huawei-cloud-cce-dependency-impact-analyzer

Analyze CCE dependency topology and incident blast radius using hcloud and kubectl-cce.

1|Updated May 27, 2026
One-click install
npx skills add https://github.com/pancake0001/huawei-cloudnative-skills --skill huawei-cloud-cce-dependency-impact-analyzer-pancake0001
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: huawei-cloud-cce-dependency-impact-analyzer
Source: https://github.com/pancake0001/huawei-cloudnative-skills/tree/main/releases/container/cce/huawei-cloud-cce-dependency-impact-analyzer
Command: npx skills add https://github.com/pancake0001/huawei-cloudnative-skills --skill huawei-cloud-cce-dependency-impact-analyzer-pancake0001

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? When a Huawei Cloud CCE workload or Pod becomes unhealthy, teams struggle to determine which Services, Ingresses, EndpointSlices, Nodes, and upstream/downstream paths are affected. This Skill maps the dependency topology and estimates the blast radius of an incident, separating possible propagation paths from observed traffic impact. ## Core Features & Use Cases - Topology Mapping: Collects Deployments, StatefulSets, DaemonSets, Pods, Services, Ingresses, Endpoints, EndpointSlices, and Nodes through read-only hcloud and kubectl-cce queries. - Propagation Path Analysis: Models external paths (Ingress -> Service -> EndpointSlice -> Pods -> Nodes) and internal paths (Service DNS -> Endpoints -> Pods -> Nodes) with confidence scoring. - Structured Impact Report: Produces a Markdown report with Summary, Impact Paths, Next Actions, Evidence, Confidence Limits, and Appendix sections, plus handoff to focused diagnoser skills. - Use Case: After a Deployment rollout causes 502 errors, run this Skill to identify which Ingress entrypoints and Services route to the failing Pods, whether impact is Node- or zone-concentrated, and which diagnoser skill should investigate the root cause. ## Quick Start Ask the assistant to analyze which Services, Ingresses, and Nodes are affected by the failing workload in your CCE cluster by providing the region, project ID, cluster ID, namespace, and target workload name.

Frequently Asked Questions about huawei-cloud-cce-dependency-impact-analyzer

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I analyze the blast radius of a CCE workload failure?▼

Provide the region, project ID, cluster ID, namespace, and target workload or Pod name. The skill snapshots topology via kubectl cce, matches the target through label selectors and owner references, then models propagation paths from Ingress or Service down to Pods and Nodes.

What tools are required for CCE dependency impact analysis?▼

You need the hcloud CLI, kubectl, and the kubectl-cce plugin installed as platform-native binaries. If any tool is missing, use the huawei-cloud-kubectl-cce-installer skill; this skill never installs tools or falls back to SDK or kubeconfig access.

Can this skill prove that user traffic was actually impacted?▼

No. Static topology only shows possible propagation paths. Claiming observed impact requires corroborating evidence such as logs, metrics, alarms, synthetic checks, or explicit user symptoms, gathered via the observability context builder skill.

What happens if my cluster_id is a name instead of a UUID?▼

The skill lists CCE clusters with hcloud and performs an exact name match. It converts the name to a UUID only when exactly one cluster matches; otherwise it stops and asks you to provide the correct UUID, never guessing or falling back to a global query.

Does the dependency impact analyzer modify any cluster resources?▼

No. It is strictly read-only and never runs apply, delete, scale, rollout, exec, or port-forward commands. Remediation is handed off to the auto-remediation workflow only after explicit user confirmation.

How do I fix x509 certificate errors when running kubectl cce?▼

Retry the same command with --cce-insecure-upstream-tls=true placed immediately after cce. Use this option only when that specific TLS validation error occurs.