huawei-cloud-cce-network-failure-diagnoser

Provide the region, cluster_id, namespace, and Service name. The skill checks the Service selector, Endpoints, EndpointSlices, and backend Pod readiness via kubectl cce, then ranks causes such as selector mismatch or no ready endpoints with supporting evidence.

The skill inspects Ingress rules, backend Service/port mapping, EndpointSlice readiness, and optionally ELB listener, pool, member, and health monitor state through read-only hcloud commands. It reports whether the failure is in Kubernetes routing or the cloud load balancer layer.

It requires the hcloud CLI, kubectl with the kubectl-cce plugin, and read-only access. IAM needs CCE cluster read plus optional ELB/VPC/EIP/NAT list permissions; Kubernetes RBAC needs get/list on Services, Endpoints, EndpointSlices, Ingresses, NetworkPolicies, Pods, and Events.

No. The skill is strictly read-only and never runs apply, create, patch, delete, scale, or hcloud write operations. It recommends candidate fixes with expected impact and hands changes off to an approved remediation workflow after user confirmation.

An x509 validation error means the upstream TLS certificate could not be verified. Retry the same command with --cce-insecure-upstream-tls=true placed immediately after cce, and use this option only when that specific TLS error occurs.

The skill lists CCE clusters in the given region and performs an exact name match. If exactly one cluster matches, it converts the name to its UUID and verifies it; if there is no match or multiple matches, it stops and asks you for the correct UUID.