hcloud

• huawei-cloud-ucs-policy-governor

  - UCS policy governance, compliance, and audit management

• Register self-managed or CCE clusters to UCS for unified management
• Remove clusters from UCS management (deregistration)
• Query cluster details, list managed clusters
• Update cluster properties and metadata
• Create, delete, update, and query fleet groups for cluster organization
• Add/remove clusters from fleet groups (join/leave)
• Retry cluster activation
• Obtain cluster access information and kubeconfig credentials
• Download federation kubeconfig for multi-cluster access
• Check UCS resource quotas

• "Register my CCE cluster to UCS"
• "List all clusters managed by UCS"
• "Remove a cluster from UCS management"
• "Create a fleet group for production clusters"
• "Get kubeconfig for my UCS-managed cluster"
• "Download federation kubeconfig for multi-cluster access"
• "Check my UCS quota usage"
• "Update cluster metadata"
• "Query cluster access information"
• "Add a cluster to a fleet group"
• "Remove a cluster from a fleet group"
• "Retry cluster activation"

• hcloud CLI installed (version >= 7.2.2)
• Run

  hcloud version

  to verify installation
• First-time usage:

  printf "y\n" | hcloud version

  to accept privacy statement

export HUAWEI_CLOUD_AK=<your-ak>
export HUAWEI_CLOUD_SK=<your-sk>
export HUAWEI_CLOUD_REGION=cn-north-4

export HUAWEI_CLOUD_AK=<your-temp-ak>
export HUAWEI_CLOUD_SK=<your-temp-sk>
export HUAWEI_CLOUD_SECURITY_TOKEN=<your-security-token>
export HUAWEI_CLOUD_REGION=cn-north-4

When

HUAWEI_CLOUD_SECURITY_TOKEN

is present, hcloud CLI automatically uses temporary credential authentication. When only AK/SK are set, it uses long-term credential authentication.

• Security Rules:
  • 🚫 Never expose AK/SK/SecurityToken values in code, conversation, or commands
  • 🚫 Never use

    echo $HUAWEI_CLOUD_AK

    or

    echo $HUAWEI_CLOUD_SK

    to check credentials
  • ✅ Use environment variables:

    HUAWEI_CLOUD_AK

    ,

    HUAWEI_CLOUD_SK

    ,

    HUAWEI_CLOUD_REGION

    ,

    HUAWEI_CLOUD_SECURITY_TOKEN

  • ✅ Prefer IAM users over root account for cloud operations
  • ✅ Enable MFA for sensitive operations

• Never commit credentials to version control
• Use IAM users with minimal required permissions
• Enable MFA for sensitive operations
• Rotate AK/SK regularly

ucs:cluster:create

ucs:cluster:delete

ucs:cluster:get

ucs:cluster:list

ucs:cluster:update

ucs:clusterGroup:create

ucs:clusterGroup:delete

ucs:clusterGroup:get

ucs:clusterGroup:update

ucs:clusterAccess:get

ucs:quota:get

ucs:kubeconfig:create

ucs:federationKubeconfig:get

1. When any command fails due to permission errors, read

   references/iam-policies.md

2. Display the required permission list and policy JSON to the user
3. Guide the user to create a custom policy in the IAM console and grant authorization
4. Pause execution and wait for user confirmation that permissions have been granted

⚠️ Cost Notice: UCS cluster onboarding is a paid service. Registering a cluster to UCS incurs costs. Before executing

RegisterCluster

or other onboarding operations, you must confirm with the user whether they agree to incur costs and obtain explicit consent before proceeding.

RegisterCluster

hcloud UCS RegisterCluster

DeleteCluster

hcloud UCS DeleteCluster

UpdateCluster

hcloud UCS UpdateCluster

RegisterClusterGroup

hcloud UCS RegisterClusterGroup

DeleteClusterGroup

hcloud UCS DeleteClusterGroup

UpdateClusterGroup

hcloud UCS UpdateClusterGroup

JoinGroup

hcloud UCS JoinGroup

LeaveGroup

hcloud UCS LeaveGroup

See Parameter Reference for complete parameter tables.

• ShowCluster:

  metadata.uid

  (UUID),

  spec.category

  (onpremise/self),

  status.phase

  (Failed/Available)
• ShowClusterList:

  items[]

  (k8s-style array),

  total

  (count)
• ShowQuota:

  quotas.resources[]

  with

  type

  /

  quota

  /

  used

  /

  min

  /

  max

1. Cluster Naming: Use descriptive names that reflect cluster purpose and environment (e.g.,

   prod-app-backend

   ,

   staging-data-pipeline

   ) via

   --metadata.name

2. Fleet Grouping: Organize clusters by environment (production/staging/development) or business domain for unified governance
3. Kubeconfig Security: Store kubeconfig files securely; never expose them in public repositories or CI logs
4. Deregistration Caution: Removing a cluster from UCS disables all policy governance and federation access for that cluster
5. Self-Managed Registration: Ensure the self-managed cluster kubeconfig is valid and the cluster API server is reachable; pass it via

   --metadata.annotations.kubeconfig

6. Quota Monitoring: Check quotas before registering new clusters to avoid hitting limits
7. Federation Kubeconfig Duration: Choose appropriate

   --duration

   for federation kubeconfig tokens based on usage patterns

1. Environment Check — Verify hcloud CLI is installed and AK/SK credentials are configured (see CLI Installation Guide)
2. Version Compatibility Check — Call

   ListRegisteredClusterVersions

   to get the list of K8s versions supported by UCS, and confirm the target cluster version is in the list
3. Cluster Registration — Choose registration method based on cluster type:
   • CCE cluster:

     --spec.category=self --spec.provider=huaweicloud --spec.type=turbo

   • Self-managed cluster:

     --spec.category=onpremise --spec.provider=self_managed

     (requires kubeconfig)
4. Registration Verification — Call

   ShowCluster

   or

   ShowClusterList

   to confirm cluster status is

   Available

5. Cluster Management (optional):
   • Fleet grouping:

     RegisterClusterGroup

     /

     JoinGroup

     /

     LeaveGroup

   • Access management: CCE clusters use

     CreateKubernetesClusterCert

     , third-party clusters use

     ShowClusterAccessInfo

     + proxy-agent
   • Property update:

     UpdateCluster

     (requires user confirmation)
6. Deregister Cluster (optional) —

   DeleteCluster

   (⚠️ irreversible operation, requires user confirmation)

• K8s version compatibility — UCS has a maximum supported K8s version that updates over time. CCE default cluster version may exceed this limit. Query supported versions with

  hcloud UCS ListRegisteredClusterVersions

  and verify cluster version is in the list before registration.
• Cluster deregistration is irreversible — the cluster loses all UCS management capabilities
• Self-managed cluster kubeconfig must be valid — invalid kubeconfig will cause registration failure; pass via

  --metadata.annotations.kubeconfig

• AK/SK must never be hardcoded — credentials should only be obtained via environment variables
• hcloud CLI is the only supported method — all operations use

  hcloud UCS <Operation>

  format
• Federation kubeconfig requires fleet group ID and duration — both

  --clustergroupid

  and

  --duration

  are required
• RegisterCluster uses K8s API-style parameters — not flat params like --name/--cluster_type; note:

  spec.category

  uses

  self

  /

  onpremise

  (not

  CCE

  /

  AttachedCluster

  ),

  spec.provider

  uses

  huaweicloud

  (not

  huawei_cloud

  ),

  spec.type

  uses lowercase

  cce

  (not

  CCE

  ),

  spec.city

  uses city codes like

  110000

  (not city names like

  Beijing

  )
• ShowQuota requires domainid — the account/domain ID is a required path parameter