Huawei Cloud SWR Enterprise Instance Management#

Overview#

This skill provides lifecycle management for Huawei Cloud SWR (Software Repository for Container) enterprise instances using hcloud CLI. Enterprise instances provide dedicated, isolated container registry environments with security scanning, replication, and custom domain support.

Architecture: hcloud CLI → SWR API → Instance/Namespace/Registry/Repository/Artifact/Credential/Endpoint/Domain

Related Skills:

• huawei-cloud-swr-image-management - Image lifecycle (basic SWR namespaces, repos, tags, auth, quotas)
• huawei-cloud-swr-image-governance - Image governance (permissions, retention, sharing, immutable rules)
• huawei-cloud-swr-image-automation - Image automation ops (sync, triggers, domains)

Capabilities:

• Instance lifecycle: create/list/show/delete/update configuration
• Namespace management with security scanning and vulnerability blocking
• Registry management for cross-instance image sync
• Repository and artifact management with vulnerability scanning
• Credential management (long-term and temporary)
• Network access (VPC internal endpoints, public access with whitelist)
• Custom domain management
• Statistics and job monitoring

Prerequisites#

0. Enterprise Repository Service Authorization (MANDATORY)#

You must authorize the SWR Enterprise Repository feature before using this skill. Visit https://console.huaweicloud.com/swr-instance to complete authorization. If any API returns an authorization error, direct the user to this link and wait for confirmation.

1. hcloud CLI Requirements (MANDATORY)#

• hcloud CLI installed (version >= 7.2.2)
• Run hcloud version to verify; first-time: printf "y\n" | hcloud version

2. Credential Configuration#

• Valid Huawei Cloud credentials (AK/SK mode via environment variables)
• Never expose AK/SK in code, conversation, or commands
• Use env vars: HUAWEI_CLOUD_AK, HUAWEI_CLOUD_SK, HUAWEI_CLOUD_REGION
• Prefer IAM users over root account; enable MFA for sensitive operations

bash

export HUAWEI_CLOUD_AK=<your-ak>
export HUAWEI_CLOUD_SK=<your-sk>
export HUAWEI_CLOUD_REGION=cn-north-4

3. IAM Permission Requirements#

See IAM Permission Policies for complete permission list and policy JSON.

Permission Failure Handling:

1. When any command fails due to permission errors, read references/iam-policies.md
2. Display the required permission list and policy JSON to the user
3. Guide the user to create a custom policy in IAM console
4. Wait for user confirmation that permissions have been granted

Core Commands#

See Command Reference for full command examples and naming rules.

⚠️ hcloud CLI CreateInstance Bug: hcloud SWR CreateInstance has a duplicate --project_id parameter bug ( 重复的参数:project_id). Use the Python SDK script instead:

bash

python scripts/swr_instance_helper.py create --name=my-instance --spec=swr.ee.basic \
    --vpc_id=<vpc-id> --subnet_id=<subnet-id> \
    --enterprise_project_id=0 --description="My enterprise registry"

All other lifecycle commands (List/Show/Update/Delete) work fine with hcloud CLI.

Resource Types and Commands:

ResourceKey CommandsReferenceInstanceCreate (SDK), List, Show, UpdateConfig, DeleteTask: LifecycleNamespaceCreate, List, Show, Update, DeleteTask: NamespacesRegistryCreate, List, Show, Update, DeleteTask: RegistriesRepositoryList, Show, Update, DeleteTask: RegistriesArtifactList, Show, Scan, DeleteTask: ArtifactsCredentialCreateLt, CreateTemp, List, Update, DeleteTask: CredentialsEndpointCreateInternal, List, Show, Delete, Policy CRUDTask: EndpointsDomainAdd, List, Show, Delete, UpdateTask: DomainsStatistics/JobsListStatistics, ListJobs, ShowJob, DeleteJobCommand Reference

Parameter Reference#

See Parameter Reference for detailed parameter tables (Common, Instance Creation, Namespace, Registry, Endpoint Whitelist).

Output Format#

See Output Format for response format examples.

Verification#

See Verification Method for step-by-step verification.

Best Practices#

1. Instance naming: Use descriptive names reflecting environment ( prod-instance, dev-instance)
2. VPC selection: Choose VPC/subnet matching your workload deployment
3. Namespace security: Enable auto_scan=true and prevent_vul=true for production
4. Severity blocking: high/ critical for production; none/ low for development
5. Registry credentials: Store securely; rotate access keys periodically
6. Public access: Always configure IP whitelist when enabling public access
7. Custom domains: Use SCM certificates for HTTPS
8. Delete with caution: Instance/namespace/artifact deletion is irreversible
9. Credentials: LtCredential for CI/CD; TempCredential for temporary access
10. Spec selection: swr.ee.basic for small teams; swr.ee.professional for enterprise

Reference Documents#

DocumentDescriptionCommand ReferenceFull CLI examples and naming rulesParameter ReferenceParameter tables (Instance, Namespace, Registry, Endpoint)SWR Instance API Guidehcloud SWR instance API referenceSDK Helper ScriptPython SDK for CreateInstance (bypasses hcloud bug)Output FormatResponse format examplesIAM Permission PoliciesRequired permissions and policy JSONVerification MethodStep-by-step verificationCommon PitfallsTroubleshooting guidesTask: Instance LifecycleInstance create, list, show, update configTask: Instance NamespacesNamespace CRUD workflowsTask: Instance RegistriesRegistry CRUD and repositoriesTask: Instance ArtifactsArtifact management and scanningTask: Instance CredentialsCredential management workflowsTask: Instance EndpointsInternal and public access configurationTask: Instance DomainsCustom domain management

Notes#

• Instance deletion is irreversible — removes ALL data permanently
• Namespace deletion is irreversible — removes all repositories and artifacts
• Artifact deletion is irreversible — the image version cannot be recovered
• Default domain cannot be deleted — only custom domains can be removed
• AK/SK must never be hardcoded — use environment variables only
• hcloud CLI CreateInstance bug — use Python SDK script as alternative
• Pagination: offset must be 0 or a multiple of limit
• Registry access_secret is sensitive — never expose or log

Common Pitfalls#

See Common Pitfalls for detailed troubleshooting guides.

Key pitfalls: invalid instance name format, VPC/subnet not found, instance still creating, offset not multiple of limit, registry credential wrong, domain cert not found, cannot delete default domain, public whitelist format, hcloud CreateInstance bug, SWR service quota exceeded.