/t-cloud-public

name: t-cloud-public
description: "Read T Cloud Public (formerly Open Telekom Cloud) infrastructure inventory and prepare guarded DevOps operations through gateway-managed OTC API signing."
user-invocable: true
requires:
  bins:
    - node
credentials:
  - id: otc-access-key-id
    kind: header
    required: true
    secret_ref:
      source: store
      id: OTC_ACCESS_KEY_ID
    scope: "T Cloud Public / Open Telekom Cloud AK/SK request signing"
    how_to_obtain: "Create an OTC access key in My Credentials > Access Keys. Set `OTC_ACCESS_KEY_ID` through browser admin at the active `/admin/secrets` route; if browser admin is unavailable, use `/secret set OTC_ACCESS_KEY_ID \"<access-key-id>\"` in browser `/chat` or TUI; local console fallback: `hybridclaw secret set OTC_ACCESS_KEY_ID \"<access-key-id>\"`. Use a least-privilege IAM user for inventory work."
  - id: otc-secret-access-key
    kind: header
    required: true
    secret_ref:
      source: store
      id: OTC_SECRET_ACCESS_KEY
    scope: "T Cloud Public / Open Telekom Cloud AK/SK request signing"
    how_to_obtain: "Save the Secret Access Key from the OTC access key CSV. Set `OTC_SECRET_ACCESS_KEY` through browser admin at the active `/admin/secrets` route; if browser admin is unavailable, use `/secret set OTC_SECRET_ACCESS_KEY \"<secret-access-key>\"` in browser `/chat` or TUI; local console fallback: `hybridclaw secret set OTC_SECRET_ACCESS_KEY \"<secret-access-key>\"`. Never paste it into chat or project files."
  - id: otc-project-id
    kind: header
    required: true
    secret_ref:
      source: store
      id: OTC_PROJECT_ID
    scope: "T Cloud Public / Open Telekom Cloud regional project paths"
    how_to_obtain: "Copy the target regional project ID from My Credentials > API Credentials. Set `OTC_PROJECT_ID` through browser admin at the active `/admin/secrets` route; if browser admin is unavailable, use `/secret set OTC_PROJECT_ID \"<project-id>\"` in browser `/chat` or TUI; local console fallback: `hybridclaw secret set OTC_PROJECT_ID \"<project-id>\"`."
  - id: otc-enterprise-dashboard-token
    kind: header
    required: false
    secret_ref:
      source: store
      id: OTC_ENTERPRISE_DASHBOARD_TOKEN
    scope: "T Cloud Public Enterprise Dashboard consumption and spend data"
    how_to_obtain: "Create an Enterprise Dashboard API key with Admin security level in organization settings. Set `OTC_ENTERPRISE_DASHBOARD_TOKEN` through browser admin at the active `/admin/secrets` route; if browser admin is unavailable, use `/secret set OTC_ENTERPRISE_DASHBOARD_TOKEN \"<enterprise-dashboard-api-token>\"` in browser `/chat` or TUI; local console fallback: `hybridclaw secret set OTC_ENTERPRISE_DASHBOARD_TOKEN \"<enterprise-dashboard-api-token>\"`."
metadata:
  hybridclaw:
    category: infrastructure
    short_description: "T Cloud Public infrastructure inventory, readiness checks, and guarded operation planning."
    tags:
      - t-cloud-public
      - "open telekom cloud"
      - t-systems
      - devops
      - infrastructure
      - otc
      - production
    stakes_tiers:
      green:
        - regions
        - projects
        - service-endpoints
        - services
        - service-status
        - quotas
        - servers
        - networks
        - vpcs
        - subnets
        - security-groups
        - eips
        - load-balancers
        - volumes
        - snapshots
        - backups
        - sfs-shares
        - obs-bucket
        - cce-clusters
        - cce-nodes
        - rds-instances
        - cloud-eye-alarms
        - traces
        - log-groups
        - kms-keys
        - waf-policies
      amber:
        - billing-daily-consumption
        - billing-hourly-consumption
        - create-or-update-compute
        - create-or-update-network
        - create-or-update-storage
        - database-or-container-change
        - iam-or-kms-change
      red:
        - delete-or-restore-resource
        - security-group-widening
        - waf-disable
        - key-disable-or-delete
        - production-database-mutation
    escalation:
      writes: confirm-each
      route: f14
    cost_measurement:
      system: UsageTotals
      sub_limit_key: t-cloud-public

T Cloud Public

Use this skill for T Cloud Public, formerly Open Telekom Cloud, infrastructure inventory, deployment-readiness checks, incident summaries, and guarded DevOps request planning. Invoke it as `t-cloud-public`. The helper path uses the current product name; credential names intentionally keep established `OTC_*` identifiers because the public API docs, domains, and customer terminology still use OTC/Open Telekom Cloud names.

Default Workflow

1. Start with read-only inventory or `plan`. V1 helper operations are read/list/describe only. 2. Treat `t_cloud_public.cjs` as the API wrapper. Do not handcraft OTC API URLs, service endpoints, signing metadata, request tiers, or SecretRefs from memory. 3. For prompt/user testing, stop after `plan` or helper `http-request` payload generation. Do not call helper `run` or the built-in `http_request` tool. 4. For real user requests that need live OTC data, use helper `run`. The helper constructs an allowlisted request and sends it through the HybridClaw gateway `http_request` route. For IaaS/API inventory, the gateway resolves `OTC_ACCESS_KEY_ID`, `OTC_SECRET_ACCESS_KEY`, optional `OTC_SECURITY_TOKEN`, and `OTC_PROJECT_ID`, then signs the request server-side. 5. Use `http-request` only to inspect the generated gateway payload or when the active runtime cannot give the helper gateway access. 6. If a live helper `run` or `http_request` call returns 401, 403, or a signature/authentication failure, stop after that first failed call. Do not retry or fan out to more OTC endpoints. Ask the operator to verify credentials, project ID, region, IAM permissions, and clock skew. 7. If a live call returns 429, stop fan-out and report retry guidance from `Retry-Af