Alibaba Cloud Lingjun Cluster Manage

Full rules / counter-examples / tutorials → references/ *.md (deep-read on demand, not on load path)

When to Use

Activate this skill when user:

• Creates, queries, or deletes Lingjun clusters
• Queries machine types or OS images
• Tags / untags / lists tags for cluster resources
• Migrates cluster to a different resource group
• Queries async task status

Scope boundary: cluster-level lifecycle only. Node group management (create / query / update / delete node group), cluster scaling, node purchase/release, and hyper-node management belong to alibabacloud-lingjun-cluster-scaling (see Out of Scope).

Routing

User intent?
├─ Create cluster (3-round flow)
│  ├─ R1: cluster_create_form --region <R> → markdown form: name/HPN/VPC/machine-type/image/keypair/disk/switches in ONE user reply
│  ├─ R2: cluster_create_form --region <R> --step 2 --vpc-id <V> → vSwitch + security group pick
│  └─ R3: cluster_create_submit <all params> → confirmation table → user replies 确认 → safe_mutate_confirm <hash from ===MUTATE_HASH=== block> → receipt, then query task on demand
│     (widget ONLY on explicit visual-form request → cluster_create_form_widget → MCP genui.show_widget; legacy fields)
├─ Query (cluster / node / machine type / image / tag / task)
│  └─ bash-first: query <region> <subcommand>
├─ Delete cluster
│  └─ bash-first: safe_mutate_oneshot delete-cluster
├─ Tag resources
│  └─ bash-first: safe_mutate_oneshot tag-resources
├─ Untag resources
│  └─ bash-first: safe_mutate_oneshot untag-resources
├─ Change resource group
│  └─ bash-first: safe_mutate_oneshot change-resource-group
└─ Uncertain
   └─ HITL: ask user intent

Hard Rules (L0-L11)

Workflows

Region mapping (translation aid only — not a supported-region list; any region id the user gives is passed through as-is): 乌兰察布=cn-wulanchabu / 上海=cn-shanghai / 北京=cn-beijing / 杭州=cn-hangzhou / 深圳=cn-shenzhen / 张家口=cn-zhangjiakou / 宁夏=cn-ningxia / 香港=cn-hongkong / 新加坡=ap-southeast-1 / 东京=ap-northeast-1 / 法兰克福=eu-central-1 / 迪拜=阿联酋=me-east-1 (NOT me-central-1 — that id does not exist here) / more pairs → references/endpoint-and-regions.md. Overseas names are listed inline on purpose: guessing an id the user never typed is worse than a wrong lookup, and this line has to be enough on its own.

cluster_create_submit full flag list — copy flag names exactly; every flag is --kebab-case, no abbreviations:

cluster_create_submit \
  --region <R> \
  --cluster-name <N> \
  --hpn-zone <H> \
  --vpc-id <V> \
  --vswitch-id <VSW> \
  --security-group-id <SG> \
  --machine-type <MT> \
  --image-id <IMG> \
  --key-pair-name <KP> \
  --node-group-name <NG> \
  --disk-size <GB>
# optional: --disk-pl PL0|PL1  --open-eni-jumbo-frame  --fs-mount  --vgpu true
# optional: --cli-dry-run  (validation only, see Dry-run mode)

Strictly forbidden (applies to all actions): self-querying aliyun API / self-rendering after calling safe_aliyun / re-formatting stdout / wrapping markdown tables in ``` code blocks

Query Reference

source "$LJ_SKILL_DIR/lib/lj_init.sh" && query <region> <subcommand> [args]

Mutating Reference

All mutating operations use safe_mutate_oneshot:

source "$LJ_SKILL_DIR/lib/lj_init.sh" && safe_mutate_oneshot <action> [--intent "<user words>"] aliyun eflo-controller <action> --region <R> [args]

Dry-run mode — only when the user explicitly asks for a --cli-dry-run validation: keep the exact same path and confirmation gate, just append --cli-dry-run at the end of the command. safe_mutate_oneshot <action> aliyun eflo-controller <action> … --cli-dry-run for the four sync actions; cluster_create_submit … --cli-dry-run for create (the flag is passed straight through to the CLI, so the following safe_mutate_confirm <hash> is what actually prints the request body). The CLI then prints DRY-RUN MODE: Request Details, API Action: <PascalCase>, the Body:/Query Parameters: payload and Request NOT sent (dry-run mode) with exit code 0 — nothing is created / deleted / tagged / moved. Verified on aliyun CLI 3.3.10.

Task Monitoring (receipt + on-demand query)

Async mutating (create-cluster only) returns TaskId. NO automatic polling — simple & reliable:

1. Receipt first: right after submit succeeds, reply with a markdown receipt table — Operation / ClusterId (if any) / TaskId / RequestId / estimated duration (~1 min without nodes, a few minutes with nodes) — plus one closing line (zh-session canonical wording, render verbatim): 可随时对我说“查一下任务进度”。
2. On-demand query: when user asks progress → query <region> task <tid> (stdout verbatim; after terminal state, optionally run query <region> cluster-describe <cid> to verify OperatingState).
3. poll_task <region> <tid> is opt-in only: use solely when user explicitly asks to wait/watch until the task finishes.

Observability

All aliyun API calls issued through safe_aliyun (and therefore query / safe_mutate_* / poll_task) automatically append a unified User-Agent flag:

--user-agent AlibabaCloud-Agent-Skills/alibabacloud-lingjun-cluster-manage/{session-id}

session-id rules (generated by lib/lj_init.sh as LJ_SESSION_ID, consumed via LJ_USER_AGENT):

• Format: lj-<UTC yyyymmddHHMMSS>-<pid>-<4-hex random> (e.g. lj-20260825073000-12345-a1b2); generated once per conversation session on first source of lj_init.sh.
• All CLI calls within one session share the same session-id so backend audit logs can correlate the whole operation chain.
• Never hardcode or reuse a stale value; a fresh source regenerates it when unset.
• The legacy persistent UA configuration mechanism (ai-mode) is deprecated and no longer used.

Prerequisites

• bash 3.2+ with coreutils (date, stat, shasum/sha256sum)
• aliyun CLI 3.3.3+ — the eflo-controller plugin is installed automatically by lib/lj_init.sh on first source (non-interactive; the CLI's own prompt would hang in a no-tty sandbox). See cli-installation.md
• eflo-controller API version is not pinned — the CLI default is used. Where a CLI build's parameter schema disagrees with the request body (unknown field: X on --networks / --node-groups, raised during local validation, so nothing is sent), safe_aliyun strips that field and replays automatically; the fields in question are platform defaults, so dropping them does not change semantics
• jq 1.6+ (JSON parsing in lib / workflows). python3 is an optional second engine for the schema-strip fallback above — either one suffices
• rsync (only for the dev-only utility scripts/sync-to-skills.sh)
• Credentials configured and RAM policies attached per ram-policies.md

References

Out of Scope

This skill does not cover:

• Cluster scaling (extend-cluster / shrink-cluster)
• Node purchase / release / migration (CreateInstance / DeleteNode / ChangeNodeGroup)
• Node group management (create-node-group / list-node-groups / update-node-group / delete-node-group)
• Hyper-node management (HyperNode)

These belong to alibabacloud-lingjun-cluster-scaling skill.