huawei-cloud-kubectl-cce-installer

어떤 스킬인가요?

Install, upgrade, verify, or troubleshoot local kubectl and the Huawei Cloud kubectl-cce plugin. Trigger when a user asks to install kubectl, install kubectl-cce, configure the CCE kubectl plugin, verify kubectl-cce availability, or repair local command prerequisites for CCE Kubernetes resource access.

설치 방법

프로젝트 폴더에서 아래 명령어를 실행하고, 설치할 에이전트를 선택하세요.

설치 명령을 직접 실행해야 적용됩니다. 지원 에이전트와 필요한 권한·라이선스는 제작자의 안내를 확인하세요.

스킬 원문 파일

# Acceptance Criteria

## Installation Behavior

- `--check` completes without changing the local machine and reports the platform, architecture, executable presence, and plugin discovery state.
- The default invocation prints a plan and exits without installing or replacing executables.
- `--execute` installs only missing `kubectl` and `kubectl-cce` executables into the confirmed `--bin-dir`.
- Linux `kubectl-cce` downloads use the Gitee `v0.1.0` Release asset matching the local CPU architecture; an unavailable asset falls back to the pinned source tag.
- Existing `kubectl` and `kubectl-cce` executables are not overwritten.

## Verification

- The installer exits successfully only when `kubectl version --client` runs and `kubectl plugin list` contains `kubectl-cce` after a confirmed installation.
- Download, source-clone, and source-build operations use the documented timeout settings and return a clear nonzero error on failure.

## Safety and Documentation

- No cloud resources, Kubernetes resources, credentials, tokens, or kubeconfig files are created, changed, printed, or stored by the installer.
- R1 installation actions require a preview and explicit user confirmation before `--execute`.
- `SKILL.md` documents triggers, configurable parameters, confirmation requirements, fallback behavior, and verification commands.

# kubectl-cce Plugin Usage

## Release Source

Use the [Gitee `pancake0001/kubectl-cce-plugin` Release `v0.1.0`](https://gitee.com/pancake0001/kubectl-cce-plugin/releases/tag/v0.1.0) when an asset exists. Its published assets support Linux and Windows amd64/arm64; it does not publish a macOS asset. The installer falls back to building the fixed `v0.1.0` source tag with Go when the asset is unavailable or its download fails.

## Plugin Credentials

Configure the plugin's documented credentials through an approved local credential provider, a protected shell environment, or tool-provided values. Do not place credential names, values, tokens, or credential export commands in this skill, command history, source code, logs, or responses. Follow the [plugin repository documentation](https://gitee.com/pancake0001/kubectl-cce-plugin) for the current supported credential configuration.

## Read-only Test

Use a specific cluster ID, the configured `HW_REGION` environment variable, and a read-only request:

```bash
kubectl cce --cluster-id <cluster-id> --region "${HW_REGION}" get namespaces
```

Do not run write operations during installation verification.

## Windows Installation

Do not run `install_kubectl_cce.sh` on Windows. Download the matching Windows `kubectl.exe` from the [official Kubernetes release site](https://kubernetes.io/releases/download/), then download the matching `kubectl-cce` v0.1.0 ZIP asset from the [Gitee Release](https://gitee.com/pancake0001/kubectl-cce-plugin/releases/tag/v0.1.0). Extract both executables, place them in a user-selected directory on `PATH`, then verify:

```powershell
kubectl plugin list
```

#!/usr/bin/env bash
set -euo pipefail

PLUGIN_VERSION="0.1.0"
PLUGIN_REPOSITORY="pancake0001/kubectl-cce-plugin"
PLUGIN_RELEASE_BASE_URL="https://gitee.com/${PLUGIN_REPOSITORY}/releases/download"
KUBERNETES_REPOSITORY="https://github.com/kubernetes/kubernetes.git"
PLUGIN_SOURCE_REPOSITORY="https://gitee.com/${PLUGIN_REPOSITORY}.git"
BIN_DIR="/usr/local/bin"
MODE="plan"
OBS_BASE_URL="https://cce-north-4.obs.cn-north-4.myhuaweicloud.com"
CONNECT_TIMEOUT="${KUBECTL_CCE_CONNECT_TIMEOUT:-10}"
DOWNLOAD_TIMEOUT="${KUBECTL_CCE_DOWNLOAD_TIMEOUT:-300}"
SOURCE_CLONE_TIMEOUT="${KUBECTL_CCE_SOURCE_CLONE_TIMEOUT:-600}"
SOURCE_BUILD_TIMEOUT="${KUBECTL_CCE_SOURCE_BUILD_TIMEOUT:-900}"

usage() {
  cat <<'EOF'
Usage: install_kubectl_cce.sh [--check] [--execute] [--bin-dir <directory>]

Without --execute, print the installation plan only. --execute installs missing
executables and must be used only after user confirmation.
EOF
}

while [[ $# -gt 0 ]]; do
  case "$1" in
    --check) MODE="check" ;;
    --execute) MODE="execute" ;;
    --bin-dir)
      BIN_DIR="${2:?--bin-dir requires a directory}"
      shift
      ;;
    --help|-h) usage; exit 0 ;;
    *) echo "Unknown argument: $1" >&2; usage >&2; exit 2 ;;
  esac
  shift
done

require_command() {
  command -v "$1" >/dev/null 2>&1 || {
    echo "Missing required command: $1" >&2
    exit 1
  }
}

validate_timeout() {
  local name="$1"
  local value="$2"
  [[ "$value" =~ ^[1-9][0-9]*$ ]] || {
    echo "${name} must be a positive integer in seconds" >&2
    exit 2
  }
}

download_file() {
  local url="$1"
  local output="$2"
  curl --fail --show-error --location \
    --connect-timeout "$CONNECT_TIMEOUT" \
    --max-time "$DOWNLOAD_TIMEOUT" \
    "$url" -o "$output"
}

download_stdout() {
  curl --fail --show-error --location --silent \
    --connect-timeout "$CONNECT_TIMEOUT" \
    --max-time "$DOWNLOAD_TIMEOUT" \
    "$1"
}

run_with_timeout() {
  local timeout_seconds="$1"
  shift
  "$@" &
  local command_pid=$!
  (
    sleep "$timeout_seconds"
    if kill -0 "$command_pid" 2>/dev/null; then
      echo "Command timed out after ${timeout_seconds}s: $1" >&2
      kill -TERM "$command_pid" 2>/dev/null || true
      sleep 5
      kill -KILL "$command_pid" 2>/dev/null || true
    fi
  ) &
  local watchdog_pid=$!
  local status=0
  if wait "$command_pid"; then
    :
  else
    status=$?
  fi
  kill "$watchdog_pid" 2>/dev/null || true
  wait "$watchdog_pid" 2>/dev/null || true
  return "$status"
}

detect_arch() {
  case "$(uname -m)" in
    x86_64|amd64) echo "amd64" ;;
    aarch64|arm64) echo "arm64" ;;
    *) echo "unsupported" ;;
  esac
}

install_file() {
  local source="$1"
  local destination="$2"
  cp "$source" "$destination"
  chmod 0755 "$destination"
}

install_latest_kubectl_from_obs() {
  local listing="$WORK_DIR/obs-kubectl-list.xml"
  local object_key package_file="$WORK_DIR/obs-kubectl.tgz" extract_dir="$WORK_DIR/obs-kubectl-extract" binary
  [[ "$OS" == "Linux" ]] || return 1
  download_file "${OBS_BASE_URL}/?list-type=2&prefix=package/kubectl/" "$listing"
  object_key="$(python3 - "$listing" "$ARCH" <<'PY'
import re, sys, xml.etree.ElementTree as ET
root = ET.parse(sys.argv[1]).getroot()
arch = sys.argv[2]
items = []
for node in root.findall('{*}Contents/{*}Key'):
    key = node.text or ''
    match = re.fullmatch(r'package/kubectl/kubectl-(\d+)\.(\d+)\.(\d+)(-arm64)?\.tgz', key)
    if not match:
        continue
    if (arch == 'arm64') != bool(match.group(4)):
        continue
    items.append((tuple(map(int, match.group(1, 2, 3))), key))
if not items:
    raise SystemExit(1)
print(sorted(items)[-1][1])
PY
 )" || return 1
  echo "Selected latest OBS package: ${object_key}"
  download_file "${OBS_BASE_URL}/${object_key}" "$package_file"
  mkdir -p "$extract_dir"
  tar -xzf "$package_file" -C "$extract_dir"
  binary="$(find "$extract_dir" -type f -name kubectl -print -quit)"
  [[ -n "$binary" ]] || return 1
  chmod +x "$binary"
  install_file "$binary" "$BIN_DIR/kubectl"
}

build_kubectl_from_source() {
  local version="$1"
  local source_dir="$WORK_DIR/kubernetes"
  require_command git
  require_command go
  echo "Official kubectl download failed; building kubectl ${version} from the Kubernetes source tag."
  run_with_timeout "$SOURCE_CLONE_TIMEOUT" git clone --depth 1 --branch "$version" "$KUBERNETES_REPOSITORY" "$source_dir"
  run_with_timeout "$SOURCE_BUILD_TIMEOUT" bash -c '
    source_dir="$1"
    output="$2"
    cd "$source_dir"
    go build -o "$output" ./cmd/kubectl
  ' _ "$source_dir" "$WORK_DIR/kubectl"
  install_file "$WORK_DIR/kubectl" "$BIN_DIR/kubectl"
}

build_plugin_from_source() {
  local source_dir="$WORK_DIR/kubectl-cce-plugin"
  require_command git
  require_command go
  echo "kubectl-cce Release asset is unavailable; building plugin v${PLUGIN_VERSION} from source."
  run_with_timeout "$SOURCE_CLONE_TIMEOUT" git clone --depth 1 --branch "v${PLUGIN_VERSION}" "$PLUGIN_SOURCE_REPOSITORY" "$source_dir"
  run_with_timeout "$SOURCE_BUILD_TIMEOUT" bash -c '
    source_dir="$1"
    output="$2"
    cd "$source_dir"
    go build -o "$output" ./cmd/kubectl-cce
  ' _ "$source_dir" "$WORK_DIR/kubectl-cce"
  install_file "$WORK_DIR/kubectl-cce" "$BIN_DIR/kubectl-cce"
}

OS="$(uname -s)"
ARCH="$(detect_arch)"
KUBECTL_PRESENT=false
PLUGIN_PRESENT=false
command -v kubectl >/dev/null 2>&1 && KUBECTL_PRESENT=true
command -v kubectl-cce >/dev/null 2>&1 && PLUGIN_PRESENT=true

validate_timeout "KUBECTL_CCE_CONNECT_TIMEOUT" "$CONNECT_TIMEOUT"
validate_timeout "KUBECTL_CCE_DOWNLOAD_TIMEOUT" "$DOWNLOAD_TIMEOUT"
validate_timeout "KUBECTL_CCE_SOURCE_CLONE_TIMEOUT" "$SOURCE_CLONE_TIMEOUT"
validate_timeout "KUBECTL_CCE_SOURCE_BUILD_TIMEOUT" "$SOURCE_BUILD_TIMEOUT"

echo "platform=${OS} arch=${ARCH}"
echo "kubectl_present=${KUBECTL_PRESENT}"
echo "kubectl_cce_present=${PLUGIN_PRESENT}"
echo "bin_dir=${BIN_DIR}"

if [[ "$MODE" == "check" ]]; then
  if "$KUBECTL_PRESENT"; then kubectl version --client 2>/dev/null || true; fi
  if "$KUBECTL_PRESENT"; then kubectl plugin list 2>/dev/null || true; fi
  exit 0
fi

if [[ "$ARCH" == "unsupported" ]]; then
  echo "Unsupported CPU architecture: $(uname -m)" >&2
  exit 1
fi

if [[ "$OS" != "Linux" && "$OS" != "Darwin" ]]; then
  echo "This installer supports Linux and macOS only. See references/plugin-usage.md for Windows." >&2
  exit 1
fi

if [[ "$KUBECTL_PRESENT" == false ]]; then
  echo "PLAN: install the latest public OBS kubectl package for Linux ${ARCH} into ${BIN_DIR}."
fi
if [[ "$PLUGIN_PRESENT" == false ]]; then
  echo "PLAN: download kubectl-cce v${PLUGIN_VERSION} for ${OS} ${ARCH} from Gitee Release when available; otherwise build tag v${PLUGIN_VERSION} from source."
fi
if [[ "$KUBECTL_PRESENT" == true && "$PLUGIN_PRESENT" == true ]]; then
  echo "Nothing to install. Run with --check to verify versions and plugin discovery."
  exit 0
fi
if [[ "$MODE" != "execute" ]]; then
  echo "No changes made. Re-run with --execute after user confirmation."
  exit 0
fi

require_command curl
require_command cp
require_command chmod
require_command tar
require_command python3
mkdir -p "$BIN_DIR"
WORK_DIR="$(mktemp -d)"
trap 'rm -rf "$WORK_DIR"' EXIT

if [[ "$KUBECTL_PRESENT" == false ]]; then
  KUBECTL_VERSION="$(download_stdout https://dl.k8s.io/release/stable.txt)"
  KUBECTL_OS="$(tr '[:upper:]' '[:lower:]' <<< "$OS")"
  if install_latest_kubectl_from_obs; then
    :
  elif download_file "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/${KUBECTL_OS}/${ARCH}/kubectl" "$WORK_DIR/kubectl"; then
    install_file "$WORK_DIR/kubectl" "$BIN_DIR/kubectl"
  else
    build_kubectl_from_source "$KUBECTL_VERSION"
  fi
fi

if [[ "$PLUGIN_PRESENT" == false ]]; then
  if [[ "$OS" == "Linux" ]]; then
    ASSET_NAME="kubectl-cce_${PLUGIN_VERSION}_linux_${ARCH}.tar.gz"
    ASSET_URL="${PLUGIN_RELEASE_BASE_URL}/v${PLUGIN_VERSION}/${ASSET_NAME}"
    if download_file "$ASSET_URL" "$WORK_DIR/$ASSET_NAME" && tar -xzf "$WORK_DIR/$ASSET_NAME" -C "$WORK_DIR" && [[ -f "$WORK_DIR/kubectl-cce" ]]; then
      install_file "$WORK_DIR/kubectl-cce" "$BIN_DIR/kubectl-cce"
    else
      build_plugin_from_source
    fi
  else
    build_plugin_from_source
  fi
fi

echo "Installation complete."
kubectl version --client
kubectl plugin list
kubectl plugin list | grep -q 'kubectl-cce' || {
  echo "kubectl-cce was installed but is not discoverable by kubectl. Verify that ${BIN_DIR} is in PATH." >&2
  exit 1
}

---
name: huawei-cloud-kubectl-cce-installer
description: Install, upgrade, verify, or troubleshoot local kubectl and the Huawei Cloud kubectl-cce plugin. Trigger when a user asks to install kubectl, install kubectl-cce, configure the CCE kubectl plugin, verify kubectl-cce availability, or repair local command prerequisites for CCE Kubernetes resource access.
tags: [kubectl, kubectl-cce, cce, huawei-cloud, kubernetes]
---

# Huawei Cloud CCE kubectl Installer

## Overview

Install and verify the local `kubectl` and `kubectl-cce` prerequisites used for Huawei Cloud CCE Kubernetes resource access. This skill changes only the local machine; it never creates, updates, or deletes cloud or Kubernetes resources.

**Architecture**: `scripts/install_kubectl_cce.sh` -> local OS package paths and official download/source repositories -> `kubectl` and `kubectl-cce` binaries -> `kubectl plugin list` verification.

**Execution Method**: Run the bundled shell script only. Do not replace its download URLs, build tags, installation paths, or verification steps with ad hoc commands unless the user explicitly asks for a different method.

**Capabilities**:
- Detect the local OS, architecture, executable availability, and plugin discovery state
- Show a no-change installation plan before execution
- Select the latest missing Linux `kubectl` package from Huawei Cloud OBS for the local architecture
- Fall back to the official Kubernetes stable release, then build the same stable tag when download fails
- Install `kubectl-cce` v0.1.0 from its Gitee Release on Linux when available
- Build the fixed `kubectl-cce` v0.1.0 source tag when a Release asset is unavailable or download fails
- Verify `kubectl` and `kubectl-cce` plugin discovery after installation

**Typical Use Cases**:
- "Install kubectl and kubectl-cce on this machine"
- "Check whether kubectl-cce is available"
- "Show the installation plan for CCE kubectl access"
- "Repair a missing kubectl-cce plugin"

## Prerequisites

### 1. Runtime Dependencies

- Bash, `curl`, `tar`, `cp`, and `chmod` for Linux/macOS installation
- `git` and Go only when source-build fallback is needed
- Write access to the selected `--bin-dir`; `/usr/local/bin` normally requires elevation
- Internet access to Kubernetes and Gitee release/source endpoints
- Network steps use timeouts by default: 10 seconds to connect, 300 seconds to download, 600 seconds to clone sources, and 900 seconds to build sources

### 2. Credential Configuration

Installation itself needs no Huawei Cloud credentials. Do not request, print, or save AK/SK, security tokens, IAM tokens, or kubeconfig content during installation.

After installation, `kubectl cce` requires credentials only when it accesses a CCE cluster. Read [plugin-usage.md](references/plugin-usage.md) before configuring that access.

### 3. Local Permission Requirements

| Permission | Purpose |
| ---------- | ------- |
| Read/execute access | Detect existing `kubectl` and `kubectl-cce` executables |
| Write access to `--bin-dir` | Install a missing executable |
| Elevated local permission when required | Write to protected directories such as `/usr/local/bin` |

**Permission Failure Handling**:

1. Report the target installation directory and the local permission error.
2. Ask the user to select a writable directory or explicitly authorize an elevated command.
3. Do not retry with `sudo` automatically.

## Core Commands

All commands use the bundled installer script:

```bash
bash scripts/install_kubectl_cce.sh [--check] [--execute] [--bin-dir <directory>]
```

### 1. Local State Check

```bash
bash scripts/install_kubectl_cce.sh --check
```

This is read-only. It reports the OS, architecture, installed binaries, `kubectl` client version, and `kubectl plugin list` output.

### 2. Installation Plan

```bash
bash scripts/install_kubectl_cce.sh --bin-dir /usr/local/bin
```

This is read-only. It shows which executables are missing and the exact download or source-build fallback without changing the machine.

### 3. Confirmed Installation

```bash
sudo bash scripts/install_kubectl_cce.sh --execute --bin-dir /usr/local/bin
```

Run only after the user confirms the previewed installation path and actions. The script does not overwrite existing `kubectl` or `kubectl-cce` executables.

### 4. Source-Build Fallback

- For Linux, list the public OBS package repository and select the latest package for the local `amd64` or `arm64` architecture. Package names determine release ordering.
- If OBS lookup, download, or extraction fails, download the official Kubernetes stable release; build the same stable tag only if that download fails.
- When the Linux `kubectl-cce` v0.1.0 asset is unavailable or download fails, build the fixed `v0.1.0` source tag.
- On macOS, build `kubectl-cce` v0.1.0 from source because the Release has no macOS asset.

The fallback requires `git` and Go. If either is absent, return the missing dependency rather than installing it automatically.

### 5. Windows Manual Installation

The bundled script does not run on Windows. Download the matching Windows `kubectl` binary from the [official Kubernetes release site](https://kubernetes.io/releases/download/) and the matching `kubectl-cce` ZIP from the [Gitee `v0.1.0` Release](https://gitee.com/pancake0001/kubectl-cce-plugin/releases/tag/v0.1.0). Extract the files, place them in a user-selected directory on `PATH`, and verify with `kubectl version --client` and `kubectl plugin list`. See [plugin-usage.md](references/plugin-usage.md) for the plugin-specific steps.

## Risk Levels

This skill modifies only local binaries and does not operate on cloud resources. It must still use a plan-and-confirm flow for system changes.

| Level | Meaning | Execution Guidance |
| ----- | ------- | ------------------ |
| R3 | Read-only local inspection | May run automatically |
| R1 | Local executable installation, replacement, or PATH-adjacent system change | Show the plan first and require explicit user confirmation before `--execute` |

| Operation | Risk Level | Description |
| --------- | ---------- | ----------- |
| `--check` | R3 | Inspect local tools and plugin discovery |
| Default script mode | R3 | Show installation plan without making changes |
| `--execute` | R1 | Install missing binaries into the selected directory |
| Source-build fallback | R1 | Clone fixed source tags and compile missing binaries |

## Parameter Reference

| Parameter | Required/Optional | Description | Default |
| --------- | ----------------- | ----------- | ------- |
| `--check` | Optional | Run only local inspection and verification | Disabled |
| `--execute` | Required for mutation | Install missing binaries after explicit confirmation | Disabled |
| `--bin-dir <directory>` | Optional | Target directory for newly installed executables | `/usr/local/bin` |
| `--help` | Optional | Display script usage | N/A |

Set `KUBECTL_CCE_CONNECT_TIMEOUT`, `KUBECTL_CCE_DOWNLOAD_TIMEOUT`, `KUBECTL_CCE_SOURCE_CLONE_TIMEOUT`, or `KUBECTL_CCE_SOURCE_BUILD_TIMEOUT` to positive integer seconds only when the default timeout is unsuitable.

## 参数确认

The installer may inspect the local machine without confirmation, but installation is an R1 local-system change. Confirm the following values with the user before running `--execute`.

| Parameter | Resolution | Confirmation Requirement |
| --------- | ---------- | ------------------------ |
| Installation mode | `--check` and the default plan are read-only; `--execute` installs missing binaries | Explicit confirmation required for `--execute` |
| `--bin-dir` | Defaults to `/usr/local/bin`; may be changed to a writable user-selected directory | Confirm the target directory before installation |
| Existing executables | Detected from `PATH`; the script does not overwrite them | Report the detected state; do not replace an executable without a separately approved workflow |
| Network timeouts | Use defaults unless the user provides positive integer overrides | Confirm non-default values when they materially extend the wait time |

Never infer a writable installation directory, use `sudo` automatically, or install a missing build dependency without the user's explicit approval.

## Output Format

The script writes human-readable output to standard output and exits nonzero when it cannot complete the requested operation.

**Key output fields**:
- `platform`: detected operating system
- `arch`: normalized CPU architecture
- `kubectl_present`: whether `kubectl` is in `PATH`
- `kubectl_cce_present`: whether `kubectl-cce` is in `PATH`
- `bin_dir`: selected installation directory
- `PLAN`: planned changes in no-change mode
- Error text: missing dependency, unsupported platform, download/build failure, or plugin discovery failure

## Workflow

1. Run `--check` and record the current local state.
2. Run the default plan command with the intended `--bin-dir`.
3. Present the planned downloads, source-build fallback, target directory, and R1 local-system impact to the user.
4. Wait for explicit confirmation.
5. Run the same command with `--execute`.
6. Verify `kubectl version --client` and `kubectl plugin list`.
7. For CCE access configuration, read [plugin-usage.md](references/plugin-usage.md) and perform only a read-only cluster request if the user asks to test connectivity.

## Verification

Run the read-only check first:

```bash
bash scripts/install_kubectl_cce.sh --check
```

After a confirmed installation, verify:

```bash
kubectl version --client
kubectl plugin list
```

The plugin is ready when `kubectl plugin list` contains `kubectl-cce`. Do not rely on `kubectl cce --version`: the source tag does not expose a stable version flag.

## Best Practices

1. **Inspect before installing** - always run `--check` and the no-change plan first.
2. **Use an explicit target directory** - show `--bin-dir` before asking for confirmation.
3. **Preserve existing binaries** - do not request `--execute` as an upgrade mechanism unless the user explicitly asks for replacement support.
4. **Use the local architecture** - select the latest amd64 or arm64 OBS package matching the host CPU.
5. **Separate installation from cluster access** - do not validate the plugin by mutating a cluster; use a read-only request only when requested.

## Notes

- Installation and source compilation are R1 local-system actions and require explicit confirmation.
- The script never writes Huawei Cloud credentials, tokens, or kubeconfig files.
- `kubectl-cce` must be named exactly `kubectl-cce` for Kubernetes plugin discovery.
- On Windows, do not run the bundled script; use the official Kubernetes download and matching Gitee Release ZIP as described in [plugin-usage.md](references/plugin-usage.md).

## Troubleshooting

| Symptom | Likely Cause | Action |
| ------- | ------------ | ------ |
| `curl`, `tar`, `cp`, or `chmod` is missing | Local prerequisite is absent | Install the missing local prerequisite through the user-approved system method, then retry |
| Download fails | Network restriction or unavailable Release asset | Allow the script to use its fixed-tag source-build fallback after confirmation |
| Network step times out | Endpoint, proxy, or connection is slow or unavailable | Check connectivity, then increase the relevant `KUBECTL_CCE_*_TIMEOUT` value if the user approves |
| Source build fails | `git`/Go missing or source build dependency failure | Install the reported build prerequisite, then rerun the plan and confirmed installation |
| Permission denied in `--bin-dir` | Protected target directory | Select a writable directory or run an explicitly approved elevated command |
| Plugin not listed | Target directory is not in `PATH` | Add the selected `--bin-dir` to `PATH`, then rerun `kubectl plugin list` |
| macOS plugin missing | v0.1.0 has no macOS Release asset | Use the fixed `v0.1.0` source-build fallback |

## Limitations

- The bundled script executes only on Linux and macOS. Windows uses manual downloads from the official Kubernetes release site and Gitee; the script must not be used.
- The script installs missing binaries only; it does not upgrade or replace existing binaries.
- The skill does not configure Huawei Cloud credentials or retrieve kubeconfig files.
- The skill does not test cluster connectivity unless the user explicitly requests a separate read-only CCE command.
- Source build depends on the availability of the pinned Git tags and a compatible local Go toolchain.

## References

| Document | Use |
| -------- | --- |
| [Plugin Usage](references/plugin-usage.md) | kubectl-cce credentials, read-only CCE connectivity test, and Windows installation |
| [Acceptance Criteria](references/acceptance-criteria.md) | Installation, verification, safety, and documentation acceptance gates |