Huawei Cloud CCE Cluster Migrator

Overview

The Huawei Cloud CCE Cluster Migrator skill automates and orchestrates the end-to-end migration of Kubernetes workloads, cluster configurations, ConfigMaps, Secrets, and persistent storage from external or third-party cloud Kubernetes environments to Huawei Cloud Cloud Container Engine (CCE). It supports multi-type storage re-mapping (EVS, SFS Turbo, OBS), image synchronization to SWR, and traffic cutover with Dedicated ELB.

Prerequisites

1. Tooling & CLIs:
   • KooCLI (hcloud) installed and authenticated on the central operator host. See references/cli-installation-guide.md.
   • kubectl configured with access to the source cluster and target CCE cluster.
   • velero CLI and/or k8clone installed for workload metadata and volume migration.
   • skopeo or image-migrator installed for container image synchronization to SWR.
2. IAM Authorization:
   • The operator or agency credentials must have CCEFullPolicy (or CCEMigrationOperatorCustomPolicy), SWRFullAccessPolicy, EVSFullAccessPolicy, VPCFullAccessPolicy, and ELBFullAccessPolicy. See references/iam-policies.md.
3. Network & Cluster Readiness:
   • Target CCE cluster (prefer CCE Turbo) provisioned and healthy.
   • VPC subnet routing, NAT Gateway SNAT rules (if public egress needed), and security group rules verified. See references/pre-migration-checklist.md.

Workflow

Phase 2 Plan Formulation Reference Matrix

[!IMPORTANT] The agent must thoroughly read and review all referenced documents listed below and populate templates/migration-plan-template.md before beginning to write implementation_plan.md. Do not start drafting the migration plan until these reference guides have been consulted.

When drafting the formal migration plan document in Phase 2, the agent must consult templates/migration-plan-template.md and incorporate:

1. Architecture Baseline & Quality Gates:
   • references/pre-migration-checklist.md — Source/target readiness matrix, CCE Turbo sizing (compute and sub-interface quotas), and system overhead reservation.
   • references/dataflow-diagram.md — Centralized control plane topology and data migration sequence flows.
2. Network Egress, Ingress & Connectivity:
   • references/external-dependency-audit-guide.md — NAT Gateway + SNAT decision matrix and upstream API allowlisting.
   • references/traffic-cutover-guide.md — Dedicated ELB, ClusterIP (Turbo) vs NodePort (Standard), and DNS cutover schedule.
3. Storage & Transactional Database Consistency:
   • references/storage-pv-migration-guide.md — Multi-type PV mapping.
   • references/velero-migration-guide.md — Velero Backup Hooks (pre.hook/post.hook) or ingress cutoff / maintenance freeze.
4. Image Synchronization, Workload Cloning & Configuration Sanitization:
   • references/swr-image-sync-guide.md — SWR namespace, image inventory, complete Velero suite mirroring, and target CCE imagePullSecrets configuration.
   • references/k8clone-migration-guide.md — Zero-cluster-overhead metadata backup and restore, restore.json for StorageClass substitution (csi-disk/csi-sfsturbo/csi-obs) and ImageRepo rewriting (docker.io $\to$ SWR), --exclude-having-owner-ref rule, and Headless Service clusterIP: None preservation.
   • references/configmap-secret-migration-guide.md — Endpoint re-pointing, SSR variable audit, and paas.elb exclusion.

Core Commands

1. Assessment & Sizing

# Query CCE cluster flavors (x86 architecture)
hcloud CCE GetClusterFlavorSpecs --cli-region=<region_id> --clusterType=VirtualMachine

# List target clusters & inspect active add-ons
hcloud CCE ListClusters --cli-region=<region_id>
hcloud CCE ShowCluster --cli-region=<region_id> --cluster_id={target_cluster_id} --detail=true

2. Kubeconfig & Target Readiness

# Sync CCE kubeconfig on operator host (intranet or public EIP access)
hcloud CCE update-kubeconfig --cluster-id={target_cluster_id} --region=cn-north-4 --output=~/.kube/cce-config

# Verify Everest CSI add-on
hcloud CCE ListAddonInstances --cli-region=<region_id> --cluster_id={target_cluster_id}

# Verify NAT Gateway and SNAT rules (for workload/image internet egress)
hcloud NAT ListNatGateways --cli-region=<region_id>
hcloud NAT ListNatGatewaySnatRules --cli-region=<region_id>

3. Container Image Synchronization (SWR)

# Retrieve temporary SWR login credentials
SWR_AUTH=$(hcloud SWR CreateSecret --cli-region=<region_id> | jq -r '.auths["swr.cn-north-4.myhuaweicloud.com"].auth' | base64 -d)

# Replicate image via skopeo with pipefail
set -euo pipefail
skopeo copy --dest-creds="${SWR_AUTH}" --insecure-policy docker://{source_image} docker://swr.cn-north-4.myhuaweicloud.com/{org}/{image}:{tag}
skopeo list-tags --creds="${SWR_AUTH}" docker://swr.cn-north-4.myhuaweicloud.com/{org}/{image} | grep -q "{tag}"

4. Workload Restore & Verification

# Option A (Primary / Recommended): k8clone Metadata Clone + Direct DB Logical Restore
k8clone backup --kubeconfig=~/.kube/source-config --exclude-having-owner-ref=true --local-dir=./k8clone-dump
k8clone restore --kubeconfig=~/.kube/cce-config --local-dir=./k8clone-dump.zip --restore-conf=./restore.json
# Logical DB stream (example: PostgreSQL)
kubectl exec -i {source_db_pod} -n {namespace} -- pg_dump -U {user} {dbname} | kubectl exec -i {cce_db_pod} -n {namespace} -- psql -U {user} {dbname}

# Option B (Secondary / Alternative): Velero Full State Restore (--uploader-type=restic)
kubectl apply -f templates/velero-sc-mapping.yaml -n velero
velero restore create cce-migration-restore --from-backup {backup_name} --restore-pvs=false --wait

# Verify workloads and database consistency post-restore
kubectl get pods,deployments,statefulsets,pvc -A
kubectl exec -i {db_pod} -n {namespace} -- psql -U {user} -d {dbname} -c "SELECT count(*) FROM accounts;"

5. Ingress & Traffic Cutover

# Inspect Dedicated ELB and public EIPs
hcloud ELB ListLoadBalancers/v3 --cli-region=<region_id>
hcloud EIP ListPublicips/v3 --cli-region=<region_id> --associate_instance_type.1=ELB

# Smoke test Ingress endpoint before DNS switch
curl -Iv https://app.example.com --resolve app.example.com:443:{target_elb_eip}

Parameter Confirmation

Prior to executing any resource provisioning, data migration, or traffic switchover, the agent must confirm the following parameters with the user:

KooCLI Command Format Standard

All Huawei Cloud CLI commands in this skill must adhere to the following standards:

1. Service and Operation Names: Service names start with uppercase/title case (e.g. CCE, NAT, SWR, VPC, ELB, EIP, IAM). Operation names use PascalCase (e.g. ListClusters, ShowCluster, ListNatGateways).
2. Region Specification: Every standard hcloud command must explicitly include --cli-region=<region> (or --region=<region> for update-kubeconfig).
3. Safe Parameter Passing: Complex body parameters (e.g. security group rules, NAT gateway specs) must use the appropriate object prefix syntax (e.g. --security_group_rule.*, --nat_gateway.*, --snat_rule.*) verified against hcloud <Service> <Operation> --help.

Reference Documents

• references/cli-installation-guide.md — Installation and setup procedures for KooCLI, kubectl, velero, and obsutil
• references/configmap-secret-migration-guide.md — ConfigMap/Secret sanitization, parameter adaptation, SSR environment audit, and paas.elb exclusion
• references/dataflow-diagram.md — Mermaid architecture and sequence diagrams
• references/external-dependency-audit-guide.md — External dependency discovery, NAT Gateway decision matrix, and network probing
• references/iam-policies.md — Verified IAM 5.0 policies and least-privilege action definitions
• references/k8clone-migration-guide.md — Lightweight Kubernetes metadata cloning and automated restore via k8clone
• references/pre-migration-checklist.md — Source and target readiness checklist, CCE Turbo sizing (compute and sub-interface quotas), and system add-on sizing
• references/related-commands.md — Complete quick-reference table of verified KooCLI and kubectl commands
• references/storage-pv-migration-guide.md — Multi-type PV migration across EVS, SFS Turbo, and OBS
• references/swr-image-sync-guide.md — Image replication via skopeo, pipefail error handling, complete Velero suite mirroring, and CCE imagePullSecrets configuration
• references/traffic-cutover-guide.md — Dedicated ELB, Ingress backend rules (ClusterIP vs NodePort), elb.autocreate, and DNS cutover
• references/troubleshooting-guide.md — Diagnostic playbooks for T-01 through T-20 (storage, 401 pulls, autocreate, NodePort, sizing)
• references/velero-migration-guide.md — Velero installation with full SWR image suite, backup hooks, and restore