Alicloud Redis Ops

> This skill follows the Agent Skill OpenSpec.

Alibaba Cloud Redis / Tair Operations Skill

Runtime Rules

| Area | Rule | Reference | | --- | --- | --- | | CLI path (control plane) | MANDATORY: Always prefer the SkillOpt wrapper ./scripts/redis-skillopt-wrapper.sh for all r-kvstore control-plane CLI operations to enable automated self-repair and dynamic optimization; fallback to native aliyun r-kvstore only when the wrapper is unavailable or skillopt-lib.sh is missing. For runtime enforcement, source the shared shim: source ../../alicloud-skill-generator/scripts/skillopt-shim/aliyun-shim.sh. | [SkillOpt](references/skillopt-integration.md), [Shim](file://../../alicloud-skill-generator/scripts/skillopt-shim/SHIM-README.md) | | Credentials | Read {env.*} from environment; wrapper auto-loads repo/skill .env — never ask user to paste secrets | [Integration](references/integration.md) | | GCL | All write operations MUST pass GCL adversarial review before execution | [GCL Rubric](references/rubric.md) |

> EXECUTION MANDATORY RULE: 所有 control-plane CLI 执行步骤 必须 通过 SkillOpt wrapper ./scripts/redis-skillopt-wrapper.sh 运行。 > 以下所有代码块中的 aliyun r-kvstore ... 命令在执行时应替换为 ./scripts/redis-skillopt-wrapper.sh ...。 > 仅在 wrapper 脚本不可用或 skillopt-lib.sh 缺失时，才退回到原生 aliyun r-kvstore CLI 调用。 > 参考 ## Runtime Rules 中的 CLI path 规则。

Overview

Alibaba Cloud Redis / Tair (KVStore) provides managed Redis-compatible and Tair enterprise-grade key-value database services. This skill is an operational runbook for agents: explicit scope, credential rules, pre-flight checks, dual-path execution (official SDK/API and CLI flows), response validation, and failure recovery.

CLI applicability (repository policy)

• cli_applicability: dual-path: Official aliyun fully supports r-kvstore.

Each execution flow documents both the SDK step and the aliyun step for every operation.

Capabilities at a Glance

| Operation | Description | Complexity | Risk Level | |-----------|-------------|------------|------------| | Create Instance | Create Redis/Tair instance | Medium | Medium | | Describe Instances | List all instances in region | Low | None | | Describe Instance Attribute | Query instance details | Low | None | | Restart Instance | Restart instance | Low | High | | Delete Instance | Delete instance | Low | High | | Modify Instance Spec | Scale up/down instance | Medium | Medium | | Describe Accounts | List database accounts | Low | None | | Create Account | Create database account | Medium | Medium | | Delete Account | Delete database account | Low | High | | Reset Account Password | Reset account password | Low | Medium | | Describe Backups | List backups | Low | None | | Create Backup | Create manual backup | Low | Low | | Restore Instance | Restore from backup | Medium | High | | Describe Security IPs | Query IP whitelist | Low | None | | Modify Security IPs | Update IP whitelist | Medium | Medium | | Describe Parameters | Query instance parameters | Low | None | | Modify Parameter | Modify instance parameter | Medium | Medium | | Describe Slow Logs | Query slow query logs | Low | None | | Describe History Monitor Values | Query monitor metrics | Low | None | | Modify Instance Maintain Time | Update maintenance window | Low | Low | | Modify Instance SSL | Enable/disable SSL | Medium | Medium | | Modify Intranet Bandwidth | Adjust instance bandwidth | Medium | Medium | | Migrate To Other Zone | Migrate instance to another zone | Medium | High | | Upgrade Minor Version | Upgrade minor version | Medium | Medium | | Flush Instance | Clear all data in instance | Low | High | | Intelligent Inspection | Run health check | Low | None | | Execute Redis Command | Run redis-cli via Cloud Assistant | Medium | High |

Trigger & Scope (Agent-Readable)

SHOULD Use This Skill When

• User mentions "Alibaba Cloud Redis" OR "Tair" OR "KVStore" OR "云数据库Redis"

OR "云数据库Tair" OR "缓存"

• User requires automated self-repair and dynamic configuration optimization for Redis/Tair operations via Runtime Harness
• Task involves CRUD or lifecycle operations on Redis/Tair instances (create,

describe, modify, delete, list, restart, upgrade)

• Task involves instance accounts (create, describe, delete, reset password)
• Task involves backups (create, describe, restore, delete)
• Task involves whitelists / security groups (describe, modify)
• Task involves parameters (describe, modify)
• Task involves performance monitoring (CPU, memory, connections, QPS, latency,

big key / hot key analysis)

• Task involves slow query logs (describe, analyze)
• Task involves instance migration, scaling, or architecture changes
• Task keywords: Redis, Tair, KVStore, 缓存, 实例, 备份, 白名单, 参数, 监控,

慢查询, 大Key, 热Key, instance, backup, whitelist, parameter, monitor, slow log

• User asks to deploy, configure, troubleshoot, or monitor Redis/Tair **via API,

SDK, CLI, or automation**

SHOULD NOT Use This Skill When

• Task is purely billing / account management → delegate to: alicloud-billing-ops

(when present)

• Task is RAM / permission model only → delegate to: alicloud-ram-ops (when present)
• Task is about RDS (relational database) → delegate to: alicloud-rds-ops

(when present)

• Task is about PolarDB MySQL → delegate to: alicloud-polar-mysql-ops
• Task is about PolarDB PostgreSQL → delegate to: alicloud-polar-postgresql-ops
• Task is about PolarDB Oracle-compatible → delegate to: alicloud-polar-oracle-ops
• Task is about MongoDB → delegate to: alicloud-mongodb-ops (when present)
• User insists on console-only flows with no API → state limitation; do not

invent undocumented HTTP steps

Delegation Rules

| 能力 | 委托目标 | 说明 | |------|----------|------| | GCL 质量门禁 | alicloud-gcl-runner-ops | 对写操作执行前，委托 GCL 循环进行对抗性评审 |

Variable Convention (Agent-Readable)

| Placeholder | Meaning | Agent Action | |-------------|---------|--------------| | {{env.ALIBABA_CLOUD_ACCESS_KEY_ID}} | From runtime environment | NEVER ask the user; fail if unset | | {{env.ALIBABA_CLOUD_ACCESS_KEY_SECRET}} | From runtime environment | NEVER ask the user; fail if unset | | {{env.ALIBABA_CLOUD_REGION_ID}} | From runtime environment | Use documented default only if skill explicitly allows | | {{user.region}} | User-supplied region | Ask once; reuse | | {{user.instance_id}} | User-supplied Redis/Tair InstanceId | Ask once; reuse | | {{user.instance_name}} | User-supplied instance name | Ask once; reuse | | {{user.instance_class}} | Instance class/specification | Ask once; reuse | | {{user.engine_version}} | Redis engine version (e.g., 5.0, 6.0, 7.0) | Ask once; reuse | | {{user.account_name}} | Database account name | Ask once; reuse | | {{user.backup_id}} | Backup ID | Ask once; reuse | | {{output.instance_id}} | From last API or CLI JSON response | Parse per OpenAPI or verified CLI path | | {{output.request_id}} | From API response | For support / correlation |

> {{env.*}} MUST NOT be collected from the user. {{user.*}} MUST be > collected interactively when missing.

> 凭据安全（强制）： 参考 [Credential Masking 规则](../alicloud-skill-generator/references/credential-masking.md)

API and Response Conventions (Agent-Readable)

• OpenAPI is canonical for path, query, body fields, enums, and response shapes.
• Errors: Map SDK/HTTP errors to code / status / message fields per spec.
• Timestamps: ISO 8601 with timezone when the API returns strings.
• Idempotency: For write operations (CreateInstance, CreateAccount, etc.),

generate a unique Token (UUID v4) per logical request. Reuse the same Token for retries within 24 hours to ensure idempotency.

Response Field Table

> TE-3/TE-6: Only most commonly used fields shown. Full field lists → [API & SDK Usage](references/api-sdk-usage.md#response-fields).

| Operation | Key Fields | |-----------|-------------| | CreateInstance | InstanceId, InstanceStatus | | DescribeInstances | InstanceId, InstanceStatus, ConnectionDomain, InstanceClass, EngineVersion | | DescribeInstanceAttribute | InstanceId, InstanceStatus, Capacity, Bandwidth, Connections | | RestartInstance | RequestId | | DeleteInstance | RequestId | | DescribeAccounts | AccountName, AccountType, AccountStatus | | DescribeBackups | BackupId, BackupStatus, BackupType, BackupStartTime, BackupSize | | DescribeSecurityIps | SecurityIpGroupName, SecurityIpList | | DescribeParameters | ParameterName, ParameterValue | | DescribeSlowLogs | SQLText, ExecuteTime, ElapsedTime | | DescribeHistoryMonitorValues | HistoryMonitorValues | | ModifyInstanceConfig | RequestId | | DeleteAccount / ResetPassword / etc. | RequestId |

Expected State Transitions

| Operation | Initial State | Target State | Poll Interval | Max Wait | |-----------|---------------|--------------|---------------|----------| | CreateInstance | — | Normal | 10s | 600s | | RestartInstance | Normal | Normal | 10s | 300s | | DeleteInstance | any stable state | absent | 10s | 300s | | ModifyInstanceSpec | Normal | Normal | 10s | 600s | | ModifyInstanceConfig | Normal | Normal | 5s | 60s | | ModifySecurityIps | Normal | Normal | 5s | 60s | | CreateAccount | — | Available | 5s | 120s | | DeleteAccount | Normal | Normal | 5s | 60s | | ResetAccountPassword | Normal | Normal | 5s | 60s | | RestoreInstance | — | Normal | 10s | 600s | | MigrateToOtherZone | Normal | Normal | 10s | 600s | | ModifyInstanceMaintainTime | Normal | Normal | 5s | 60s | | ModifyInstanceSSL | Normal | Normal | 10s | 120s | | ModifyIntranetBandwidth | Normal | Normal | 5s | 60s | | UpgradeMinorVersion | Normal | Normal | 10s | 600s | | FlushInstance | Normal | Normal | 10s | 300s |

Execution Flows (Agent-Readable)

Every operation: Pre-flight → Execute (SDK/API and aliyun) → Validate → Recover.

---

Operation: Create Instance

Pre-flight Checks

| Check | Method | Expected | On Failure | |-------|--------|----------|------------| | SDK / deps | aliyun version | Exit code 0 | Document CLI install | | Credentials | Env vars or CLI config | Non-empty keys | HALT; user configures env | | Region | aliyun r-kvstore describe-regions | {{user.region}} supported | Suggest valid region | | Engine / Version | aliyun r-kvstore describe-available-resource | {{user.engine_version}} supported | Suggest valid combo | | VPC/VSwitch | aliyun vpc describe-vpcs / describe-v-switches | VPC and VSwitch exist | Delegate to alicloud-vpc-ops | | Quota | aliyun r-kvstore describe-available-resource | Sufficient quota | HALT; user raises quota |

Execution — CLI (Primary Path)

aliyun r-kvstore create-instance \
  --RegionId "{{user.region}}" \
  --InstanceName "{{user.instance_name}}" \
  --InstanceClass "{{user.instance_class}}" \
  --EngineVersion "{{user.engine_version|5.0}}" \
  --ZoneId "{{user.zone_id}}" \
  --NetworkType "{{user.network_type|VPC}}" \
  --VPCId "{{user.vpc_id}}" \
  --VSwitchId "{{user.vswitch_id}}" \
  --ChargeType "{{user.charge_type|PostPaid}}" \
  --Password "{{user.password}}" \
  --Token "{{user.token}}"

> Note: Output is JSON by default. Parse InstanceId from response.

Execution — JIT Go SDK (Fallback Path)

完整 Go SDK 示例见 [references/api-sdk-usage.md#go-sdk-examples](references/api-sdk-usage.md#go-sdk-examples)

Post-execution Validation

1. Read {{output.instance_id}} from $.InstanceId.
2. Poll DescribeInstances until InstanceStatus is Normal:

# 通用轮询，参数见 [references/polling-patterns.md](references/polling-patterns.md)

1. On success, report {{output.instance_id}}, connection domain, and key fields.
2. On terminal failure, go to Failure Recovery.

Failure Recovery

| Error pattern | Max retries | Backoff | Agent Action | |---------------|-------------|---------|--------------| | InvalidParameter / 400 | 0–1 | — | Fix args from OpenAPI; retry once if safe | | QuotaExceeded / InstanceQuotaExceeded | 0 | — | HALT | | InsufficientBalance | 0 | — | HALT | | InstanceAlreadyExists | 0 | — | Ask reuse vs new name | | Throttling / 429 | 3 | exponential | Back off; respect Retry-After | | InternalError / 5xx | 3 | 2s, 4s, 8s | Retry; then HALT with RequestId |

---

Operation: Describe Instances

Execution — CLI

# Describe all instances in region
aliyun r-kvstore describe-instances --RegionId "{{user.region}}"

# Describe specific instance
aliyun r-kvstore describe-instances \
  --RegionId "{{user.region}}" \
  --InstanceId "{{user.instance_id}}"

# Extract specific fields with JMESPath
aliyun r-kvstore describe-instances --RegionId "{{user.region}}" \
  --output cols=InstanceId,InstanceStatus,InstanceClass,EngineVersion rows=Instances.KVStoreInstance[].{InstanceId,InstanceStatus,InstanceClass,EngineVersion}

Execution — JIT Go SDK

完整 Go SDK 示例见 [references/api-sdk-usage.md#go-sdk-examples](references/api-sdk-usage.md#go-sdk-examples)

Present to User

| Field | Path | Notes | |-------|------|-------| | Instance ID | $.Instances.KVStoreInstance[].InstanceId | Plain text | | Name | $.Instances.KVStoreInstance[].InstanceName | Plain text | | Status | $.Instances.KVStoreInstance[].InstanceStatus | Normal, Creating, Changing, etc. | | Instance Class | $.Instances.KVStoreInstance[].InstanceClass | e.g., redis.master.small.default | | Engine Version | $.Instances.KVStoreInstance[].EngineVersion | e.g., 5.0, 6.0, 7.0 | | Region | $.Instances.KVStoreInstance[].RegionId | Plain text | | Zone | $.Instances.KVStoreInstance[].ZoneId | Plain text | | Network Type | $.Instances.KVStoreInstance[].NetworkType | CLASSIC / VPC | | VPC ID | $.Instances.KVStoreInstance[].VPCId | Plain text | | VSwitch ID | $.Instances.KVStoreInstance[].VSwitchId | Plain text | | Connection Domain | $.Instances.KVStoreInstance[].ConnectionDomain | Connection endpoint | | Port | $.Instances.KVStoreInstance[].Port | Service port | | Capacity | $.Instances.KVStoreInstance[].Capacity | MB | | Bandwidth | $.Instances.KVStoreInstance[].Bandwidth | MB/s | | Connections | $.Instances.KVStoreInstance[].Connections | Max connections | | QPS | $.Instances.KVStoreInstance[].QPS | Max QPS | | Create Time | $.Instances.KVStoreInstance[].CreateTime | ISO 8601 | | Charge Type | $.Instances.KVStoreInstance[].ChargeType | PrePaid / PostPaid | | Architecture Type | $.Instances.KVStoreInstance[].ArchitectureType | standard / cluster / rwsplit |

---

Operation: Describe Instance Attribute

Execution — CLI

aliyun r-kvstore describe-instance-attribute \
  --InstanceId "{{user.instance_id}}"

Execution — JIT Go SDK

完整 Go SDK 示例见 [references/api-sdk-usage.md#go-sdk-examples](references/api-sdk-usage.md#go-sdk-examples)

Present to User

| Field | Path | Notes | |-------|------|-------| | Instance ID | $.Instances.KVStoreInstance[].InstanceId | Plain text | | Status | $.Instances.KVStoreInstance[].InstanceStatus | Plain text | | Capacity | $.Instances.KVStoreInstance[].Capacity | MB | | Bandwidth | $.Instances.KVStoreInstance[].Bandwidth | MB/s | | Connections | $.Instances.KVStoreInstance[].Connections | Max connections | | QPS | $.Instances.KVStoreInstance[].QPS | Max QPS | | Config | $.Instances.KVStoreInstance[].Config | Parameter config JSON | | Security IP List | $.Instances.KVStoreInstance[].SecurityIPList | Comma-separated | | Maintain Start Time | $.Instances.KVStoreInstance[].MaintainStartTime | Maintenance window start | | Maintain End Time | $.Instances.KVStoreInstance[].MaintainEndTime | Maintenance window end |

---

Operation: Restart Instance

Pre-flight

• Verify instance ex

…

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: buhaiqing
• Source: buhaiqing/aliyun-skills
• License: MIT

Install and usage instructions live in the source repository linked above.