Huawei Cloud Swr Image Automation

Huawei Cloud SWR Image Automation

Overview

This skill provides image automation capabilities for Huawei Cloud SWR (Software Repository for Container) using the hcloud CLI, including cross-region image sync and trigger-based auto-deployment.

Architecture: hcloud CLI → SWR Service API → SyncRepo/Trigger/SyncJob/SyncRegion resources

Related Skills:

• huawei-cloud-swr-image-management - Image lifecycle management (namespaces, repos, tags, auth, quotas)
• huawei-cloud-swr-image-governance - Image governance (permissions, retention, sharing, tags, immutable rules)
• huawei-cloud-swr-enterprise-instance - Enterprise instance management

• Configure auto-sync to replicate images across regions on push
• Manually sync specific image tags to target regions
• List available sync target regions
• Check sync job execution status
• Create and manage triggers for auto-deploy to CCE/CCI workloads
• Enable/disable triggers and update trigger configurations

Typical Use Cases:

• "Set up auto-sync for my image repository to cn-east-3"
• "Manually sync image tags v1.0 and v2.0 to another region"
• "List available regions for image sync"
• "Check the status of my image sync job"
• "Create a trigger to auto-update my CCE deployment when a new image is pushed"
• "List all triggers for a repository"
• "Disable a trigger temporarily"
• "Delete an old trigger configuration"
• "Configure image replication across multiple regions"

Prerequisites

1. hcloud CLI Requirements (MANDATORY)

• hcloud CLI installed (version >= 7.2.2)
• Run hcloud version to verify installation
• First-time usage: printf "y\n" | hcloud version to accept privacy statement

2. Credential Configuration

hcloud CLI supports two credential modes via environment variables, automatically detected at runtime:

Mode A — Long-term AK/SK (permanent access):

export HUAWEI_CLOUD_AK=<your-ak>
export HUAWEI_CLOUD_SK=<your-sk>
export HUAWEI_CLOUD_REGION=cn-north-4

Mode B — Temporary AK/SK + SecurityToken (recommended for temporary or delegated access):

export HUAWEI_CLOUD_AK=<your-temp-ak>
export HUAWEI_CLOUD_SK=<your-temp-sk>
export HUAWEI_CLOUD_SECURITY_TOKEN=<your-security-token>
export HUAWEI_CLOUD_REGION=cn-north-4

When HUAWEI_CLOUD_SECURITY_TOKEN is present, hcloud CLI automatically uses temporary credential authentication. When only AK/SK are set, it uses long-term credential authentication.

• Security Rules:
• 🚫 Never expose AK/SK/SecurityToken values in code, conversation, or commands
• 🚫 Never use echo $HUAWEI_CLOUD_AK or echo $HUAWEI_CLOUD_SK to check credentials
• ✅ Use environment variables: HUAWEI_CLOUD_AK, HUAWEI_CLOUD_SK, HUAWEI_CLOUD_REGION, HUAWEI_CLOUD_SECURITY_TOKEN
• ✅ Prefer IAM users over root account for cloud operations
• ✅ Enable MFA for sensitive operations

⚠️ Important Security Notes:

• Never commit credentials to version control
• Use IAM users with minimal required permissions
• Enable MFA for sensitive operations
• Rotate AK/SK regularly

3. IAM Permission Requirements

See IAM Permission Policies for complete policy JSON.

Permission Failure Handling:

1. When any command fails due to permission errors, read references/iam-policies.md 2. Display the required permission list and policy JSON to the user 3. Guide the user to create a custom policy in the IAM console and grant authorization 4. Pause execution and wait for user confirmation that permissions have been granted

Core Commands

1. Auto Sync (Cross-region Image Replication)

See Task: Image Sync for detailed workflows.

# List available sync target regions
hcloud SWR ListSyncRegions --cli-region=cn-north-4

# Configure auto-sync for a repository to target region
hcloud SWR CreateImageSyncRepo --namespace=group-dev --repository=my-app --remoteRegionId=cn-east-3 --remoteNamespace=group-dev --override=false --syncAuto=true --cli-region=cn-north-4

# List auto-sync configurations for a repository
hcloud SWR ListImageAutoSyncReposDetails --namespace=group-dev --repository=my-app --cli-region=cn-north-4

# Delete auto-sync configuration
hcloud SWR DeleteImageSyncRepo --namespace=group-dev --repository=my-app --remoteRegionId=cn-east-3 --remoteNamespace=group-dev --cli-region=cn-north-4

Auto Sync Behavior: When syncAuto=true, every new image push to the source repository automatically triggers a sync to the target region. When syncAuto=false, sync only occurs on manual trigger.

2. Manual Sync

# Manually sync specific image tags to target region
hcloud SWR CreateManualImageSyncRepo --namespace=group-dev --repository=my-app --remoteRegionId=cn-east-3 --remoteNamespace=group-dev --imageTag.1=v1.0 --imageTag.2=v2.0 --override=false --cli-region=cn-north-4

⚠️ Important: --imageTag uses indexed array format, NOT plain value format:

• ✅ CORRECT: --imageTag.1=v1.0 --imageTag.2=v2.0
• ❌ WRONG: --imageTag=v1.0 (missing index)
• ❌ WRONG: --imageTag=v1.0,v2.0 (comma-separated not supported)

3. Sync Regions

# List all regions available as sync targets
hcloud SWR ListSyncRegions --cli-region=cn-north-4

Response Format (verified against actual API):

[
  {
    "regionID": "cn-north-4"
  }

Returns all regions where you can sync images. Use the regionID field value as the --remoteRegionId parameter.

4. Sync Job Status

# Check sync job status (--filter is REQUIRED with limit and offset)
hcloud SWR ShowSyncJob --namespace=group-dev --repository=my-app --filter="limit::10|offset::0" --cli-region=cn-north-4

⚠️ Important: --filter is required and must include both limit::N and offset::N (e.g., "limit::10|offset::0"). Without it, the command returns a missing parameter error.

Response format (verified against actual API): Returns a flat JSON array. Returns [] when no sync jobs exist.

5. Trigger Management (Auto-deploy to CCE/CCI)

See Task: Trigger Management for detailed workflows.

# Create a trigger for auto-deploy to CCE
hcloud SWR CreateTrigger --namespace=group-dev --repository=my-app --name=deploy-trigger --trigger_type=all --condition=".*" --action=update --app_type=deployments --application=my-deployment --cluster_ns=default --enable=true --trigger_mode=cce --cluster_id=<cluster-id> --cluster_name=<cluster-name> --cli-region=cn-north-4

# List all triggers for a repository
hcloud SWR ListTriggersDetails --namespace=group-dev --repository=my-app --cli-region=cn-north-4

# Show trigger details
hcloud SWR ShowTrigger --namespace=group-dev --repository=my-app --trigger=deploy-trigger --cli-region=cn-north-4

# Update a trigger (enable/disable or modify configuration)
hcloud SWR UpdateTrigger --namespace=group-dev --repository=my-app --trigger=deploy-trigger --enable=false --cli-region=cn-north-4

# Delete a trigger
hcloud SWR DeleteTrigger --namespace=group-dev --repository=my-app --trigger=deploy-trigger --cli-region=cn-north-4

Trigger Types:

• all: Trigger on any image push (condition=".*")
• tag: Trigger on specific tag push (condition=tag-name)
• regular: Trigger on tag matching regex (condition=regex-pattern)

Trigger Modes:

• cce: Deploy to CCE (Cloud Container Engine) cluster — requires --cluster_id
• cci: Deploy to CCI (Cloud Container Instance) — no cluster ID needed

Parameter Reference

Common Parameters

Auto Sync Parameters

Manual Sync Parameters

Trigger Parameters

Output Format

ListSyncRegions (verified)

Response is a flat JSON array of region objects:

[
  {
    "regionID": "cn-north-4",
    "region_name": "north-1"
  }
]

Note: Returns all available sync target regions. Use region_id as --remoteRegionId.

ListImageAutoSyncReposDetails

Response format to be verified — returns list of sync repo configurations when they exist. Returns empty when no auto sync configured.

ListTriggersDetails

Response format to be verified — returns list of trigger objects when they exist. Returns empty when no triggers configured.

ShowTrigger

Response format to be verified. Use --namespace, --repository, --trigger (trigger name) as parameters.

ShowSyncJob (verified)

Response is a flat JSON array. Returns [] when no sync jobs exist:

[]

Note: Requires --filter="limit::N|offset::N" parameter. See Sync Job Status for usage.

Verification

See Verification Method for step-by-step verification.

Common Region IDs

Best Practices

1. Auto-sync for production repos: Set syncAuto=true for production repositories to ensure images are automatically replicated to target regions 2. Manual sync for selective replication: Use CreateManualImageSyncRepo when you only need to sync specific tags (e.g., production releases) 3. Override caution: Only set override=true when you intentionally want to overwrite existing images in the target region 4. Trigger naming: Use descriptive trigger names (e.g., prod-deploy-trigger, staging-update-trigger) 5. Trigger condition design: Use trigger_type=regular with regex for flexible matching (e.g., v\d+\.\d+\.\d+ for semver tags) 6. Disable before delete: Disable a trigger (enable=false) before deleting to avoid unintended deployments during cleanup 7. Verify target namespace: Ensure the target namespace exists in the target region before creating sync configurations 8. Regional namespace alignment: Use identical namespace names across regions for easier cross-region management 9. Check sync regions first: Always run ListSyncRegions before creating sync configurations to verify the target region is available

Reference Documents

Notes

• Auto-sync is persistent — once configured, it automatically triggers on every new push until deleted
• Manual sync is one-time — each CreateManualImageSyncRepo invocation syncs specified tags once
• `--imageTag.[N]` uses indexed array format — NOT plain value or comma-separated
• Sync target namespace must exist — create the namespace in the target region before syncing
• AK/SK must never be hardcoded — credentials should only be obtained via environment variables
• hcloud CLI is the only supported method — all operations use hcloud SWR <Operation> format
• Trigger requires CCE/CCI cluster — triggers only work with existing CCE clusters or CCI instances
• Response formats pending verification — ListImageAutoSyncReposDetails, ListTriggersDetails, ShowTrigger response formats need live verification

Common Pitfalls

See Common Pitfalls & Solutions for detailed troubleshooting guides.

Quick Reference:

Common Pitfalls & Solutions

This document contains detailed troubleshooting guides for common issues encountered when using the Huawei Cloud SWR Image Automation skill.

Pitfall 1: --imageTag Array Format Wrong

Symptom: CreateManualImageSyncRepo fails with parameter validation error

Root Cause: The --imageTag parameter uses indexed array format, NOT plain value or comma-separated

Common Mistakes:

• ❌ --imageTag=v1.0 — missing index number
• ❌ --imageTag=v1.0,v2.0 — comma-separated not supported
• ❌ --imageTag.0=v1.0 — index starts from 1, not 0
• ❌ --imageTag.1=v1 --imageTag1=v2 — inconsistent format

Solution: Always use indexed array format starting from 1:

# ✅ CORRECT - Single tag
hcloud SWR CreateManualImageSyncRepo --namespace=group-dev --repository=my-app --remoteRegionId=cn-east-3 --remoteNamespace=group-dev --imageTag.1=v1.0 --cli-region=cn-north-4

# ✅ CORRECT - Multiple tags
hcloud SWR CreateManualImageSyncRepo --namespace=group-dev --repository=my-app --remoteRegionId=cn-east-3 --remoteNamespace=group-dev --imageTag.1=v1.0 --imageTag.2=v2.0 --cli-region=cn-north-4

Pitfall 2: Target Namespace Does Not Exist in Target Region

Symptom: CreateImageSyncRepo or CreateManualImageSyncRepo fails with namespace not found

Root Cause: The target namespace must exist in the target region before creating sync configurations

Solution: Create the namespace in the target region first:

# Create namespace in target region (using target region's cli-region)
hcloud SWR CreateNamespace --namespace=group-dev --cli-region=cn-east-3

# Then create sync configuration (using source region's cli-region)
hcloud SWR CreateImageSyncRepo --namespace=group-dev --repository=my-app --remoteRegionId=cn-east-3 --remoteNamespace=group-dev --syncAuto=true --cli-region=cn-north-4

Pitfall 3: Invalid remoteRegionId

Symptom: Sync creation fails with invalid region ID

Root Cause: The --remoteRegionId value must be a valid region returned by ListSyncRegions

Solution: Always verify the target region ID before creating sync:

# List available sync regions
hcloud SWR ListSyncRegions --cli-region=cn-north-4

# Use a valid region_id from the result as remoteRegionId
hcloud SWR CreateImageSyncRepo --namespace=group-dev --repository=my-app --remoteRegionId=cn-east-3 --remoteNamespace=group-dev --cli-region=cn-north-4

Pitfall 4: Auto-sync Replicates Unexpectedly

Symptom: Every image push triggers sync, causing unexpected images in target region

Root Cause: Auto-sync with syncAuto=true triggers on every push, including development/beta images

Solution:

• Use syncAuto=false for repos where you want manual control of what gets synced
• Alternatively, create a separate "release" repository with auto-sync, and only push production-ready images to it
• Delete auto-sync config if no longer needed:

# Delete unwanted auto-sync
hcloud SWR DeleteImageSyncRepo --namespace=group-dev --repository=my-app --remoteRegionId=cn-east-3 --remoteNamespace=group-dev --cli-region=cn-north-4

Pitfall 5: override=true Overwrites Production Images

Symptom: Production images in target region are accidentally overwritten by older/different versions

Root Cause: Setting override=true causes existing images in the target region to be replaced

Solution:

• Default to override=false for safety
• Only use override=true when you intentionally want to update images (e.g., patch releases)
• Before using override=true, verify what images exist in the target region:

# Check existing images in target region (use target region's cli-region)
hcloud SWR ListRepositoryTags --namespace=group-dev --repository=my-app --cli-region=cn-east-3

Pitfall 6: CCE Cluster ID Required But Not Provided

Symptom: CreateTrigger fails for CCE mode when --cluster_id is missing

Root Cause: CCE trigger mode requires --cluster_id; without it, the trigger cannot locate the target cluster

Solution:

• For CCE mode: always provide --cluster_id (obtain from CCE console)
• For CCI mode: omit --cluster_id (CCI doesn't use cluster IDs)

# ✅ CORRECT - CCE mode with cluster_id
hcloud SWR CreateTrigger --namespace=group-dev --repository=my-app --name=cce-trigger --trigger_type=all --condition=".*" --action=update --app_type=deployments --application=my-deployment --cluster_ns=default --enable=true --trigger_mode=cce --cluster_id=<cluster-id> --cli-region=cn-north-4

# ✅ CORRECT - CCI mode (no cluster_id)
hcloud SWR CreateTrigger --namespace=group-dev --repository=my-app --name=cci-trigger --trigger_type=all --condition=".*" --action=update --app_type=deployments --application=my-cci-app --cluster_ns=default --enable=true --trigger_mode=cci --cli-region=cn-north-4

Pitfall 7: Trigger Name Already Exists

Symptom: CreateTrigger returns 409 Conflict

Root Cause: Trigger names must be unique within a repository

Solution: Check existing triggers before creating:

# Check existing triggers
hcloud SWR ListTriggersDetails --namespace=group-dev --repository=my-app --cli-region=cn-north-4

# Or check a specific trigger name
hcloud SWR ShowTrigger --namespace=group-dev --repository=my-app --trigger=deploy-trigger --cli-region=cn-north-4

Pitfall 8: Trigger Condition Format Errors

Symptom: Trigger doesn fire as expected or fails creation

Root Cause: Wrong --condition format for the chosen --trigger_type

Condition Rules:

• trigger_type=all: condition must be .*
• trigger_type=tag: condition is exact tag name (e.g., v2.0)
• trigger_type=regular: condition is regex pattern (e.g., v\d+\.\d+)

Common Mistakes:

• ❌ trigger_type=all with condition=v1.0 — should use .*
• ❌ trigger_type=regular with condition=v1.0 — should use regex pattern
• ❌ trigger_type=tag with condition=.* — should use exact tag name

Solution: Match condition format to trigger type:

# All pushes
hcloud SWR CreateTrigger --trigger_type=all --condition=".*" ...

# Specific tag
hcloud SWR CreateTrigger --trigger_type=tag --condition=v2.0 ...

# Regex pattern (semver)
hcloud SWR CreateTrigger --trigger_type=regular --condition="v\d+\.\d+" ...

Pitfall 9: Sync Job Status Check Missing Parameters

Symptom: ShowSyncJob returns unexpected results or errors

Root Cause: Missing required path parameters

Solution: Always provide namespace and repository:

# ✅ CORRECT
hcloud SWR ShowSyncJob --namespace=group-dev --repository=my-app --cli-region=cn-north-4

# ❌ WRONG - missing namespace
hcloud SWR ShowSyncJob --repository=my-app --cli-region=cn-north-4

Pitfall 10: Deleting Sync Configuration Does Not Delete Synced Images

Symptom: Images remain in target region after deleting sync configuration

Root Cause: DeleteImageSyncRepo only removes the sync configuration, not the already-synced images

Solution: If you need to remove synced images, delete them separately in the target region:

# Delete tags in target region (use target region's cli-region)
hcloud SWR DeleteRepoTag --namespace=group-dev --repository=my-app --tag=v1.0 --cli-region=cn-east-3

Common Error Response Reference

IAM Permission Policies - SWR Image Automation Skill

Overview

This document declares the IAM permissions required by the Huawei Cloud SWR Image Automation skill. All permissions follow the principle of least privilege.

Read-Only Operations

Write Operations (Require Additional Authorization)

Minimum Read-Only Policy (JSON)

{
  "Version": "1.1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "swr:syncregion:list",
        "swr:sync:list",
        "swr:syncjob:get",
        "swr:trigger:list",
        "swr:trigger:get"
      ],
      "Resource": ["*"]
    }
  ]
}

Full Automation Policy (JSON)

{
  "Version": "1.1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "swr:syncregion:list",
        "swr:sync:list",
        "swr:sync:create",
        "swr:sync:delete",
        "swr:syncmanual:create",
        "swr:syncjob:get",
        "swr:trigger:list",
        "swr:trigger:get",
        "swr:trigger:create",
        "swr:trigger:update",
        "swr:trigger:delete"
      ],
      "Resource": ["*"]
    }
  ]
}

Permission Assignment Steps

1. Log in to Huawei Cloud IAM console: https://console.huaweicloud.com/iam/ 2. Navigate to Policies → Create Custom Policy 3. Choose JSON mode and paste the policy JSON above 4. Navigate to Users / User Groups → Authorize 5. Select the custom policy and confirm

Permission Failure Handling

When a command fails with a permission error:

1. Read this document (references/iam-policies.md) 2. Display the required permission list and policy JSON to the user 3. Guide the user to create a custom policy in the IAM console 4. Pause execution and wait for user confirmation that permissions have been granted 5. Retry the failed command

SWR Automation API Reference Guide

Overview

This document provides API reference information for Huawei Cloud SWR automation operations using hcloud CLI. All commands follow the standard format: hcloud SWR <Operation> --param=value --cli-region=<region>.

Authentication

Environment Variables

export HUAWEI_CLOUD_AK=<your-ak>
export HUAWEI_CLOUD_SK=<your-sk>

hcloud CLI Configuration

# Interactive configuration
hcloud configure

# Verify configuration (safe - does not expose values)
hcloud configure list

✅ Correct: Use hcloud configure list to verify credentials ❌ Incorrect: Never use echo $HUAWEI_CLOUD_AK to check credentials

Sync Region Operations

1. List Available Sync Regions

hcloud SWR ListSyncRegions --cli-region=cn-north-4

Parameters:

• --cli-region (required): Source region ID

Response Example (verified against actual API — flat array):

[
  {
    "regionID": "cn-north-4"
  }
]

Key Fields:

• regionID (not region_id): Region identifier (use as --remoteRegionId in sync operations)
• region_name: Human-readable region name
• Response is a flat array (not wrapped in an object)

Note: Returns all regions where cross-region sync is available. The source region is determined by --cli-region.

Auto Sync Operations

1. Create Auto Sync Configuration

# Configure auto-sync (automatically sync on new push)
hcloud SWR CreateImageSyncRepo --namespace=group-dev --repository=my-app --remoteRegionId=cn-east-3 --remoteNamespace=group-dev --syncAuto=true --override=false --cli-region=cn-north-4

# Configure manual-only sync (no auto-trigger)
hcloud SWR CreateImageSyncRepo --namespace=group-dev --repository=my-app --remoteRegionId=cn-east-3 --remoteNamespace=group-dev --syncAuto=false --override=false --cli-region=cn-north-4

Parameters:

• --namespace (required, path): Source organization/namespace
• --repository (required, path): Source repository
• --remoteRegionId (required, body): Target region ID (must be from ListSyncRegions)
• --remoteNamespace (required, body): Target organization/namespace in target region
• --override (optional, body): Overwrite existing images in target (true/false, default false)
• --syncAuto (optional, body): Auto sync on new push (true/false, default false)
• --cli-region (required): Source region ID

Auto Sync Behavior:

• syncAuto=true: Every new image push to source repo automatically triggers sync to target
• syncAuto=false: Sync configuration exists but requires manual trigger via CreateManualImageSyncRepo

2. List Auto Sync Configurations

hcloud SWR ListImageAutoSyncReposDetails --namespace=group-dev --repository=my-app --cli-region=cn-north-4

Parameters:

• --namespace (required, path): Source namespace
• --repository (required, path): Source repository
• --cli-region (required): Source region ID

Response: Returns list of sync repo configurations when they exist. Returns empty when no auto sync configured. Response format to be verified.

3. Delete Auto Sync Configuration

hcloud SWR DeleteImageSyncRepo --namespace=group-dev --repository=my-app --remoteRegionId=cn-east-3 --remoteNamespace=group-dev --cli-region=cn-north-4

Parameters:

• --namespace (required, path): Source namespace
• --repository (required, path): Source repository
• --remoteRegionId (required): Target region ID
• --remoteNamespace (required): Target namespace
• --cli-region (required): Source region ID

⚠️ Warning: Deleting auto-sync configuration stops automatic replication. Existing synced images in the target region are NOT deleted.

Manual Sync Operations

1. Create Manual Image Sync

# Sync specific tags to target region
hcloud SWR CreateManualImageSyncRepo --namespace=group-dev --repository=my-app --remoteRegionId=cn-east-3 --remoteNamespace=group-dev --imageTag.1=v1.0 --imageTag.2=v2.0 --override=false --cli-region=cn-north-4

# Sync a single tag
hcloud SWR CreateManualImageSyncRepo --namespace=group-dev --repository=my-app --remoteRegionId=cn-east-3 --remoteNamespace=group-dev --imageTag.1=v1.0 --cli-region=cn-north-4

# Sync with override (overwrite existing images)
hcloud SWR CreateManualImageSyncRepo --namespace=group-dev --repository=my-app --remoteRegionId=cn-east-3 --remoteNamespace=group-dev --imageTag.1=latest --override=true --cli-region=cn-north-4

Parameters:

• --namespace (required, path): Source namespace
• --repository (required, path): Source repository
• --remoteRegionId (required, body): Target region ID
• --remoteNamespace (required, body): Target namespace in target region
• --imageTag.[N] (required, body): Tag list in indexed array format (--imageTag.1=v1.0 --imageTag.2=v2.0)
• --override (optional, body): Overwrite existing images (true/false, default false)
• --cli-region (required): Source region ID

⚠️ Critical: `--imageTag` Array Format:

• ✅ CORRECT: --imageTag.1=v1.0 --imageTag.2=v2.0 (indexed, starts from 1)
• ❌ WRONG: --imageTag=v1.0 (missing index number)
• ❌ WRONG: --imageTag=v1.0,v2.0 (comma-separated not supported)
• ❌ WRONG: --imageTag.0=v1.0 (index starts from 1, not 0)

Manual Sync Behavior: This is a one-time operation. It syncs the specified tags immediately and does not set up any ongoing replication.

Sync Job Status Operations

1. Show Sync Job Status

hcloud SWR ShowSyncJob --namespace=group-dev --repository=my-app --cli-region=cn-north-4

Parameters:

• --namespace (required, path): Source namespace
• --repository (required, path): Source repository
• Other filtering parameters available (run hcloud SWR ShowSyncJob --help for details)
• --cli-region (required): Region ID

Response: Response format to be verified. Use --help for complete parameter list.

Trigger Operations

1. Create Trigger

# Create trigger for auto-deploy to CCE (all pushes)
hcloud SWR CreateTrigger --namespace=group-dev --repository=my-app --name=deploy-trigger --trigger_type=all --condition=".*" --action=update --app_type=deployments --application=my-deployment --cluster_ns=default --enable=true --trigger_mode=cce --cluster_id=<cluster-id> --cluster_name=<cluster-name> --cli-region=cn-north-4

# Create trigger for specific tag pattern (semver)
hcloud SWR CreateTrigger --namespace=group-dev --repository=my-app --name=prod-trigger --trigger_type=regular --condition="v\d+\.\d+\.\d+" --action=update --app_type=deployments --application=my-deployment --cluster_ns=default --enable=true --trigger_mode=cce --cluster_id=<cluster-id> --cli-region=cn-north-4

# Create trigger for specific tag name
hcloud SWR CreateTrigger --namespace=group-dev --repository=my-app --name=release-trigger --trigger_type=tag --condition=v2.0 --action=update --app_type=deployments --application=my-deployment --cluster_ns=default --enable=true --trigger_mode=cce --cluster_id=<cluster-id> --cli-region=cn-north-4

# Create trigger for CCI (no cluster_id needed)
hcloud SWR CreateTrigger --namespace=group-dev --repository=my-app --name=cci-trigger --trigger_type=all --condition=".*" --action=update --app_type=deployments --application=my-cci-app --cluster_ns=default --enable=true --trigger_mode=cci --cli-region=cn-north-4

Parameters:

• --namespace (required, path): SWR namespace
• --repository (required, path): Image repository
• --name (required, body): Trigger name (unique within repository)
• --trigger_type (required, body): Trigger type (all, tag, regular)
• --condition (required, body): Match condition (.* for all, tag name, regex pattern)
• --action (required, body): Action type (update)
• --app_type (required, body): Application type (deployments or statefulsets)
• --application (required, body): CCE/CCI application (deployment) name
• --cluster_ns (required, body): Application namespace (Kubernetes namespace)
• --enable (required, body): Enable state (true or false)
• --trigger_mode (optional, body): Deploy target (cce or cci, default cce)
• --cluster_id (optional): CCE cluster ID (required for cce mode, empty for cci)
• --cluster_name (optional): CCE cluster name
• --container (optional): Specific container to update (default: all containers)
• --cli-region (required): Region ID

Trigger Type Details:

• all: Matches any image push. Condition must be .*
• tag: Matches exact tag name. Condition is the specific tag (e.g., v2.0)
• regular: Matches regex pattern. Condition is a regex (e.g., v\d+\.\d+)

Trigger Mode Details:

• cce: Updates a workload in a CCE (Cloud Container Engine) cluster. Requires cluster_id
• cci: Updates a workload in CCI (Cloud Container Instance). No cluster ID needed

2. List Triggers

hcloud SWR ListTriggersDetails --namespace=group-dev --repository=my-app --cli-region=cn-north-4

Parameters:

• --namespace (required, path): SWR namespace
• --repository (required, path): Image repository
• --cli-region (required): Region ID

Response: Returns list of trigger objects when they exist. Returns empty when no triggers configured. Response format to be verified.

3. Show Trigger Details

hcloud SWR ShowTrigger --namespace=group-dev --repository=my-app --trigger=deploy-trigger --cli-region=cn-north-4

Parameters:

• --namespace (required, path): SWR namespace
• --repository (required, path): Image repository
• --trigger (required, path): Trigger name
• --cli-region (required): Region ID

Response: Response format to be verified.

4. Update Trigger

# Disable a trigger
hcloud SWR UpdateTrigger --namespace=group-dev --repository=my-app --trigger=deploy-trigger --enable=false --cli-region=cn-north-4

# Enable a trigger
hcloud SWR UpdateTrigger --namespace=group-dev --repository=my-app --trigger=deploy-trigger --enable=true --cli-region=cn-north-4

Parameters:

• --namespace (required, path): SWR namespace
• --repository (required, path): Image repository
• --trigger (required, path): Trigger name
• --enable (optional, body): Enable state (true/false)
• --cli-region (required): Region ID

Note: Run hcloud SWR UpdateTrigger --help for complete updateable parameters.

5. Delete Trigger

hcloud SWR DeleteTrigger --namespace=group-dev --repository=my-app --trigger=deploy-trigger --cli-region=cn-north-4

Parameters:

• --namespace (required, path): SWR namespace
• --repository (required, path): Image repository
• --trigger (required, path): Trigger name
• --cli-region (required): Region ID

⚠️ Warning: Deleting a trigger permanently removes the auto-deploy configuration.

Common Region IDs

Common Errors

Related Documentation

• Huawei Cloud SWR Documentation
• hcloud CLI Documentation
• Huawei Cloud API Explorer

Task: Image Sync

Overview

SWR image sync enables cross-region image replication. You can configure auto-sync to automatically replicate images on every push, or manually sync specific tags. This task covers auto-sync configuration, manual sync, available sync regions, and sync job status.

Operations Catalog

Workflows

W1: Check Available Sync Regions

Before setting up any sync, verify which regions are available as targets:

# List all available sync target regions
hcloud SWR ListSyncRegions --cli-region=cn-north-4

Output Fields (verified against actual API — flat array):

• `regionID: Region identifier (use as --remoteRegionId`)
• region_name: Human-readable region name
• Response is a flat array of region objects (not wrapped)

W2: Configure Auto-sync for a Repository

Set up automatic image replication across regions:

Pre-creation Checklist: 1. Verify target region is available: hcloud SWR ListSyncRegions --cli-region=cn-north-4 2. Ensure target namespace exists in target region:

hcloud SWR CreateNamespace --namespace=group-dev --cli-region=cn-east-3

3. Verify source repository exists:

hcloud SWR ShowRepository --namespace=group-dev --repository=my-app --cli-region=cn-north-4

# Configure auto-sync (automatically sync on every new push)
hcloud SWR CreateImageSyncRepo --namespace=group-dev --repository=my-app --remoteRegionId=cn-east-3 --remoteNamespace=group-dev --syncAuto=true --override=false --cli-region=cn-north-4

# Configure sync without auto-trigger (manual sync only)
hcloud SWR CreateImageSyncRepo --namespace=group-dev --repository=my-app --remoteRegionId=cn-east-3 --remoteNamespace=group-dev --syncAuto=false --override=false --cli-region=cn-north-4

Parameters:

• --syncAuto=true: Every push triggers automatic sync to target region
• --syncAuto=false: Sync config exists but only triggers manually
• --override=true: Overwrite existing images in target region
• --override=false: Skip images that already exist in target

Post-creation Verification:

hcloud SWR ListImageAutoSyncReposDetails --namespace=group-dev --repository=my-app --cli-region=cn-north-4

W3: View Auto-sync Configurations

# List all auto-sync configurations for a repository
hcloud SWR ListImageAutoSyncReposDetails --namespace=group-dev --repository=my-app --cli-region=cn-north-4

Use Cases:

• Verify which regions a repository is syncing to
• Check whether auto-sync is enabled or manual-only
• Audit cross-region replication setup

W4: Manually Sync Specific Tags

Manually replicate specific image tags to a target region:

Pre-sync Checklist: 1. Verify source tags exist:

hcloud SWR ListRepositoryTags --namespace=group-dev --repository=my-app --cli-region=cn-north-4

2. Ensure target namespace exists:

hcloud SWR ShowNamespace --namespace=group-dev --cli-region=cn-east-3

# Sync a single tag
hcloud SWR CreateManualImageSyncRepo --namespace=group-dev --repository=my-app --remoteRegionId=cn-east-3 --remoteNamespace=group-dev --imageTag.1=v1.0 --override=false --cli-region=cn-north-4

# Sync multiple tags
hcloud SWR CreateManualImageSyncRepo --namespace=group-dev --repository=my-app --remoteRegionId=cn-east-3 --remoteNamespace=group-dev --imageTag.1=v1.0 --imageTag.2=v2.0 --override=false --cli-region=cn-north-4

# Sync with override (replace existing images)
hcloud SWR CreateManualImageSyncRepo --namespace=group-dev --repository=my-app --remoteRegionId=cn-east-3 --remoteNamespace=group-dev --imageTag.1=latest --override=true --cli-region=cn-north-4

⚠️ Critical: --imageTag uses indexed array format:

• ✅ --imageTag.1=v1.0 --imageTag.2=v2.0 (correct)
• ❌ --imageTag=v1.0 (missing index)
• ❌ --imageTag=v1.0,v2.0 (comma not supported)

Note: Manual sync is a one-time operation. It does not set up ongoing replication.

W5: Check Sync Job Status

# Check status of sync jobs for a repository
hcloud SWR ShowSyncJob --namespace=group-dev --repository=my-app --cli-region=cn-north-4

Use Cases:

• Verify whether a sync completed successfully
• Check if a manual sync job is still running
• Troubleshoot failed sync operations

W6: Delete Auto-sync Configuration

⚠️ Note: Deleting sync config stops automatic replication but does NOT delete already-synced images.

hcloud SWR DeleteImageSyncRepo --namespace=group-dev --repository=my-app --remoteRegionId=cn-east-3 --remoteNamespace=group-dev --cli-region=cn-north-4

Post-deletion Verification:

# Should no longer show the sync config
hcloud SWR ListImageAutoSyncReposDetails --namespace=group-dev --repository=my-app --cli-region=cn-north-4

Common Scenarios

S1: Multi-region DR Setup

Set up cross-region replication for disaster recovery:

# 1. Create target namespace in each DR region
hcloud SWR CreateNamespace --namespace=group-dev --cli-region=cn-east-3
hcloud SWR CreateNamespace --namespace=group-dev --cli-region=ap-southeast-1

# 2. Configure auto-sync to each DR region
hcloud SWR CreateImageSyncRepo --namespace=group-dev --repository=my-app --remoteRegionId=cn-east-3 --remoteNamespace=group-dev --syncAuto=true --override=true --cli-region=cn-north-4
hcloud SWR CreateImageSyncRepo --namespace=group-dev --repository=my-app --remoteRegionId=ap-southeast-1 --remoteNamespace=group-dev --syncAuto=true --override=true --cli-region=cn-north-4

# 3. Verify sync configurations
hcloud SWR ListImageAutoSyncReposDetails --namespace=group-dev --repository=my-app --cli-region=cn-north-4

S2: Selective Production Release Sync

Only sync production-ready tags to target regions:

# 1. Configure sync WITHOUT auto-trigger
hcloud SWR CreateImageSyncRepo --namespace=group-dev --repository=my-app --remoteRegionId=cn-east-3 --remoteNamespace=group-dev --syncAuto=false --override=false --cli-region=cn-north-4

# 2. Manually sync only production tags
hcloud SWR CreateManualImageSyncRepo --namespace=group-dev --repository=my-app --remoteRegionId=cn-east-3 --remoteNamespace=group-dev --imageTag.1=v2.1.0-stable --cli-region=cn-north-4

# 3. Verify sync status
hcloud SWR ShowSyncJob --namespace=group-dev --repository=my-app --cli-region=cn-north-4

S3: Regional Namespace Alignment

Use identical namespace names across regions for easy management:

# Create matching namespaces in multiple regions
hcloud SWR CreateNamespace --namespace=group-dev --cli-region=cn-north-4
hcloud SWR CreateNamespace --namespace=group-dev --cli-region=cn-east-3
hcloud SWR CreateNamespace --namespace=group-dev --cli-region=ap-southeast-1

# Set up sync with same namespace name
hcloud SWR CreateImageSyncRepo --namespace=group-dev --repository=my-app --remoteRegionId=cn-east-3 --remoteNamespace=group-dev --syncAuto=true --cli-region=cn-north-4

Task: Trigger Management

Overview

SWR triggers enable automatic deployment updates when new images are pushed. A trigger watches a repository for new image pushes matching a condition, and automatically updates a CCE or CCI workload. This task covers creating, querying, updating, and deleting triggers.

Operations Catalog

Workflows

W1: Create a Trigger

Set up auto-deploy to a CCE workload when new images are pushed:

Pre-creation Checklist: 1. Verify repository exists:

hcloud SWR ShowRepository --namespace=group-dev --repository=my-app --cli-region=cn-north-4

2. Obtain CCE cluster ID from CCE console 3. Verify deployment exists in the CCE cluster 4. Decide trigger type and condition

# Create trigger for ALL image pushes to CCE deployment
hcloud SWR CreateTrigger --namespace=group-dev --repository=my-app --name=deploy-trigger --trigger_type=all --condition=".*" --action=update --app_type=deployments --application=my-deployment --cluster_ns=default --enable=true --trigger_mode=cce --cluster_id=<cluster-id> --cluster_name=<cluster-name> --cli-region=cn-north-4

# Create trigger for specific tag pushes (only v2.0)
hcloud SWR CreateTrigger --namespace=group-dev --repository=my-app --name=release-trigger --trigger_type=tag --condition=v2.0 --action=update --app_type=deployments --application=my-deployment --cluster_ns=default --enable=true --trigger_mode=cce --cluster_id=<cluster-id> --cli-region=cn-north-4

# Create trigger for semver tag pattern
hcloud SWR CreateTrigger --namespace=group-dev --repository=my-app --name=semver-trigger --trigger_type=regular --condition="v\d+\.\d+\.\d+" --action=update --app_type=deployments --application=my-deployment --cluster_ns=default --enable=true --trigger_mode=cce --cluster_id=<cluster-id> --cli-region=cn-north-4

# Create trigger for StatefulSet
hcloud SWR CreateTrigger --namespace=group-dev --repository=my-app --name=sts-trigger --trigger_type=all --condition=".*" --action=update --app_type=statefulsets --application=my-statefulset --cluster_ns=default --enable=true --trigger_mode=cce --cluster_id=<cluster-id> --cli-region=cn-north-4

# Create trigger for CCI (no cluster_id)
hcloud SWR CreateTrigger --namespace=group-dev --repository=my-app --name=cci-trigger --trigger_type=all --condition=".*" --action=update --app_type=deployments --application=my-cci-app --cluster_ns=default --enable=true --trigger_mode=cci --cli-region=cn-north-4

# Create trigger targeting a specific container only
hcloud SWR CreateTrigger --namespace=group-dev --repository=my-app --name=container-trigger --trigger_type=all --condition=".*" --action=update --app_type=deployments --application=my-deployment --cluster_ns=default --enable=true --trigger_mode=cce --cluster_id=<cluster-id> --container=my-sidecar --cli-region=cn-north-4

Trigger Parameters:

• --trigger_type: all (any push), tag (exact tag), regular (regex match)
• --condition: Must match trigger_type — .* for all, tag name for tag, regex for regular
• --app_type: deployments or statefulsets
• --trigger_mode: cce (CCE cluster, requires cluster_id) or cci (CCI instance)
• --container: Optional — target specific container within multi-container pods

Post-creation Verification:

hcloud SWR ShowTrigger --namespace=group-dev --repository=my-app --trigger=deploy-trigger --cli-region=cn-north-4

W2: List All Triggers

# List triggers for a repository
hcloud SWR ListTriggersDetails --namespace=group-dev --repository=my-app --cli-region=cn-north-4

Use Cases:

• Audit all trigger configurations for a repository
• Verify trigger was created correctly
• Check trigger enable/disable status

W3: View Trigger Details

hcloud SWR ShowTrigger --namespace=group-dev --repository=my-app --trigger=deploy-trigger --cli-region=cn-north-4

Use Cases:

• Verify trigger configuration (type, condition, target)
• Check trigger status (enabled/disabled)
• Troubleshoot trigger not firing

W4: Update a Trigger

# Disable a trigger (pause auto-deploy without deleting)
hcloud SWR UpdateTrigger --namespace=group-dev --repository=my-app --trigger=deploy-trigger --enable=false --cli-region=cn-north-4

# Re-enable a trigger
hcloud SWR UpdateTrigger --namespace=group-dev --repository=my-app --trigger=deploy-trigger --enable=true --cli-region=cn-north-4

Common Update Use Cases:

• Temporarily disable trigger during maintenance
• Re-enable after maintenance window
• Run hcloud SWR UpdateTrigger --help for all updateable parameters

W5: Delete a Trigger

⚠️ Best Practice: Disable trigger before deleting to prevent unintended deployments during the deletion process.

# 1. Disable trigger first (recommended)
hcloud SWR UpdateTrigger --namespace=group-dev --repository=my-app --trigger=deploy-trigger --enable=false --cli-region=cn-north-4

# 2. Delete trigger
hcloud SWR DeleteTrigger --namespace=group-dev --repository=my-app --trigger=deploy-trigger --cli-region=cn-north-4

Post-deletion Verification:

# Should return 404 or trigger should not appear in list
hcloud SWR ListTriggersDetails --namespace=group-dev --repository=my-app --cli-region=cn-north-4

Common Scenarios

S1: CI/CD Auto-deploy Pipeline

Set up automatic deployment updates when CI pushes new images:

# 1. Create trigger for production deployment (semver only)
hcloud SWR CreateTrigger --namespace=prod --repository=my-app --name=prod-deploy --trigger_type=regular --condition="v\d+\.\d+\.\d+" --action=update --app_type=deployments --application=my-app-deployment --cluster_ns=production --enable=true --trigger_mode=cce --cluster_id=<prod-cluster-id> --cli-region=cn-north-4

# 2. Create trigger for staging (all pushes)
hcloud SWR CreateTrigger --namespace=staging --repository=my-app --name=staging-deploy --trigger_type=all --condition=".*" --action=update --app_type=deployments --application=my-app-deployment --cluster_ns=staging --enable=true --trigger_mode=cce --cluster_id=<staging-cluster-id> --cli-region=cn-north-4

S2: Multi-container Deployment Update

Update only a specific container in a multi-container pod:

# Update only the sidecar container, not the main app container
hcloud SWR CreateTrigger --namespace=group-dev --repository=log-collector --name=sidecar-trigger --trigger_type=all --condition=".*" --action=update --app_type=deployments --application=my-app-deployment --cluster_ns=default --enable=true --trigger_mode=cce --cluster_id=<cluster-id> --container=log-collector --cli-region=cn-north-4

S3: Trigger Audit and Cleanup

Periodically review and clean up triggers:

# 1. List all triggers for each repository
hcloud SWR ListTriggersDetails --namespace=group-dev --repository=my-app --cli-region=cn-north-4

# 2. Review each trigger configuration
hcloud SWR ShowTrigger --namespace=group-dev --repository=my-app --trigger=<trigger-name> --cli-region=cn-north-4

# 3. Disable unused triggers
hcloud SWR UpdateTrigger --namespace=group-dev --repository=my-app --trigger=<unused-trigger> --enable=false --cli-region=cn-north-4

# 4. Delete obsolete triggers
hcloud SWR DeleteTrigger --namespace=group-dev --repository=my-app --trigger=<obsolete-trigger> --cli-region=cn-north-4

Verification Method - SWR Image Automation Skill

Overview

This document defines the verification steps for the SWR image automation skill. Verification is divided into three levels: installation verification, configuration verification, and functional verification.

Level 1: Installation Verification

1.1 hcloud CLI Installation

1.2 hcloud CLI First Run

# Accept privacy statement (first time only)
printf "y\n" | hcloud version

Expected: Version number displayed without error.

Level 2: Configuration Verification

2.1 Credential Configuration

✅ Correct: Use hcloud configure list to verify ❌ Incorrect: Do NOT use echo $HUAWEI_CLOUD_AK to check credentials

2.2 Connectivity Test

# Test API connectivity with a read-only operation
hcloud SWR ListSyncRegions --cli-region=cn-north-4

Expected: Returns HTTP 200 and list of available sync regions.

Level 3: Functional Verification

3.1 Sync Regions (Read-only)

# List available sync target regions
hcloud SWR ListSyncRegions --cli-region=cn-north-4

Expected: returns array of objects with regionID field with region_id and region_name fields.

3.2 Auto Sync Configuration

# List existing auto-sync configurations (read-only)
hcloud SWR ListImageAutoSyncReposDetails --namespace=group-dev --repository=my-app --cli-region=cn-north-4

Expected: Returns list of sync configurations (may be empty if none configured).

# Create auto-sync configuration (requires existing repo and target namespace)
hcloud SWR CreateImageSyncRepo --namespace=group-dev --repository=my-app --remoteRegionId=cn-east-3 --remoteNamespace=group-dev --syncAuto=true --override=false --cli-region=cn-north-4

Expected: Auto-sync configuration created.

# Verify auto-sync creation
hcloud SWR ListImageAutoSyncReposDetails --namespace=group-dev --repository=my-app --cli-region=cn-north-4

Expected: Shows the newly created sync configuration.

# Clean up: delete auto-sync configuration
hcloud SWR DeleteImageSyncRepo --namespace=group-dev --repository=my-app --remoteRegionId=cn-east-3 --remoteNamespace=group-dev --cli-region=cn-north-4

Expected: Auto-sync configuration removed.

3.3 Manual Sync (Requires existing tags in repository)

# Manually sync specific tags (requires existing image tags)
hcloud SWR CreateManualImageSyncRepo --namespace=group-dev --repository=my-app --remoteRegionId=cn-east-3 --remoteNamespace=group-dev --imageTag.1=v1.0 --override=false --cli-region=cn-north-4

Expected: Manual sync job initiated for the specified tags.

3.4 Sync Job Status

# Check sync job status
hcloud SWR ShowSyncJob --namespace=group-dev --repository=my-app --cli-region=cn-north-4

Expected: Returns sync job status information.

3.5 Trigger Management

# List existing triggers (read-only)
hcloud SWR ListTriggersDetails --namespace=group-dev --repository=my-app --cli-region=cn-north-4

Expected: Returns list of triggers (may be empty if none configured).

# Create a trigger (requires CCE cluster)
hcloud SWR CreateTrigger --namespace=group-dev --repository=my-app --name=test-trigger --trigger_type=all --condition=".*" --action=update --app_type=deployments --application=<deployment-name> --cluster_ns=default --enable=true --trigger_mode=cce --cluster_id=<cluster-id> --cli-region=cn-north-4

Expected: Trigger created successfully.

# Show trigger details
hcloud SWR ShowTrigger --namespace=group-dev --repository=my-app --trigger=test-trigger --cli-region=cn-north-4

Expected: Returns trigger details including configuration and status.

# Update trigger (disable)
hcloud SWR UpdateTrigger --namespace=group-dev --repository=my-app --trigger=test-trigger --enable=false --cli-region=cn-north-4

Expected: Trigger disabled.

# Clean up: delete trigger
hcloud SWR DeleteTrigger --namespace=group-dev --repository=my-app --trigger=test-trigger --cli-region=cn-north-4

Expected: Trigger deleted.

Verification Checklist