Huawei Cloud Swr Enterprise Instance

Huawei Cloud SWR Enterprise Instance Management

Overview

This skill provides lifecycle management capabilities for Huawei Cloud SWR (Software Repository for Container) enterprise instances using the hcloud CLI. Enterprise instances provide dedicated, isolated container registry environments with advanced features like security scanning, replication policies, and custom domain support.

Architecture: hcloud CLI → SWR Service API → Instance/Namespace/Registry/Repository/Artifact/Credential/Endpoint/Domain resources

Related Skills:

• huawei-cloud-swr-image-management - Image lifecycle management (basic SWR namespaces, repos, tags, auth, quotas)
• huawei-cloud-swr-image-governance - Image governance (permissions, retention, sharing, tags, immutable rules)
• huawei-cloud-swr-image-automation - Image automation ops (sync, triggers, domains)

• Create and manage SWR enterprise instances
• Manage instance namespaces with security scanning and vulnerability blocking
• Configure instance registries for cross-instance image sync
• Query and manage instance repositories and artifacts
• Obtain instance access credentials (long-term and temporary)
• Configure instance network access (internal VPC endpoints, public access with whitelist)
• Manage custom domains for instance access
• Monitor instance statistics and job status

Typical Use Cases:

• "Create an SWR enterprise instance for my organization"
• "List all enterprise instances in my project"
• "Create a namespace with auto-scan and vulnerability blocking"
• "Configure a registry for syncing images to another instance"
• "List repositories and artifacts in my instance"
• "Get docker login credentials for my instance"
• "Add a VPC internal endpoint for my instance"
• "Enable public access with IP whitelist"
• "Add a custom domain to my instance"
• "Check instance statistics and resource usage"

Prerequisites

1. hcloud CLI Requirements (MANDATORY)

• hcloud CLI installed (version >= 7.2.2)
• Run hcloud version to verify installation
• First-time usage: printf "y\n" | hcloud version to accept privacy statement

2. Credential Configuration

hcloud CLI supports two credential modes. See references/credential-configuration.md for full details.

Quick setup (choose one):

# Mode A — Long-term AK/SK
export HUAWEI_CLOUD_AK=<your-ak>
export HUAWEI_CLOUD_SK=<your-sk>
export HUAWEI_CLOUD_REGION=cn-north-4

# Mode B — Temporary AK/SK + SecurityToken
export HUAWEI_CLOUD_AK=<your-temp-ak>
export HUAWEI_CLOUD_SK=<your-temp-sk>
export HUAWEI_CLOUD_SECURITY_TOKEN=<your-security-token>
export HUAWEI_CLOUD_REGION=cn-north-4

• Security rules: Never expose AK/SK/SecurityToken values. Use hcloud configure list to check presence only.

3. IAM Permission Requirements

See IAM Permission Policies for complete policy JSON.

Permission Failure Handling:

1. When any command fails due to permission errors, read references/iam-policies.md 2. Display the required permission list and policy JSON to the user 3. Guide the user to create a custom policy in the IAM console and grant authorization 4. Pause execution and wait for user confirmation that permissions have been granted

Core Commands

1. Instance Lifecycle

See Task: Instance Lifecycle for detailed workflows.

# Create an enterprise instance
hcloud SWR CreateInstance --name=my-instance --spec=swr.ee.professional --charge_mode=postPaid --vpc_id=<vpc-id> --subnet_id=<subnet-id> --enterprise_project_id=0 --cli-region=cn-north-4

# List all instances
hcloud SWR ListInstance --cli-region=cn-north-4

# List instances with status filter
hcloud SWR ListInstance --status=Running --cli-region=cn-north-4

# Show instance details
hcloud SWR ShowInstance --instance_id=<instance-id> --cli-region=cn-north-4

# View instance configuration
hcloud SWR ShowInstanceConfiguration --instance_id=<instance-id> --cli-region=cn-north-4

# Update instance configuration (anonymous access)
hcloud SWR UpdateInstanceConfiguration --instance_id=<instance-id> --anonymous_access=false --cli-region=cn-north-4

# Delete instance (CAUTION: removes all data permanently)
hcloud SWR DeleteInstance --instance_id=<instance-id> --cli-region=cn-north-4

Instance Naming Rules:

• Start with lowercase letter
• Followed by lowercase letters, digits, or hyphens (-)
• No consecutive hyphens
• Cannot end with hyphen
• Length: 3-48 characters

Instance Spec Options: swr.ee.basic (basic edition), swr.ee.professional (professional edition)

Instance Status Values: Initial, Creating, Running, Unavailable

2. Instance Namespaces

See Task: Instance Namespaces for detailed workflows.

# Create a namespace with auto-scan and vulnerability blocking
hcloud SWR CreateInstanceNamespace --instance_id=<instance-id> --namespace_name=group-dev --metadata.public=false --metadata.auto_scan=true --metadata.prevent_vul=true --metadata.severity=high --cli-region=cn-north-4

# List namespaces
hcloud SWR ListInstanceNamespaces --instance_id=<instance-id> --cli-region=cn-north-4

# List namespaces with filter
hcloud SWR ListInstanceNamespaces --instance_id=<instance-id> --public=false --limit=20 --offset=0 --cli-region=cn-north-4

# Show namespace details
hcloud SWR ShowInstanceNamespace --instance_id=<instance-id> --namespace_name=group-dev --cli-region=cn-north-4

# Update namespace (change visibility, scan settings)
hcloud SWR UpdateInstanceNamespace --instance_id=<instance-id> --namespace_name=group-dev --metadata.public=true --metadata.prevent_vul=false --cli-region=cn-north-4

# Delete namespace (CAUTION: removes all repositories under it)
hcloud SWR DeleteInstanceNamespace --instance_id=<instance-id> --namespace_name=group-dev --cli-region=cn-north-4

Namespace Naming Rules:

• Start with lowercase letter or digit
• Followed by lowercase letters, digits, dots, underscores, or hyphens
• Dots, underscores, hyphens cannot be directly connected
• End with lowercase letter or digit
• Length: 1-64 characters

Vulnerability Severity Levels: none, low, medium, high, critical

3. Instance Registries (Sync Targets)

See Task: Instance Registries for detailed workflows.

# Create a registry (sync target for another SWR enterprise instance)
hcloud SWR CreateInstanceRegistry --instance_id=<instance-id> --name=target-instance --type=swr-pro-internal --url=<target-url> --credential.type=basic --credential.access_key=<ak> --credential.access_secret=<sk> --insecure=false --instance_id=<target-instance-id> --project_id=<target-project-id> --region_id=cn-east-3 --cli-region=cn-north-4

# Create a registry for open-source Harbor
hcloud SWR CreateInstanceRegistry --instance_id=<instance-id> --name=harbor-target --type=swr-pro --url=https://harbor.example.com --credential.type=basic --credential.access_key=<username> --credential.access_secret=<password> --insecure=false --cli-region=cn-north-4

# List registries
hcloud SWR ListInstanceRegistries --instance_id=<instance-id> --cli-region=cn-north-4

# Show registry details
hcloud SWR ShowInstanceRegistry --instance_id=<instance-id> --registry_id=<registry-id> --cli-region=cn-north-4

# Update registry
hcloud SWR UpdateInstanceRegistry --instance_id=<instance-id> --registry_id=<registry-id> --name=new-name --url=<new-url> --credential.type=basic --credential.access_key=<new-ak> --credential.access_secret=<new-sk> --insecure=false --type=swr-pro --cli-region=cn-north-4

# Delete registry
hcloud SWR DeleteInstanceRegistry --instance_id=<instance-id> --registry_id=<registry-id> --cli-region=cn-north-4

Registry Types: swr-pro (open-source Harbor), swr-pro-internal (another SWR enterprise instance), huawei-SWR (basic SWR)

4. Instance Repositories

See Task: Instance Registries for repository section.

# List repositories in instance
hcloud SWR ListInstanceRepositories --instance_id=<instance-id> --cli-region=cn-north-4

# List repositories with filter
hcloud SWR ListInstanceRepositories --instance_id=<instance-id> --namespace_id=<ns-id> --limit=20 --offset=0 --order_column=updated_at --order_type=desc --cli-region=cn-north-4

# Show repository details
hcloud SWR ShowInstanceRepository --instance_id=<instance-id> --namespace_name=group-dev --repository_name=my-app --cli-region=cn-north-4

# Update repository description
hcloud SWR UpdateInstanceRepository --instance_id=<instance-id> --namespace_name=group-dev --repository_name=my-app --description="Updated description" --cli-region=cn-north-4

# Delete repository (CAUTION: removes all artifacts)
hcloud SWR DeleteInstanceRepository --instance_id=<instance-id> --namespace_name=group-dev --repository_name=my-app --cli-region=cn-north-4

5. Instance Artifacts (Image Versions)

See Task: Instance Artifacts for detailed workflows.

# List artifacts in a repository
hcloud SWR ListInstanceArtifacts --instance_id=<instance-id> --namespace_name=group-dev --repository_name=my-app --cli-region=cn-north-4

# List artifacts with filter
hcloud SWR ListInstanceArtifacts --instance_id=<instance-id> --namespace_name=group-dev --repository_name=my-app --type=IMAGE --limit=20 --offset=0 --cli-region=cn-north-4

# Show artifact details
hcloud SWR ShowInstanceArtifact --instance_id=<instance-id> --namespace_name=group-dev --repository_name=my-app --reference=<digest> --cli-region=cn-north-4

# Show artifact with scan overview
hcloud SWR ShowInstanceArtifact --instance_id=<instance-id> --namespace_name=group-dev --repository_name=my-app --reference=<digest> --with_scan_overview=true --cli-region=cn-north-4

# Get artifact build history
hcloud SWR ShowInstanceArtifactAddition --instance_id=<instance-id> --namespace_name=group-dev --repository_name=my-app --reference=<digest> --addition=build_history --cli-region=cn-north-4

# List artifact vulnerabilities
hcloud SWR ListInstanceArtifactVulnerabilities --instance_id=<instance-id> --namespace_name=group-dev --repository_name=my-app --reference=<digest> --cli-region=cn-north-4

# Start manual vulnerability scan
hcloud SWR StartManualScanning --instance_id=<instance-id> --namespace_name=group-dev --repository_name=my-app --reference=<digest> --cli-region=cn-north-4

# Delete artifact (CAUTION: removes the image version permanently)
hcloud SWR DeleteInstanceArtifact --instance_id=<instance-id> --namespace_name=group-dev --repository_name=my-app --reference=<digest> --cli-region=cn-north-4

Artifact Types: IMAGE (container image), CHART (Helm chart)

6. Instance Credentials

See Task: Instance Credentials for detailed workflows.

# Create a long-term access credential
hcloud SWR CreateInstanceLtCredential --instance_id=<instance-id> --name=my-credential --cli-region=cn-north-4

# Create a temporary access credential
hcloud SWR CreateInstanceTempCredential --instance_id=<instance-id> --cli-region=cn-north-4

# List long-term credentials
hcloud SWR ListInstanceLtCredentials --instance_id=<instance-id> --cli-region=cn-north-4

# Enable/disable a long-term credential
hcloud SWR UpdateInstanceLtCredential --instance_id=<instance-id> --credential_id=<cred-id> --enable=false --cli-region=cn-north-4

# Delete a long-term credential
hcloud SWR DeleteInstanceLtCredential --instance_id=<instance-id> --credential_id=<cred-id> --cli-region=cn-north-4

Credential Naming Rules (same as namespace): lowercase/digit start, 1-64 chars

7. Instance Endpoints (Network Access)

See Task: Instance Endpoints for detailed workflows.

# Create internal VPC endpoint
hcloud SWR CreateInstanceInternalEndpoint --instance_id=<instance-id> --vpc_id=<vpc-id> --subnet_id=<subnet-id> --project_id=<vpc-project-id> --cli-region=cn-north-4

# List internal endpoints
hcloud SWR ListInstanceInternalEndpoints --instance_id=<instance-id> --cli-region=cn-north-4

# Show internal endpoint details
hcloud SWR ShowInstanceInternalEndpoint --instance_id=<instance-id> --internal_endpoints_id=<endpoint-id> --cli-region=cn-north-4

# Delete internal endpoint
hcloud SWR DeleteInstanceInternalEndpoint --instance_id=<instance-id> --internal_endpoints_id=<endpoint-id> --cli-region=cn-north-4

# Enable public access
hcloud SWR CreateInstanceEndpointPolicy --instance_id=<instance-id> --enable=true --cli-region=cn-north-4

# Disable public access
hcloud SWR CreateInstanceEndpointPolicy --instance_id=<instance-id> --enable=false --cli-region=cn-north-4

# View public access status and whitelist
hcloud SWR ShowInstanceEndpointPolicy --instance_id=<instance-id> --cli-region=cn-north-4

# Update public access whitelist (full replacement)
hcloud SWR UpdateInstanceEndpointPolicy --instance_id=<instance-id> --ip_list.1.ip=10.0.0.0/8 --ip_list.1.description="Internal network" --ip_list.2.ip=192.168.0.0/16 --ip_list.2.description="VPN network" --cli-region=cn-north-4

8. Instance Domains

See Task: Instance Domains for detailed workflows.

# Add a custom domain
hcloud SWR AddDomainName --instance_id=<instance-id> --domain_name=registry.example.com --certificate_id=<scm-cert-id> --cli-region=cn-north-4

# List all domains
hcloud SWR ListDomainNames --instance_id=<instance-id> --cli-region=cn-north-4

# Get domain overview
hcloud SWR ShowDomainOverview --cli-region=cn-north-4

# Delete a domain (default domain cannot be deleted)
hcloud SWR DeleteDomainName --instance_id=<instance-id> --domainname_id=<domain-id> --cli-region=cn-north-4

# Update domain certificate
hcloud SWR UpdateDomainName --instance_id=<instance-id> --domainname_id=<domain-id> --certificate_id=<new-cert-id> --cli-region=cn-north-4

9. Instance Statistics and Jobs

# Get instance statistics
hcloud SWR ListInstanceStatistics --instance_id=<instance-id> --cli-region=cn-north-4

# List instance jobs (async operations)
hcloud SWR ListInstanceJobs --cli-region=cn-north-4

# Show job details
hcloud SWR ShowInstanceJob --job_id=<job-id> --cli-region=cn-north-4

# Delete a job record
hcloud SWR DeleteInstanceJob --job_id=<job-id> --cli-region=cn-north-4

Parameter Reference

Common Parameters

Instance Creation Parameters

Namespace Parameters

Registry Parameters

Endpoint Whitelist Parameters

Output Format

See Output Format for detailed response format examples (Instance List, Instance Details, Namespace List, Internal Endpoint List, Domain Name List, Long-term Credential).

Verification

See Verification Method for step-by-step verification.

Best Practices

1. Instance naming: Use descriptive names like prod-instance, dev-instance that reflect the environment 2. VPC selection: Choose VPC/subnet that matches your workload deployment environment 3. Namespace security: Enable auto_scan=true and prevent_vul=true for production namespaces to block vulnerable images 4. Severity blocking: Set severity=high or critical for production; use none or low for development 5. Registry credentials: Store registry credentials securely; rotate access keys periodically 6. Public access whitelist: Always configure IP whitelist when enabling public access; use UpdateInstanceEndpointPolicy for full whitelist management 6. Custom domains: Use SCM (SSL Certificate Manager) certificates for custom domain HTTPS 7. Delete with caution: Deleting an instance removes ALL data permanently; deleting a namespace removes ALL repositories 8. Long-term credentials: Use CreateInstanceLtCredential for CI/CD pipelines; use CreateInstanceTempCredential for temporary access 9. Instance spec selection: Use swr.ee.basic for small teams; swr.ee.professional for enterprise requirements with advanced features

Reference Documents

Notes

• Instance deletion is irreversible — removes ALL namespaces, repositories, artifacts, and data permanently
• Namespace deletion is irreversible — removes all repositories and artifacts under it
• Artifact deletion is irreversible — the image version cannot be recovered
• Default domain cannot be deleted — only custom domains can be removed
• AK/SK must never be hardcoded — credentials should only be obtained via environment variables
• hcloud CLI is the only supported method — all operations use hcloud SWR <Operation> format
• Pagination offset must be multiple of limit — offset must be 0 or a multiple of limit
• Registry credential.access_secret is sensitive — never expose or log access secrets

Common Pitfalls

See Common Pitfalls & Solutions for detailed troubleshooting guides.

Quick Reference:

Common Pitfalls & Solutions

This document contains detailed troubleshooting guides for common issues encountered when using the Huawei Cloud SWR Enterprise Instance skill.

Pitfall 1: Instance Creation Requires Existing VPC and Subnet

Symptom: CreateInstance fails with VPC/subnet not found error

Root Cause: Enterprise instances must be deployed within an existing VPC and subnet. The VPC/subnet must exist before creating the instance.

Solution: Verify VPC and subnet exist before creating an instance:

# Verify VPC exists (use VPC CLI or console)
# Verify subnet exists within the VPC

# Then create instance with valid VPC/subnet IDs
hcloud SWR CreateInstance --name=my-instance --spec=swr.ee.basic --charge_mode=postPaid --vpc_id=<valid-vpc-id> --subnet_id=<valid-subnet-id> --enterprise_project_id=0 --cli-region=cn-north-4

Pitfall 2: Instance Not Ready for Operations

Symptom: Instance-related operations (namespace creation, credential creation) fail with errors

Root Cause: Instance operations cannot be performed while the instance is in Creating or Initial status. Only Running instances are ready for use.

Solution: Wait for the instance to reach Running status:

# Check instance status
hcloud SWR ListInstance --cli-region=cn-north-4

# Or check specific instance
hcloud SWR ShowInstance --instance_id=<instance-id> --cli-region=cn-north-4

# Wait until status is "Running" before proceeding

Instance Status Flow: Initial → Creating → Running (or Unavailable if creation fails)

Pitfall 3: Invalid Instance Name Format

Symptom: CreateInstance returns error 400 Bad Request or name validation error

Root Cause: Instance name violates naming rules

Naming Rules:

• Start with lowercase letter
• Followed by lowercase letters, digits, or hyphens (-)
• No consecutive hyphens (-- is invalid)
• Cannot end with hyphen (-)
• Length: 3-48 characters

Common Mistakes:

• ❌ MyInstance — starts with uppercase
• ❌ my--instance — consecutive hyphens
• ❌ my-instance- — ends with hyphen
• ❌ ab — too short (minimum 3 chars)
• ❌ Very long names > 48 chars

Valid Examples: my-instance, prod-registry01, dev-team-app

Pitfall 4: Pagination Offset Must Be Multiple of Limit

Symptom: ListInstanceNamespaces, ListInstanceRegistries, ListInstanceRepositories, or ListInstanceArtifacts pagination returns errors or unexpected results

Root Cause: For instance-specific list operations (namespace, registry, repository, artifact), the offset parameter must be 0 or a multiple of limit. This is different from the basic SWR pagination which allows any offset value.

Solution: Always use offset values that are multiples of limit:

# ✅ CORRECT - offset=0, limit=20 (0 is multiple of 20)
hcloud SWR ListInstanceNamespaces --instance_id=<id> --limit=20 --offset=0 --cli-region=cn-north-4

# ✅ CORRECT - offset=20, limit=20 (20 is multiple of 20)
hcloud SWR ListInstanceNamespaces --instance_id=<id> --limit=20 --offset=20 --cli-region=cn-north-4

# ✅ CORRECT - offset=40, limit=20 (40 is multiple of 20)
hcloud SWR ListInstanceNamespaces --instance_id=<id> --limit=20 --offset=40 --cli-region=cn-north-4

# ❌ WRONG - offset=10, limit=20 (10 is NOT multiple of 20)
hcloud SWR ListInstanceNamespaces --instance_id=<id> --limit=20 --offset=10 --cli-region=cn-north-4

⚠️ Note: ListInstance and ListInstanceLtCredentials use standard offset/limit pagination (offset does not need to be multiple of limit). Only instance namespace, registry, repository, and artifact lists require the offset-to-be-multiple constraint.

Pitfall 5: Namespace metadata.public Required for Update

Symptom: UpdateInstanceNamespace fails or only changes visibility when other settings were intended

Root Cause: --metadata.public is a required parameter for UpdateInstanceNamespace, even if you only want to change auto_scan, prevent_vul, or severity settings

Solution: Always include --metadata.public in update commands:

# ✅ CORRECT - Include metadata.public even when changing only scan settings
hcloud SWR UpdateInstanceNamespace --instance_id=<id> --namespace_name=group-dev --metadata.public=false --metadata.auto_scan=true --cli-region=cn-north-4

# ❌ WRONG - Missing metadata.public
hcloud SWR UpdateInstanceNamespace --instance_id=<id> --namespace_name=group-dev --metadata.auto_scan=true --cli-region=cn-north-4

Pitfall 6: Registry Instance ID Appears Twice for swr-pro-internal

Symptom: CreateInstanceRegistry with type swr-pro-internal fails with missing parameters

Root Cause: When creating a registry of type swr-pro-internal, --instance_id appears both as a path parameter (the source instance) and a body parameter (the target instance ID). Both must be provided.

Solution: Provide both instance IDs when creating swr-pro-internal registry:

# ✅ CORRECT - Both instance_id values provided
hcloud SWR CreateInstanceRegistry --instance_id=<source-instance-id> --name=target-registry --type=swr-pro-internal --url=<target-url> --credential.type=basic --credential.access_key=<key> --credential.access_secret=<secret> --insecure=false --instance_id=<target-instance-id> --project_id=<target-project-id> --region_id=cn-east-3 --cli-region=cn-north-4

# ❌ WRONG - Missing target instance_id body parameter
hcloud SWR CreateInstanceRegistry --instance_id=<source-instance-id> --name=target-registry --type=swr-pro-internal --url=<target-url> --credential.type=basic --credential.access_key=<key> --credential.access_secret=<secret> --insecure=false --cli-region=cn-north-4

Pitfall 7: Deleting Instance Removes ALL Data Permanently

Symptom: All namespaces, repositories, artifacts, and configurations disappear after instance deletion

Root Cause: DeleteInstance removes the entire instance and all associated data permanently

Solution: Before deleting an instance, always:

1. Confirm with the user that they understand ALL data will be permanently deleted 2. Consider using --delete_obs=true and --delete_dns=true for complete cleanup 3. If any data needs to be preserved, sync/migrate it to another instance first

# Delete with OBS bucket and DNS cleanup
hcloud SWR DeleteInstance --instance_id=<id> --delete_obs=true --delete_dns=true --cli-region=cn-north-4

Pitfall 8: Default Domain Cannot Be Deleted

Symptom: DeleteDomainName fails when attempting to delete the default domain

Root Cause: The SWR-assigned default domain (e.g., xxx.cn-north-4.myhuaweicloud.com) cannot be deleted. Only custom domains added via AddDomainName can be removed.

Solution: Only delete custom domains. Leave the default domain intact:

# ✅ CORRECT - Delete only custom domain
hcloud SWR DeleteDomainName --instance_id=<id> --domainname_id=<custom-domain-id> --cli-region=cn-north-4

# ❌ WRONG - Attempting to delete default domain will fail

Pitfall 9: Public Access Whitelist is Full Replacement

Symptom: Previous whitelist entries disappear after updating the whitelist

Root Cause: UpdateInstanceEndpointPolicy performs a full replacement of the IP whitelist, not an incremental add. All existing entries are replaced by the new ones provided.

Solution: When adding new IPs, include ALL existing IPs plus the new ones:

# ✅ CORRECT - Include all existing IPs plus new ones
hcloud SWR UpdateInstanceEndpointPolicy --instance_id=<id> --ip_list.1.ip=10.0.0.0/8 --ip_list.1.description="Existing: Internal" --ip_list.2.ip=192.168.0.0/16 --ip_list.2.description="Existing: VPN" --ip_list.3.ip=172.16.0.0/12 --ip_list.3.description="New: Docker network" --cli-region=cn-north-4

# ❌ WRONG - Only providing new entries (existing entries will be lost)
hcloud SWR UpdateInstanceEndpointPolicy --instance_id=<id> --ip_list.1.ip=172.16.0.0/12 --ip_list.1.description="New: Docker network" --cli-region=cn-north-4

Best Practice: Before updating the whitelist, check current entries with ShowInstanceEndpointPolicy and include all existing entries in the update command.

Pitfall 10: Artifact Reference Uses Digest, Not Tag Name

Symptom: ShowInstanceArtifact, DeleteInstanceArtifact, StartManualScanning fail with "not found" error

Root Cause: These operations use --reference which must be the artifact's SHA256 digest (e.g., sha256:abc123...), NOT the tag name (e.g., v1.0)

Solution: First obtain the digest from ListInstanceArtifacts, then use it for operations:

# 1. List artifacts to find the digest
hcloud SWR ListInstanceArtifacts --instance_id=<id> --namespace_name=group-dev --repository_name=my-app --cli-region=cn-north-4

# 2. Use the digest value for operations
hcloud SWR ShowInstanceArtifact --instance_id=<id> --namespace_name=group-dev --repository_name=my-app --reference=sha256:abc123def456... --cli-region=cn-north-4

Pitfall 11: CreateInstanceEndpointPolicy Status Constraints

Symptom: CreateInstanceEndpointPolicy fails when trying to enable or disable public access

Root Cause: The enable/disable operation has status constraints:

• Can only enable (--enable=true) when status is Disable or EnableFailed
• Can only disable (--enable=false) when status is Enable or DisableFailed

Solution: Check current status before changing:

# Check current public access status
hcloud SWR ShowInstanceEndpointPolicy --instance_id=<id> --cli-region=cn-north-4

# Then enable or disable based on current status
hcloud SWR CreateInstanceEndpointPolicy --instance_id=<id> --enable=true --cli-region=cn-north-4

Pitfall 12: Registry Credential Security

Symptom: Registry sync fails with authentication error

Root Cause: Registry credentials (--credential.access_key and --credential.access_secret) must be correct and current. If the target registry changes its credentials, sync will fail.

Solution:

• Never expose or log credential values
• Update registry credentials when they change on the target side
• Verify credentials work by testing manually before configuring in SWR

# Update registry credentials when target credentials change
hcloud SWR UpdateInstanceRegistry --instance_id=<id> --registry_id=<reg-id> --name=target --type=swr-pro --url=<url> --credential.type=basic --credential.access_key=<new-key> --credential.access_secret=<new-secret> --insecure=false --cli-region=cn-north-4

Pitfall 13: Instance VPC Project ID Confusion

Symptom: CreateInstance or CreateInstanceInternalEndpoint fails with project ID errors

Root Cause: The --project_id body parameter for VPC/subnet configuration may differ from the auto-filled path --project_id. If the VPC/subnet is in a different project, the body --project_id must specify the VPC/subnet project.

Solution: Ensure the body --project_id matches the project where the VPC and subnet reside:

# If VPC/subnet are in a different project, specify that project ID
hcloud SWR CreateInstance --name=my-instance --spec=swr.ee.basic --charge_mode=postPaid --vpc_id=<vpc-id> --subnet_id=<subnet-id> --enterprise_project_id=0 --project_id=<vpc-project-id> --cli-region=cn-north-4

Pitfall 14: ListAllInstanceRepositories Uses Marker-Based Pagination

Symptom: Pagination with --offset/--limit returns unexpected results for ListAllInstanceRepositories

Root Cause: ListAllInstanceRepositories uses --marker/--limit pagination, not --offset/--limit. The --marker value comes from the next_marker field in the previous response.

Solution: Use marker-based pagination:

# ✅ CORRECT - First page (no marker needed)
hcloud SWR ListAllInstanceRepositories --limit=20 --cli-region=cn-north-4

# ✅ CORRECT - Next page (use next_marker from previous response)
hcloud SWR ListAllInstanceRepositories --limit=20 --marker=<next_marker> --cli-region=cn-north-4

# ❌ WRONG - Using offset for this operation
hcloud SWR ListAllInstanceRepositories --limit=20 --offset=0 --cli-region=cn-north-4

Common Error Response Reference

Credential Configuration for hcloud CLI

hcloud CLI (KooCLI) supports two credential modes via environment variables, automatically detected at runtime.

Security Rules:

- 🚫 Never expose AK/SK/SecurityToken values in conversation, commands, or output

- ✅ Prefer environment variables or hcloud CLI profile mode

- ✅ Use hcloud configure list to check credential status (presence only, not values)

Mode A — Long-term AK/SK

Suitable for permanent access, CI/CD pipelines, and long-running automation.

export HUAWEI_CLOUD_AK=<your-ak>
export HUAWEI_CLOUD_SK=<your-sk>
export HUAWEI_CLOUD_REGION=cn-north-4

Characteristics:

• Credentials are valid until manually revoked in IAM console
• Recommended for service accounts, CI/CD pipelines, and automation scripts
• Rotate regularly following security best practices

Mode B — Temporary AK/SK + SecurityToken

Recommended for temporary, delegated, or fine-grained access scenarios.

export HUAWEI_CLOUD_AK=<your-temp-ak>
export HUAWEI_CLOUD_SK=<your-temp-sk>
export HUAWEI_CLOUD_SECURITY_TOKEN=<your-security-token>
export HUAWEI_CLOUD_REGION=cn-north-4

Characteristics:

• Credentials expire after a configured duration (typically 15 minutes to 24 hours)
• Obtained via IAM CreateTemporaryAccessKeyByToken or CreateTemporaryAccessKeyByAgency APIs
• Supports scoped permissions via agency delegation
• When HUAWEI_CLOUD_SECURITY_TOKEN is present, hcloud CLI automatically uses temporary credential authentication
• When only AK/SK are set, it uses long-term credential authentication

Validation

After configuring credentials, verify they work:

# Check credential presence (shows profile name, NOT credential values)
hcloud configure list

# Verify connectivity with a simple query
hcloud SWR ListNamespaces --cli-region=cn-north-4 --cli-output=json

Important Notes

• Never commit credentials to version control
• Use IAM users with minimal required permissions (least privilege principle)
• Enable MFA for sensitive operations
• Rotate long-term AK/SK regularly
• For temporary credentials, use appropriate expiration duration — too short causes frequent re-authentication, too long increases risk

IAM Permission Policies - SWR Enterprise Instance Skill

Overview

This document declares the IAM permissions required by the Huawei Cloud SWR Enterprise Instance skill. All permissions follow the principle of least privilege.

Read-Only Operations

Write Operations (Require Additional Authorization)

Minimum Read-Only Policy (JSON)

{
  "Version": "1.1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "swr:instance:list",
        "swr:instance:get",
        "swr:instanceNamespace:list",
        "swr:instanceNamespace:get",
        "swr:instanceRegistry:list",
        "swr:instanceRegistry:get",
        "swr:instanceRepository:list",
        "swr:instanceRepository:get",
        "swr:instanceArtifact:list",
        "swr:instanceArtifact:get",
        "swr:instanceCredential:list",
        "swr:instanceEndpoint:list",
        "swr:instanceEndpoint:get",
        "swr:instanceDomain:list",
        "swr:instanceDomain:get",
        "swr:instanceJob:list",
        "swr:instanceJob:get",
        "swr:instanceStatistic:get"
      ],
      "Resource": ["*"]
    }
  ]
}

Full Management Policy (JSON)

{
  "Version": "1.1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "swr:instance:list",
        "swr:instance:get",
        "swr:instance:create",
        "swr:instance:delete",
        "swr:instance:update",
        "swr:instanceNamespace:list",
        "swr:instanceNamespace:get",
        "swr:instanceNamespace:create",
        "swr:instanceNamespace:update",
        "swr:instanceNamespace:delete",
        "swr:instanceRegistry:list",
        "swr:instanceRegistry:get",
        "swr:instanceRegistry:create",
        "swr:instanceRegistry:update",
        "swr:instanceRegistry:delete",
        "swr:instanceRepository:list",
        "swr:instanceRepository:get",
        "swr:instanceRepository:update",
        "swr:instanceRepository:delete",
        "swr:instanceArtifact:list",
        "swr:instanceArtifact:get",
        "swr:instanceArtifact:delete",
        "swr:instanceArtifact:scan",
        "swr:instanceCredential:create",
        "swr:instanceCredential:list",
        "swr:instanceCredential:update",
        "swr:instanceCredential:delete",
        "swr:instanceEndpoint:create",
        "swr:instanceEndpoint:list",
        "swr:instanceEndpoint:get",
        "swr:instanceEndpoint:delete",
        "swr:instanceEndpoint:update",
        "swr:instanceDomain:add",
        "swr:instanceDomain:list",
        "swr:instanceDomain:get",
        "swr:instanceDomain:delete",
        "swr:instanceDomain:update",
        "swr:instanceJob:list",
        "swr:instanceJob:get",
        "swr:instanceJob:delete",
        "swr:instanceStatistic:get"
      ],
      "Resource": ["*"]
    }
  ]
}

Permission Assignment Steps

1. Log in to Huawei Cloud IAM console: https://console.huaweicloud.com/iam/ 2. Navigate to Policies → Create Custom Policy 3. Choose JSON mode and paste the policy JSON above 4. Navigate to Users / User Groups → Authorize 5. Select the custom policy and confirm

Permission Failure Handling

When a command fails with a permission error:

1. Read this document (references/iam-policies.md) 2. Display the required permission list and policy JSON to the user 3. Guide the user to create a custom policy in the IAM console 4. Pause execution and wait for user confirmation that permissions have been granted 5. Retry the failed command

SWR Enterprise Instance — Output Format

Instance List

Response format needs verification.

{
  "instances": [
    {
      "id": "xxx-xxx-xxx",
      "name": "my-instance",
      "spec": "swr.ee.professional",
      "status": "Running",
      "charge_mode": "postPaid",
      "vpc_id": "xxx",
      "subnet_id": "xxx",
      "created_at": "2026-01-01T00:00:00Z",
      "updated_at": "2026-05-01T00:00:00Z"
    }
  ]
}

Instance Details

Response format needs verification.

{
  "id": "xxx-xxx-xxx",
  "name": "my-instance",
  "spec": "swr.ee.professional",
  "status": "Running",
  "charge_mode": "postPaid",
  "description": "",
  "internal_endpoint": "xxx.cn-north-4.myhuaweicloud.com",
  "public_endpoint": "xxx.cn-north-4.myhuaweicloud.com"
}

Namespace List

Response format needs verification.

{
  "namespaces": [
    {
      "id": 1,
      "name": "group-dev",
      "metadata": {
        "public": "false",
        "auto_scan": "true",
        "prevent_vul": "true",
        "severity": "high"
      },
      "creation_time": "2026-01-01T00:00:00Z",
      "update_time": "2026-05-01T00:00:00Z",
      "repo_count": 5
    }
  ]
}

Long-term Credential

Response format needs verification — returns credential info including authentication token.

Internal Endpoint List

Response format needs verification.

{
  "internal_endpoints": [
    {
      "id": "xxx",
      "vpc_id": "xxx",
      "subnet_id": "xxx",
      "endpoint": "xxx.cn-north-4.myhuaweicloud.com",
      "status": "Running"
    }
  ]
}

Domain Name List

Response format needs verification.

{
  "domain_names": [
    {
      "id": "xxx",
      "domain_name": "registry.example.com",
      "status": "Active",
      "certificate_id": "xxx"
    }
  ]
}

SWR Instance API Reference Guide

Overview

This document provides API reference information for Huawei Cloud SWR enterprise instance operations using hcloud CLI. All commands follow the standard format: hcloud SWR <Operation> --param=value --cli-region=<region>. Enterprise instance operations differ from basic SWR operations — they require --instance_id for most operations and use a separate set of API endpoints.

Authentication

Environment Variables

export HUAWEI_CLOUD_AK=<your-ak>
export HUAWEI_CLOUD_SK=<your-sk>

hcloud CLI Configuration

# Interactive configuration
hcloud configure

# Verify configuration (safe - does not expose values)
hcloud configure list

✅ Correct: Use hcloud configure list to verify credentials ❌ Incorrect: Never use echo $HUAWEI_CLOUD_AK to check credentials

Instance Lifecycle Operations

1. Create Instance

# Create basic edition instance
hcloud SWR CreateInstance --name=my-instance --spec=swr.ee.basic --charge_mode=postPaid --vpc_id=<vpc-id> --subnet_id=<subnet-id> --enterprise_project_id=0 --cli-region=cn-north-4

# Create professional edition instance with description
hcloud SWR CreateInstance --name=prod-instance --spec=swr.ee.professional --charge_mode=postPaid --vpc_id=<vpc-id> --subnet_id=<subnet-id> --enterprise_project_id=0 --description="Production enterprise registry" --cli-region=cn-north-4

# Create instance with OBS encryption
hcloud SWR CreateInstance --name=secure-instance --spec=swr.ee.professional --charge_mode=postPaid --vpc_id=<vpc-id> --subnet_id=<subnet-id> --enterprise_project_id=0 --obs_encrypt=true --obs_enc_kms_key_id=<kms-key-id> --cli-region=cn-north-4

# Create instance with 国密 encryption
hcloud SWR CreateInstance --name=gm-instance --spec=swr.ee.professional --charge_mode=postPaid --vpc_id=<vpc-id> --subnet_id=<subnet-id> --enterprise_project_id=0 --obs_encrypt=true --encrypt_type=gm --cli-region=cn-north-4

# Create instance without intranet access
hcloud SWR CreateInstance --name=public-instance --spec=swr.ee.basic --charge_mode=postPaid --vpc_id=<vpc-id> --subnet_id=<subnet-id> --enterprise_project_id=0 --enable_intranet_access=false --cli-region=cn-north-4

# Create instance with custom OBS bucket
hcloud SWR CreateInstance --name=custom-obs-instance --spec=swr.ee.professional --charge_mode=postPaid --vpc_id=<vpc-id> --subnet_id=<subnet-id> --enterprise_project_id=0 --obs_bucket_name=my-obs-bucket --cli-region=cn-north-4

# Create instance with tags
hcloud SWR CreateInstance --name=tagged-instance --spec=swr.ee.professional --charge_mode=postPaid --vpc_id=<vpc-id> --subnet_id=<subnet-id> --enterprise_project_id=0 --resource_tags.1.key=Environment --resource_tags.1.value=Production --resource_tags.2.key=Team --resource_tags.2.value=Backend --cli-region=cn-north-4

Parameters:

• --name (required, body): Instance name, 3-48 chars, lowercase start, no consecutive hyphens, cannot end with hyphen
• --spec (required, body): swr.ee.basic or swr.ee.professional
• --charge_mode (required, body): postPaid (on-demand)
• --vpc_id (required, body): VPC ID
• --subnet_id (required, body): Subnet ID
• --enterprise_project_id (required, body): Enterprise project ID (use 0 for default)
• --project_id (required, body): Project ID for VPC and subnet
• --description (optional, body): Instance description
• --enable_intranet_access (optional, body): Create internal access, default true
• --obs_encrypt (optional, body): Enable OBS bucket encryption
• --encrypt_type (optional, body): Encryption algorithm, gm for 国密, empty for AES-256
• --obs_bucket_name (optional, body): Custom OBS bucket name (skips OBS encryption config)
• --obs_enc_kms_key_id (optional, body): KMS key ID for OBS encryption
• --resource_tags.[N].key (optional, body): Tag key in indexed format
• --resource_tags.[N].value (optional, body): Tag value in indexed format

⚠️ Note: Instance creation is asynchronous. After calling CreateInstance, check status with ListInstance or ShowInstance until status becomes Running.

2. List Instances

# List all instances
hcloud SWR ListInstance --cli-region=cn-north-4

# List instances by status
hcloud SWR ListInstance --status=Running --cli-region=cn-north-4

# List instances with pagination
hcloud SWR ListInstance --limit=20 --offset=0 --cli-region=cn-north-4

# List instances by enterprise project
hcloud SWR ListInstance --enterprise_project_id=<ep-id> --cli-region=cn-north-4

Parameters:

• --cli-region (required): Region ID
• --project_id (required, path, auto-filled): Project ID
• --status (optional): Filter by status (Initial, Creating, Running, Unavailable)
• --limit (optional): Page size, default 100, max 100
• --offset (optional): Page offset (must pair with --limit)
• --enterprise_project_id (optional): Filter by enterprise project

Response: Response format needs verification.

3. Show Instance Details

hcloud SWR ShowInstance --instance_id=<instance-id> --cli-region=cn-north-4

Parameters:

• --instance_id (required, path): Instance ID
• --project_id (required, path, auto-filled): Project ID

Response: Response format needs verification.

4. Show Instance Configuration

hcloud SWR ShowInstanceConfiguration --instance_id=<instance-id> --cli-region=cn-north-4

Parameters:

• --instance_id (required, path): Instance ID
• --project_id (required, path, auto-filled): Project ID

Response: Response format needs verification — returns configuration including anonymous access setting.

5. Update Instance Configuration

# Enable anonymous access
hcloud SWR UpdateInstanceConfiguration --instance_id=<instance-id> --anonymous_access=true --cli-region=cn-north-4

# Disable anonymous access
hcloud SWR UpdateInstanceConfiguration --instance_id=<instance-id> --anonymous_access=false --cli-region=cn-north-4

Parameters:

• --instance_id (required, path): Instance ID
• --anonymous_access (required, body): Enable/disable anonymous login (true/false)
• --project_id (required, path, auto-filled): Project ID

6. Delete Instance

⚠️ Warning: This operation is irreversible. ALL data (namespaces, repositories, artifacts, configurations) will be permanently deleted.

# Delete instance (basic)
hcloud SWR DeleteInstance --instance_id=<instance-id> --cli-region=cn-north-4

# Delete instance and also delete OBS bucket
hcloud SWR DeleteInstance --instance_id=<instance-id> --delete_obs=true --cli-region=cn-north-4

# Delete instance and also delete DNS records
hcloud SWR DeleteInstance --instance_id=<instance-id> --delete_dns=true --cli-region=cn-north-4

# Delete instance with both OBS and DNS cleanup
hcloud SWR DeleteInstance --instance_id=<instance-id> --delete_obs=true --delete_dns=true --cli-region=cn-north-4

Parameters:

• --instance_id (required, path): Instance ID
• --project_id (required, path, auto-filled): Project ID
• --delete_dns (optional, body): Whether to delete DNS domain info
• --delete_obs (optional, body): Whether to delete OBS bucket

Instance Namespace Operations

1. Create Instance Namespace

# Create private namespace (basic)
hcloud SWR CreateInstanceNamespace --instance_id=<instance-id> --namespace_name=group-dev --metadata.public=false --cli-region=cn-north-4

# Create public namespace with auto-scan and vulnerability blocking
hcloud SWR CreateInstanceNamespace --instance_id=<instance-id> --namespace_name=prod-ns --metadata.public=false --metadata.auto_scan=true --metadata.prevent_vul=true --metadata.severity=high --cli-region=cn-north-4

# Create namespace with only vulnerability blocking (no auto-scan)
hcloud SWR CreateInstanceNamespace --instance_id=<instance-id> --namespace_name=secure-ns --metadata.public=false --metadata.auto_scan=false --metadata.prevent_vul=true --metadata.severity=critical --cli-region=cn-north-4

Parameters:

• --instance_id (required, path): Instance ID
• --namespace_name (required, body): Namespace name, 1-64 chars
• --metadata.public (required, body): Public visibility (true/false)
• --metadata.auto_scan (optional, body): Auto scan on upload (true/false)
• --metadata.prevent_vul (optional, body): Block vulnerable images (true/false)
• --metadata.severity (optional, body): Blocking severity (none, low, medium, high, critical)
• --project_id (required, path, auto-filled): Project ID

Namespace Naming Rules:

• Start with lowercase letter or digit
• Followed by lowercase letters, digits, dots (.), underscores (_), or hyphens (-)
• Dots, underscores, hyphens cannot be directly connected (e.g., a._b is invalid)
• End with lowercase letter or digit
• Length: 1-64 characters

2. List Instance Namespaces

# List all namespaces
hcloud SWR ListInstanceNamespaces --instance_id=<instance-id> --cli-region=cn-north-4

# List namespaces with pagination
hcloud SWR ListInstanceNamespaces --instance_id=<instance-id> --limit=20 --offset=0 --cli-region=cn-north-4

# Filter by name
hcloud SWR ListInstanceNamespaces --instance_id=<instance-id> --name=group-dev --cli-region=cn-north-4

# Filter by visibility
hcloud SWR ListInstanceNamespaces --instance_id=<instance-id> --public=false --cli-region=cn-north-4

# Sort by update time
hcloud SWR ListInstanceNamespaces --instance_id=<instance-id> --order_column=updated_at --order_type=desc --cli-region=cn-north-4

Parameters:

• --instance_id (required, path): Instance ID
• --project_id (required, path, auto-filled): Project ID
• --limit (optional): Page size, default 10, max 100
• --offset (optional): Page offset, must be 0 or multiple of limit
• --name (optional): Filter by namespace name
• --public (optional): Filter by visibility
• --order_column (optional): Sort column (updated_at)
• --order_type (optional): Sort direction (desc, asc)

Response: Response format needs verification.

3. Show Instance Namespace

hcloud SWR ShowInstanceNamespace --instance_id=<instance-id> --namespace_name=group-dev --cli-region=cn-north-4

Parameters:

• --instance_id (required, path): Instance ID
• --namespace_name (required, path): Namespace name
• --project_id (required, path, auto-filled): Project ID

4. Update Instance Namespace

# Change namespace to public
hcloud SWR UpdateInstanceNamespace --instance_id=<instance-id> --namespace_name=group-dev --metadata.public=true --cli-region=cn-north-4

# Enable vulnerability blocking with medium severity
hcloud SWR UpdateInstanceNamespace --instance_id=<instance-id> --namespace_name=group-dev --metadata.public=false --metadata.prevent_vul=true --metadata.severity=medium --cli-region=cn-north-4

# Disable auto-scan
hcloud SWR UpdateInstanceNamespace --instance_id=<instance-id> --namespace_name=group-dev --metadata.public=false --metadata.auto_scan=false --cli-region=cn-north-4

# Update namespace with CVE whitelist
hcloud SWR UpdateInstanceNamespace --instance_id=<instance-id> --namespace_name=group-dev --metadata.public=false --cve_allowlist.id=<whitelist-id> --cve_allowlist.namespace_id=<ns-id> --cve_allowlist.expires_at=1735689600 --cve_allowlist.items.1.cve_id=CVE-2019-10164 --cli-region=cn-north-4

Parameters:

• --instance_id (required, path): Instance ID
• --namespace_name (required, path): Namespace name
• --metadata.public (required, body): Public visibility
• --metadata.auto_scan (optional, body): Auto scan on upload
• --metadata.prevent_vul (optional, body): Block vulnerable images
• --metadata.severity (optional, body): Blocking severity
• --cve_allowlist.id (optional, body): Whitelist ID
• --cve_allowlist.namespace_id (optional, body): Namespace ID for whitelist
• --cve_allowlist.expires_at (optional, body): Whitelist expiry (Unix timestamp)
• --cve_allowlist.items.[N].cve_id (optional, body): CVE ID entries in indexed format

⚠️ Note: --metadata.public is required even if you only want to change scan settings.

5. Delete Instance Namespace

hcloud SWR DeleteInstanceNamespace --instance_id=<instance-id> --namespace_name=group-dev --cli-region=cn-north-4

Parameters:

• --instance_id (required, path): Instance ID
• --namespace_name (required, path): Namespace name
• --project_id (required, path, auto-filled): Project ID

⚠️ Warning: This operation is irreversible. ALL repositories and artifacts under the namespace will be permanently deleted.

Instance Registry Operations

1. Create Instance Registry

# Create registry for another SWR enterprise instance (internal)
hcloud SWR CreateInstanceRegistry --instance_id=<instance-id> --name=target-registry --type=swr-pro-internal --url=https://<target-instance>.cn-east-3.myhuaweicloud.com --credential.type=basic --credential.access_key=<username> --credential.access_secret=<password> --insecure=false --instance_id=<target-instance-id> --project_id=<target-project-id> --region_id=cn-east-3 --cli-region=cn-north-4

# Create registry for open-source Harbor
hcloud SWR CreateInstanceRegistry --instance_id=<instance-id> --name=harbor-reg --type=swr-pro --url=https://harbor.example.com --credential.type=basic --credential.access_key=admin --credential.access_secret=<password> --insecure=true --cli-region=cn-north-4

# Create registry for basic SWR
hcloud SWR CreateInstanceRegistry --instance_id=<instance-id> --name=swr-basic --type=huawei-SWR --url=https://swr.cn-north-4.myhuaweicloud.com --credential.type=basic --credential.access_key=<ak> --credential.access_secret=<sk> --insecure=false --cli-region=cn-north-4

# Create registry with description
hcloud SWR CreateInstanceRegistry --instance_id=<instance-id> --name=prod-harbor --type=swr-pro --url=https://harbor.example.com --credential.type=basic --credential.access_key=admin --credential.access_secret=<password> --insecure=false --description="Production Harbor instance" --cli-region=cn-north-4

# Create registry with DNS host mapping
hcloud SWR CreateInstanceRegistry --instance_id=<instance-id> --name=custom-harbor --type=swr-pro --url=https://harbor.internal.example.com --credential.type=basic --credential.access_key=admin --credential.access_secret=<password> --insecure=false --dns_conf.hosts.harbor.internal.example.com=10.0.1.100 --cli-region=cn-north-4

Parameters:

• --instance_id (required, path): Source instance ID
• --name (required, body): Registry display name, 1-64 chars
• --type (required, body): swr-pro, swr-pro-internal, huawei-SWR
• --url (required, body): Registry URL
• --credential.type (required, body): Auth type, only basic supported
• --credential.access_key (required, body): Access ID/username
• --credential.access_secret (required, body): Access secret/password
• --insecure (required, body): Verify remote cert (true=skip, false=verify)
• --description (optional, body): Registry description
• --instance_id (optional, body): Target instance ID (required for swr-pro-internal)
• --project_id (optional, body): Target project ID (required for swr-pro-internal)
• --region_id (optional, body): Target region (required for swr-pro-internal)
• --dns_conf.hosts.{*} (optional, body): DNS host mapping entries

⚠️ Note: --instance_id appears twice in parameters — once as path parameter (source instance), and once as body parameter (target instance for swr-pro-internal type). When using swr-pro-internal, both are needed.

2. List Instance Registries

# List all registries
hcloud SWR ListInstanceRegistries --instance_id=<instance-id> --cli-region=cn-north-4

# List registries with pagination
hcloud SWR ListInstanceRegistries --instance_id=<instance-id> --limit=20 --offset=0 --cli-region=cn-north-4

# Filter by name (fuzzy match)
hcloud SWR ListInstanceRegistries --instance_id=<instance-id> --name=harbor --cli-region=cn-north-4

# Filter by type
hcloud SWR ListInstanceRegistries --instance_id=<instance-id> --type=swr-pro --cli-region=cn-north-4

# Sort by updated time
hcloud SWR ListInstanceRegistries --instance_id=<instance-id> --order_column=updated_at --order_type=desc --cli-region=cn-north-4

Parameters:

• --instance_id (required, path): Instance ID
• --project_id (required, path, auto-filled): Project ID
• --limit (optional): Page size, default 10, max 100
• --offset (optional): Page offset, must be 0 or multiple of limit
• --name (optional): Filter by name (fuzzy)
• --type (optional): Filter by registry type
• --order_column (optional): created_at, updated_at, name (default created_at)
• --order_type (optional): desc, asc (default desc)

3. Show Instance Registry

hcloud SWR ShowInstanceRegistry --instance_id=<instance-id> --registry_id=<registry-id> --cli-region=cn-north-4

Parameters:

• --instance_id (required, path): Instance ID
• --registry_id (required, path): Registry ID (numeric)
• --project_id (required, path, auto-filled): Project ID

4. Update Instance Registry

hcloud SWR UpdateInstanceRegistry --instance_id=<instance-id> --registry_id=<registry-id> --name=updated-name --type=swr-pro --url=https://harbor.example.com --credential.type=basic --credential.access_key=<new-key> --credential.access_secret=<new-secret> --insecure=false --cli-region=cn-north-4

Parameters:

• Same as CreateInstanceRegistry, plus --registry_id (required, path) for identifying the registry to update
• All required body parameters from CreateInstanceRegistry must be provided even for partial updates

5. Delete Instance Registry

hcloud SWR DeleteInstanceRegistry --instance_id=<instance-id> --registry_id=<registry-id> --cli-region=cn-north-4

Parameters:

• --instance_id (required, path): Instance ID
• --registry_id (required, path): Registry ID (numeric)
• --project_id (required, path, auto-filled): Project ID

Instance Repository Operations

1. List Instance Repositories

# List all repositories in instance
hcloud SWR ListInstanceRepositories --instance_id=<instance-id> --cli-region=cn-north-4

# List repositories with pagination
hcloud SWR ListInstanceRepositories --instance_id=<instance-id> --limit=20 --offset=0 --cli-region=cn-north-4

# Filter by namespace
hcloud SWR ListInstanceRepositories --instance_id=<instance-id> --namespace_id=<ns-id> --cli-region=cn-north-4

# Sort by update time
hcloud SWR ListInstanceRepositories --instance_id=<instance-id> --order_column=updated_at --order_type=desc --cli-region=cn-north-4

Parameters:

• --instance_id (required, path): Instance ID
• --project_id (required, path, auto-filled): Project ID
• --namespace_id (optional): Filter by namespace ID (numeric)
• --limit (optional): Page size, default 10, max 100
• --offset (optional): Page offset, must be 0 or multiple of limit
• --order_column (optional): created_at, updated_at (default created_at)
• --order_type (optional): desc, asc (default desc)

2. List All Instance Repositories (Cross-Instance)

# List repositories across all instances in project
hcloud SWR ListAllInstanceRepositories --cli-region=cn-north-4

# Filter by name
hcloud SWR ListAllInstanceRepositories --name=my-app --cli-region=cn-north-4

# List with pagination using marker
hcloud SWR ListAllInstanceRepositories --limit=20 --marker=<next-marker> --cli-region=cn-north-4

Parameters:

• --project_id (required, path, auto-filled): Project ID
• --limit (optional): Page size, default 100, max 100
• --marker (optional): Pagination marker (use next_marker from previous response)
• --name (optional): Filter by repository name

⚠️ Note: ListAllInstanceRepositories uses --marker pagination instead of --offset/--limit.

3. Show Instance Repository

hcloud SWR ShowInstanceRepository --instance_id=<instance-id> --namespace_name=group-dev --repository_name=my-app --cli-region=cn-north-4

Parameters:

• --instance_id (required, path): Instance ID
• --namespace_name (required, path): Namespace name
• --repository_name (required, path): Repository name
• --project_id (required, path, auto-filled): Project ID

4. Update Instance Repository

hcloud SWR UpdateInstanceRepository --instance_id=<instance-id> --namespace_name=group-dev --repository_name=my-app --description="Updated repository description" --cli-region=cn-north-4

Parameters:

• --instance_id (required, path): Instance ID
• --namespace_name (required, path): Namespace name
• --repository_name (required, path): Repository name
• --description (required, body): New description
• --project_id (required, path, auto-filled): Project ID

5. Delete Instance Repository

hcloud SWR DeleteInstanceRepository --instance_id=<instance-id> --namespace_name=group-dev --repository_name=my-app --cli-region=cn-north-4

Parameters:

• --instance_id (required, path): Instance ID
• --namespace_name (required, path): Namespace name
• --repository_name (required, path): Repository name
• --project_id (required, path, auto-filled): Project ID

⚠️ Warning: This operation is irreversible. ALL artifacts in the repository will be permanently deleted.

Instance Artifact Operations

1. List Instance Artifacts

# List artifacts in a repository
hcloud SWR ListInstanceArtifacts --instance_id=<instance-id> --namespace_name=group-dev --repository_name=my-app --cli-region=cn-north-4

# List artifacts with pagination
hcloud SWR ListInstanceArtifacts --instance_id=<instance-id> --namespace_name=group-dev --repository_name=my-app --limit=20 --offset=0 --cli-region=cn-north-4

# Filter by type
hcloud SWR ListInstanceArtifacts --instance_id=<instance-id> --namespace_name=group-dev --repository_name=my-app --type=IMAGE --cli-region=cn-north-4

# Search by tag name
hcloud SWR ListInstanceArtifacts --instance_id=<instance-id> --namespace_name=group-dev --repository_name=my-app --tags=v1.0 --cli-region=cn-north-4

Parameters:

• --instance_id (required, path): Instance ID
• --namespace_name (required, path): Namespace name
• --repository_name (required, path): Repository name
• --project_id (required, path, auto-filled): Project ID
• --limit (optional): Page size, default 10, max 100
• --offset (optional): Page offset, must be 0 or multiple of limit
• --tags (optional): Fuzzy match on tag/version names
• --type (optional): Artifact type (IMAGE, CHART)

2. List All Instance Artifacts (Cross-Repository)

# List all artifacts across all repositories in instance
hcloud SWR ListInstanceAllArtifacts --instance_id=<instance-id> --cli-region=cn-north-4

# List with pagination
hcloud SWR ListInstanceAllArtifacts --instance_id=<instance-id> --limit=20 --marker=1 --cli-region=cn-north-4

Parameters:

• --instance_id (required, path): Instance ID
• --project_id (required, path, auto-filled): Project ID
• --limit (optional): Page size, default 10, max 100
• --marker (optional): Pagination marker (default 1)

⚠️ Note: ListInstanceAllArtifacts uses --marker pagination instead of --offset/--limit.

3. Show Instance Artifact

# Show artifact details
hcloud SWR ShowInstanceArtifact --instance_id=<instance-id> --namespace_name=group-dev --repository_name=my-app --reference=sha256:abc123... --cli-region=cn-north-4

# Show artifact with scan overview
hcloud SWR ShowInstanceArtifact --instance_id=<instance-id> --namespace_name=group-dev --repository_name=my-app --reference=sha256:abc123... --with_scan_overview=true --cli-region=cn-north-4

Parameters:

• --instance_id (required, path): Instance ID
• --namespace_name (required, path): Namespace name
• --reference (required, path): Artifact digest (SHA256 hash)
• --repository_name (required, path): Repository name
• --project_id (required, path, auto-filled): Project ID
• --with_scan_overview (optional, query): Include scan results (true/false)

4. Show Instance Artifact Addition (Build History)

hcloud SWR ShowInstanceArtifactAddition --instance_id=<instance-id> --namespace_name=group-dev --repository_name=my-app --reference=sha256:abc123... --addition=build_history --cli-region=cn-north-4

Parameters:

• --instance_id (required, path): Instance ID
• --namespace_name (required, path): Namespace name
• --reference (required, path): Artifact digest
• --repository_name (required, path): Repository name
• --addition (required, path): Addition type (build_history)
• --project_id (required, path, auto-filled): Project ID

5. List Instance Artifact Vulnerabilities

hcloud SWR ListInstanceArtifactVulnerabilities --instance_id=<instance-id> --namespace_name=group-dev --repository_name=my-app --reference=sha256:abc123... --cli-region=cn-north-4

Parameters:

• --instance_id (required, path): Instance ID
• --namespace_name (required, path): Namespace name
• --reference (required, path): Artifact digest
• --repository_name (required, path): Repository name
• --project_id (required, path, auto-filled): Project ID

6. Start Manual Scanning

hcloud SWR StartManualScanning --instance_id=<instance-id> --namespace_name=group-dev --repository_name=my-app --reference=sha256:abc123... --cli-region=cn-north-4

Parameters:

• --instance_id (required, path): Instance ID
• --namespace_name (required, path): Namespace name
• --reference (required, path): Artifact digest
• --repository_name (required, path): Repository name
• --project_id (required, path, auto-filled): Project ID

7. Delete Instance Artifact

hcloud SWR DeleteInstanceArtifact --instance_id=<instance-id> --namespace_name=group-dev --repository_name=my-app --reference=sha256:abc123... --cli-region=cn-north-4

Parameters:

• --instance_id (required, path): Instance ID
• --namespace_name (required, path): Namespace name
• --reference (required, path): Artifact digest
• --repository_name (required, path): Repository name
• --project_id (required, path, auto-filled): Project ID

⚠️ Warning: This operation is irreversible. The artifact (image version) will be permanently deleted.

Instance Credential Operations

1. Create Long-term Access Credential

hcloud SWR CreateInstanceLtCredential --instance_id=<instance-id> --name=my-credential --cli-region=cn-north-4

Parameters:

• --instance_id (required, path): Instance ID
• --name (required, body): Credential name, same naming rules as namespace (1-64 chars)
• --project_id (required, path, auto-filled): Project ID

Use Case: Long-term credentials for CI/CD pipelines and automation tools.

2. Create Temporary Access Credential

hcloud SWR CreateInstanceTempCredential --instance_id=<instance-id> --cli-region=cn-north-4

Parameters:

• --instance_id (required, path): Instance ID
• --project_id (required, path, auto-filled): Project ID

Use Case: Short-lived credentials for temporary access (e.g., developer testing).

3. List Long-term Credentials

# List all credentials (admin view)
hcloud SWR ListInstanceLtCredentials --instance_id=<instance-id> --cli-region=cn-north-4

# List only self-created credentials
hcloud SWR ListInstanceLtCredentials --instance_id=<instance-id> --self_only=true --cli-region=cn-north-4

# List with pagination
hcloud SWR ListInstanceLtCredentials --instance_id=<instance-id> --limit=20 --offset=0 --cli-region=cn-north-4

Parameters:

• --instance_id (required, path): Instance ID
• --project_id (required, path, auto-filled): Project ID
• --limit (optional): Page size, default 100, max 100
• --offset (optional): Page offset
• --self_only (optional): Only show self-created credentials (true/false)

4. Enable/Disable Long-term Credential

# Disable a credential
hcloud SWR UpdateInstanceLtCredential --instance_id=<instance-id> --credential_id=<cred-id> --enable=false --cli-region=cn-north-4

# Re-enable a credential
hcloud SWR UpdateInstanceLtCredential --instance_id=<instance-id> --credential_id=<cred-id> --enable=true --cli-region=cn-north-4

Parameters:

• --instance_id (required, path): Instance ID
• --credential_id (required, path): Credential ID (token_id)
• --enable (required, body): Enable/disable (true/false)
• --project_id (required, path, auto-filled): Project ID

5. Delete Long-term Credential

hcloud SWR DeleteInstanceLtCredential --instance_id=<instance-id> --credential_id=<cred-id> --cli-region=cn-north-4

Parameters:

• --instance_id (required, path): Instance ID
• --credential_id (required, path): Credential ID (token_id)
• --project_id (required, path, auto-filled): Project ID

Instance Endpoint Operations

1. Create Internal VPC Endpoint

hcloud SWR CreateInstanceInternalEndpoint --instance_id=<instance-id> --vpc_id=<vpc-id> --subnet_id=<subnet-id> --project_id=<vpc-project-id> --cli-region=cn-north-4

# Create with description
hcloud SWR CreateInstanceInternalEndpoint --instance_id=<instance-id> --vpc_id=<vpc-id> --subnet_id=<subnet-id> --project_id=<vpc-project-id> --description="Production VPC endpoint" --cli-region=cn-north-4

Parameters:

• --instance_id (required, path): Instance ID
• --vpc_id (required, body): VPC ID
• --subnet_id (required, body): Subnet ID
• --project_id (required, body): VPC/subnet project ID
• --description (optional, body): Endpoint description

⚠️ Note: --project_id appears as both path (auto-filled) and body parameter. The body --project_id specifies the project where the VPC/subnet resides.

2. List Internal Endpoints

hcloud SWR ListInstanceInternalEndpoints --instance_id=<instance-id> --cli-region=cn-north-4

# List with pagination
hcloud SWR ListInstanceInternalEndpoints --instance_id=<instance-id> --limit=20 --offset=0 --cli-region=cn-north-4

Parameters:

• --instance_id (required, path): Instance ID
• --project_id (required, path, auto-filled): Project ID
• --limit (optional): Page size, default 100, max 100
• --offset (optional): Page offset

3. Show Internal Endpoint

hcloud SWR ShowInstanceInternalEndpoint --instance_id=<instance-id> --internal_endpoints_id=<endpoint-id> --cli-region=cn-north-4

Parameters:

• --instance_id (required, path): Instance ID
• --internal_endpoints_id (required, path): Endpoint ID
• --project_id (required, path, auto-filled): Project ID

4. Delete Internal Endpoint

hcloud SWR DeleteInstanceInternalEndpoint --instance_id=<instance-id> --internal_endpoints_id=<endpoint-id> --cli-region=cn-north-4

Parameters:

• --instance_id (required, path): Instance ID
• --internal_endpoints_id (required, path): Endpoint ID
• --project_id (required, path, auto-filled): Project ID

5. Enable/Disable Public Access

# Enable public access
hcloud SWR CreateInstanceEndpointPolicy --instance_id=<instance-id> --enable=true --cli-region=cn-north-4

# Disable public access
hcloud SWR CreateInstanceEndpointPolicy --instance_id=<instance-id> --enable=false --cli-region=cn-north-4

Parameters:

• --instance_id (required, path): Instance ID
• --enable (required, body): Enable/disable (true/false)
• --project_id (required, path, auto-filled): Project ID

Status Constraints:

• Can only enable when status is Disable or EnableFailed
• Can only disable when status is Enable or DisableFailed

6. Show Public Access (Endpoint Policy)

hcloud SWR ShowInstanceEndpointPolicy --instance_id=<instance-id> --cli-region=cn-north-4

Parameters:

• --instance_id (required, path): Instance ID
• --project_id (required, path, auto-filled): Project ID

7. Update Public Access Whitelist

# Update whitelist (full replacement)
hcloud SWR UpdateInstanceEndpointPolicy --instance_id=<instance-id> --ip_list.1.ip=10.0.0.0/8 --ip_list.1.description="Internal network" --ip_list.2.ip=192.168.0.0/16 --ip_list.2.description="VPN access" --cli-region=cn-north-4

# Allow single IP
hcloud SWR UpdateInstanceEndpointPolicy --instance_id=<instance-id> --ip_list.1.ip=10.0.1.100 --ip_list.1.description="Build server" --cli-region=cn-north-4

Parameters:

• --instance_id (required, path): Instance ID
• --ip_list.[N].ip (required, body): IP or CIDR in indexed format
• --ip_list.[N].description (optional, body): Description in indexed format
• --project_id (required, path, auto-filled): Project ID

⚠️ Note: Whitelist update is full replacement — specifying new entries replaces all existing entries. To add entries, you must include all existing ones plus the new ones.

Instance Domain Operations

1. Add Domain Name

hcloud SWR AddDomainName --instance_id=<instance-id> --domain_name=registry.example.com --certificate_id=<scm-cert-id> --cli-region=cn-north-4

# Add wildcard domain
hcloud SWR AddDomainName --instance_id=<instance-id> --domain_name=*.registry.example.com --certificate_id=<scm-cert-id> --cli-region=cn-north-4

Parameters:

• --instance_id (required, path): Instance ID
• --domain_name (required, body): Domain name
• --certificate_id (required, body): SCM certificate ID
• --project_id (required, path, auto-filled): Project ID

Domain Naming Rules:

• Letters, digits, hyphens, and asterisks (wildcard only at start)
• Hyphens cannot be at start or end
• At least two strings separated by dots
• Each string max 63 chars
• Total length max 100 chars
• Examples: registry.example.com, *.registry.example.com

2. List Domain Names

# List all domains for an instance
hcloud SWR ListDomainNames --instance_id=<instance-id> --cli-region=cn-north-4

# Filter by domain name
hcloud SWR ListDomainNames --instance_id=<instance-id> --domain_name=registry.example.com --cli-region=cn-north-4

# Filter by domain ID
hcloud SWR ListDomainNames --instance_id=<instance-id> --uid=<domain-id> --cli-region=cn-north-4

Parameters:

• --instance_id (required, path): Instance ID
• --project_id (required, path, auto-filled): Project ID
• --domain_name (optional): Filter by domain name
• --uid (optional): Filter by domain ID

3. Show Domain Overview

hcloud SWR ShowDomainOverview --cli-region=cn-north-4

⚠️ Note: ShowDomainOverview is a tenant-level operation, not instance-specific. It returns overall domain overview for the current tenant.

4. Update Domain Name (Certificate)

hcloud SWR UpdateDomainName --instance_id=<instance-id> --domainname_id=<domain-id> --certificate_id=<new-scm-cert-id> --cli-region=cn-north-4

Parameters:

• --instance_id (required, path): Instance ID
• --domainname_id (required, path): Domain ID
• --certificate_id (required, body): New SCM certificate ID
• --project_id (required, path, auto-filled): Project ID

5. Delete Domain Name

hcloud SWR DeleteDomainName --instance_id=<instance-id> --domainname_id=<domain-id> --cli-region=cn-north-4

Parameters:

• --instance_id (required, path): Instance ID
• --domainname_id (required, path): Domain ID
• --project_id (required, path, auto-filled): Project ID

⚠️ Warning: The default domain assigned by SWR cannot be deleted. Only custom domains can be removed.

Instance Statistics and Job Operations

1. List Instance Statistics

hcloud SWR ListInstanceStatistics --instance_id=<instance-id> --cli-region=cn-north-4

Parameters:

• --instance_id (required, path): Instance ID
• --project_id (required, path, auto-filled): Project ID

Response: Response format needs verification — returns resource statistics for the instance.

2. List Instance Jobs

# List all jobs
hcloud SWR ListInstanceJobs --cli-region=cn-north-4

# Filter by status
hcloud SWR ListInstanceJobs --status=Success --cli-region=cn-north-4

# List with pagination
hcloud SWR ListInstanceJobs --limit=20 --offset=0 --cli-region=cn-north-4

Parameters:

• --project_id (required, path, auto-filled): Project ID
• --status (optional): Job status (Creating, Initializing, Running, Failed, Success)
• --limit (optional): Page size, default 100, max 100
• --offset (optional): Page offset

3. Show Instance Job

hcloud SWR ShowInstanceJob --job_id=<job-id> --cli-region=cn-north-4

Parameters:

• --job_id (required, path): Job ID
• --project_id (required, path, auto-filled): Project ID

4. Delete Instance Job

hcloud SWR DeleteInstanceJob --job_id=<job-id> --cli-region=cn-north-4

Parameters:

• --job_id (required, path): Job ID
• --project_id (required, path, auto-filled): Project ID

Common Region IDs

Common Errors

Related Documentation

• Huawei Cloud SWR Documentation
• hcloud CLI Documentation
• Huawei Cloud API Explorer

Task: Instance Artifacts

Overview

SWR enterprise instance artifacts represent image versions (tags) within repositories. Enterprise instances provide advanced artifact management including vulnerability scanning, build history viewing, and security blocking. This task covers listing, viewing, scanning, and deleting artifacts.

Operations Catalog

Workflows

W1: List Artifacts in a Repository

# List all artifacts in a repository
hcloud SWR ListInstanceArtifacts --instance_id=<instance-id> --namespace_name=group-dev --repository_name=my-app --cli-region=cn-north-4

# List artifacts with pagination
hcloud SWR ListInstanceArtifacts --instance_id=<instance-id> --namespace_name=group-dev --repository_name=my-app --limit=20 --offset=0 --cli-region=cn-north-4

# Filter by type (IMAGE or CHART)
hcloud SWR ListInstanceArtifacts --instance_id=<instance-id> --namespace_name=group-dev --repository_name=my-app --type=IMAGE --cli-region=cn-north-4

# Search by tag name (fuzzy match)
hcloud SWR ListInstanceArtifacts --instance_id=<instance-id> --namespace_name=group-dev --repository_name=my-app --tags=v1.0 --cli-region=cn-north-4

⚠️ Pagination Note: offset must be 0 or a multiple of limit (0, 20, 40...).

W2: List All Artifacts Across All Repositories

# List all artifacts in the instance
hcloud SWR ListInstanceAllArtifacts --instance_id=<instance-id> --cli-region=cn-north-4

# List with marker-based pagination
hcloud SWR ListInstanceAllArtifacts --instance_id=<instance-id> --limit=20 --marker=1 --cli-region=cn-north-4

# Next page
hcloud SWR ListInstanceAllArtifacts --instance_id=<instance-id> --limit=20 --marker=<next_marker> --cli-region=cn-north-4

⚠️ Note: ListInstanceAllArtifacts uses marker-based pagination (--marker/--limit), not offset/limit.

W3: View Artifact Details

# Show artifact details (basic)
hcloud SWR ShowInstanceArtifact --instance_id=<instance-id> --namespace_name=group-dev --repository_name=my-app --reference=sha256:abc123def456... --cli-region=cn-north-4

# Show artifact with vulnerability scan overview
hcloud SWR ShowInstanceArtifact --instance_id=<instance-id> --namespace_name=group-dev --repository_name=my-app --reference=sha256:abc123def456... --with_scan_overview=true --cli-region=cn-north-4

Key Fields (response format needs verification):

• Artifact digest (SHA256 hash)
• Artifact size
• Push time
• Vulnerability scan summary (when with_scan_overview=true)

⚠️ Important: --reference must be the artifact's SHA256 digest, NOT the tag name. Obtain the digest from ListInstanceArtifacts first.

W4: View Artifact Build History

hcloud SWR ShowInstanceArtifactAddition --instance_id=<instance-id> --namespace_name=group-dev --repository_name=my-app --reference=sha256:abc123def456... --addition=build_history --cli-region=cn-north-4

Use Cases:

• View Docker build history layers
• Check build commands and creation timestamps
• Debug image build issues

W5: View Artifact Vulnerabilities

hcloud SWR ListInstanceArtifactVulnerabilities --instance_id=<instance-id> --namespace_name=group-dev --repository_name=my-app --reference=sha256:abc123def456... --cli-region=cn-north-4

Use Cases:

• Review detailed vulnerability report for an artifact
• Identify specific CVEs affecting an image
• Determine which vulnerabilities need remediation
• Cross-reference with namespace blocking severity settings

W6: Start Manual Vulnerability Scan

hcloud SWR StartManualScanning --instance_id=<instance-id> --namespace_name=group-dev --repository_name=my-app --reference=sha256:abc123def456... --cli-region=cn-north-4

Use Cases:

• Re-scan an image after it was initially pushed without auto-scan
• Verify vulnerability status before promoting to production
• Trigger scan after updating vulnerability database

Note: If the namespace has metadata.auto_scan=true, images are automatically scanned on push. Manual scanning is needed only for images pushed before auto-scan was enabled, or for re-scanning.

W7: Delete an Artifact

⚠️ CAUTION: Deleting an artifact permanently removes the image version. This is irreversible.

Pre-deletion Checklist: 1. Verify artifact exists and get its digest:

hcloud SWR ListInstanceArtifacts --instance_id=<instance-id> --namespace_name=group-dev --repository_name=my-app --cli-region=cn-north-4

2. Check if artifact is still being used (pulled by running containers) 3. Confirm with the user that the artifact will be permanently deleted

hcloud SWR DeleteInstanceArtifact --instance_id=<instance-id> --namespace_name=group-dev --repository_name=my-app --reference=sha256:abc123def456... --cli-region=cn-north-4

Post-deletion Verification:

# Should return 404 or artifact should not appear in list
hcloud SWR ListInstanceArtifacts --instance_id=<instance-id> --namespace_name=group-dev --repository_name=my-app --cli-region=cn-north-4

Common Scenarios

S1: Security Audit for Production Images

Review vulnerability status of production images before deployment:

# 1. List artifacts in production namespace
hcloud SWR ListInstanceArtifacts --instance_id=<instance-id> --namespace_name=production --repository_name=my-app --type=IMAGE --cli-region=cn-north-4

# 2. For each artifact, check scan overview
hcloud SWR ShowInstanceArtifact --instance_id=<instance-id> --namespace_name=production --repository_name=my-app --reference=sha256:abc123... --with_scan_overview=true --cli-region=cn-north-4

# 3. If vulnerabilities exist, review detailed report
hcloud SWR ListInstanceArtifactVulnerabilities --instance_id=<instance-id> --namespace_name=production --repository_name=my-app --reference=sha256:abc123... --cli-region=cn-north-4

# 4. If artifact was not auto-scanned, trigger manual scan
hcloud SWR StartManualScanning --instance_id=<instance-id> --namespace_name=production --repository_name=my-app --reference=sha256:abc123... --cli-region=cn-north-4

S2: Image Cleanup and Storage Management

Periodically remove old image versions to manage storage:

# 1. List all artifacts sorted by update time
hcloud SWR ListInstanceArtifacts --instance_id=<instance-id> --namespace_name=group-dev --repository_name=my-app --cli-region=cn-north-4

# 2. Identify old/outdated artifacts

# 3. Delete outdated artifacts one by one
hcloud SWR DeleteInstanceArtifact --instance_id=<instance-id> --namespace_name=group-dev --repository_name=my-app --reference=sha256:old_digest... --cli-region=cn-north-4

# 4. Verify cleanup
hcloud SWR ListInstanceArtifacts --instance_id=<instance-id> --namespace_name=group-dev --repository_name=my-app --cli-region=cn-north-4

S3: Cross-Repository Artifact Search

Find specific artifacts across all repositories in the instance:

# Search across all repositories
hcloud SWR ListInstanceAllArtifacts --instance_id=<instance-id> --cli-region=cn-north-4

# Or search by tag name within a specific repository
hcloud SWR ListInstanceArtifacts --instance_id=<instance-id> --namespace_name=group-dev --repository_name=my-app --tags=v2.0 --cli-region=cn-north-4

S4: Pre-Deployment Vulnerability Check

Ensure an image is safe before deploying to production:

# 1. Get artifact digest
hcloud SWR ListInstanceArtifacts --instance_id=<instance-id> --namespace_name=staging --repository_name=my-app --tags=v2.1.0 --cli-region=cn-north-4

# 2. Check scan results
hcloud SWR ShowInstanceArtifact --instance_id=<instance-id> --namespace_name=staging --repository_name=my-app --reference=sha256:<digest> --with_scan_overview=true --cli-region=cn-north-4

# 3. If no scan results, trigger manual scan
hcloud SWR StartManualScanning --instance_id=<instance-id> --namespace_name=staging --repository_name=my-app --reference=sha256:<digest> --cli-region=cn-north-4

# 4. Review vulnerabilities
hcloud SWR ListInstanceArtifactVulnerabilities --instance_id=<instance-id> --namespace_name=staging --repository_name=my-app --reference=sha256:<digest> --cli-region=cn-north-4

# 5. If no blocking vulnerabilities, proceed with deployment

Task: Instance Credentials

Overview

SWR enterprise instance credentials provide authentication for accessing the instance registry via Docker CLI or other container tools. Enterprise instances support both long-term credentials (for CI/CD) and temporary credentials (for short-lived access). This task covers creating, listing, enabling/disabling, and deleting credentials.

Operations Catalog

Workflows

W1: Create a Long-term Access Credential

Long-term credentials are suitable for CI/CD pipelines, automation tools, and persistent access.

# Create a long-term credential
hcloud SWR CreateInstanceLtCredential --instance_id=<instance-id> --name=ci-pipeline --cli-region=cn-north-4

# Create credential for automation
hcloud SWR CreateInstanceLtCredential --instance_id=<instance-id> --name=automation-bot --cli-region=cn-north-4

# Create credential for a specific team
hcloud SWR CreateInstanceLtCredential --instance_id=<instance-id> --name=team-backend --cli-region=cn-north-4

Credential Naming Rules:

• Start with lowercase letter or digit
• Followed by lowercase letters, digits, dots, underscores, or hyphens
• Dots, underscores, hyphens cannot be directly connected
• End with lowercase letter or digit
• Length: 1-64 characters

Post-creation:

• Response format needs verification — returns credential information including authentication details
• Store the credential securely; the secret/token is only returned once during creation

⚠️ Security Warning: Never expose, log, or share credential secrets. Store them securely in CI/CD secret management tools.

W2: Create a Temporary Access Credential

Temporary credentials are suitable for short-lived access, developer testing, or one-time operations.

# Create a temporary credential
hcloud SWR CreateInstanceTempCredential --instance_id=<instance-id> --cli-region=cn-north-4

Use Cases:

• Developer testing for a limited time
• One-time image push or pull
• Debugging access issues

Post-creation:

• Response format needs verification — returns temporary authentication details
• Temporary credentials have limited validity period

W3: List Long-term Credentials

# List all long-term credentials (requires te_admin role)
hcloud SWR ListInstanceLtCredentials --instance_id=<instance-id> --cli-region=cn-north-4

# List only self-created credentials
hcloud SWR ListInstanceLtCredentials --instance_id=<instance-id> --self_only=true --cli-region=cn-north-4

# List with pagination
hcloud SWR ListInstanceLtCredentials --instance_id=<instance-id> --limit=20 --offset=0 --cli-region=cn-north-4

Use Cases:

• Audit all credentials in the instance
• Verify credential creation was successful
• Check credential enable/disable status
• Review who has access to the instance

⚠️ Note: --self_only=false (with te_admin role) lists ALL credentials. --self_only=true lists only the current user's credentials.

W4: Enable/Disable a Long-term Credential

# Disable a credential (pause access without deleting)
hcloud SWR UpdateInstanceLtCredential --instance_id=<instance-id> --credential_id=<cred-id> --enable=false --cli-region=cn-north-4

# Re-enable a credential
hcloud SWR UpdateInstanceLtCredential --instance_id=<instance-id> --credential_id=<cred-id> --enable=true --cli-region=cn-north-4

Common Use Cases:

• Temporarily disable credentials during security incidents
• Disable credentials for maintenance windows
• Re-enable after incident resolution
• Disable credentials of team members who have left

W5: Delete a Long-term Credential

hcloud SWR DeleteInstanceLtCredential --instance_id=<instance-id> --credential_id=<cred-id> --cli-region=cn-north-4

⚠️ Warning: Deleting a credential permanently removes it. Any systems using this credential will immediately lose access.

Best Practice: Disable the credential first (--enable=false) before deleting to ensure no active connections are disrupted.

# 1. Disable credential first (recommended)
hcloud SWR UpdateInstanceLtCredential --instance_id=<instance-id> --credential_id=<cred-id> --enable=false --cli-region=cn-north-4

# 2. Verify no active connections are affected

# 3. Delete credential
hcloud SWR DeleteInstanceLtCredential --instance_id=<instance-id> --credential_id=<cred-id> --cli-region=cn-north-4

Common Scenarios

S1: CI/CD Pipeline Credential Setup

Set up credentials for a CI/CD pipeline:

# 1. Create long-term credential for CI/CD
hcloud SWR CreateInstanceLtCredential --instance_id=<instance-id> --name=ci-cd-pipeline --cli-region=cn-north-4

# 2. Store the credential secret securely in CI/CD tool (e.g., Jenkins, GitLab CI secrets)

# 3. Use the credential in docker login:
# docker login -u <username_from_response> -p <password_from_response> <instance-endpoint>

# 4. Push images:
# docker push <instance-endpoint>/namespace/repository:tag

S2: Credential Rotation

Periodically rotate credentials for security:

# 1. Create a new credential
hcloud SWR CreateInstanceLtCredential --instance_id=<instance-id> --name=ci-cd-v2 --cli-region=cn-north-4

# 2. Update CI/CD pipeline to use the new credential

# 3. Disable the old credential
hcloud SWR UpdateInstanceLtCredential --instance_id=<instance-id> --credential_id=<old-cred-id> --enable=false --cli-region=cn-north-4

# 4. Verify new credential works correctly

# 5. Delete the old credential
hcloud SWR DeleteInstanceLtCredential --instance_id=<instance-id> --credential_id=<old-cred-id> --cli-region=cn-north-4

S3: Credential Audit

Review all credentials and their status:

# 1. List all credentials
hcloud SWR ListInstanceLtCredentials --instance_id=<instance-id> --cli-region=cn-north-4

# 2. Identify unused or stale credentials

# 3. Disable unused credentials
hcloud SWR UpdateInstanceLtCredential --instance_id=<instance-id> --credential_id=<unused-id> --enable=false --cli-region=cn-north-4

# 4. Delete obsolete credentials
hcloud SWR DeleteInstanceLtCredential --instance_id=<instance-id> --credential_id=<obsolete-id> --cli-region=cn-north-4

S4: Temporary Developer Access

Provide temporary access for a developer to test image operations:

# 1. Create temporary credential
hcloud SWR CreateInstanceTempCredential --instance_id=<instance-id> --cli-region=cn-north-4

# 2. Share the temporary credentials with the developer (via secure channel)

# 3. Developer uses credentials for docker login and push/pull operations

# 4. Temporary credentials expire automatically after the validity period

Task: Instance Domains

Overview

SWR enterprise instance domains provide custom access URLs for the container registry. Each instance has a default domain assigned by SWR, and you can add custom domains with SSL certificates from SCM (SSL Certificate Manager). This task covers adding, listing, viewing, updating, and deleting custom domains.

Operations Catalog

Workflows

W1: Add a Custom Domain

Pre-creation Checklist: 1. Obtain an SSL certificate from SCM (SSL Certificate Manager) for the domain 2. Get the SCM certificate ID 3. Configure DNS to point the domain to the instance endpoint 4. Verify the domain name follows naming rules

# Add a custom domain with SCM certificate
hcloud SWR AddDomainName --instance_id=<instance-id> --domain_name=registry.example.com --certificate_id=<scm-cert-id> --cli-region=cn-north-4

# Add a wildcard domain
hcloud SWR AddDomainName --instance_id=<instance-id> --domain_name=*.registry.example.com --certificate_id=<scm-cert-id> --cli-region=cn-north-4

# Add a domain for a specific subdomain
hcloud SWR AddDomainName --instance_id=<instance-id> --domain_name=swr.mycompany.cn --certificate_id=<scm-cert-id> --cli-region=cn-north-4

Domain Naming Rules:

• Letters, digits, hyphens, and asterisks (wildcard only at start)
• Hyphens cannot be at start or end of individual strings
• At least two strings separated by dots
• Each individual string max 63 characters
• Total length max 100 characters
• Wildcard (*) can only appear at the start (e.g., *.example.com)

Valid Examples: registry.example.com, *.registry.example.com, swr.mycompany.cn Invalid Examples: -registry.example.com (hyphen at start), registry-.example.com (hyphen at end), **.example.com (double wildcard)

SCM Certificate Requirements:

• The certificate must cover the domain name (exact match or wildcard)
• The certificate must be issued by a trusted CA
• The certificate must be active (not expired)

Post-creation:

• Configure DNS resolution: point the domain to the instance's public endpoint
• Verify domain resolves correctly before using it for docker operations

Post-creation Verification:

hcloud SWR ListDomainNames --instance_id=<instance-id> --cli-region=cn-north-4

W2: List Domain Names

# List all domains for an instance
hcloud SWR ListDomainNames --instance_id=<instance-id> --cli-region=cn-north-4

# Filter by domain name
hcloud SWR ListDomainNames --instance_id=<instance-id> --domain_name=registry.example.com --cli-region=cn-north-4

# Filter by domain ID
hcloud SWR ListDomainNames --instance_id=<instance-id> --uid=<domain-id> --cli-region=cn-north-4

Use Cases:

• Verify custom domain was added correctly
• Find domain ID for update/delete operations
• Check domain status (Active, Pending, etc.)
• Review all domains including the default domain

W3: View Domain Overview

hcloud SWR ShowDomainOverview --cli-region=cn-north-4

⚠️ Note: ShowDomainOverview is a tenant-level operation that returns overall domain overview for the current tenant, NOT specific to an instance. It provides a summary of domain configuration across the tenant's SWR resources.

W4: Update Domain Certificate

When the SSL certificate expires or needs to be replaced, update the domain with a new certificate:

# Update domain with new SCM certificate
hcloud SWR UpdateDomainName --instance_id=<instance-id> --domainname_id=<domain-id> --certificate_id=<new-scm-cert-id> --cli-region=cn-north-4

Common Use Cases:

• Replace expired SSL certificate
• Switch to a certificate from a different CA
• Update wildcard certificate coverage
• Renew certificate before expiration

Pre-update Checklist: 1. Obtain a new SCM certificate 2. Verify the new certificate covers the same domain name 3. Get the new SCM certificate ID

W5: Delete a Custom Domain

⚠️ Important: The default domain assigned by SWR (e.g., xxx.cn-north-4.myhuaweicloud.com) cannot be deleted. Only custom domains added via AddDomainName can be removed.

# Delete a custom domain
hcloud SWR DeleteDomainName --instance_id=<instance-id> --domainname_id=<domain-id> --cli-region=cn-north-4

Pre-deletion Checklist: 1. Verify no workloads are using the custom domain for image pull/push 2. Update DNS configuration if needed 3. Confirm with the user that the domain will be removed

Post-deletion Verification:

# Domain should not appear in list (only default domain remains)
hcloud SWR ListDomainNames --instance_id=<instance-id> --cli-region=cn-north-4

Common Scenarios

S1: Custom Domain Setup for Production

Set up a custom domain with HTTPS for a production registry:

# 1. Obtain SSL certificate from SCM for registry.mycompany.com
# (This is done via SCM console or CLI, not covered in this skill)

# 2. Add the custom domain to the instance
hcloud SWR AddDomainName --instance_id=<instance-id> --domain_name=registry.mycompany.com --certificate_id=<scm-cert-id> --cli-region=cn-north-4

# 3. Configure DNS: point registry.mycompany.com to instance's public endpoint
# (This is done via DNS provider, not covered in this skill)

# 4. Verify domain works for docker login:
# docker login registry.mycompany.com -u <username> -p <password>

# 5. Push images using custom domain:
# docker push registry.mycompany.com/namespace/repository:tag

S2: Certificate Renewal

Renew an expiring SSL certificate for a custom domain:

# 1. Obtain new certificate from SCM
# 2. Update domain with new certificate
hcloud SWR UpdateDomainName --instance_id=<instance-id> --domainname_id=<domain-id> --certificate_id=<new-scm-cert-id> --cli-region=cn-north-4

# 3. Verify domain still works
hcloud SWR ListDomainNames --instance_id=<instance-id> --domain_name=registry.mycompany.com --cli-region=cn-north-4

S3: Domain Audit and Cleanup

Review and manage domains periodically:

# 1. List all domains
hcloud SWR ListDomainNames --instance_id=<instance-id> --cli-region=cn-north-4

# 2. Review domain status and certificate expiration

# 3. Renew certificates for domains approaching expiration
hcloud SWR UpdateDomainName --instance_id=<instance-id> --domainname_id=<domain-id> --certificate_id=<new-cert-id> --cli-region=cn-north-4

# 4. Remove unused custom domains
hcloud SWR DeleteDomainName --instance_id=<instance-id> --domainname_id=<unused-domain-id> --cli-region=cn-north-4

# 5. Check tenant-level domain overview
hcloud SWR ShowDomainOverview --cli-region=cn-north-4