/alibabacloud-lingjun-node-ops

name: alibabacloud-lingjun-node-ops
description: |
  Manage Alibaba Cloud Lingjun (hyper-)node full-lifecycle ops: stop/reboot/reimage,
  subscription renewal (bssopenapi renew-instance), spec change (change-node-types),
  repair (report-node-status/approve-operation), run-command, node-group default
  update, tag/untag, change-resource-group, plus read-only inventory prerequisite
  (list-cluster-nodes/describe-node/list-cluster-hyper-nodes). change-node-group &
  send-file out of scope (see alibabacloud-lingjun-cluster-scaling).
  Triggers: "lingjun node ops", "灵骏节点运维", "节点停机", "stop nodes", "节点重启",
  "reboot nodes", "节点重装", "reimage nodes", "节点续费", "renew lingjun node",
  "节点规格修改", "change node types", "节点维修", "report node status",
  "节点执行命令", "run command", "节点分组更新", "update node group",
  "节点打标", "tag node", "节点资源转组", "change node resource group".

Alibaba Cloud Lingjun Node Operations (Full Lifecycle)

Scenario Description

Cover the **post-provisioning** day-to-day operations of Lingjun regular nodes (`NodeId`) and rack-level hyper-nodes (`HyperNodeId`). Provisioning/expansion/shrink/release is **out of scope** here - see the sister skill `alibabacloud-lingjun-cluster-scaling`. This skill focuses on 9 capability areas / 22 use cases (node-to-group move `change-node-group` and file delivery `send-file` are out of scope):

| # | Capability | Mutating CLI | Sync/Async | Reversible | |---|---|---|---|---| | F1 | Node Stop | `stop-nodes` | Async (TaskId) | Yes (start later via reboot) | | F2 | Node Reboot | `reboot-nodes` | Async (TaskId) | N/A | | F3 | Node Reimage | `reimage-nodes` | Async (TaskId) | **No** (data loss) | | F4 | Node Renew | `bssopenapi renew-instance` | Sync (OrderId) | No (paid) | | F5 | Node Spec Change | `change-node-types` | Async (TaskId) | Yes (re-issue) | | F6 | Repair | `report-node-status` + `approve-operation` | Sync | N/A | | F7 | Run Command | `run-command` (+ `describe-invocations` / `stop-invocation`) | Async (InvokeId) | N/A | | F8 | Node Group Update | `update-node-group` (group default) | Sync | Yes | | F9 | Tag & Resource Group | `tag-resources` / `untag-resources` / `change-resource-group` | Sync | Yes |

> **Canonical Chinese feature names (MANDATORY in zh sessions)** - the authoritative zh rendering strings live in `lib/core/i18n.sh` (`render.feat.F1`..`render.feat.F9` keys, rendered via `_lj_t`); the agent must use them verbatim and never free-translate (e.g. F5 must never be rendered with a non-canonical synonym). The `F1`-`F9` codes themselves are **internal documentation indices** - never show them in **any user-facing output** (confirmation-table titles, operation names, submission receipts, progress lines, final reports): write the canonical feature name plus the CLI name in parentheses, never the F-code; they may appear only in capability-overview tables that enumerate all features.

**Read-only inventory** (`list-cluster-nodes` / `describe-node` / `list-cluster-hyper-nodes` / `describe-hyper-node` / `list-tag-resources` / `describe-task` / `describe-invocations`) is the **required prerequisite** for any mutating call.

**Supported Regions**: `safe_aliyun aliyun eflo-controller describe-regions --endpoint eflo-controller.cn-hangzhou.aliyuncs.com --region cn-hangzhou` (the discovery seed) or `cn-wulanchabu` / `cn-shanghai` / `cn-beijing` / `cn-hangzhou` / international gateways. Test region: `cn-wulanchabu-test-6` (auto-injects `--insecure`).

---

Installation

Verify `aliyun version >= 3.3.3`; otherwise:

curl -fsSL --connect-timeout 10 --max-time 120 https://aliyuncli.alicdn.com/setup.sh | bash
aliyun version

This skill orchestrates **two** Alibaba Cloud OpenAPI namespaces (plugin mode, lowercase-hyphenated commands):

| Plugin | CLI Namespace | Used For | |---|---|---| | `eflo-controller` | `aliyun eflo-controller ...` | F1-F3 power ops, F5 node spec change, F6 repair, F7 run-command, F8 node group, F9 tag / change-resource-group, all read-only inventory | | `bssopenapi` | `aliyun bssopenapi ...` | F4 subscription renewal (`renew-instance`) and order verification (`query-orders`) |

aliyun configure set --auto-plugin-install true
aliyun plugin install --name eflo-controller
aliyun plugin install --name bssopenapi
aliyun plugin update

Verification: `aliyun eflo-controller version && aliyun bssopenapi version`. See [cli-installation-guide.md](references/cli-installation-guide.md).

---

Authentication

Verify credentials via `aliyun configure list`. **Never** echo or display AccessKey values; render as `***` when discussing them. Missing -> guide users to the [Alibaba Cloud RAM Console](https://ram.console.aliyun.com/manage/ak) outside this session.

---

RAM Permissions

Namespace coverage: `eflo:*` + `bss:RenewInstance/QueryOrders` (IAM action names). Split into 4 permission sets for least-privilege:

| Set | Actions | API Coverage | |---|---|---| | **Read-Only** | `eflo:DescribeRegions/ListClusters/ListClusterNodes/ListClusterHyperNodes/DescribeNode/DescribeHyperNode/ListNodeGroups/DescribeNodeGroup/DescribeTask/ListTagResources/DescribeInvocations` | Inventory & verification | | **Power** (F1-F3) | `eflo:StopNodes/RebootNodes/ReimageNodes/DescribeTask` | Power state mutation | | **Lifecycle** (F4-F8) | `eflo:ChangeNodeTypes/ReportNodeStatus/ApproveOperation/RunCommand/StopInvocation/UpdateNodeGroup` + `bss:RenewInstance/QueryOrders` | Renewal / node spec change / repair / exec / group update | | **Tag & RG** (F9) | `eflo:TagResources/UntagResources/ListTagResources/ChangeResourceGroup` | Metadata mutation |

Full policies in [ram-policies.md](references/ram-policies.md). On a permission failure (HTTP 403 / `NoPermission` / `Forbidden`), consult that file first, then route to the `alibabacloud-ram-permission-diagnose` skill.

---

Observability (MANDATORY for every aliyun command)

1. **Session-id generation rule**: upon loading this skill (`source lib/lj_init.sh`), generate a random se