Alicloud Slb Ops

> This skill follows the Agent Skill OpenSpec.

Alibaba Cloud SLB Operations Skill

Common JSON Paths (Centralized)

# Create LB:           $.{LoadBalancerId,Address,VSwitchId,VpcId}
# Describe LBs:        $.LoadBalancers.LoadBalancer[].{LoadBalancerId,LoadBalancerStatus,Address}
# Describe LB Attr:    $.{LoadBalancerId,LoadBalancerStatus,Address,VpcId,CreateTime}
# Create VServerGroup: $.VServerGroupId
# Describe VSGs:       $.VServerGroups.VServerGroup[].VServerGroupId
# Upload Cert:         $.ServerCertificateId
# Create ACL:          $.AclId
# Create Rules:        $.Rules.Rule[].RuleId
# Delete/Set/Modify:   $.RequestId

Overview

Alibaba Cloud SLB (Server Load Balancer, also known as CLB — Classic Load Balancer) provides traffic distribution across multiple backend servers to improve service availability and elasticity. This skill is an operational runbook for agents: explicit scope, credential rules, pre-flight checks, cli-first execution (official aliyun CLI as primary path, JIT Go SDK as fallback), response validation, and failure recovery.

CLI applicability (repository policy)

• cli_applicability: cli-first: Official aliyun fully supports SLB. CLI is

the primary execution path for all operations. JIT Go SDK is the fallback only when CLI lacks support for a specific edge-case operation.

Runtime Rules

| Area | Rule | Reference | | --- | --- | --- | | CLI path | MANDATORY: Always prefer the SkillOpt wrapper ./scripts/slb-skillopt-wrapper.sh for all SLB CLI operations to enable automated self-repair and dynamic optimization; fallback to native aliyun slb only when the wrapper is unavailable or skillopt-lib.sh is missing. For runtime enforcement, source the shared shim: source ../../alicloud-skill-generator/scripts/skillopt-shim/aliyun-shim.sh. | [CLI](references/cli-usage.md), [SkillOpt](references/skillopt-integration.md), [Shim](file://../../alicloud-skill-generator/scripts/skillopt-shim/SHIM-README.md) | | Credentials | Read {{env.*}} only from environment; never ask user to paste or print secrets | [Integration](references/integration.md) | | GCL | All write operations MUST pass GCL adversarial review before execution | [GCL Rubric](references/rubric.md) |

Trigger & Scope (Agent-Readable)

SHOULD Use This Skill When

• User mentions "Alibaba Cloud SLB" OR "CLB" OR "负载均衡" OR "传统型负载均衡"

OR "Classic Load Balancer"

• Task involves CRUD or lifecycle operations on SLB instances (create, describe,

modify, delete, list, start, stop)

• Task involves listeners (create, describe, modify, delete TCP/UDP/HTTP/HTTPS

listeners)

• Task involves virtual server groups (create, describe, modify, delete,

add/remove backend servers)

• Task involves backend servers (add, remove, set weights, describe)
• Task involves certificates (upload, describe, delete server/CA certificates)
• Task involves access control lists (ACL) (create, describe, modify, delete,

add/remove entries)

• Task involves forwarding rules (create, describe, modify, delete)
• Task involves health check configuration or session persistence
• Task keywords: 负载均衡, SLB, CLB, listener, 监听, vserver group, 虚拟服务器组,

backend server, 后端服务器, certificate, 证书, ACL, 访问控制, forwarding rule, 转发规则, health check, 健康检查

• User asks to deploy, configure, troubleshoot, or monitor SLB **via API, SDK,

CLI, or automation**

SHOULD NOT Use This Skill When

• Task is purely billing / account management → delegate to:

alicloud-billing-ops (when present)

• Task is RAM / permission model only → delegate to: alicloud-ram-ops (when present)
• Task is about ALB (Application Load Balancer) → ALB uses a different API

surface; note limitation and suggest ALB-specific skill if available

• Task is about NLB (Network Load Balancer) → NLB uses a different API surface;

note limitation and suggest NLB-specific skill if available

• Task is about ECS / compute only → delegate to: alicloud-ecs-ops
• Task is about VPC / networking only → delegate to: alicloud-vpc-ops (when present)
• User insists on console-only flows with no API → state limitation; do not

invent undocumented HTTP steps

Delegation Rules

| 能力 | 委托目标 | 说明 | |------|----------|------| | GCL 质量门禁 | alicloud-gcl-runner-ops | 对写操作执行前，委托 GCL 循环进行对抗性评审 |

Variable Convention (Agent-Readable)

| Placeholder | Meaning | Agent Action | |-------------|---------|--------------| | {{env.ALIBABA_CLOUD_ACCESS_KEY_ID}} | From runtime environment | NEVER ask the user; fail if unset | | {{env.ALIBABA_CLOUD_ACCESS_KEY_SECRET}} | From runtime environment | NEVER ask the user; fail if unset | | {{env.ALIBABA_CLOUD_REGION_ID}} | From runtime environment | Use documented default only if skill explicitly allows | | {{user.region}} | User-supplied region | Ask once; reuse | | {{user.load_balancer_id}} | User-supplied SLB instance ID | Ask once; reuse | | {{user.load_balancer_name}} | User-supplied SLB instance name | Ask once; reuse | | {{user.listener_port}} | User-supplied listener port | Ask once; reuse | | {{user.listener_protocol}} | User-supplied protocol (tcp/udp/http/https) | Ask once; reuse | | {{user.vserver_group_id}} | User-supplied vserver group ID | Ask once; reuse | | {{user.vserver_group_name}} | User-supplied vserver group name | Ask once; reuse | | {{user.backend_server_id}} | User-supplied ECS/ENI/ECI instance ID | Ask once; reuse | | {{user.certificate_id}} | User-supplied certificate ID | Ask once; reuse | | {{user.acl_id}} | User-supplied ACL ID | Ask once; reuse | | {{user.rule_id}} | User-supplied forwarding rule ID | Ask once; reuse | | {{output.load_balancer_id}} | From last API or CLI JSON response | Parse per OpenAPI or verified CLI path | | {{output.listener_port}} | From last API or CLI JSON response | Parse per OpenAPI or verified CLI path | | {{output.vserver_group_id}} | From last API or CLI JSON response | Parse per OpenAPI or verified CLI path | | {{output.request_id}} | From API response | For support / correlation |

> {{env.*}} MUST NOT be collected from the user. {{user.*}} MUST be > collected interactively when missing.

> 凭据安全（强制）： 参考 [Credential Masking 规则](../alicloud-skill-generator/references/credential-masking.md)

API and Response Conventions (Agent-Readable)

• OpenAPI is canonical for path, query, body fields, enums, and response shapes.
• Errors: Map SDK/HTTP errors to code / status / message fields per spec.
• Timestamps: ISO 8601 with timezone when the API returns strings.
• Idempotency: Document client request tokens, duplicate names, and

LoadBalancerAlreadyExists behavior per API.

• ClientToken: For write operations (CreateLoadBalancer, CreateVServerGroup, etc.),

generate a unique ClientToken (UUID v4) per logical request. If the same operation is retried due to network timeout, reuse the same ClientToken to ensure idempotency. The API returns the same result for duplicate requests with the same ClientToken within 24 hours.

Response Field Table

| Operation | JSON Path | Type | Description | |-----------|-----------|------|-------------| | CreateLoadBalancer | $.LoadBalancerId | string | New SLB instance ID | | CreateLoadBalancer | $.Address | string | Assigned IP address | | CreateLoadBalancer | $.VSwitchId | string | VSwitch ID | | CreateLoadBalancer | $.VpcId | string | VPC ID | | DescribeLoadBalancers | $.LoadBalancers.LoadBalancer[].LoadBalancerId | array | Instance IDs | | DescribeLoadBalancers | $.LoadBalancers.LoadBalancer[].LoadBalancerStatus | string | Instance status | | DescribeLoadBalancers | $.LoadBalancers.LoadBalancer[].Address | string | IP address | | DescribeLoadBalancers | $.LoadBalancers.LoadBalancer[].AddressType | string | internet / intranet | | DescribeLoadBalancers | $.LoadBalancers.LoadBalancer[].RegionId | string | Region ID | | DescribeLoadBalancerAttribute | $.LoadBalancerId | string | Instance ID | | DescribeLoadBalancerAttribute | $.LoadBalancerStatus | string | Status | | DescribeLoadBalancerAttribute | $.Address | string | IP address | | DescribeLoadBalancerAttribute | $.Bandwidth | int | Bandwidth (Mbps) | | DescribeLoadBalancerAttribute | $.VpcId | string | VPC ID | | DescribeLoadBalancerAttribute | $.VSwitchId | string | VSwitch ID | | DescribeLoadBalancerAttribute | $.CreateTime | string | ISO 8601 timestamp | | DescribeLoadBalancerAttribute | $.ListenerPorts.ListenerPort[] | array | Listener ports | | DescribeLoadBalancerAttribute | $.ListenerPortsAndProtocol.ListenerPortAndProtocol[].ListenerPort | array | Listener ports with protocol | | DescribeLoadBalancerAttribute | $.DeleteProtection | string | on / off | | DescribeLoadBalancerAttribute | $.ModificationProtectionStatus | string | ConsoleProtection / NonProtection | | SetLoadBalancerStatus | $.RequestId | string | Request ID | | DeleteLoadBalancer | $.RequestId | string | Request ID | | CreateVServerGroup | $.VServerGroupId | string | New vserver group ID | | DescribeVServerGroups | $.VServerGroups.VServerGroup[].VServerGroupId | array | Group IDs | | DescribeVServerGroupAttribute | $.VServerGroupId | string | Group ID | | DescribeVServerGroupAttribute | $.BackendServers.BackendServer[].ServerId | array | Backend server IDs | | DeleteVServerGroup | $.RequestId | string | Request ID | | DescribeLoadBalancerListeners | $.Listeners.Listener[].ListenerPort | array | Listener ports | | DescribeLoadBalancerListeners | $.Listeners.Listener[].Protocol | string | Protocol | | DescribeLoadBalancerListeners | $.Listeners.Listener[].ListenerForward | string | Forwarding config | | UploadServerCertificate | $.ServerCertificateId | string | New certificate ID | | DescribeServerCertificates | $.ServerCertificates.ServerCertificate[].ServerCertificateId | array | Certificate IDs | | DeleteServerCertificate | $.RequestId | string | Request ID | | CreateAccessControlList | $.AclId | string | New ACL ID | | DescribeAccessControlLists | $.Acls.Acl[].AclId | array | ACL IDs | | DeleteAccessControlList | $.RequestId | string | Request ID | | CreateRules | $.Rules.Rule[].RuleId | array | New rule IDs | | DescribeRules | $.Rules.Rule[].RuleId | array | Rule IDs | | DeleteRules | $.RequestId | string | Request ID |

Expected State Transitions

| Operation | Initial State | Target State | Poll Interval | Max Wait | |-----------|---------------|--------------|---------------|----------| | CreateLoadBalancer | — | active | 5s | 120s | | SetLoadBalancerStatus (stop) | active | inactive | 5s | 60s | | SetLoadBalancerStatus (start) | inactive | active | 5s | 60s | | DeleteLoadBalancer | any stable state | absent | 5s | 120s | | CreateVServerGroup | — | Available | 5s | 60s | | DeleteVServerGroup | Available | absent | 5s | 60s | | CreateLoadBalancerTCPListener | — | running | 5s | 60s | | CreateLoadBalancerUDPListener | — | running | 5s | 60s | | CreateLoadBalancerHTTPListener | — | running | 5s | 60s | | CreateLoadBalancerHTTPSListener | — | running | 5s | 60s |

Polling Strategy

CLB 写入操作多为异步；通用轮询模板与各 Operation 参数见 [references/polling-patterns.md](references/polling-patterns.md)。

Execution Flows (Agent-Readable)

Every operation: Pre-flight → Execute (CLI primary, SDK fallback) → Validate → Recover.

> EXECUTION MANDATORY RULE: 所有 CLI 执行步骤 必须 通过 SkillOpt wrapper ./scripts/slb-skillopt-wrapper.sh 运行。 > 以下所有代码块中的 aliyun slb ... 命令在执行时应替换为 ./scripts/slb-skillopt-wrapper.sh ...。 > 仅在 wrapper 脚本不可用时，才退回到原生 aliyun slb CLI 调用。 > 参考 ## Runtime Rules 中的 CLI path 规则。

---

Operation: Create Load Balancer

Pre-flight Checks

| Check | Method | Expected | On Failure | |-------|--------|----------|------------| | SDK / deps | aliyun version | Exit code 0 | Document CLI install | | Credentials | Env vars or CLI config | Non-empty keys | HALT; user configures env | | Region | aliyun slb DescribeRegions | {{user.region}} supported | Suggest valid region | | VPC/VSwitch | aliyun vpc DescribeVpcs / DescribeVSwitches | VPC and VSwitch exist | Delegate to alicloud-vpc-ops | | Quota | aliyun slb DescribeAvailableResource | Sufficient quota | HALT; user raises quota |

Execution — CLI (Primary Path)

aliyun slb CreateLoadBalancer \
  --RegionId "{{user.region}}" \
  --LoadBalancerName "{{user.load_balancer_name}}" \
  --AddressType "{{user.address_type|internet}}" \
  --InternetChargeType "{{user.internet_charge_type|paybytraffic}}" \
  --VpcId "{{user.vpc_id}}" \
  --VSwitchId "{{user.vswitch_id}}" \
  --Bandwidth "{{user.bandwidth|10}}" \
  --LoadBalancerSpec "{{user.load_balancer_spec|slb.s1.small}}" \
  --ClientToken "{{output.client_token}}"

> Idempotency: Include --ClientToken (UUID v4) for idempotency. Reuse the > same token when retrying the same logical request within 24 hours.

> Note: Output is JSON by default. Parse LoadBalancerId from response.

> Important: CLB subscription instances stopped new purchases on 2024-12-01. Only pay-as-you-go instances can be created.

Execution — JIT Go SDK (Fallback Path)

JIT Go SDK fallback: 参见 [API & SDK Usage](references/api-sdk-usage.md)

Post-execution Validation

1. Read {{output.load_balancer_id}} from $.LoadBalancerId.
2. Poll DescribeLoadBalancerAttribute until LoadBalancerStatus is active:

# 通用轮询，参数见 [references/polling-patterns.md](references/polling-patterns.md)

1. On success, report {{output.load_balancer_id}}, Address, and key fields.
2. On terminal failure, go to Failure Recovery.

Failure Recovery

| Error pattern | Max retries | Backoff | Agent Action | |---------------|-------------|---------|--------------| | InvalidParameter / 400 | 0–1 | — | Fix args from OpenAPI; retry once if safe | | QuotaExceeded / LoadBalancerQuotaExceeded | 0 | — | HALT | | InsufficientBalance | 0 | — | HALT | | LoadBalancerAlreadyExists | 0 | — | Ask reuse vs new name | | Throttling / 429 | 3 | exponential | Back off; respect Retry-After | | InternalError / 5xx | 3 | 2s, 4s, 8s | Retry; then HALT with RequestId |

---

Operation: Describe Load Balancers

Execution — CLI

# Describe all SLB instances in region
aliyun slb DescribeLoadBalancers --RegionId "{{user.region}}"

# Describe specific instance
aliyun slb DescribeLoadBalancers \
  --RegionId "{{user.region}}" \
  --LoadBalancerId "{{user.load_balancer_id}}"

# Extract specific fields with JMESPath
aliyun slb DescribeLoadBalancers --RegionId "{{user.region}}" \
  --output cols=LoadBalancerId,LoadBalancerStatus,Address,AddressType rows=LoadBalancers.LoadBalancer[].{LoadBalancerId,LoadBalancerStatus,Address,AddressType}

Execution — JIT Go SDK

JIT Go SDK fallback: 参见 [API & SDK Usage](references/api-sdk-usage.md)

Present to User

| Field | Path | Notes | |-------|------|-------| | Load Balancer ID | $.LoadBalancers.LoadBalancer[].LoadBalancerId | e.g., lb-bp67acfmxazb4ph*** | | Name | $.LoadBalancers.LoadBalancer[].LoadBalancerName | Plain text | | Status | $.LoadBalancers.LoadBalancer[].LoadBalancerStatus | active, inactive | | Address | $.LoadBalancers.LoadBalancer[].Address | IP address | | Address Type | $.LoadBalancers.LoadBalancer[].AddressType | internet / intranet | | Region | $.LoadBalancers.LoadBalancer[].RegionId | Plain text | | VPC ID | $.LoadBalancers.LoadBalancer[].VpcId | Plain text | | VSwitch ID | $.LoadBalancers.LoadBalancer[].VSwitchId | Plain text | | Bandwidth | $.LoadBalancers.LoadBalancer[].Bandwidth | Mbps | | Spec | $.LoadBalancers.LoadBalancer[].LoadBalancerSpec | e.g., slb.s1.small | | Create Time | $.LoadBalancers.LoadBalancer[].CreateTime | ISO 8601 | | Pay Type | `$.LoadBalancers.LoadBalanc

…

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: buhaiqing
• Source: buhaiqing/aliyun-skills
• License: MIT

Install and usage instructions live in the source repository linked above.