Tencent Cloud Lighthouse

The Problem It Solves

Managing Tencent Cloud Lighthouse instances via a web console is often cumbersome, especially for repetitive tasks like querying instances, monitoring metrics, or executing remote commands. Key pain points include:
- Manual operations that are inefficient and error-prone at scale.
- Complexity in credential management, with OAuth offering temporary security (expires in ~2 hours) and AK/SK keys posing permanent risks if misused.
- Frequent need to look up parameters (e.g., region codes, instance IDs) and API changes that can break legacy commands.
- Silent output corruption in messaging platforms (e.g., WeChat, Slack) where Markdown rendering strips underscores or asterisks from identifiers.

This skill addresses these issues by providing a structured command-line interface via the tccli CLI tool.

How the Skill Works

The skill leverages the tccli CLI to interact with Tencent Cloud Lighthouse APIs. Here’s a breakdown of its core capabilities and key steps:

Credential Setup and Security Prioritization

• OAuth Browser Login (Recommended): Uses the script/tccli-oauth-helper.sh script for non-interactive authentication:
  1. Run --status to check existing credentials.
  2. If expired or missing, execute --get-url to generate a temporary authorization URL (valid for 10 minutes).
  3. User logs in via the browser and copies a base64 code, then run --code with that code to complete login.
  4. Verify with tccli lighthouse DescribeRegions.
• AK/SK Key Pair: Only used if the user explicitly provides SecretId and SecretKey, suitable for cases requiring permanent credentials.
• OAuth is the default to minimize security risks from long-lived keys.

Instance Operations and Core Commands

The skill offers quick-reference commands for common tasks:
- Query and Listing:
- tccli lighthouse DescribeInstances --region <region>: List all instances.
- tccli lighthouse DescribeInstances --region <region> --InstanceIds '["lhins-xxx"]': Get details for specific instances.
- Security and Monitoring:
- tccli lighthouse DescribeFirewallRules --region <region> --InstanceId <instance-id>: Inspect firewall rules.
- tccli monitor GetMonitorData --Namespace QCE/LIGHT_HOUSE ...: Retrieve monitoring data.
- Remote Management:
- tccli tat RunCommand --region <region> --InstanceIds '["lhins-xxx"]' --Content "...": Execute commands on instances.
- Snapshots and Traffic:
- tccli lighthouse DescribeSnapshots --region <region>: Manage snapshots.
- tccli lighthouse DescribeInstancesTrafficPackages --region <region> --InstanceIds '["lhins-xxx"]': Check traffic packages.

Operational Safety and Verification Steps

• Region Mandatory: All operations except DescribeRegions require the --region parameter.
• Query Before Modify: Always run Describe commands before any creation or deletion to avoid blind actions.
• Use Real IDs: Obtain InstanceId from DescribeInstances; never use placeholders.
• Parameter Verification: Run --help (e.g., tccli lighthouse <Action> --help) to confirm parameter names and formats.
• Risk-Based Confirmation: High-risk operations (e.g., deleting instances, applying snapshots) require double confirmation; medium-risk operations (e.g., stopping instances, modifying firewalls) require single confirmation.

Applicable Boundaries and Considerations

• Technical Dependencies: Requires tccli pre-installed (via pip install tccli), and credentials have limited validity (OAuth expires in ~2 hours).
• API Compatibility: Lighthouse and CVM are separate products—never mix their APIs. Always verify parameters with --help to avoid errors from API updates.
• Output Channel Compatibility: When outputting to messaging platforms:
• Replace underscores _ with %5F in URLs (e.g., OAuth authorization parameters).
• Wrap CLI or script output in code blocks (triple backticks) to prevent Markdown parsing from corrupting identifiers.
• Avoid bare underscores or asterisks in plain text; use inline code (e.g., instance_name) for sensitive terms.
• Verification Limits: OAuth credentials do not support validation via tccli sts GetCallerIdentity; prefer lightweight commands like DescribeRegions.
• Creation Means New: When a user requests to "create" or "deploy" a server, default to creating a new instance unless an existing instance ID is explicitly specified.