Huawei Cloud Swr Image Governance

Huawei Cloud SWR Image Governance

Overview

This skill provides governance capabilities for Huawei Cloud SWR (Software Repository for Container) using the hcloud CLI, covering permissions, retention policies, sharing, and agency delegation.

Architecture: hcloud CLI → SWR Service API → Permission/Retention/Domain/Share/Agency resources

Related Skills:

• huawei-cloud-swr-image-management - Image lifecycle management (namespace, repo, tag, auth, quota)
• huawei-cloud-swr-image-automation - Image automation ops (sync, triggers, domains)
• huawei-cloud-swr-enterprise-instance - Enterprise instance management

Capabilities:

• Grant, query, modify, and revoke namespace-level permissions
• Grant, query, modify, and revoke repository-level permissions
• Create and manage image retention rules for automated cleanup
• Create and manage shared download domains for cross-organization access
• List shared repositories and check sharing feature gates
• Check and create agency delegation for SWR operations
• List repository accessories and references

Typical Use Cases:

• "Grant edit permission on namespace 'group-dev' to user 'dev-team'"
• "List all users with access to namespace 'group-dev'"
• "Set up a retention rule to keep only the last 10 tags in repository 'nginx'"
• "Create a shared download domain for repository 'my-app'"
• "List all shared repositories"
• "Check if image sharing feature is enabled"
• "Check agency delegation status for SWR"
• "Revoke a user's permission on a repository"

Prerequisites

1. hcloud CLI Requirements (MANDATORY)

• hcloud CLI installed (version >= 7.2.2)
• Run hcloud version to verify installation
• First-time usage: printf "y\n" | hcloud version to accept privacy statement

2. Credential Configuration

hcloud CLI supports two credential modes via environment variables, automatically detected at runtime:

Mode A — Long-term AK/SK (permanent access):

export HUAWEI_CLOUD_AK=<your-ak>
export HUAWEI_CLOUD_SK=<your-sk>
export HUAWEI_CLOUD_REGION=cn-north-4

Mode B — Temporary AK/SK + SecurityToken (recommended for temporary or delegated access):

export HUAWEI_CLOUD_AK=<your-temp-ak>
export HUAWEI_CLOUD_SK=<your-temp-sk>
export HUAWEI_CLOUD_SECURITY_TOKEN=<your-security-token>
export HUAWEI_CLOUD_REGION=cn-north-4

When HUAWEI_CLOUD_SECURITY_TOKEN is present, hcloud CLI automatically uses temporary credential authentication. When only AK/SK are set, it uses long-term credential authentication.

• Security Rules:
• 🚫 Never expose AK/SK/SecurityToken values in code, conversation, or commands
• 🚫 Never use echo $HUAWEI_CLOUD_AK or echo $HUAWEI_CLOUD_SK to check credentials
• ✅ Use environment variables: HUAWEI_CLOUD_AK, HUAWEI_CLOUD_SK, HUAWEI_CLOUD_REGION, HUAWEI_CLOUD_SECURITY_TOKEN
• ✅ Prefer IAM users over root account for cloud operations
• ✅ Enable MFA for sensitive operations

⚠️ Important Security Notes:

• Never commit credentials to version control
• Use IAM users with minimal required permissions
• Enable MFA for sensitive operations
• Rotate AK/SK regularly

3. IAM Permission Requirements

See IAM Permission Policies for complete policy JSON.

Permission Failure Handling:

1. When any command fails due to permission errors, read references/iam-policies.md 2. Display the required permission list and policy JSON to the user 3. Guide the user to create a custom policy in the IAM console and grant authorization 4. Pause execution and wait for user confirmation that permissions have been granted

Core Commands

1. Namespace Permissions

See Task: Namespace Permissions for detailed workflows.

# Show namespace permissions (who has access and their auth levels)
hcloud SWR ShowNamespaceAuth --namespace=pancake --cli-region=cn-north-4

# Grant namespace permission to a user
hcloud SWR CreateNamespaceAuth --namespace=pancake --1.auth=7 --1.user_id=05949eb5350010e21f85c017722182de --1.user_name=hwstaff_p00506267 --cli-region=cn-north-4

# Update namespace permission for a user
hcloud SWR UpdateNamespaceAuth --namespace=pancake --1.auth=3 --1.user_id=05949eb5350010e21f85c017722182de --1.user_name=hwstaff_p00506267 --cli-region=cn-north-4

# Revoke namespace permission for a user
hcloud SWR DeleteNamespaceAuth --namespace=pancake --1.user_id=05949eb5350010e21f85c017722182de --1.user_name=hwstaff_p00506267 --cli-region=cn-north-4

Auth Values: 7 = manage (full control), 3 = edit (push/pull), 1 = read (pull only)

⚠️ Array-Style Parameters: Permission operations use --[N].auth, --[N].user_id, --[N].user_name format where [N] is the array index (starting from 1). For a single user, use --1.auth=7 --1.user_id=xxx --1.user_name=xxx. See Common Pitfalls for details.

2. Repository Permissions

See Task: Repository Permissions for detailed workflows.

# Show repository permissions
hcloud SWR ShowUserRepositoryAuth --namespace=pancake --repository=openclaw-sandbox --cli-region=cn-north-4

# Grant repository permission to a user
hcloud SWR CreateUserRepositoryAuth --namespace=pancake --repository=openclaw-sandbox --1.auth=7 --1.user_id=05949eb5350010e21f85c017722182de --1.user_name=hwstaff_p00506267 --cli-region=cn-north-4

# Update repository permission for a user
hcloud SWR UpdateUserRepositoryAuth --namespace=pancake --repository=openclaw-sandbox --1.auth=3 --1.user_id=05949eb5350010e21f85c017722182de --1.user_name=hwstaff_p00506267 --cli-region=cn-north-4

# Revoke repository permission for a user
hcloud SWR DeleteUserRepositoryAuth --namespace=pancake --repository=openclaw-sandbox --1.user_id=05949eb5350010e21f85c017722182de --1.user_name=hwstaff_p00506267 --cli-region=cn-north-4

Auth Values: Same as namespace permissions: 7 = manage, 3 = edit, 1 = read

3. Agency Delegation

# Check if agency delegation is enabled
hcloud SWR CheckAgency --cli-region=cn-north-4

# Create agency delegation for SWR
hcloud SWR CreateAgency --cli-region=cn-north-4

Use Cases:

• Agency delegation allows SWR to access other services (OBS, CCE) on your behalf
• Required for features like image sync to OBS and CCE trigger deployments
• CheckAgency returns whether agency is already configured; CreateAgency sets up the delegation

4. Retention Rules

See Task: Retention Management for detailed workflows.

# List retention rules for a repository
hcloud SWR ListRetentions --namespace=pancake --repository=openclaw-sandbox --cli-region=cn-north-4

# Create a retention rule (keep last 10 tags)
hcloud SWR CreateRetention --namespace=pancake --repository=openclaw-sandbox --algorithm=or --rules.1.template=tag_rule --rules.1.params.num=10 --rules.1.tag_selectors.1.kind=label --rules.1.tag_selectors.1.pattern=latest --cli-region=cn-north-4

# Create a retention rule (keep tags from last 30 days)
hcloud SWR CreateRetention --namespace=pancake --repository=openclaw-sandbox --algorithm=or --rules.1.template=date_rule --rules.1.params.days=30 --rules.1.tag_selectors.1.kind=label --rules.1.tag_selectors.1.pattern=latest --cli-region=cn-north-4

# Show retention rule details
hcloud SWR ShowRetention --namespace=pancake --repository=openclaw-sandbox --retention_id=<id> --cli-region=cn-north-4

# Update a retention rule
hcloud SWR UpdateRetention --namespace=pancake --repository=openclaw-sandbox --retention_id=<id> --algorithm=or --rules.1.template=tag_rule --rules.1.params.num=5 --rules.1.tag_selectors.1.kind=label --rules.1.tag_selectors.1.pattern=latest --cli-region=cn-north-4

# Delete a retention rule
hcloud SWR DeleteRetention --namespace=pancake --repository=openclaw-sandbox --retention_id=<id> --cli-region=cn-north-4

# List retention execution histories
hcloud SWR ListRetentionHistories --namespace=pancake --repository=openclaw-sandbox --retention_id=<id> --cli-region=cn-north-4

Retention Rule Templates:

• tag_rule: Keep a specified number of the most recent tags (params.num)
• date_rule: Keep tags created within a specified number of days (params.days)

Tag Selector Kinds:

• label: Exact tag name match (e.g., latest, v1.0)
• regexp: Regex pattern match (e.g., v\d+\.\d+\.\d+)

Algorithm: or means rules are combined with OR logic (a tag is retained if it matches ANY rule)

5. Shared Download Domains

See Task: Shared Domains for detailed workflows.

# List shared download domains for a repository
hcloud SWR ListRepoDomains --namespace=pancake --repository=openclaw-sandbox --cli-region=cn-north-4

# Create a shared download domain
hcloud SWR CreateRepoDomains --namespace=pancake --repository=openclaw-sandbox --domain=shared-domain-name --cli-region=cn-north-4

# Show shared domain details
hcloud SWR ShowAccessDomain --namespace=pancake --repository=openclaw-sandbox --access_domain=shared-domain-name --cli-region=cn-north-4

# Update a shared download domain
hcloud SWR UpdateRepoDomains --namespace=pancake --repository=openclaw-sandbox --domain=shared-domain-name --permit=read --cli-region=cn-north-4

# Delete a shared download domain
hcloud SWR DeleteRepoDomains --namespace=pancake --repository=openclaw-sandbox --access_domain=shared-domain-name --cli-region=cn-north-4

6. Image Sharing

See Task: Image Sharing for detailed workflows.

# List shared repositories I have shared (self) or received (thirdparty)
# --center is REQUIRED: "self" = repos I shared to others, "thirdparty" = repos shared to me
hcloud SWR ListSharedReposDetails --center=self --cli-region=cn-north-4

# List shared repository details (--shared_by is REQUIRED: self|thirdparty)
hcloud SWR ListSharedRepoDetails --shared_by=self --cli-region=cn-north-4

# Check sharing feature gates
hcloud SWR ShowShareFeatureGates --cli-region=cn-north-4

# Check global feature gates
hcloud SWR ListGlobalFeatureGates --cli-region=cn-north-4

7. Repository Accessories & References

# List repository accessories
hcloud SWR ListRepoAccessories --namespace=pancake --repository=openclaw-sandbox --cli-region=cn-north-4

# List repository references
hcloud SWR ListReferences --namespace=pancake --repository=openclaw-sandbox --cli-region=cn-north-4

Parameter Reference

Common Parameters

Permission Parameters

⚠️ Array Index Format: [N] starts from 1 (not 0). For granting permission to a single user, use --1.auth=7 --1.user_id=xxx --1.user_name=xxx. For multiple users, use --1.auth=7 --1.user_id=xxx --1.user_name=xxx --2.auth=3 --2.user_id=yyy --2.user_name=yyy.

Retention Parameters

Domain Parameters

Output Format

See Output Format for detailed response format examples (NamespaceAuth, RepositoryAuth, RepoDomains, CheckAgency, ShareFeatureGates, GlobalFeatureGates, Retentions, RepoAccessories, ListSharedReposDetails).

Key Format Notes:

• auth: Permission value (7=manage, 3=edit, 1=read)
• self_auth vs others_auths: Check both when auditing permissions
• ListRepoDomains: Uses created/updated (NOT created_at/updated_at)
• ListRetentions: Returns flat array (empty [] when no rules)
• ListRepoAccessories: Uses total + accessories (null when empty)

Verification

See Verification Method for step-by-step verification.

Best Practices

1. Least Privilege: Grant the minimum auth level needed — 1 (read) for pull-only, 3 (edit) for push/pull, 7 (manage) for full control 2. Namespace vs Repository Permissions: Namespace permissions apply to ALL repositories under it; repository permissions are granular per-repo 3. Retention Rules: Use tag_rule (keep N most recent) for most cases; date_rule (keep tags within N days) for time-based cleanup 4. Retention Tag Selectors: Use label kind with latest pattern to protect important tags from retention cleanup 5. Shared Domains: Use deadline=forever for stable internal sharing; set specific deadlines for temporary cross-team access 6. Agency Delegation: Check agency status before configuring image sync or CCE triggers — these require agency to be enabled 7. Audit Permissions Regularly: Use ShowNamespaceAuth and ShowUserRepositoryAuth to periodically review who has access

Reference Documents

Notes

• Permission changes are immediate — no delay between granting and availability
• Revoke with caution — removing manage auth (7) prevents the user from administering the namespace/repository
• Retention rules execute automatically — tags matching the rule conditions will be deleted during execution
• AK/SK must never be hardcoded — credentials should only be obtained via environment variables
• hcloud CLI is the only supported method — all operations use hcloud SWR <Operation> format
• ListRepoDomains timestamps use `created/updated` — NOT created_at/updated_at

Common Pitfalls

See Common Pitfalls & Solutions for detailed troubleshooting guides.

Quick Reference:

Common Pitfalls & Solutions

This document contains detailed troubleshooting guides for common issues encountered when using the Huawei Cloud SWR Image Governance skill.

Pitfall 1: Array-Style Permission Parameters

Symptom: CreateNamespaceAuth or CreateUserRepositoryAuth fails with parameter validation error

Root Cause: Permission operations use array-style parameters with index notation --[N].auth, --[N].user_id, --[N].user_name where [N] starts from 1 (not 0)

Common Mistakes:

• ❌ --auth=7 --user_id=xxx --user_name=xxx — missing array index
• ❌ --0.auth=7 --0.user_id=xxx — using 0-based index
• ❌ --auth[0]=7 — wrong bracket syntax

Solution: Always use 1-based array index:

# ✅ CORRECT - Single user with index 1
hcloud SWR CreateNamespaceAuth --namespace=pancake --1.auth=7 --1.user_id=05949eb5350010e21f85c017722182de --1.user_name=hwstaff_p00506267 --cli-region=cn-north-4

# ✅ CORRECT - Multiple users with sequential indices
hcloud SWR CreateNamespaceAuth --namespace=pancake --1.auth=7 --1.user_id=xxx --1.user_name=user1 --2.auth=3 --2.user_id=yyy --2.user_name=user2 --cli-region=cn-north-4

# ❌ WRONG - Missing array index
hcloud SWR CreateNamespaceAuth --namespace=pancake --auth=7 --user_id=xxx --user_name=user1 --cli-region=cn-north-4

Pitfall 2: Auth Value Confusion (7/3/1, Not 1/2/3)

Symptom: User receives unexpected permission level after granting auth

Root Cause: SWR auth values use 7/3/1 encoding, NOT a sequential 1/2/3 scale

Auth Value Mapping:

• 7 = Manage (full control: create/delete repos, manage permissions)
• 3 = Edit (push and pull images)
• 1 = Read (pull images only)

Common Mistakes:

• ❌ --1.auth=1 when intending "manage" — actually grants "read only"
• ❌ --1.auth=2 — invalid value, there is no auth level 2

Solution: Always use the correct auth values:

Pitfall 3: self_auth vs others_auths Confusion

Symptom: Permission audit appears incomplete, missing users

Root Cause: ShowNamespaceAuth and ShowUserRepositoryAuth return self_auth (your own permission) as a separate object from others_auths (other users' permissions)

Solution: When auditing permissions, check both objects:

{
  "self_auth": {
    "user_id": "...",
    "user_name": "...",
    "auth": 7
  },
  "others_auths": [
    {
      "user_id": "...",
      "user_name": "...",
      "auth": 7
    }
  ]
}

• self_auth: Your permission level (always present)
• others_auths: Other users' permissions (may be empty array [])
• To get complete access list, combine both

Pitfall 4: Domain Timestamp Field Names (created/updated, NOT created_at/updated_at)

Symptom: Parsing created_at or updated_at from ListRepoDomains response fails

Root Cause: ListRepoDomains uses created and updated fields, NOT created_at and updated_at

Solution: Use the correct field names:

{
  "created": "2026-04-28T09:18:19.830309Z",
  "updated": "2026-04-28T09:18:19.83031Z"
}

Pitfall 5: Nested Array Parameters for Retention Rules

Symptom: CreateRetention fails with parameter validation error

Root Cause: Retention rules use deeply nested array parameters: --rules.[N].tag_selectors.[N].kind

Common Mistakes:

• ❌ --rules.tag_selectors.kind=label — missing both array indices
• ❌ --rules.1.tag_selectors.kind=label — missing inner array index
• ❌ --rules.1.tag_selectors.0.kind=label — using 0-based inner index

Solution: Use 1-based indices for both outer and inner arrays:

# ✅ CORRECT - Proper nested array format
hcloud SWR CreateRetention --namespace=pancake --repository=openclaw-sandbox \
  --algorithm=or \
  --rules.1.template=tag_rule \
  --rules.1.params.num=10 \
  --rules.1.tag_selectors.1.kind=label \
  --rules.1.tag_selectors.1.pattern=latest \
  --cli-region=cn-north-4

# ❌ WRONG - Missing inner index
hcloud SWR CreateRetention --namespace=pancake --repository=openclaw-sandbox \
  --algorithm=or \
  --rules.1.template=tag_rule \
  --rules.1.params.num=10 \
  --rules.1.tag_selectors.kind=label \
  --cli-region=cn-north-4

Pitfall 6: Retention params Format (String Values, Not Numbers)

Symptom: CreateRetention fails because params expects string values

Root Cause: The --rules.[N].params parameter expects string values for days and num, not numeric integers

Solution: Use string values in params:

# ✅ CORRECT - String values
--rules.1.params.num=10
--rules.1.params.days=30

# Note: hcloud CLI accepts numeric-looking strings; the API expects string format

Pitfall 7: Agency Not Configured Before Using Sync/Trigger Features

Symptom: Image sync or CCE trigger features fail with agency-related errors

Root Cause: SWR agency delegation must be configured before features like image sync (to OBS) and CCE trigger deployments can work

Solution: Check and configure agency before using dependent features:

# Check agency status first
hcloud SWR CheckAgency --cli-region=cn-north-4

# If is_agency is false, create the delegation
hcloud SWR CreateAgency --cli-region=cn-north-4

# Then verify
hcloud SWR CheckAgency --cli-region=cn-north-4

Pitfall 8: Namespace Permission Affects ALL Repositories Under It

Symptom: Granting namespace manage permission unintentionally gives full control of all repositories

Root Cause: Namespace-level permissions apply to ALL repositories under that namespace. Repository-level permissions are more granular.

Solution: Choose the right permission scope:

• Namespace permission: When the user needs access to all repositories under the namespace
• Repository permission: When the user only needs access to specific repositories

# For broad access (all repos in namespace)
hcloud SWR CreateNamespaceAuth --namespace=pancake --1.auth=3 --1.user_id=xxx --1.user_name=dev-user --cli-region=cn-north-4

# For granular access (specific repo only)
hcloud SWR CreateUserRepositoryAuth --namespace=pancake --repository=openclaw-sandbox --1.auth=3 --1.user_id=xxx --1.user_name=dev-user --cli-region=cn-north-4

Pitfall 9: Deleting Namespace Permission Removes Repository Access

Symptom: After revoking namespace permission, user also loses repository access under that namespace

Root Cause: Namespace permission is the foundation for repository access. Removing namespace access can cascade to repository access loss.

Solution: Before revoking namespace permissions, check if the user has separate repository-level permissions that should be preserved:

# Check repository-level permissions for the user
hcloud SWR ShowUserRepositoryAuth --namespace=pancake --repository=openclaw-sandbox --cli-region=cn-north-4

Pitfall 10: Empty Retention List Returns Flat Empty Array

Symptom: Attempting to parse ListRetentions response as an object with a wrapper key fails

Root Cause: When no retention rules exist, ListRetentions returns a flat empty array [], not an object like {"retentions": []}

Solution: Handle both empty array and populated array cases:

// Empty result (no rules)
[]

// When rules exist, format to be verified with actual API call

Pitfall 11: ListRepoAccessories Returns Object with Null Field

Symptom: Accessing accessories as a guaranteed array fails when it's null

Root Cause: ListRepoAccessories returns {"total": 0, "accessories": null} when no accessories exist, not an empty array

Solution: Handle null accessories field:

{
  "total": 0,
  "accessories": null
}

Always check total first, and treat accessories as nullable.

Common Error Response Reference

IAM Permission Policies - SWR Image Governance Skill

Overview

This document declares the IAM permissions required by the Huawei Cloud SWR Image Governance skill. All permissions follow the principle of least privilege.

Read-Only Operations

Write Operations (Require Additional Authorization)

Minimum Read-Only Policy (JSON)

{
  "Version": "1.1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "swr:namespace:auth:get",
        "swr:repository:auth:get",
        "swr:retention:list",
        "swr:retention:get",
        "swr:domain:list",
        "swr:domain:get",
        "swr:share:list",
        "swr:share:get",
        "swr:share:feature:get",
        "swr:global:feature:get",
        "swr:agency:check",
        "swr:accessory:list",
        "swr:reference:list"
      ],
      "Resource": ["*"]
    }
  ]
}

Full Governance Policy (JSON)

{
  "Version": "1.1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "swr:namespace:auth:get",
        "swr:namespace:auth:create",
        "swr:namespace:auth:update",
        "swr:namespace:auth:delete",
        "swr:repository:auth:get",
        "swr:repository:auth:create",
        "swr:repository:auth:update",
        "swr:repository:auth:delete",
        "swr:retention:list",
        "swr:retention:get",
        "swr:retention:create",
        "swr:retention:update",
        "swr:retention:delete",
        "swr:domain:list",
        "swr:domain:get",
        "swr:domain:create",
        "swr:domain:update",
        "swr:domain:delete",
        "swr:share:list",
        "swr:share:get",
        "swr:share:feature:get",
        "swr:global:feature:get",
        "swr:agency:check",
        "swr:agency:create",
        "swr:accessory:list",
        "swr:reference:list"
      ],
      "Resource": ["*"]
    }
  ]
}

Permission Assignment Steps

1. Log in to Huawei Cloud IAM console: https://console.huaweicloud.com/iam/ 2. Navigate to Policies → Create Custom Policy 3. Choose JSON mode and paste the policy JSON above 4. Navigate to Users / User Groups → Authorize 5. Select the custom policy and confirm

Permission Failure Handling

When a command fails with a permission error:

1. Read this document (references/iam-policies.md) 2. Display the required permission list and policy JSON to the user 3. Guide the user to create a custom policy in the IAM console 4. Pause execution and wait for user confirmation that permissions have been granted 5. Retry the failed command

SWR Image Governance — Output Format

ShowNamespaceAuth (verified)

{
  "id": 3827347,
  "name": "pancake",
  "creator_name": "hwstaff_p00506267",
  "self_auth": {
    "user_id": "05949eb5350010e21f85c017722182de",
    "user_name": "hwstaff_p00506267",
    "auth": 7
  },
  "others_auths": [
    {
      "user_id": "05949eb5350010e21f85c017722182de",
      "user_name": "hwstaff_p00506267",
      "auth": 7
    }
  ]
}

Key Fields:

• self_auth: Your own permission level on this namespace
• others_auths: Array of other users' permission levels
• auth: Permission value (7=manage, 3=edit, 1=read)
• self_auth is separate from others_auths — check both when auditing permissions

ShowUserRepositoryAuth (verified)

{
  "id": 3374887,
  "name": "openclaw-sandbox",
  "self_auth": {
    "user_id": "...",
    "user_name": "...",
    "auth": 7
  },
  "others_auths": []
}

Same structure as namespace auth but with repository id and name.

ListRepoDomains (verified — uses created/updated, NOT created_at/updated_at)

Response is a flat JSON array (not wrapped in an object):

[
  {
    "namespace": "pancake",
    "repository": "openclaw-sandbox",
    "access_domain": "shijingcheng_test",
    "permit": "read",
    "deadline": "forever",
    "description": "",
    "creator_id": "05949eb5350010e21f85c017722182de",
    "creator_name": "hwstaff_p00506267",
    "created": "2026-04-28T09:18:19.830309Z",
    "updated": "2026-04-28T09:18:19.83031Z",
    "status": true
  }
]

Key Fields:

• access_domain: Shared download domain name
• permit: Permission type (read)
• deadline: Expiration (forever or specific date)
• status: Whether the domain is active (boolean)
• created/updated: Timestamps (NOT created_at/updated_at)

CheckAgency (verified)

{
  "domain_id": "05949eb4190010e40f36c017b62fafa0",
  "is_agency": true
}

Key Fields:

• is_agency: Whether agency delegation is enabled (boolean)
• domain_id: Domain ID (hex string)

ShowShareFeatureGates (verified)

{
  "enable_experience": true,
  "enable_hss_service": true,
  "enable_image_scan": true,
  "enable_sm3": false,
  "enable_image_sync": true,
  "enable_cci_service": true,
  "enable_image_label": false,
  "enable_pipeline": true,
  "enable_authorization_token": true,
  "enable_resource": true,
  "enable_list_v3": true,
  "enable_image_quota": false,
  "enable_cosign_signature": true,
  "enable_enterprise_edition_link": false,
  "enable_customize_validity_period": true,
  "swr_util_download_url": ""
}

Key Feature Gates:

• enable_experience: Shared image experience
• enable_image_scan: Security scan
• enable_image_sync: Cross-region sync
• enable_cosign_signature: Cosign signature verification
• enable_authorization_token: Authorization token

ListGlobalFeatureGates (verified)

{
  "enableUserDefObs": true,
  "enableEnterprise": true,
  "cerAvailable": true,
  "enableIntranetAccessSwitch": true,
  "enableOBSEncryptUserKmsKey": true
}

Key Feature Gates:

• enableUserDefObs: Custom OBS bucket
• enableEnterprise: Enterprise edition features
• cerAvailable: CER available
• enableIntranetAccessSwitch: Intranet access toggle
• enableOBSEncryptUserKmsKey: OBS encryption with user KMS key

ListRetentions (verified — returns empty flat array when no rules)

[]

When retention rules exist, response format to be verified with actual API call.

ListRepoAccessories (verified)

{
  "total": 0,
  "accessories": null
}

Key Fields:

• total: Total count of accessories
• accessories: Array of accessory objects (null when empty)

ListSharedReposDetails

Returns flat array of repository objects with same fields as ListReposDetails (name, category, description, size, is_public, num_images, num_download, created_at, updated_at, path, internal_path, domain_name, namespace, tags, status, total_range). Response format identical to image-management ListReposDetails.

SWR Governance API Reference Guide

Overview

This document provides API reference information for Huawei Cloud SWR governance operations using hcloud CLI. All commands follow the standard format: hcloud SWR <Operation> --param=value --cli-region=<region>.

Authentication

Environment Variables

export HUAWEI_CLOUD_AK=<your-ak>
export HUAWEI_CLOUD_SK=<your-sk>

hcloud CLI Configuration

# Interactive configuration
hcloud configure

# Verify configuration (safe - does not expose values)
hcloud configure list

✅ Correct: Use hcloud configure list to verify credentials ❌ Incorrect: Never use echo $HUAWEI_CLOUD_AK to check credentials

Namespace Permission Operations

1. Show Namespace Permissions

hcloud SWR ShowNamespaceAuth --namespace=pancake --cli-region=cn-north-4

Parameters:

• --namespace (required): Namespace name (path parameter)
• --cli-region (required): Region ID

Response Example (verified against actual API):

{
  "id": 3827347,
  "name": "pancake",
  "creator_name": "hwstaff_p00506267",
  "self_auth": {
    "user_id": "05949eb5350010e21f85c017722182de",
    "user_name": "hwstaff_p00506267",
    "auth": 7
  },
  "others_auths": [
    {
      "user_id": "05949eb5350010e21f85c017722182de",
      "user_name": "hwstaff_p00506267",
      "auth": 7
    }
  ]
}

Key Fields:

• id: Namespace numeric ID
• name: Namespace name
• creator_name: Creator IAM user name
• self_auth: Your own permission on this namespace (separate object)
• others_auths: Array of other users' permissions
• auth: Permission level (7=manage, 3=edit, 1=read)

⚠️ Important: self_auth is a separate object from others_auths. When auditing permissions, check both.

2. Create Namespace Permission

hcloud SWR CreateNamespaceAuth --namespace=pancake --1.auth=7 --1.user_id=05949eb5350010e21f85c017722182de --1.user_name=hwstaff_p00506267 --cli-region=cn-north-4

Parameters:

• --namespace (required): Namespace name (path parameter)
• --[N].auth (required, body): Permission level (7=manage, 3=edit, 1=read)
• --[N].user_id (required, body): IAM user ID (hex string)
• --[N].user_name (required, body): IAM user display name
• --cli-region (required): Region ID

⚠️ Array-Style Parameters: [N] is the array index starting from 1. For a single user, use --1.auth=7 --1.user_id=xxx --1.user_name=xxx. For multiple users, add --2.auth=3 --2.user_id=yyy --2.user_name=yyy etc.

Auth Values:

• 7: Manage — full control (create/delete repos, manage permissions)
• 3: Edit — push and pull images
• 1: Read — pull images only

3. Update Namespace Permission

hcloud SWR UpdateNamespaceAuth --namespace=pancake --1.auth=3 --1.user_id=05949eb5350010e21f85c017722182de --1.user_name=hwstaff_p00506267 --cli-region=cn-north-4

Parameters: Same as CreateNamespaceAuth. Use to change an existing user's auth level.

4. Delete Namespace Permission

hcloud SWR DeleteNamespaceAuth --namespace=pancake --1.user_id=05949eb5350010e21f85c017722182de --1.user_name=hwstaff_p00506267 --cli-region=cn-north-4

Parameters:

• --namespace (required): Namespace name (path parameter)
• --[N].user_id (required, body): IAM user ID to revoke
• --[N].user_name (required, body): IAM user name to revoke
• --cli-region (required): Region ID

⚠️ Warning: This removes the user's access to the namespace and ALL repositories under it.

Repository Permission Operations

1. Show Repository Permissions

hcloud SWR ShowUserRepositoryAuth --namespace=pancake --repository=openclaw-sandbox --cli-region=cn-north-4

Parameters:

• --namespace (required): Namespace name (path parameter)
• --repository (required): Repository name (path parameter)
• --cli-region (required): Region ID

Response Example (verified against actual API):

{
  "id": 3374887,
  "name": "openclaw-sandbox",
  "self_auth": {
    "user_id": "...",
    "user_name": "...",
    "auth": 7
  },
  "others_auths": []
}

Key Fields: Same structure as namespace auth but with repository id and name.

2. Create Repository Permission

hcloud SWR CreateUserRepositoryAuth --namespace=pancake --repository=openclaw-sandbox --1.auth=7 --1.user_id=05949eb5350010e21f85c017722182de --1.user_name=hwstaff_p00506267 --cli-region=cn-north-4

Parameters: Same array-style format as CreateNamespaceAuth, plus --repository.

3. Update Repository Permission

hcloud SWR UpdateUserRepositoryAuth --namespace=pancake --repository=openclaw-sandbox --1.auth=3 --1.user_id=05949eb5350010e21f85c017722182de --1.user_name=hwstaff_p00506267 --cli-region=cn-north-4

Parameters: Same as CreateUserRepositoryAuth.

4. Delete Repository Permission

hcloud SWR DeleteUserRepositoryAuth --namespace=pancake --repository=openclaw-sandbox --1.user_id=05949eb5350010e21f85c017722182de --1.user_name=hwstaff_p00506267 --cli-region=cn-north-4

Parameters: --namespace, --repository, and array-style --[N].user_id/--[N].user_name.

Agency Operations

1. Check Agency Status

hcloud SWR CheckAgency --cli-region=cn-north-4

Parameters:

• --cli-region (required): Region ID

Response Example (verified against actual API):

{
  "domain_id": "05949eb4190010e40f36c017b62fafa0",
  "is_agency": true
}

Key Fields:

• domain_id: Domain ID (hex string)
• is_agency: Whether agency delegation is configured (boolean)

2. Create Agency Delegation

hcloud SWR CreateAgency --cli-region=cn-north-4

Parameters:

• --cli-region (required): Region ID

Use Case: Creates SWR agency delegation allowing SWR to access OBS (for image sync) and CCE (for trigger deployments) on your behalf.

Retention Operations

1. List Retention Rules

hcloud SWR ListRetentions --namespace=pancake --repository=openclaw-sandbox --cli-region=cn-north-4

Parameters:

• --namespace (required): Namespace name (path parameter)
• --repository (required): Repository name (path parameter)
• --cli-region (required): Region ID

Response Example (verified — empty flat array when no rules):

[]

When retention rules exist, returns array of retention rule objects. Response format to be verified with actual API call.

2. Create Retention Rule

# Keep last 10 tags (tag_rule)
hcloud SWR CreateRetention --namespace=pancake --repository=openclaw-sandbox --algorithm=or --rules.1.template=tag_rule --rules.1.params.num=10 --rules.1.tag_selectors.1.kind=label --rules.1.tag_selectors.1.pattern=latest --cli-region=cn-north-4

# Keep tags from last 30 days (date_rule)
hcloud SWR CreateRetention --namespace=pancake --repository=openclaw-sandbox --algorithm=or --rules.1.template=date_rule --rules.1.params.days=30 --rules.1.tag_selectors.1.kind=label --rules.1.tag_selectors.1.pattern=latest --cli-region=cn-north-4

# Multiple rules (OR logic)
hcloud SWR CreateRetention --namespace=pancake --repository=openclaw-sandbox --algorithm=or --rules.1.template=tag_rule --rules.1.params.num=5 --rules.1.tag_selectors.1.kind=label --rules.1.tag_selectors.1.pattern=latest --rules.2.template=date_rule --rules.2.params.days=30 --rules.2.tag_selectors.1.kind=regexp --rules.2.tag_selectors.1.pattern=v\d+ --cli-region=cn-north-4

Parameters:

• --namespace (required): Namespace name (path parameter)
• --repository (required): Repository name (path parameter)
• --algorithm (required, body): Fixed value or (rules combined with OR logic)
• --rules.[N].template (required, body): Rule type — date_rule or tag_rule
• --rules.[N].params (required, body): Rule parameters
• For date_rule: {"days": "xxx"} — keep tags within N days
• For tag_rule: {"num": "xxx"} — keep N most recent tags
• --rules.[N].tag_selectors.[N].kind (required, body): Selector kind — label or regexp
• --rules.[N].tag_selectors.[N].pattern (required, body): Selector pattern — tag name or regex
• --cli-region (required): Region ID

⚠️ Nested Array Parameters: Retention rules use deeply nested arrays: --rules.1.tag_selectors.1.kind=label. Index starts from 1.

3. Show Retention Rule Details

hcloud SWR ShowRetention --namespace=pancake --repository=openclaw-sandbox --retention_id=<id> --cli-region=cn-north-4

Parameters:

• --namespace (required): Namespace name
• --repository (required): Repository name
• --retention_id (required): Retention rule ID
• --cli-region (required): Region ID

Response format to be verified with actual API call.

4. Update Retention Rule

hcloud SWR UpdateRetention --namespace=pancake --repository=openclaw-sandbox --retention_id=<id> --algorithm=or --rules.1.template=tag_rule --rules.1.params.num=5 --rules.1.tag_selectors.1.kind=label --rules.1.tag_selectors.1.pattern=latest --cli-region=cn-north-4

Parameters: Same as CreateRetention plus --retention_id.

5. Delete Retention Rule

hcloud SWR DeleteRetention --namespace=pancake --repository=openclaw-sandbox --retention_id=<id> --cli-region=cn-north-4

Parameters:

• --namespace (required): Namespace name
• --repository (required): Repository name
• --retention_id (required): Retention rule ID
• --cli-region (required): Region ID

6. List Retention Execution Histories

hcloud SWR ListRetentionHistories --namespace=pancake --repository=openclaw-sandbox --retention_id=<id> --cli-region=cn-north-4

Parameters: Same as ShowRetention.

Response format to be verified with actual API call.

Shared Download Domain Operations

1. List Shared Domains

hcloud SWR ListRepoDomains --namespace=pancake --repository=openclaw-sandbox --cli-region=cn-north-4

Parameters:

• --namespace (required): Namespace name (path parameter)
• --repository (required): Repository name (path parameter)
• --cli-region (required): Region ID

Response Example (verified against actual API — flat JSON array):

[
  {
    "namespace": "pancake",
    "repository": "openclaw-sandbox",
    "access_domain": "shijingcheng_test",
    "permit": "read",
    "deadline": "forever",
    "description": "",
    "creator_id": "05949eb5350010e21f85c017722182de",
    "creator_name": "hwstaff_p00506267",
    "created": "2026-04-28T09:18:19.830309Z",
    "updated": "2026-04-28T09:18:19.83031Z",
    "status": true
  }
]

Key Fields:

• access_domain: Shared download domain name
• permit: Permission type (read)
• deadline: Expiration (forever or specific date string)
• description: Domain description
• status: Whether domain is active (boolean)
• created/updated: Timestamps (NOT created_at/updated_at)

2. Create Shared Domain

hcloud SWR CreateRepoDomains --namespace=pancake --repository=openclaw-sandbox --domain=shared-domain-name --cli-region=cn-north-4

Parameters:

• --namespace (required): Namespace name (path parameter)
• --repository (required): Repository name (path parameter)
• --domain (required, body): Shared download domain name
• --cli-region (required): Region ID

3. Show Shared Domain Details

hcloud SWR ShowAccessDomain --namespace=pancake --repository=openclaw-sandbox --access_domain=shijingcheng_test --cli-region=cn-north-4

Parameters:

• --namespace (required): Namespace name
• --repository (required): Repository name
• --access_domain (required): Domain name (path parameter)
• --cli-region (required): Region ID

4. Update Shared Domain

hcloud SWR UpdateRepoDomains --namespace=pancake --repository=openclaw-sandbox --domain=shared-domain-name --permit=read --cli-region=cn-north-4

Parameters:

• --namespace (required): Namespace name
• --repository (required): Repository name
• --domain (required): Domain name
• --permit (required): Permission type (read)
• --cli-region (required): Region ID

5. Delete Shared Domain

hcloud SWR DeleteRepoDomains --namespace=pancake --repository=openclaw-sandbox --access_domain=shared-domain-name --cli-region=cn-north-4

Parameters:

• --namespace (required): Namespace name
• --repository (required): Repository name
• --access_domain (required): Domain name
• --cli-region (required): Region ID

Image Sharing Operations

1. List Shared Repositories

hcloud SWR ListSharedReposDetails --cli-region=cn-north-4

Parameters:

• --cli-region (required): Region ID

Response: Returns flat array of repository objects with same fields as ListReposDetails (name, category, description, size, is_public, num_images, num_download, created_at, updated_at, path, internal_path, domain_name, namespace, tags, status, total_range).

2. List Shared Repository Details

hcloud SWR ListSharedRepoDetails --cli-region=cn-north-4

Parameters:

• --cli-region (required): Region ID

3. Show Share Feature Gates

hcloud SWR ShowShareFeatureGates --cli-region=cn-north-4

Parameters:

• --cli-region (required): Region ID

Response Example (verified against actual API):

{
  "enable_experience": true,
  "enable_hss_service": true,
  "enable_image_scan": true,
  "enable_sm3": false,
  "enable_image_sync": true,
  "enable_cci_service": true,
  "enable_image_label": false,
  "enable_pipeline": true,
  "enable_authorization_token": true,
  "enable_resource": true,
  "enable_list_v3": true,
  "enable_image_quota": false,
  "enable_cosign_signature": true,
  "enable_enterprise_edition_link": false,
  "enable_customize_validity_period": true,
  "swr_util_download_url": ""
}

Key Feature Gates:

• enable_experience: Shared image experience enabled
• enable_image_scan: Security scanning enabled
• enable_image_sync: Cross-region sync enabled
• enable_cosign_signature: Cosign signature verification enabled
• enable_authorization_token: Authorization token enabled
• enable_cci_service: CCI service integration enabled

4. List Global Feature Gates

hcloud SWR ListGlobalFeatureGates --cli-region=cn-north-4

Parameters:

• --cli-region (required): Region ID

Response Example (verified against actual API):

{
  "enableUserDefObs": true,
  "enableEnterprise": true,
  "cerAvailable": true,
  "enableIntranetAccessSwitch": true,
  "enableOBSEncryptUserKmsKey": true
}

Key Feature Gates:

• enableUserDefObs: Custom OBS bucket for image sync
• enableEnterprise: Enterprise edition features
• enableIntranetAccessSwitch: Intranet access control
• enableOBSEncryptUserKmsKey: OBS encryption with user KMS key

Repository Accessory & Reference Operations

1. List Repository Accessories

hcloud SWR ListRepoAccessories --namespace=pancake --repository=openclaw-sandbox --cli-region=cn-north-4

Parameters:

• --namespace (required): Namespace name
• --repository (required): Repository name
• --cli-region (required): Region ID

Response Example (verified against actual API):

{
  "total": 0,
  "accessories": null
}

Key Fields:

• total: Total count of accessories
• accessories: Array of accessory objects (null when empty)

2. List Repository References

hcloud SWR ListReferences --namespace=pancake --repository=openclaw-sandbox --cli-region=cn-north-4

Parameters:

• --namespace (required): Namespace name
• --repository (required): Repository name
• --cli-region (required): Region ID

Common Region IDs

Common Errors

Related Documentation

• Huawei Cloud SWR Documentation
• hcloud CLI Documentation
• Huawei Cloud API Explorer

Task: Image Sharing

Overview

SWR image sharing allows repositories to be shared across organizations and users. This task covers listing shared repositories, querying sharing feature gates, checking global feature gates, checking agency status, creating agency delegation, and listing repository accessories and references.

Operations Catalog

Workflows

W1: List Shared Repositories

# List all shared repositories
hcloud SWR ListSharedReposDetails --cli-region=cn-north-4

Response: Returns flat array of repository objects with same fields as ListReposDetails (name, category, description, size, is_public, num_images, num_download, created_at, updated_at, path, internal_path, domain_name, namespace, tags, status, total_range).

# List shared repository details
hcloud SWR ListSharedRepoDetails --cli-region=cn-north-4

W2: Check Sharing Feature Gates

hcloud SWR ShowShareFeatureGates --cli-region=cn-north-4

Output Fields (verified against actual API):

{
  "enable_experience": true,
  "enable_hss_service": true,
  "enable_image_scan": true,
  "enable_sm3": false,
  "enable_image_sync": true,
  "enable_cci_service": true,
  "enable_image_label": false,
  "enable_pipeline": true,
  "enable_authorization_token": true,
  "enable_resource": true,
  "enable_list_v3": true,
  "enable_image_quota": false,
  "enable_cosign_signature": true,
  "enable_enterprise_edition_link": false,
  "enable_customize_validity_period": true,
  "swr_util_download_url": ""
}

Key Feature Gates:

• enable_experience: Whether shared image experience is enabled
• enable_image_scan: Whether security scanning is enabled
• enable_image_sync: Whether cross-region sync is enabled
• enable_cosign_signature: Whether Cosign signature verification is enabled
• enable_authorization_token: Whether authorization token is enabled
• enable_cci_service: Whether CCI service integration is enabled
• enable_pipeline: Whether pipeline feature is enabled

W3: Check Global Feature Gates

hcloud SWR ListGlobalFeatureGates --cli-region=cn-north-4

Output Fields (verified against actual API):

{
  "enableUserDefObs": true,
  "enableEnterprise": true,
  "cerAvailable": true,
  "enableIntranetAccessSwitch": true,
  "enableOBSEncryptUserKmsKey": true
}

Key Feature Gates:

• enableUserDefObs: Whether custom OBS bucket for image sync is enabled
• enableEnterprise: Whether enterprise edition features are enabled
• cerAvailable: Whether CER is available
• enableIntranetAccessSwitch: Whether intranet access toggle is available
• enableOBSEncryptUserKmsKey: Whether OBS encryption with user KMS key is enabled

W4: Check Agency Delegation

# Check if agency delegation is configured
hcloud SWR CheckAgency --cli-region=cn-north-4

Output Fields (verified against actual API):

{
  "domain_id": "05949eb4190010e40f36c017b62fafa0",
  "is_agency": true
}

• is_agency: Whether agency delegation is configured (boolean)
• domain_id: Domain ID (hex string)

Use Cases:

• Before setting up image sync, verify agency is configured
• Before creating CCE triggers, verify agency is configured
• Troubleshoot agency-related feature failures

W5: Create Agency Delegation

# Create agency delegation for SWR
hcloud SWR CreateAgency --cli-region=cn-north-4

When to create agency:

• CheckAgency returns is_agency: false
• You need to use image sync (requires OBS access)
• You need to create CCE triggers (requires CCE access)

Post-creation Verification:

hcloud SWR CheckAgency --cli-region=cn-north-4

Expected: is_agency should now be true.

W6: List Repository Accessories

hcloud SWR ListRepoAccessories --namespace=pancake --repository=openclaw-sandbox --cli-region=cn-north-4

Output Fields (verified against actual API):

{
  "total": 0,
  "accessories": null
}

• total: Total count of accessories
• accessories: Array of accessory objects (null when empty)

W7: List Repository References

hcloud SWR ListReferences --namespace=pancake --repository=openclaw-sandbox --cli-region=cn-north-4

Common Scenarios

S1: Pre-Deployment Feature Check

Before deploying features that depend on SWR capabilities:

# Check sharing features
hcloud SWR ShowShareFeatureGates --cli-region=cn-north-4

# Check global features
hcloud SWR ListGlobalFeatureGates --cli-region=cn-north-4

# Check agency
hcloud SWR CheckAgency --cli-region=cn-north-4

S2: Setup for Image Sync

Before configuring cross-region image sync:

# 1. Check if image sync feature is enabled
hcloud SWR ShowShareFeatureGates --cli-region=cn-north-4
# Verify enable_image_sync is true

# 2. Check if OBS feature is enabled
hcloud SWR ListGlobalFeatureGates --cli-region=cn-north-4
# Verify enableUserDefObs is true

# 3. Check and configure agency
hcloud SWR CheckAgency --cli-region=cn-north-4
# If is_agency is false:
hcloud SWR CreateAgency --cli-region=cn-north-4

S3: Audit Shared Image Inventory

Review all shared repositories across the organization:

# List all shared repositories
hcloud SWR ListSharedReposDetails --cli-region=cn-north-4

# For specific shared repos, check accessories and references
hcloud SWR ListRepoAccessories --namespace=<ns> --repository=<repo> --cli-region=cn-north-4
hcloud SWR ListReferences --namespace=<ns> --repository=<repo> --cli-region=cn-north-4

Task: Namespace Permissions

Overview

SWR namespace permissions control who can access and manage images within an organization (namespace). This task covers granting, querying, modifying, and revoking namespace-level permissions.

Operations Catalog

Workflows

W1: Audit Namespace Permissions

# Show who has access to a namespace
hcloud SWR ShowNamespaceAuth --namespace=pancake --cli-region=cn-north-4

Output Fields (verified against actual API):

• id: Namespace numeric ID
• name: Namespace name
• creator_name: Creator IAM user name
• self_auth: Your own permission object (separate from others)
• user_id: Your IAM user ID
• user_name: Your IAM user name
• auth: Your permission level (7=manage, 3=edit, 1=read)
• others_auths: Array of other users' permission objects
• Each has user_id, user_name, auth fields

⚠️ Important: self_auth is separate from others_auths. When auditing, check both to get the complete access list.

W2: Grant Namespace Permission

Pre-grant Checklist: 1. Verify namespace exists: hcloud SWR ShowNamespace --namespace=<name> --cli-region=cn-north-4 2. Obtain the target user's IAM user ID and user name 3. Decide the appropriate auth level:

• 7 (manage): Full control — can create/delete repos, manage permissions
• 3 (edit): Push and pull — can push images and pull images
• 1 (read): Pull only — can only pull images

# Grant manage permission (full control)
hcloud SWR CreateNamespaceAuth --namespace=pancake --1.auth=7 --1.user_id=05949eb5350010e21f85c017722182de --1.user_name=hwstaff_p00506267 --cli-region=cn-north-4

# Grant edit permission (push/pull)
hcloud SWR CreateNamespaceAuth --namespace=pancake --1.auth=3 --1.user_id=<user-id> --1.user_name=<user-name> --cli-region=cn-north-4

# Grant read permission (pull only)
hcloud SWR CreateNamespaceAuth --namespace=pancake --1.auth=1 --1.user_id=<user-id> --1.user_name=<user-name> --cli-region=cn-north-4

# Grant permissions to multiple users at once
hcloud SWR CreateNamespaceAuth --namespace=pancake --1.auth=7 --1.user_id=<id1> --1.user_name=<name1> --2.auth=3 --2.user_id=<id2> --2.user_name=<name2> --cli-region=cn-north-4

⚠️ Array-Style Parameters: Use --1.auth, --1.user_id, --1.user_name (1-based index). NOT --auth, --user_id or --0.auth.

Post-grant Verification:

hcloud SWR ShowNamespaceAuth --namespace=pancake --cli-region=cn-north-4

W3: Modify Namespace Permission

Change an existing user's permission level:

# Downgrade from manage to edit
hcloud SWR UpdateNamespaceAuth --namespace=pancake --1.auth=3 --1.user_id=05949eb5350010e21f85c017722182de --1.user_name=hwstaff_p00506267 --cli-region=cn-north-4

# Upgrade from read to edit
hcloud SWR UpdateNamespaceAuth --namespace=pancake --1.auth=3 --1.user_id=<user-id> --1.user_name=<user-name> --cli-region=cn-north-4

Post-update Verification:

hcloud SWR ShowNamespaceAuth --namespace=pancake --cli-region=cn-north-4

W4: Revoke Namespace Permission

⚠️ CAUTION: Revoking namespace permission removes access to the namespace AND ALL repositories under it.

hcloud SWR DeleteNamespaceAuth --namespace=pancake --1.user_id=05949eb5350010e21f85c017722182de --1.user_name=hwstaff_p00506267 --cli-region=cn-north-4

Pre-revoke Checklist: 1. Check if the user has repository-level permissions that should be preserved 2. Confirm with the user that they understand the impact 3. Consider whether a downgrade (Update) is more appropriate than full revocation (Delete)

Post-revoke Verification:

hcloud SWR ShowNamespaceAuth --namespace=pancake --cli-region=cn-north-4

Common Scenarios

S1: Team Access Setup

Grant appropriate permissions to team members:

# Grant manage to team lead
hcloud SWR CreateNamespaceAuth --namespace=team-backend --1.auth=7 --1.user_id=<lead-id> --1.user_name=<lead-name> --cli-region=cn-north-4

# Grant edit to developers
hcloud SWR CreateNamespaceAuth --namespace=team-backend --1.auth=3 --1.user_id=<dev1-id> --1.user_name=<dev1-name> --2.auth=3 --2.user_id=<dev2-id> --2.user_name=<dev2-name> --cli-region=cn-north-4

# Grant read to QA team
hcloud SWR CreateNamespaceAuth --namespace=team-backend --1.auth=1 --1.user_id=<qa-id> --1.user_name=<qa-name> --cli-region=cn-north-4

S2: Permission Audit

Regularly review who has access:

# For each namespace, check permissions
hcloud SWR ShowNamespaceAuth --namespace=team-backend --cli-region=cn-north-4

# Downgrade overly broad permissions
hcloud SWR UpdateNamespaceAuth --namespace=team-backend --1.auth=3 --1.user_id=<user-id> --1.user_name=<user-name> --cli-region=cn-north-4

S3: Least Privilege Implementation

Apply least privilege by using the minimum auth level needed:

Task: Repository Permissions

Overview

SWR repository permissions provide granular access control for individual image repositories within a namespace. This task covers granting, querying, modifying, and revoking repository-level permissions.

Operations Catalog

Workflows

W1: Audit Repository Permissions

# Show who has access to a specific repository
hcloud SWR ShowUserRepositoryAuth --namespace=pancake --repository=openclaw-sandbox --cli-region=cn-north-4

Output Fields (verified against actual API):

• id: Repository numeric ID
• name: Repository name
• self_auth: Your own permission object
• user_id: Your IAM user ID
• user_name: Your IAM user name
• auth: Your permission level (7=manage, 3=edit, 1=read)
• others_auths: Array of other users' permission objects
• Each has user_id, user_name, auth fields

⚠️ Important: Same structure as namespace auth — self_auth is separate from others_auths.

W2: Grant Repository Permission

Pre-grant Checklist: 1. Verify repository exists: hcloud SWR ShowRepository --namespace=<name> --repository=<repo> --cli-region=cn-north-4 2. Obtain the target user's IAM user ID and user name 3. Decide the appropriate auth level (7=manage, 3=edit, 1=read)

# Grant manage permission on a repository
hcloud SWR CreateUserRepositoryAuth --namespace=pancake --repository=openclaw-sandbox --1.auth=7 --1.user_id=05949eb5350010e21f85c017722182de --1.user_name=hwstaff_p00506267 --cli-region=cn-north-4

# Grant edit permission (push/pull)
hcloud SWR CreateUserRepositoryAuth --namespace=pancake --repository=openclaw-sandbox --1.auth=3 --1.user_id=<user-id> --1.user_name=<user-name> --cli-region=cn-north-4

# Grant read permission (pull only)
hcloud SWR CreateUserRepositoryAuth --namespace=pancake --repository=openclaw-sandbox --1.auth=1 --1.user_id=<user-id> --1.user_name=<user-name> --cli-region=cn-north-4

⚠️ Array-Style Parameters: Same format as namespace permissions — use --1.auth, --1.user_id, --1.user_name (1-based index).

Post-grant Verification:

hcloud SWR ShowUserRepositoryAuth --namespace=pancake --repository=openclaw-sandbox --cli-region=cn-north-4

W3: Modify Repository Permission

# Downgrade from manage to edit
hcloud SWR UpdateUserRepositoryAuth --namespace=pancake --repository=openclaw-sandbox --1.auth=3 --1.user_id=05949eb5350010e21f85c017722182de --1.user_name=hwstaff_p00506267 --cli-region=cn-north-4

# Upgrade from read to edit
hcloud SWR UpdateUserRepositoryAuth --namespace=pancake --repository=openclaw-sandbox --1.auth=3 --1.user_id=<user-id> --1.user_name=<user-name> --cli-region=cn-north-4

W4: Revoke Repository Permission

hcloud SWR DeleteUserRepositoryAuth --namespace=pancake --repository=openclaw-sandbox --1.user_id=05949eb5350010e21f85c017722182de --1.user_name=hwstaff_p00506267 --cli-region=cn-north-4

Post-revoke Verification:

hcloud SWR ShowUserRepositoryAuth --namespace=pancake --repository=openclaw-sandbox --cli-region=cn-north-4

Namespace vs Repository Permissions

When to use each:

• Namespace permission: When a user needs consistent access across all repos in the namespace
• Repository permission: When a user only needs access to specific repos, or when you want to grant different levels for different repos

Common Scenarios

S1: External Partner Access to Specific Repository

Grant an external partner read access to only one repository:

# Grant read on a specific repo (not the whole namespace)
hcloud SWR CreateUserRepositoryAuth --namespace=team-backend --repository=shared-base-image --1.auth=1 --1.user_id=<partner-id> --1.user_name=<partner-name> --cli-region=cn-north-4

S2: CI/CD Pipeline Push Access

Grant a CI/CD pipeline edit access to push images:

# Grant edit (push/pull) on specific repository
hcloud SWR CreateUserRepositoryAuth --namespace=team-backend --repository=my-app --1.auth=3 --1.user_id=<pipeline-id> --1.user_name=<pipeline-name> --cli-region=cn-north-4

S3: Mixed Permission Levels

Grant different levels for different repositories within the same namespace:

# Grant edit on development repo
hcloud SWR CreateUserRepositoryAuth --namespace=team-backend --repository=my-app-dev --1.auth=3 --1.user_id=<dev-id> --1.user_name=<dev-name> --cli-region=cn-north-4

# Grant read on production repo
hcloud SWR CreateUserRepositoryAuth --namespace=team-backend --repository=my-app-prod --1.auth=1 --1.user_id=<dev-id> --1.user_name=<dev-name> --cli-region=cn-north-4

Task: Retention Management

Overview

SWR retention rules automate the cleanup of old image tags, helping manage storage and maintain a clean repository. This task covers creating, listing, updating, deleting retention rules, and viewing execution histories.

Operations Catalog

Workflows

W1: List Retention Rules

# List all retention rules for a repository
hcloud SWR ListRetentions --namespace=pancake --repository=openclaw-sandbox --cli-region=cn-north-4

Output: Returns a flat JSON array. When no rules exist, returns [].

W2: Create a Retention Rule

Retention rules define which tags to keep. Tags NOT matching any rule condition will be deleted during execution.

Rule Templates:

• tag_rule: Keep a specified number of the most recent tags (by num)
• date_rule: Keep tags created within a specified number of days (by days)

Tag Selector Kinds:

• label: Exact tag name match (e.g., latest, v1.0)
• regexp: Regular expression pattern match (e.g., v\d+\.\d+)

Algorithm: or — a tag is retained if it matches ANY rule (OR logic)

# Keep last 10 tags (regardless of age)
hcloud SWR CreateRetention --namespace=pancake --repository=openclaw-sandbox \
  --algorithm=or \
  --rules.1.template=tag_rule \
  --rules.1.params.num=10 \
  --rules.1.tag_selectors.1.kind=label \
  --rules.1.tag_selectors.1.pattern=latest \
  --cli-region=cn-north-4

# Keep tags from last 30 days
hcloud SWR CreateRetention --namespace=pancake --repository=openclaw-sandbox \
  --algorithm=or \
  --rules.1.template=date_rule \
  --rules.1.params.days=30 \
  --rules.1.tag_selectors.1.kind=label \
  --rules.1.tag_selectors.1.pattern=latest \
  --cli-region=cn-north-4

# Multiple rules: keep last 5 tags OR keep tags from last 30 days
hcloud SWR CreateRetention --namespace=pancake --repository=openclaw-sandbox \
  --algorithm=or \
  --rules.1.template=tag_rule \
  --rules.1.params.num=5 \
  --rules.1.tag_selectors.1.kind=label \
  --rules.1.tag_selectors.1.pattern=latest \
  --rules.2.template=date_rule \
  --rules.2.params.days=30 \
  --rules.2.tag_selectors.1.kind=regexp \
  --rules.2.tag_selectors.1.pattern=v\d+ \
  --cli-region=cn-north-4

# Protect specific tags with label selector (these will always be kept)
hcloud SWR CreateRetention --namespace=pancake --repository=openclaw-sandbox \
  --algorithm=or \
  --rules.1.template=tag_rule \
  --rules.1.params.num=10 \
  --rules.1.tag_selectors.1.kind=label \
  --rules.1.tag_selectors.1.pattern=latest \
  --rules.1.tag_selectors.2.kind=label \
  --rules.1.tag_selectors.2.pattern=stable \
  --cli-region=cn-north-4

⚠️ Nested Array Format: Rules use deeply nested arrays:

• --rules.1.template (outer array, 1-based)
• --rules.1.tag_selectors.1.kind (inner array, 1-based)
• Index starts from 1 (not 0)

Tag Selector Purpose: Tag selectors define WHICH tags the rule applies to. Use label kind with important tag names (like latest, stable) to protect them from cleanup, or use regexp to match version patterns.

Post-creation Verification:

hcloud SWR ListRetentions --namespace=pancake --repository=openclaw-sandbox --cli-region=cn-north-4

W3: View Retention Rule Details

hcloud SWR ShowRetention --namespace=pancake --repository=openclaw-sandbox --retention_id=<id> --cli-region=cn-north-4

Response format to be verified with actual API call.

W4: Update a Retention Rule

# Change retention to keep only last 5 tags
hcloud SWR UpdateRetention --namespace=pancake --repository=openclaw-sandbox \
  --retention_id=<id> \
  --algorithm=or \
  --rules.1.template=tag_rule \
  --rules.1.params.num=5 \
  --rules.1.tag_selectors.1.kind=label \
  --rules.1.tag_selectors.1.pattern=latest \
  --cli-region=cn-north-4

Parameters: Same as CreateRetention, plus --retention_id.

W5: Delete a Retention Rule

⚠️ CAUTION: Deleting a retention rule stops automated cleanup. Old tags will accumulate indefinitely.

hcloud SWR DeleteRetention --namespace=pancake --repository=openclaw-sandbox --retention_id=<id> --cli-region=cn-north-4

Post-deletion Verification:

hcloud SWR ListRetentions --namespace=pancake --repository=openclaw-sandbox --cli-region=cn-north-4

W6: View Retention Execution History

hcloud SWR ListRetentionHistories --namespace=pancake --repository=openclaw-sandbox --retention_id=<id> --cli-region=cn-north-4

Response format to be verified with actual API call.

Common Scenarios

S1: Standard Cleanup Policy for Development Repository

Keep a reasonable number of recent tags:

# Keep last 10 tags to manage storage
hcloud SWR CreateRetention --namespace=dev-team --repository=my-app \
  --algorithm=or \
  --rules.1.template=tag_rule \
  --rules.1.params.num=10 \
  --rules.1.tag_selectors.1.kind=label \
  --rules.1.tag_selectors.1.pattern=latest \
  --cli-region=cn-north-4

S2: Production Repository with Strict Retention

Keep production images for a longer period:

# Keep all tags from last 90 days in production repo
hcloud SWR CreateRetention --namespace=prod-team --repository=my-app \
  --algorithm=or \
  --rules.1.template=date_rule \
  --rules.1.params.days=90 \
  --rules.1.tag_selectors.1.kind=regexp \
  --rules.1.tag_selectors.1.pattern=v\d+\.\d+\.\d+ \
  --cli-region=cn-north-4

S3: Protect Important Tags While Cleaning Old Ones

Use tag selectors to protect critical tags:

# Keep last 3 tags, but always protect latest and stable
hcloud SWR CreateRetention --namespace=team-backend --repository=gateway \
  --algorithm=or \
  --rules.1.template=tag_rule \
  --rules.1.params.num=3 \
  --rules.1.tag_selectors.1.kind=label \
  --rules.1.tag_selectors.1.pattern=latest \
  --rules.1.tag_selectors.2.kind=label \
  --rules.1.tag_selectors.2.pattern=stable \
  --cli-region=cn-north-4

S4: Batch Apply Retention to All Repositories

Apply retention rules to all repositories in a namespace:

# 1. List all repositories in the namespace
hcloud SWR ListReposDetails --namespace=team-backend --cli-region=cn-north-4

# 2. For each repository, create a retention rule
hcloud SWR CreateRetention --namespace=team-backend --repository=<repo-name> \
  --algorithm=or \
  --rules.1.template=tag_rule \
  --rules.1.params.num=10 \
  --rules.1.tag_selectors.1.kind=label \
  --rules.1.tag_selectors.1.pattern=latest \
  --cli-region=cn-north-4

Retention Rule Design Guide

Task: Shared Domains

Overview

SWR shared download domains allow other organizations or users to download images from your repository without direct repository permissions. This task covers creating, listing, viewing, updating, and deleting shared download domains.

Operations Catalog

Workflows

W1: List Shared Domains

# List all shared download domains for a repository
hcloud SWR ListRepoDomains --namespace=pancake --repository=openclaw-sandbox --cli-region=cn-north-4

Output Fields (verified against actual API — flat JSON array):

[
  {
    "namespace": "pancake",
    "repository": "openclaw-sandbox",
    "access_domain": "shijingcheng_test",
    "permit": "read",
    "deadline": "forever",
    "description": "",
    "creator_id": "05949eb5350010e21f85c017722182de",
    "creator_name": "hwstaff_p00506267",
    "created": "2026-04-28T09:18:19.830309Z",
    "updated": "2026-04-28T09:18:19.83031Z",
    "status": true
  }
]

Key Fields:

• access_domain: Domain name used for shared access
• permit: Permission type (read)
• deadline: Expiration — forever or specific date string
• description: Domain description
• creator_id/creator_name: Who created the domain
• created/updated: Timestamps (NOT created_at/updated_at)
• status: Whether the domain is active (boolean)

W2: Create a Shared Domain

# Create a shared download domain
hcloud SWR CreateRepoDomains --namespace=pancake --repository=openclaw-sandbox --domain=shared-domain-name --cli-region=cn-north-4

Parameters:

• --namespace (required): Namespace name (path parameter)
• --repository (required): Repository name (path parameter)
• --domain (required, body): Shared download domain name
• --cli-region (required): Region ID

Post-creation Verification:

hcloud SWR ListRepoDomains --namespace=pancake --repository=openclaw-sandbox --cli-region=cn-north-4

W3: View Shared Domain Details

hcloud SWR ShowAccessDomain --namespace=pancake --repository=openclaw-sandbox --access_domain=shijingcheng_test --cli-region=cn-north-4

Parameters:

• --namespace (required): Namespace name
• --repository (required): Repository name
• --access_domain (required): Domain name to query
• --cli-region (required): Region ID

W4: Update a Shared Domain

# Update domain permit or deadline
hcloud SWR UpdateRepoDomains --namespace=pancake --repository=openclaw-sandbox --domain=shared-domain-name --permit=read --cli-region=cn-north-4

Parameters:

• --namespace (required): Namespace name
• --repository (required): Repository name
• --domain (required): Domain name
• --permit (required): Permission type (read)
• --cli-region (required): Region ID

W5: Delete a Shared Domain

⚠️ CAUTION: Deleting a shared domain removes the ability for external users to download images via this domain.

hcloud SWR DeleteRepoDomains --namespace=pancake --repository=openclaw-sandbox --access_domain=shared-domain-name --cli-region=cn-north-4

Parameters:

• --namespace (required): Namespace name
• --repository (required): Repository name
• --access_domain (required): Domain name to delete
• --cli-region (required): Region ID

Post-deletion Verification:

hcloud SWR ListRepoDomains --namespace=pancake --repository=openclaw-sandbox --cli-region=cn-north-4

Common Scenarios

S1: Share Base Image with Other Teams

Allow other teams to pull your base image:

# Create a shared domain for the base image repository
hcloud SWR CreateRepoDomains --namespace=team-infra --repository=base-ubuntu --domain=team-infra-shared --cli-region=cn-north-4

# Verify the domain is active
hcloud SWR ShowAccessDomain --namespace=team-infra --repository=base-ubuntu --access_domain=team-infra-shared --cli-region=cn-north-4

S2: Audit Shared Domains

Review all shared domains across repositories:

# For each repository, list shared domains
hcloud SWR ListRepoDomains --namespace=pancake --repository=openclaw-sandbox --cli-region=cn-north-4

# Check domain details
hcloud SWR ShowAccessDomain --namespace=pancake --repository=openclaw-sandbox --access_domain=<domain-name> --cli-region=cn-north-4

S3: Clean Up Expired or Unnecessary Domains

Remove shared domains that are no longer needed:

# List domains to identify expired ones
hcloud SWR ListRepoDomains --namespace=pancake --repository=openclaw-sandbox --cli-region=cn-north-4

# Delete unnecessary domains
hcloud SWR DeleteRepoDomains --namespace=pancake --repository=openclaw-sandbox --access_domain=<domain-name> --cli-region=cn-north-4

Verification Method - SWR Image Governance Skill

Overview

This document defines the verification steps for the SWR image governance skill. Verification is divided into three levels: installation verification, configuration verification, and functional verification.

Level 1: Installation Verification

1.1 hcloud CLI Installation

1.2 hcloud CLI First Run

# Accept privacy statement (first time only)
printf "y\n" | hcloud version

Expected: Version number displayed without error.

Level 2: Configuration Verification

2.1 Credential Configuration

✅ Correct: Use hcloud configure list to verify ❌ Incorrect: Do NOT use echo $HUAWEI_CLOUD_AK to check credentials

2.2 Connectivity Test

# Test API connectivity with a read-only operation
hcloud SWR CheckAgency --cli-region=cn-north-4

Expected: Returns HTTP 200 and agency status JSON.

Level 3: Functional Verification

3.1 Namespace Permissions

# Show namespace permissions (requires an existing namespace)
hcloud SWR ShowNamespaceAuth --namespace=<your-namespace> --cli-region=cn-north-4

Expected: Returns namespace auth information with self_auth and others_auths.

# Grant namespace permission (requires IAM user ID and name)
hcloud SWR CreateNamespaceAuth --namespace=<your-namespace> --1.auth=1 --1.user_id=<user-id> --1.user_name=<user-name> --cli-region=cn-north-4

Expected: Permission created successfully.

# Verify permission was granted
hcloud SWR ShowNamespaceAuth --namespace=<your-namespace> --cli-region=cn-north-4

Expected: New user appears in others_auths with auth level 1.

# Clean up: revoke permission
hcloud SWR DeleteNamespaceAuth --namespace=<your-namespace> --1.user_id=<user-id> --1.user_name=<user-name> --cli-region=cn-north-4

Expected: Permission revoked successfully.

3.2 Repository Permissions

# Show repository permissions
hcloud SWR ShowUserRepositoryAuth --namespace=<your-namespace> --repository=<your-repo> --cli-region=cn-north-4

Expected: Returns repository auth information.

3.3 Agency Check

# Check agency delegation status
hcloud SWR CheckAgency --cli-region=cn-north-4

Expected: Returns is_agency boolean.

3.4 Feature Gates

# Check sharing feature gates
hcloud SWR ShowShareFeatureGates --cli-region=cn-north-4

Expected: Returns feature gate object with boolean values.

# Check global feature gates
hcloud SWR ListGlobalFeatureGates --cli-region=cn-north-4

Expected: Returns global feature gate object.

3.5 Shared Domains

# List shared domains for a repository
hcloud SWR ListRepoDomains --namespace=<your-namespace> --repository=<your-repo> --cli-region=cn-north-4

Expected: Returns domain list (may be empty array []).

3.6 Retention Rules

# List retention rules
hcloud SWR ListRetentions --namespace=<your-namespace> --repository=<your-repo> --cli-region=cn-north-4

Expected: Returns retention rule list (may be empty array []).

3.7 Repository Accessories

# List accessories
hcloud SWR ListRepoAccessories --namespace=<your-namespace> --repository=<your-repo> --cli-region=cn-north-4

Expected: Returns accessories object with total and accessories fields.

Verification Checklist