huawei-cloud-devkit-webui-create · git:20260822.3378cbb · 2026-08-22 · sha256 4484b643302e39ca
huawei-cloud-devkit-webui-create git:20260822.3378cbbA

Name: huawei-cloud-devkit-webui-create
Author: huaweicloud
Immutable. This exact content is served forever at /api/v1/blob/4484b643302e39ca.
---
name: huawei-cloud-devkit-webui-create
description: |
  Install Kunpeng DevKit in WebUI mode on Huawei Cloud. Create a Kunpeng (aarch64) ECS via Python SDK with random password, encrypt password via Python KMS SDK, use hcloud CLI for EIP/VPC operations, use Python paramiko SSH (password in process memory only) to install DevKit-All-x.x.x-Linux-Kunpeng.tar.gz, including framework and all plugins (porting/affinity/devtools/debugger/sys_perf/java_perf/sys_diagnosis).
  Use this skill when the user wants to: (1) install DevKit on a new Kunpeng ECS, (2) install DevKit on an existing Kunpeng ECS.
  Trigger: user mentions "DevKit", "Kunpeng DevKit", "install DevKit", "DevKit WebUI", "Kunpeng DevKit", "DevKit-All", "鲲鹏DevKit", "安装DevKit", "鲲鹏开发套件"
tags: ["devkit webui", "devkit", "kunpeng"]
---

# Kunpeng DevKit WebUI Installation Skill

## Overview

Create a Kunpeng (aarch64) ECS instance via Python SDK (ECS + KMS), use hcloud CLI for cloud operations (EIP, VPC), use Python paramiko SSH to connect and install Kunpeng DevKit in WebUI mode. **Password never leaves Python process memory.**

**Tool separation principle:**
- **Python SDK** — ECS creation + KMS encrypt/decrypt/delete (**password never leaves Python process memory, never appears in `ps -ef`**)
- **hcloud CLI** — All other cloud operations (EIP create/bind, VPC query, security group)
- **Python paramiko** — SSH connection + DevKit installation (**password from KMS decrypt, stays in Python memory only**)

**Security architecture:**
- ECS password is randomly generated by Python code (never typed by user, never passed via hcloud CLI, never exported to shell)
- Password is encrypted and stored in Huawei Cloud KMS via Python SDK (never appears in `ps -ef`, env vars, or conversation)
- Password is decrypted from KMS and passed to paramiko `SSHClient.connect(password=...)` (in Python process memory, not CLI args → no `ps -ef` leakage)
- Only `kms_key_id` and `kms_cipher_text_file` are exported (password itself is never exported; cipher text is written to a local file, never passed via command line)
- KMS key is scheduled for deletion after DevKit installation
- No COC dependency, no UniAgent dependency, no third-party skill dependency

## ⛔ Prohibited Operations (Security Constraints)

> **This skill strictly forbids the following operations, regardless of user requests:**

| Prohibited Operation | Reason |
|---------------------|--------|
| ❌ Use `--server.adminPass` in `hcloud ECS CreateServers` | Password appears in `ps -ef` output |
| ❌ Use `hcloud AOM BatchImportAgent --agent_import_param_list.1.password=...` | Password appears in `ps -ef` output |
| ❌ Accept ECS password in chat conversation | Password must never appear in conversation |
| ❌ Use `expect` + `$env(DEVKIT_ECS_PASSWORD)` for SSH | Environment variable can be read by other processes |
| ❌ Use `sshpass -p <password>` for SSH | Password appears in `ps -ef` output |
| ❌ Use `ssh -o PasswordAuthentication` with password on CLI | Password appears in `ps -ef` output |
| ❌ Hardcode password in scripts or command-line arguments | Password exposure risk |
| ❌ Use `question` tool to ask user for password | Password must never appear in conversation |
| ❌ Print or log the ECS password in any output | Password must only exist in Python process memory and KMS |
| ❌ Export password to shell variables or stdout | Password must stay in Python process; only KMS key_id and cipher_text_file path are exported |
| ❌ Pass KMS cipher text via command line arguments | Cipher text appears in `ps -ef`; must use `--kms-cipher-text-file` to read from local file |
| ❌ Auto-select ECS flavor or image without user confirmation | Must let user choose from available options |
| ❌ Display aarch64 images other than CentOS 7.6 and Ubuntu 18.04 | Only these two images are compatibility-verified |
| ❌ Select x86 flavors (c6/c7 etc.) | DevKit requires aarch64 (Kunpeng) architecture |
| ❌ Skip security group port confirmation | Ports 22 and 8086 must be opened before SSH |
| ❌ Auto-modify security group rules without user consent | Must ask user to choose manual or automatic mode |
| ❌ Write new install/verify scripts instead of using existing ones | Must use scripts in `scripts/` directory |
| ❌ Disable or delete KMS key when installation verification fails | KMS key must be preserved for retry; only destroy after verified success (via Task 4 cleanup-kms) |
| ❌ Run cleanup-kms before Task 3 verification passes | KMS key must be preserved until agent confirms DevKit installation success |
| ❌ Run expect script without verifying `expect` binary is installed | Shebang `#!/usr/bin/expect -f` fails with misleading "No such file or directory" if expect is missing |

> **If a user requests a prohibited operation, you must refuse and explain the security constraint.**

## Architecture

```
Kunpeng DevKit WebUI Installation
├── Task 0: hcloud Setup          (Install KooCLI, configure AK/SK authentication)
├── Task 1: Prepare Target Machine (Choose to create new ECS or use existing Kunpeng ECS)
│   ├── Option A: Create New ECS  (Python SDK for ECS + KMS, hcloud CLI for EIP/VPC)
│   │   ├── 1a. hcloud VPC: create empty security group for DevKit
│   │   ├── 1b. Python SDK: create ECS with random adminPass + dedicated security group (password never in ps -ef)
│   │   ├── 1c. Python SDK: KMS create key, encrypt password
│   │   ├── 1d. hcloud EIP: create and bind EIP to ECS
│   │   └── 1e. hcloud VPC: configure security group rules (or user manual)
│   └── Option B: Use Existing ECS (Provide EIP → Confirm security group)
├── Task 2: Python SSH Install    (paramiko SSH, password from KMS decrypt)
│   ├── 2a. Python SDK: KMS decrypt password (in process memory)
│   ├── 2b. paramiko SSH: connect to ECS EIP with decrypted password
│   ├── 2c. Upload install scripts via SFTP
│   ├── 2d. Execute install_devkit_webui.sh on remote ECS
│   ├── 2e. Execute verify_devkit.sh on remote ECS
│   └── 2f. KMS key is NOT cleaned up here (preserved until Task 4)
└── Task 3: Verify & Access       (Check WebUI access at https://<EIP>:8086)
├── Task 4: Cleanup KMS Key      (Independent Python method, run ONLY after Task 3 verified success)
│   ├── 4a. Python SDK: kms_disable_key (password immediately unrecoverable)
│   └── 4b. Python SDK: kms_schedule_deletion (7 days, API minimum)
└── Task 5: Reset ECS Password   (If SSH access needed, reset password in ECS console — random password no longer recoverable)
```

## Prerequisites

> **Prerequisite check 1/4: Environment variables for Python SDK credentials (highest priority)**
>
> The Python SDK scripts (`create_ecs_and_setup_devkit.py`) read credentials from environment variables, **NOT from `hcloud configure list`** (which shows masked/desensitized values). The following environment variables **MUST** be set before running any `create` / `install` / `status` subcommand:
>
> | Variable | Required | Description |
> |----------|----------|-------------|
> | `HW_ACCESS_KEY` | Yes | Huawei Cloud Access Key ID (AK) |
> | `HW_SECRET_KEY` | Yes | Huawei Cloud Secret Access Key (SK) |
> | `HW_SECURITY_TOKEN` | No | Temporary security token (only for temporary AK/SK) |
>
> **Project ID:** Not a prerequisite. The SDK auto-resolves the project ID from the region via IAM on the first API call (requires IAM read permission). The `HUAWEICLOUD_SDK_PROJECT_ID` environment variable is an optional override if set.
>
> ```bash
> # Linux — verify HW_ACCESS_KEY / HW_SECRET_KEY are set (values never printed)
> python3 -c 'import os,sys;ak=os.environ.get("HW_ACCESS_KEY","");sk=os.environ.get("HW_SECRET_KEY","");ok=bool(ak) and bool(sk);print("AK/SK configured OK" if ok else "ERROR: HW_ACCESS_KEY/HW_SECRET_KEY not set");sys.exit(0 if ok else 1)'
> # Windows (cmd / PowerShell)
> python -c "import os,sys;ak=os.environ.get('HW_ACCESS_KEY','');sk=os.environ.get('HW_SECRET_KEY','');ok=bool(ak) and bool(sk);print('AK/SK configured OK' if ok else 'ERROR: HW_ACCESS_KEY/HW_SECRET_KEY not set');sys.exit(0 if ok else 1)"
> ```
>
> **If verification reports ERROR (variables not set), configure them:**
> - **Linux**: add `export HW_ACCESS_KEY=...` / `export HW_SECRET_KEY=...` to your shell profile (`~/.bashrc`, `~/.zshrc`) or a secrets manager, then `source` the profile.
> - **Windows**: set **system environment variables** via the GUI (System Properties → Advanced → Environment Variables → System variables → New). See [references/prerequisites.md](references/prerequisites.md) "Windows GUI Setup" for step-by-step instructions. Avoid `setx` (it records credentials in command history).
>
> ⚠️ **Never set these variables in conversation or hardcode them in scripts.** After setting, restart the terminal/Python process and re-run the verification above.

> **Prerequisite check 2/4: Huawei Cloud CLI (hcloud / KooCLI) >= 3.2.0 required**
> Run `hcloud version` to verify version >= 3.2.0. If not installed or version is too low,
> see [references/cli-installation-guide.md](references/cli-installation-guide.md) for installation guide.

```bash
hcloud version
```

> **Prerequisite check 3/4: Python 3.8+ and huaweicloudsdkcore/ecs/kms + paramiko required**
>
> The ECS creation + KMS encryption + paramiko SSH script uses Python to keep password in process memory only.
> Install the required packages:
> ```bash
> # Auto-use China mirror when system timezone is UTC+8 (faster in CN region; auto-detected via Python)
> PIP_INDEX=$(python3 -c "import time;print('-i https://mirrors.huaweicloud.com/repository/pypi/simple' if -(time.timezone)//3600==8 else '')")
> pip install $PIP_INDEX huaweicloudsdkcore huaweicloudsdkecs huaweicloudsdkkms paramiko
> ```
>
> **Other cloud operations (EIP, VPC) use hcloud CLI — no additional Python SDK packages needed.**

> **Prerequisite check 4/4: Target ECS requirements**
>
> - Architecture: **aarch64** (Kunpeng processor)
> - OS: **CentOS 7.6** or **Ubuntu 18.04** (only these two are compatibility-verified)
> - Disk space: >= 2GB available
> - Memory: >= 4GB
> - Access: root privileges required

---

## Authentication

> **Security rules (must be followed):**
> - **Prohibited** from reading, echoing, or printing AK/SK values
> - **Prohibited** from asking the user to input AK/SK directly in the conversation
> - **Prohibited** from using `hcloud configure set` to pass plaintext credential values
> - **Prohibited** from accepting AK/SK directly provided by the user in the conversation
> - **Only allowed** to read credentials from environment variables or configured CLI config files
>
> **Check CLI configuration:**
> ```bash
> hcloud configure list
> ```
> Verify the output contains valid AK/SK configuration.
>
> **If no valid credentials exist, stop here.**

---

## IAM Permission Policies

Ensure the IAM user has the required permissions (ECS/VPC/IMS/EIP/KMS, scoped to the DevKit workflow only). See [references/iam-policies.md](references/iam-policies.md) for the full permission table and recommended IAM policy JSON.

**Permission boundaries:**

- **Scope constraint**: Only create/manage resources named or tagged with `devkit`. Never modify or delete existing resources not created by this workflow.
- **Must stop if**: credentials missing or invalid, user declines any confirmation, package signature verification fails, or installation verification fails.
- **Prohibited actions**: deleting any existing ECS/VPC/security group, modifying IAM policies, accessing resources outside the DevKit workflow, running commands not documented in this skill.

---

## Core Workflows

### Task 0: hcloud Installation and Configuration

Install Huawei Cloud CLI tool and configure authentication.

📄 Detailed steps → [references/cli-installation-guide.md](references/cli-installation-guide.md)

### Task 1: Prepare Target Machine

Create a Kunpeng (aarch64) ECS instance, or use an existing Kunpeng ECS.

> **⚠️ Tool separation: Python SDK for ECS + KMS, hcloud CLI for EIP/VPC**
>
> - **Python SDK** (`create_ecs_and_setup_devkit.py create`): Generates random password, creates ECS, encrypts password in KMS. **Password never leaves Python process memory.** Outputs only `server_id`, `kms_key_id`, `kms_cipher_text_file` (cipher text written to file, never passed via CLI).
> - **hcloud CLI**: All remaining operations — EIP create/bind, VPC query, security group.

📄 Detailed steps → [references/ecs-creation-guide.md](references/ecs-creation-guide.md)

**Option A: Create New ECS — Sub-tasks:**

1. **1a. Create empty security group** — `hcloud VPC CreateSecurityGroup --cli-region=$REGION --security_group.name=$SG_NAME` — dedicated DevKit security group with no ingress rules (v3 API, no vpc_id needed)
2. **1b. Create ECS + KMS encrypt** — `scripts/create_ecs_and_setup_devkit.py create --security-group-id` — attaches dedicated security group. Password never exported.
3. **1c. Bind EIP** — `hcloud EIP CreatePublicip` + `hcloud VPC ListPorts` + `hcloud EIP UpdatePublicip`
4. **1d. Configure security group rules** — Open ports 22 and 8086

**Option B: Use Existing ECS**

- Provide EIP
- Confirm security group ports 22 and 8086 are open
- If password is unknown, reset it via ECS API and store in KMS

### Task 2: Python SSH Install DevKit

Use `scripts/create_ecs_and_setup_devkit.py install` to SSH into the ECS and install DevKit. Password is decrypted from KMS in Python memory and passed to paramiko — **never appears in `ps -ef` or shell variables**.

📄 Detailed steps → [references/ssh-connection-guide.md](references/ssh-connection-guide.md) | [references/devkit-installation-workflow.md](references/devkit-installation-workflow.md) | [references/devkit-installation-guide.md](references/devkit-installation-guide.md)

**Sub-tasks:**

1. **2a. KMS decrypt** — Python SDK reads cipher text from file and decrypts password from `kms_key_id`
2. **2b. paramiko SSH connect** — `SSHClient.connect(password=decrypted)` — password in Python memory only
3. **2c. Upload scripts** — SFTP upload `install_devkit_webui.sh`, `auto_install_devkit.expect`, `verify_devkit.sh` to `/tmp/`
4. **2d. Start DevKit install** — Execute `nohup bash /tmp/install_devkit_webui.sh <url> &` on remote ECS (background)
5. **2e. Poll install progress** — Launch `poll_devkit_status.py` in background (output to log file), then use `read` tool with incrementing offset to read the log every 10-20s and report to user (doom-loop safe, continuous visibility; see Polling Progress below)
6. **2f. Verify installation** — Run `verify_devkit.sh` and check results
7. **2g. Report result** — If verification passed, prompt agent to proceed to Task 4 (cleanup-kms); if failed, KMS key is preserved for retry

> **⚠️ KMS key is NOT cleaned up in Task 2.** Cleanup is a separate Task 4, executed only after the agent confirms DevKit installation success in Task 3.

> **⚠️ DevKit installation takes 5-15 minutes.** The `install` subcommand starts the installation in the background and returns immediately. The agent **MUST** poll progress and report to the user continuously.
>
> - **Install process status**: `PREPARING` (early stages [1/6]-[4/6]: env check / dependency install / package download / extraction) / `RUNNING` ([5/6] expect install) / `DONE` / `NOT_STARTED`
> - **Current stage**: e.g. `[2/6] Install Dependencies` (parsed from wrapper log during PREPARING; empty otherwise)
> - **Services**: devkit_nginx, gunicorn_framework, gunicorn_plugin (active/failed/inactive)
> - **Plugins**: porting, affinity, devtools, debugger, sys_perf, java_perf, sys_diagnosis (installed/missing)
> - **Ports**: 8086, 8002, 7996 (listening or not)
> - **Last log lines**: PREPARING → from `/tmp/devkit_install_wrapper.log` (yum/wget output); RUNNING/DONE → from `/tmp/devkit_install.log`
>
> **Polling Progress (doom-loop safe):** Launch `poll_devkit_status.py` in background (output to a log file), then use the `read` tool with incrementing offset every 10-20s to report progress until the log contains `DONE`/`TIMEOUT`. See [references/polling-progress-guide.md](references/polling-progress-guide.md) for the exact steps, guidelines table, and status field reference.

### Task 3: Verify & Access

Check WebUI access at `https://<EIP>:8086`.

📄 Acceptance criteria → [references/acceptance-criteria.md](references/acceptance-criteria.md)

> **⚠️ KMS key cleanup must NOT be performed until this verification passes.**
> The agent must confirm all services are active and WebUI is accessible before proceeding to Task 4.

### Task 4: Cleanup KMS Key (After Verified Success)

**Only execute this task after Task 3 verification has passed.** Use `scripts/create_ecs_and_setup_devkit.py cleanup-kms` to disable the KMS key and schedule its deletion. This is an independent Python method that does not require SSH or cipher text — only the KMS key ID.

**Sub-tasks:**

1. **4a. Disable KMS key** — `kms_disable_key()` — password immediately becomes unrecoverable
2. **4b. Schedule KMS key deletion** — `kms_schedule_deletion(delay_days=7)` — key permanently deleted after 7 days (API minimum)

```bash
python scripts/create_ecs_and_setup_devkit.py cleanup-kms \
  --region $R \

  --kms-key-id $KID \
  --delay-days 7
```

> **⚠️ Critical: Only run cleanup-kms after verified success**
>
> - If Task 3 verification FAILED: do NOT run cleanup-kms; KMS key is preserved for retry
> - If Task 3 verification PASSED: run cleanup-kms to disable key + schedule deletion
> - The `--force` flag allows scheduling deletion even if disable fails (use with caution)

### Task 5: Reset ECS Password (If SSH Access Needed)

The ECS password was randomly generated by Python SDK and the KMS key is disabled after successful installation. The password is no longer recoverable. If the user needs SSH access to the ECS later, they must reset the password in the ECS console.

**Steps:**
1. Navigate to ECS console: `https://console.huaweicloud.com/ecm/?region=<REGION>#/detail/<SERVER_ID>`
2. Click "More" > "Reset Password"
3. Set a new password following the complexity requirements
4. Confirm the password reset

---

## Core Commands

### Python SDK (ECS + KMS — password never in ps -ef)

| Command | Description |
|---------|-------------|
| `pip install huaweicloudsdkcore huaweicloudsdkecs huaweicloudsdkkms paramiko` | Install Python SDK + paramiko (for UTC+8, add `-i https://mirrors.huaweicloud.com/repository/pypi/simple`) |
| `python scripts/create_ecs_and_setup_devkit.py create --region $R --vpc-id $V --subnet-id $S --flavor $F --image-id $I --az $A --ecs-name $N` | Phase 1: Create ECS + KMS encrypt |
| `python scripts/create_ecs_and_setup_devkit.py install --region $R --eip $EIP --kms-key-id $KID --kms-cipher-text-file $CT_FILE` | Phase 2: SSH start DevKit install in background, returns immediately (add --wait to poll+verify) |
| `python scripts/create_ecs_and_setup_devkit.py status --region $R --eip $EIP --kms-key-id $KID --kms-cipher-text-file $CT_FILE` | Poll install progress (every 30s) |
| `python scripts/create_ecs_and_setup_devkit.py cleanup-kms --region $R --kms-key-id $KID --delay-days 7` | Phase 3: Disable + schedule KMS key deletion (after verified success) |

### hcloud CLI (EIP, VPC — no password involved)

| Command | Description |
|---------|-------------|
| `hcloud VPC ListVpcs --cli-region=$REGION` | List VPCs for subnet selection |
| `hcloud VPC ListSubnets --cli-region=$REGION --limit=10` | List subnets (first 10) for user selection |
| `hcloud ECS NovaListAvailabilityZones --cli-region=$REGION` | List all availability zones in the region |
| `hcloud ECS ListFlavors --cli-region=$REGION --availability_zone=<AZ>` | Query flavors available in a specific AZ (filter for `kc1`/`kx1` to find AZs with Kunpeng servers) |
| `hcloud ECS NovaListFlavorsDetails --cli-region=$REGION` | Query ECS flavors (filter for `kc1`/`kx1` Kunpeng flavors) |
| `hcloud IMS ListImages --cli-region=$REGION --__imagetype=gold --status=active` | Query public images (filter for CentOS 7.6 ARM + Ubuntu 18.04 ARM only) |
| `hcloud EIP CreatePublicip --cli-region=$REGION --publicip.type=5_bgp --bandwidth.share_type=PER --bandwidth.name=$ECS_NAME-eip --bandwidth.size=300 --bandwidth.charge_mode=traffic` | Create pay-per-use 300Mbit/s EIP (bandwidth.name required when share_type=PER) |
| `hcloud VPC ListPorts --cli-region=$REGION --device_id.1=$SERVER_ID` | Get port_id for EIP binding |
| `hcloud EIP UpdatePublicip --cli-region=$REGION --publicip_id=$EIP_ID --publicip.associate_instance_type=PORT --publicip.associate_instance_id=$PORT_ID` | Bind EIP to ECS port (v3 API) |
| `hcloud VPC CreateSecurityGroupRule --cli-region=$REGION ...` | Add security group ingress rule (ports 22/8086) |

> **⚠️ Key constraints on Core Commands:**
>
> - ECS creation + KMS: **MUST use `scripts/create_ecs_and_setup_devkit.py`** — password never in `ps -ef`
> - SSH + DevKit install: **MUST use `scripts/create_ecs_and_setup_devkit.py install`** — password from KMS, in paramiko memory only
> - `hcloud ECS CreateServers`: **MUST NOT include `--server.adminPass`**
> - EIP/VPC: **MUST use hcloud CLI**
> - `IMS ListImages`: Only display CentOS 7.6 ARM and Ubuntu 18.04 ARM
> - `ECS NovaListFlavorsDetails`: Only display flavors starting with `k` (Kunpeng)
> - `install_devkit_webui.sh` must be executed via paramiko SSH (not scp + manual ssh)

---

## Parameter Confirmation

> **Before executing any task, the following parameters must be confirmed with the user. Guessing is prohibited.**

| Parameter | Required/Optional | Description | Default |
|-----------|-------------------|-------------|---------|
| Region | Required | Huawei Cloud region (e.g., `cn-south-1`, `cn-north-4`); must be explicitly selected by the user | - |

| Subnet | Required | Subnet for ECS creation; user selects from list of first 10 subnets | - |
| Target machine method | Required | Create New Kunpeng ECS (recommended) or Use Existing Kunpeng ECS | Create New |
| ECS Flavor | Required (New ECS) | Kunpeng flavor starting with `k` (e.g., `kc1.xlarge.2`); user selects from list | - |
| OS Image | Required (New ECS) | CentOS 7.6 ARM or Ubuntu 18.04 ARM only; user selects from list | - |
| Existing ECS EIP | Required (Existing ECS) | Public IP of existing Kunpeng ECS | - |
| Security group method | Required | Manual (recommended) or Agent automatic; user chooses | Manual |
| DevKit download URL | Optional | URL for DevKit-All tar.gz package | Default OBS URL for 26.1.RC1 |

> **Note**: No password parameter is required. The password is randomly generated by Python SDK, encrypted via Python KMS SDK, and decrypted for paramiko SSH. The password is never exported from the Python process.

---

## Script Tools

| Script | Description |
|--------|-------------|
| [create_ecs_and_setup_devkit.py](scripts/create_ecs_and_setup_devkit.py) | ECS creation + KMS encrypt/decrypt + paramiko SSH DevKit install (password never in `ps -ef`). Subcommands: `create`, `install`, `status`, `cleanup-kms`. See Core Commands above for usage. |
| [install_devkit_webui.sh](scripts/install_devkit_webui.sh) | One-click installation script, uploaded and executed on the remote ECS via paramiko. |
| [auto_install_devkit.expect](scripts/auto_install_devkit.expect) | Interactive installation automation, used by `install_devkit_webui.sh`. |
| [verify_devkit.sh](scripts/verify_devkit.sh) | Installation verification, executed on the remote ECS via paramiko. |
| [poll_devkit_status.py](scripts/poll_devkit_status.py) | Doom-loop safe progress polling (background + `read` tool). See [references/polling-progress-guide.md](references/polling-progress-guide.md). |

> **⚠️ Script usage rules:**
> - Must use existing scripts; do not write new expect/shell scripts as replacements
> - Do not split `install_devkit_webui.sh` internal logic into individual SSH commands
> - Do not create new install/verify scripts

---

## Verification Method

See [references/verification-method.md](references/verification-method.md) for details. For common issues and solutions, see [references/troubleshooting.md](references/troubleshooting.md).

**Quick validation:**
```bash
hcloud version && hcloud configure list
python scripts/create_ecs_and_setup_devkit.py install \
  --region $R --eip $EIP --kms-key-id $KID --kms-cipher-text-file $CT_FILE
```

**Post-installation access:** `https://<EIP>:8086` (accept self-signed certificate; default account: devadmin)

> **⚠️ Password reminder:** The ECS password was randomly generated and the KMS key is disabled after successful installation. If you need SSH access to the ECS later, you must reset the password in the ECS console first:
> ```
> ECS console: https://console.huaweicloud.com/ecm/?region=<REGION>#/detail/<SERVER_ID>
> ```

---

## Security Design

The security architecture keeps the ECS password exclusively in Python process memory and KMS — never in `ps -ef`, shell variables, environment variables, or conversation. Tool separation: **Python SDK** for ECS creation + KMS encrypt/decrypt/delete, **hcloud CLI** for EIP/VPC (no password), **Python paramiko** for SSH + DevKit install. The KMS key is preserved on failure (for retry) and only disabled + scheduled for deletion after verified success.

📄 Full details (tool separation table, password leakage risk elimination, password lifecycle) → [references/security-design.md](references/security-design.md)

---

## References

| Document | Description |
|----------|-------------|
| [prerequisites.md](references/prerequisites.md) | Prerequisites + Windows GUI env var setup |
| [cli-installation-guide.md](references/cli-installation-guide.md) | hcloud (KooCLI) installation and configuration |
| [ecs-creation-guide.md](references/ecs-creation-guide.md) | Kunpeng ECS creation detailed steps (Python SDK + hcloud CLI) |
| [ssh-connection-guide.md](references/ssh-connection-guide.md) | Python paramiko SSH connection guide |
| [devkit-installation-workflow.md](references/devkit-installation-workflow.md) | Task 2-3 installation detailed steps |
| [devkit-installation-guide.md](references/devkit-installation-guide.md) | Complete installation steps |

| [iam-policies.md](references/iam-policies.md) | Required IAM permissions |
| [verification-method.md](references/verification-method.md) | Installation result verification method |
| [acceptance-criteria.md](references/acceptance-criteria.md) | Installation acceptance criteria |
| [troubleshooting.md](references/troubleshooting.md) | Common installation issues and solutions |
| [polling-progress-guide.md](references/polling-progress-guide.md) | Doom-loop safe progress polling detailed guide |
| [security-design.md](references/security-design.md) | Security design: tool separation, password lifecycle |
| [install_devkit_webui.sh](scripts/install_devkit_webui.sh) | One-click installation script |
| [auto_install_devkit.expect](scripts/auto_install_devkit.expect) | expect automated interactive installation |
| [verify_devkit.sh](scripts/verify_devkit.sh) | Installation verification script |
| [create_ecs_and_setup_devkit.py](scripts/create_ecs_and_setup_devkit.py) | ECS + KMS + paramiko SSH DevKit script (password never in ps -ef) |
| [poll_devkit_status.py](scripts/poll_devkit_status.py) | Doom-loop safe progress polling (background + read tool, 10-20s interval) |