/alibabacloud-pai-eas-service-deploy

name: alibabacloud-pai-eas-service-deploy
description: |
  Deploy AI models as PAI-EAS inference services.
  Supports LLMs (Qwen, Llama), image gen (SD, SDXL),
  speech synthesis, and more.
  When to use: deploy models, create inference services,
  EAS deployment, model serving, deploy vLLM/SGLang/ComfyUI.
license: Apache-2.0
metadata:
  version: "1.0.0"
  domain: aiops
  owner: pai-eas-team
  contact: pai-eas-agent@alibaba-inc.com
  tags:
    - pai-eas
    - model-deployment
    - inference-service
    - llm
    - vllm
    - sglang
  required_tools:
    - aliyun
    - jq
  prerequisites:
    - "Aliyun CLI >= 3.3.3"
    - "jq command-line JSON processor"
  required_permissions:
    - "eas:CreateService"
    - "eas:DescribeService"
    - "eas:ListServices"
    - "eas:DescribeMachineSpec"
    - "eas:ListResources"
    - "eas:ListGateway"
    - "eas:DescribeGateway"
    - "nlb:ListLoadBalancers"
    - "aiworkspace:ListImages"
    - "aiworkspace:ListWorkspaces"
    - "vpc:DescribeVpcs"
    - "vpc:DescribeVSwitches"
    - "ecs:DescribeSecurityGroups"

PAI-EAS Service Deployment

⚠️ TOP RULES (read first)

**1. 🔴 NO DUPLICATE SERVICE NAMES** 🔴

If a service with the target name already exists: STOP and inform the user. Do NOT delete and recreate. Do NOT reuse it either.

**2. Mandatory API Calls** — Execute ALL of these in order:

| # | API | CLI | Purpose | |---|-----|-----|---------| | 1 | ListImages | `aliyun aiworkspace list-images` | Validate image | | 2 | describe-machine-spec | `aliyun eas describe-machine-spec` | Validate GPU type | | 3 | create-service | `aliyun eas create-service` | Create service | | 4 | describe-service | `aliyun eas describe-service` | Check status (once) | | 5 | describe-service-endpoints | `aliyun eas describe-service-endpoints` | Get endpoints |

Execute #1 and #2 ALWAYS, even if user provided the info. `describe-machine-spec` ≠ `list-resources`. `describe-service` ≠ `ListServices`.

**3. Prohibited** — ❌ Reuse existing service ❌ Write bash scripts (run CLI directly) ❌ CPU+vLLM/SGLang ❌ `file://` in create-service ❌ Skip mandatory APIs ❌ Change the service name the user specified ❌ Poll describe-service in a loop (call once only) ❌ Stop after writing/validating service.json — writing the JSON is NOT completing the task. You MUST run create-service (Step 6) then describe-service (Step 7). If resources were found, deploy them.

**4. Autonomous Execution** — Do NOT ask user for info discoverable via APIs. Do NOT ask "should I proceed?" Execute directly. Timeout? Retry with `--read-timeout 60`. Error? Inform user and CONTINUE. Missing param? Pick reasonable default. If any pre-check or resource discovery step fails, log the failure and continue to the next step. Only STOP for the specific conditions listed in Self-Verify Checkpoints (duplicate service name, missing NLB/GW/dedicated resource group).

**5. Self-Verify Checkpoints:**

Before Step 2: Did Step 1.5 confirm no duplicate service name?
  If duplicate → STOP, inform user, do NOT proceed.
Before Step 5: Have I run list-images AND describe-machine-spec?
  If NO → STOP and run them NOW.
Before Step 6: Did Step 1.5 confirm no duplicate service name?
  If duplicate exists → STOP, inform user, do NOT proceed.
Step 4 resources: If NLB/GW/Resource Group not found → inform user and STOP.
  Do NOT block or attempt workarounds.
After Step 7: Did I call describe-service once and report the status?

**6. Run CLI commands DIRECTLY** — Use `execute_shell_command` to run each aliyun CLI command one at a time. Do NOT write bash scripts, deployment scripts, or shell files. Do NOT use `retry_command()` or any wrapper functions. Each command = one direct execution.

---

Pre-checks

# Install or upgrade Aliyun CLI to >= 3.3.3 (required baseline), then verify.
curl -fsSL https://aliyuncli.alicdn.com/install.sh | bash
aliyun version   # must report >= 3.3.3; re-run install.sh to upgrade if lower

# Generate the per-session trace id once (see Observability section) and build
# the unified user-agent. Pass it via --user-agent on every CLI command.
SESSION_ID=$(openssl rand -hex 16)
UA="AlibabaCloud-Agent-Skills/alibabacloud-pai-eas-service-deploy/${SESSION_ID}"
aliyun plugin update
aliyun configure set --auto-plugin-install true

**⚠️ MANDATORY: Install and update required plugins BEFORE proceeding:**

aliyun plugin update
aliyun plugin install aiworkspace --force
aliyun plugin install eas --force

**Verify plugins are installed:**

aliyun plugin list 2>/dev/null | grep -E "aiworkspace|eas"

If either plugin is missing after install, retry with:

aliyun plugin install <plugin-name> --force

See [CLI Guide](references/cli-installation-guide.md). Never read/echo AK/SK. Timeout? Retry with `--read-timeout 60`.

**⚠️ MANDATORY CHECKPOINT: After pre-checks, you MUST proceed to Step 1 regardless of any warnings during plugin installation. Plugin install failures are non-blocking — the plugins may already be installed. NEVER stop execution at the pre-check stage.**

---

Observability

All CLI, SDK, and Terraform calls MUST carry a unified user-agent (UA) so requests trace back to this skill and one session.

**UA template declaration (placeholder form):**

--user-agent AlibabaCloud-Agent-Skills/{SKILL_NAME}/{session-id}

• `{SKILL_NAME}` — fixed identifier: `alibabacloud-pai-eas-service-deploy`
• `{session-id}` — 32-char lowercase hex (128-bit), generated **once per session**

**session-id rule:** Generate it once before any call via `SESSION_ID=$(openssl rand -hex 16)`; reuse the **same** value for **every** CLI (`--user-agent`), SDK (client UA), and Terraform (`ALIBABACLOUDSTACK_UA` / provider `ua`) call so all requests share one trace id. Do NOT regenerate between steps or hardcode it.

SESSION_ID=$(openssl rand -hex 16)
UA="AlibabaCloud-Agent-Skills/alibabacloud-pai-eas-service-deploy/${SESSION_ID}"
# Pass on every command, e.g.:
aliyun eas de