
No hardcoded AK/SK in any file — credentials configured via hcloud configure set by the user outside the agent session
Agent must use hcloud configure list for credential presence check only — NEVER read/echo AK/SK values
If no valid credentials found, agent must STOP and guide user through the 3-step configuration process (see Prerequisites section)
SDK fallback available when CLI encounters bugs
Complex nested parameters use --cli-jsonInput with JSON file
