hcloud

Note: Some features mentioned above (e.g., replication policies) are managed via the SWR enterprise instance console, not through this skill's CLI commands. See the Unsupported Operations section below for details.

• huawei-cloud-swr-image-management

  - Image lifecycle management (basic SWR namespaces, repos, tags, auth, quotas)

• huawei-cloud-swr-image-governance

  - Image governance (permissions, retention, sharing, tags, immutable rules)

• huawei-cloud-swr-image-automation

  - Image automation ops (sync, triggers, domains)
• Create and manage SWR enterprise instances
• Manage instance namespaces with security scanning and vulnerability blocking
• Configure instance registries for cross-instance image sync
• Query and manage instance repositories and artifacts
• Obtain instance access credentials (long-term and temporary)
• Configure instance network access (internal VPC endpoints, public access with whitelist)
• Manage custom domains for instance access
• Monitor instance statistics and job status

• "Create an SWR enterprise instance for my organization"
• "List all enterprise instances in my project"
• "Create a namespace with auto-scan and vulnerability blocking"
• "Configure a registry for syncing images to another instance"
• "List repositories and artifacts in my instance"
• "Get docker login credentials for my instance"
• "Add a VPC internal endpoint for my instance"
• "Enable public access with IP whitelist"
• "Add a custom domain to my instance"
• "Check instance statistics and resource usage"

• hcloud CLI installed (version >= 7.2.2)
• Run

  hcloud version

  to verify installation
• First-time usage:

  printf "y\n" | hcloud version

  to accept privacy statement

1. Access the SWR enterprise instance console via direct URL:

   https://console.huaweicloud.com/swr-instance

   • Important: The SWR enterprise instance console is not available from the main console navigation menu. Users must use this direct URL to access it.
2. If prompted, review and accept the SWR enterprise service terms
3. Confirm the service is activated by verifying the console loads successfully
4. If activation is not available in the target region, the console will display an error or the service will not be listed

hcloud SWR ListInstance --cli-region=<region>

• SWR Enterprise Instance Console:

  https://console.huaweicloud.com/swr-instance

• This URL provides access to instance management, namespace configuration, repository browsing, and replication policy setup
• The console is region-aware — select the target region in the top-right corner after opening the URL

1. When any command fails due to permission errors, read

   references/iam-policies.md

2. Display the required permission list and policy JSON to the user
3. Guide the user to create a custom policy in the IAM console and grant authorization
4. Pause execution and wait for user confirmation that permissions have been granted

ShowInstance

• hcloud SWR ListInstanceInternalEndpoints --instance_id=<instance-id> --cli-region=cn-north-4

  for internal VPC endpoints

• hcloud SWR ShowInstanceEndpointPolicy --instance_id=<instance-id> --cli-region=cn-north-4

  for public access status and whitelist

1. Instance naming & VPC: Use descriptive names (

   prod-instance

   ,

   dev-instance

   ); choose VPC/subnet matching your workload environment
2. Namespace security: Enable

   auto_scan=true

   and

   prevent_vul=true

   for production; set

   severity=high

   /

   critical

   for prod,

   none

   /

   low

   for dev
3. Credentials: Store registry credentials securely and rotate periodically; use

   CreateInstanceLtCredential

   for CI/CD,

   CreateInstanceTempCredential

   for temp access
4. Public access: Always configure IP whitelist when enabling public access via

   UpdateInstanceEndpointPolicy

   ; use SCM certificates for custom domain HTTPS
5. Delete with caution: Deleting an instance removes ALL data permanently; deleting a namespace removes ALL repositories
6. Instance spec: Use

   swr.ee.basic

   for small teams;

   swr.ee.professional

   for enterprise with advanced features

1. Prerequisites Check — Verify hcloud CLI installation and credential configuration
2. Instance Identification — List or show existing instances to obtain

   instance_id

3. Operation Execution — Execute the requested operation (create/update/delete/query)
4. Result Verification — Confirm the operation succeeded by querying the resulting state
5. Credential Management — For write operations, obtain and securely store any returned credentials
6. Cleanup Confirmation — For destructive operations, confirm with the user before proceeding

• Instance deletion is irreversible — removes ALL namespaces, repositories, artifacts, and data permanently
• Namespace deletion is irreversible — removes all repositories and artifacts under it
• Artifact deletion is irreversible — the image version cannot be recovered
• Default domain cannot be deleted — only custom domains can be removed
• AK/SK must never be hardcoded — credentials should only be obtained via environment variables
• hcloud CLI is the only supported method — all operations use

  hcloud SWR <Operation>

  format
• Pagination offset must be multiple of limit —

  offset

  must be 0 or a multiple of

  limit

• Registry credential.access_secret is sensitive — never expose or log access secrets
• SWR enterprise service must be activated first — access

  https://console.huaweicloud.com/swr-instance

  to activate before creating instances
• Console access requires direct URL — the SWR enterprise instance console is not in the main navigation menu; use

  https://console.huaweicloud.com/swr-instance

• Spec availability varies by region — not all specs are available in all regions; verify before creating instances
• Instance creation incurs hourly costs — inform the user of billing implications before creating an instance