Huawei Cloud Troubleshooting
STOP - Do not answer from general knowledge. Follow the procedure below.
Use evidence before fixes. Do not guess service behavior when request IDs, region, project_id, and exact errors can identify the issue.
Critical Warnings
| Trap |
Why |
| Error in response body, not HTTP status |
Many APIs return HTTP 200 with error in JSON body. Always check error_code and error_msg |
Missing project_id is common |
New users often omit project_id from API path or CLI. Get it from IAM KeystoneListProjects |
| Sandbox may block hcloud |
OpenCode/Codex sandbox can block hcloud metadata files in ~/.hcloud/. Use dangerouslyDisableSandbox or Bash tool |
| KooCLI param prefix varies |
VPC params need --vpc.x, ECS params need --server.x, ALWAYS check --help first |
Workflow
- Capture the redacted error message, service, operation, region, project_id, and request_id.
- Classify likely cause:
- auth or permission
- wrong region or endpoint
- wrong project_id
- missing resource
- quota or account limit
- invalid request body
- service-side failure
- Run the smallest read-only check that can prove or disprove the cause.
- Compare with official API/SDK docs or Huawei Cloud Skills if the operation contract is uncertain.
- Propose one fix at a time.
- Verify with read-only observation after the fix.
Common Checks
| Check |
Command |
| Authentication |
hcloud configure list (redacted) |
| Region |
Match CLI region, endpoint, and resource region |
| Project ID |
hcloud IAM KeystoneListProjects |
| Pagination |
Add --limit=100 and check marker |
| Quota |
Check service quotas in console or API |
| IAM Permission |
Verify user/role has required action — see huawei-iam skill |
| KooCLI version |
hcloud version |
| Public IP (outbound) |
必须绕过系统代理 + 多源交叉验证：PowerShell Invoke-WebRequest 会走系统代理返回代理出口 IP（实测 167.x vs 真实 117.x，SSH 白名单放错 IP）。正确姿势：node -e "fetch('https://cip.cc').then(r=>r.text()).then(console.log)"（node 直连国内源，不继承 IE 代理）+ curl --noproxy '*' ifconfig.me 交叉比对；不一致即告警 |
| SSH 超时但安全组规则"正确" |
先怀疑探测到的公网 IP 走了代理 → 按上行方法重取真实出口 IP，删旧规则加新规则 |
Common Error Codes
| Error |
Likely Cause |
Fix |
| AuthFailure / 401 |
AK/SK invalid or expired |
Regenerate AK/SK, re-run npx huaweicloud-devkit auth init |
| AccessDenied / 403 |
IAM permission missing |
Check huawei-iam skill, add required policy action |
| NoSuchKey / 404 |
Resource not found |
Verify resource ID, region, and project_id |
| QuotaExceeded |
Account limit reached |
Request quota increase in console |
| [USE_ERROR] 不正确的参数 |
Wrong param name |
Run --help, check --param=value format and nested prefix |
[USE_ERROR]缺少必填参数 cli-domain-id |
Invalid/expired credentials — KooCLI's account-id lookup failed (APIGW.0301) |
Re-run npx huaweicloud-devkit auth init; KooCLI auto-resolves domain-id once creds are valid |
| Ecs.0005 |
Flavor-image mismatch |
Check image __support_* against flavor virtualization type |
| FSS.0400 |
FunctionGraph latest version error |
Strip :latest from function URN |
| FSS.1417 |
DEDICATEDGATEWAY missing params |
Add instance_id, group_id, protocol, env_name, env_id |
| APIC.7201 |
Missing security_group_id |
Add --security_group_id param for APIG CreateInstanceV2 |
| [NETWORK_ERROR] |
Transient network failure |
Retry with maxRetries param or wait and retry |
KooCLI Error Types
KooCLI classifies errors into 5 types. The error type prefix in the message guides initial diagnosis:
| Type |
Meaning |
First Check |
[NETWORK_ERROR] |
HTTP request exception |
Network connectivity, firewall, endpoint reachability |
[CLI_ERROR] |
KooCLI internal error |
Contact KooCLI support |
[USE_ERROR] |
Incorrect command parameters |
Run --help, check param names and format |
[OPENAPI_ERROR] |
Cloud service API error |
Check service docs, contact service support |
[APIE_ERROR] |
API Explorer metadata error |
Contact API Explorer support |
Enable debug with --cli-debug=true to see the underlying HTTP request/response and pinpoint network or endpoint issues.
Cross-Skill References
- IAM permissions: See
huawei-iam
- CLI auth setup: See
huaweicloud-cli-and-auth
- ECS specific errors: See
huawei-ecs
- FunctionGraph specific: See
huawei-functiongraph
1---2name: huaweicloud-troubleshooting3description: Troubleshoot Huawei Cloud CLI, API, SDK, deployment, permission, region, quota, endpoint, and resource errors. Use when commands fail, APIs return errors, resources are missing, or the user needs a structured diagnosis.4---56# Huawei Cloud Troubleshooting78**STOP - Do not answer from general knowledge.** Follow the procedure below.910Use evidence before fixes. Do not guess service behavior when request IDs, region, project_id, and exact errors can identify the issue.1112## Critical Warnings1314| Trap | Why |15| --------------------------------------- | -------------------------------------------------------------------------------------------------------------------- |16| Error in response body, not HTTP status | Many APIs return HTTP 200 with error in JSON body. Always check `error_code` and `error_msg` |17| Missing `project_id` is common | New users often omit project_id from API path or CLI. Get it from `IAM KeystoneListProjects` |18| Sandbox may block hcloud | OpenCode/Codex sandbox can block hcloud metadata files in `~/.hcloud/`. Use `dangerouslyDisableSandbox` or Bash tool |19| KooCLI param prefix varies | VPC params need `--vpc.x`, ECS params need `--server.x`, ALWAYS check `--help` first |2021## Workflow22231. Capture the redacted error message, service, operation, region, project_id, and request_id.242. Classify likely cause:25 - auth or permission26 - wrong region or endpoint27 - wrong project_id28 - missing resource29 - quota or account limit30 - invalid request body31 - service-side failure323. Run the smallest read-only check that can prove or disprove the cause.334. Compare with official API/SDK docs or Huawei Cloud Skills if the operation contract is uncertain.345. Propose one fix at a time.356. Verify with read-only observation after the fix.3637## Common Checks3839| Check | Command |40| -------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |41| Authentication | `hcloud configure list` (redacted) |42| Region | Match CLI region, endpoint, and resource region |43| Project ID | `hcloud IAM KeystoneListProjects` |44| Pagination | Add `--limit=100` and check `marker` |45| Quota | Check service quotas in console or API |46| IAM Permission | Verify user/role has required action — see `huawei-iam` skill |47| KooCLI version | `hcloud version` |48| Public IP (outbound) | **必须绕过系统代理 + 多源交叉验证**：PowerShell `Invoke-WebRequest` 会走系统代理返回代理出口 IP（实测 167.x vs 真实 117.x，SSH 白名单放错 IP）。正确姿势：`node -e "fetch('https://cip.cc').then(r=>r.text()).then(console.log)"`（node 直连国内源，不继承 IE 代理）+ `curl --noproxy '*' ifconfig.me` 交叉比对；不一致即告警 |49| SSH 超时但安全组规则"正确" | 先怀疑探测到的公网 IP 走了代理 → 按上行方法重取真实出口 IP，删旧规则加新规则 |5051## Common Error Codes5253| Error | Likely Cause | Fix |54| --------------------------------------- | ---------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------- |55| AuthFailure / 401 | AK/SK invalid or expired | Regenerate AK/SK, re-run `npx huaweicloud-devkit auth init` |56| AccessDenied / 403 | IAM permission missing | Check `huawei-iam` skill, add required policy action |57| NoSuchKey / 404 | Resource not found | Verify resource ID, region, and project_id |58| QuotaExceeded | Account limit reached | Request quota increase in console |59| [USE_ERROR] 不正确的参数 | Wrong param name | Run `--help`, check `--param=value` format and nested prefix |60| `[USE_ERROR]缺少必填参数 cli-domain-id` | Invalid/expired credentials — KooCLI's account-id lookup failed (APIGW.0301) | Re-run `npx huaweicloud-devkit auth init`; KooCLI auto-resolves domain-id once creds are valid |61| Ecs.0005 | Flavor-image mismatch | Check image `__support_*` against flavor virtualization type |62| FSS.0400 | FunctionGraph latest version error | Strip `:latest` from function URN |63| FSS.1417 | DEDICATEDGATEWAY missing params | Add instance_id, group_id, protocol, env_name, env_id |64| APIC.7201 | Missing security_group_id | Add `--security_group_id` param for APIG CreateInstanceV2 |65| [NETWORK_ERROR] | Transient network failure | Retry with `maxRetries` param or wait and retry |6667## KooCLI Error Types6869KooCLI classifies errors into 5 types. The error type prefix in the message guides initial diagnosis:7071| Type | Meaning | First Check |72| ----------------- | ---------------------------- | ----------------------------------------------------- |73| `[NETWORK_ERROR]` | HTTP request exception | Network connectivity, firewall, endpoint reachability |74| `[CLI_ERROR]` | KooCLI internal error | Contact KooCLI support |75| `[USE_ERROR]` | Incorrect command parameters | Run `--help`, check param names and format |76| `[OPENAPI_ERROR]` | Cloud service API error | Check service docs, contact service support |77| `[APIE_ERROR]` | API Explorer metadata error | Contact API Explorer support |7879Enable debug with `--cli-debug=true` to see the underlying HTTP request/response and pinpoint network or endpoint issues.8081## Cross-Skill References8283- **IAM permissions**: See `huawei-iam`84- **CLI auth setup**: See `huaweicloud-cli-and-auth`85- **ECS specific errors**: See `huawei-ecs`86- **FunctionGraph specific**: See `huawei-functiongraph`
huaweicloud