Huawei Cloud SWR Image Automation#

Overview#

This skill provides image automation capabilities for Huawei Cloud SWR (Software Repository for Container) using the hcloud CLI, including cross-region image sync and trigger-based auto-deployment.

Architecture: hcloud CLI → SWR Service API → SyncRepo/Trigger/SyncJob/SyncRegion resources

Related Skills:

• huawei-cloud-swr-image-management - Image lifecycle management (namespaces, repos, tags, auth, quotas)

• huawei-cloud-swr-image-governance - Image governance (permissions, retention, sharing, tags, immutable rules)

• huawei-cloud-swr-enterprise-instance - Enterprise instance management

• Configure auto-sync to replicate images across regions on push

• Manually sync specific image tags to target regions

• List available sync target regions

• Check sync job execution status

• Create and manage triggers for auto-deploy to CCE/CCI workloads

• Enable/disable triggers and update trigger configurations

Typical Use Cases:

• "Set up auto-sync for my image repository to cn-east-3"
• "Manually sync image tags v1.0 and v2.0 to another region"
• "List available regions for image sync"
• "Check the status of my image sync job"
• "Create a trigger to auto-update my CCE deployment when a new image is pushed"
• "List all triggers for a repository"
• "Disable a trigger temporarily"
• "Delete an old trigger configuration"
• "Configure image replication across multiple regions"

Prerequisites#

1. hcloud CLI Requirements (MANDATORY)#

• hcloud CLI installed (version >= 7.2.2)
• Run hcloud version to verify installation
• First-time usage: printf "y\n" | hcloud version to accept privacy statement

2. Credential Configuration#

• Valid Huawei Cloud credentials (AK/SK mode)

• Security Rules:

  • 🚫 Never expose AK/SK values in code, conversation, or commands
  • 🚫 Never use echo $HUAWEI_CLOUD_AK or echo $HUAWEI_CLOUD_SK to check credentials
  • ✅ Use environment variables: HUAWEI_CLOUD_AK, HUAWEI_CLOUD_SK, HUAWEI_CLOUD_REGION
  • ✅ Prefer IAM users over root account for cloud operations
  • ✅ Enable MFA for sensitive operations

Configuration Method (Environment Variables Only):

bash

export HUAWEI_CLOUD_AK=<your-ak>
export HUAWEI_CLOUD_SK=<your-sk>
export HUAWEI_CLOUD_REGION=cn-north-4

⚠️ Important Security Notes:

• Never commit credentials to version control
• Use IAM users with minimal required permissions
• Enable MFA for sensitive operations
• Rotate AK/SK regularly

3. IAM Permission Requirements#

API ActionPermissionPurposeswr:sync:createCreate sync repoConfigure cross-region image syncswr:sync:deleteDelete sync repoRemove sync configurationswr:sync:listList sync reposQuery auto-sync configurationsswr:syncmanual:createManual syncTrigger manual image syncswr:syncregion:listList sync regionsQuery available sync target regionsswr:syncjob:getGet sync job statusCheck sync execution statusswr:trigger:createCreate triggerSet up auto-deploy triggerswr:trigger:listList triggersQuery trigger configurationsswr:trigger:getGet triggerView specific trigger detailsswr:trigger:updateUpdate triggerModify trigger configurationswr:trigger:deleteDelete triggerRemove trigger configuration

See IAM Permission Policies for complete policy JSON.

Permission Failure Handling:

1. When any command fails due to permission errors, read references/iam-policies.md
2. Display the required permission list and policy JSON to the user
3. Guide the user to create a custom policy in the IAM console and grant authorization
4. Pause execution and wait for user confirmation that permissions have been granted

Core Commands#

1. Auto Sync (Cross-region Image Replication)#

See Task: Image Sync for detailed workflows.

bash

# List available sync target regions
hcloud SWR ListSyncRegions --cli-region=cn-north-4

# Configure auto-sync for a repository to target region
hcloud SWR CreateImageSyncRepo --namespace=group-dev --repository=my-app --remoteRegionId=cn-east-3 --remoteNamespace=group-dev --override=false --syncAuto=true --cli-region=cn-north-4

# List auto-sync configurations for a repository
hcloud SWR ListImageAutoSyncReposDetails --namespace=group-dev --repository=my-app --cli-region=cn-north-4

# Delete auto-sync configuration
hcloud SWR DeleteImageSyncRepo --namespace=group-dev --repository=my-app --remoteRegionId=cn-east-3 --remoteNamespace=group-dev --cli-region=cn-north-4

Auto Sync Behavior: When syncAuto=true, every new image push to the source repository automatically triggers a sync to the target region. When syncAuto=false, sync only occurs on manual trigger.

2. Manual Sync#

bash

# Manually sync specific image tags to target region
hcloud SWR CreateManualImageSyncRepo --namespace=group-dev --repository=my-app --remoteRegionId=cn-east-3 --remoteNamespace=group-dev --imageTag.1=v1.0 --imageTag.2=v2.0 --override=false --cli-region=cn-north-4

⚠️ Important: --imageTag uses indexed array format, NOT plain value format:

• ✅ CORRECT: --imageTag.1=v1.0 --imageTag.2=v2.0
• ❌ WRONG: --imageTag=v1.0 (missing index)
• ❌ WRONG: --imageTag=v1.0,v2.0 (comma-separated not supported)

3. Sync Regions#

bash

# List all regions available as sync targets
hcloud SWR ListSyncRegions --cli-region=cn-north-4

Response Format (verified against actual API):

json

[
  {
    "regionID": "cn-north-4"
  }

Returns all regions where you can sync images. Use the regionID field value as the --remoteRegionId parameter.

4. Sync Job Status#

bash

# Check sync job status
hcloud SWR ShowSyncJob --namespace=group-dev --repository=my-app --cli-region=cn-north-4

Response format to be verified. Use --help for parameter details.

5. Trigger Management (Auto-deploy to CCE/CCI)#

See Task: Trigger Management for detailed workflows.

bash

# Create a trigger for auto-deploy to CCE
hcloud SWR CreateTrigger --namespace=group-dev --repository=my-app --name=deploy-trigger --trigger_type=all --condition=".*" --action=update --app_type=deployments --application=my-deployment --cluster_ns=default --enable=true --trigger_mode=cce --cluster_id=<cluster-id> --cluster_name=<cluster-name> --cli-region=cn-north-4

# List all triggers for a repository
hcloud SWR ListTriggersDetails --namespace=group-dev --repository=my-app --cli-region=cn-north-4

# Show trigger details
hcloud SWR ShowTrigger --namespace=group-dev --repository=my-app --trigger=deploy-trigger --cli-region=cn-north-4

# Update a trigger (enable/disable or modify configuration)
hcloud SWR UpdateTrigger --namespace=group-dev --repository=my-app --trigger=deploy-trigger --enable=false --cli-region=cn-north-4

# Delete a trigger
hcloud SWR DeleteTrigger --namespace=group-dev --repository=my-app --trigger=deploy-trigger --cli-region=cn-north-4

Trigger Types:

• all: Trigger on any image push ( condition=".*")
• tag: Trigger on specific tag push ( condition=tag-name)
• regular: Trigger on tag matching regex ( condition=regex-pattern)

Trigger Modes:

• cce: Deploy to CCE (Cloud Container Engine) cluster — requires --cluster_id
• cci: Deploy to CCI (Cloud Container Instance) — no cluster ID needed

Parameter Reference#

Common Parameters#

ParameterRequired/OptionalDescriptionDefault--cli-regionRequiredHuawei Cloud region IDConfig value or HUAWEI_CLOUD_REGION``--namespaceContext-dependentSWR namespace (organization)N/A--repositoryContext-dependentImage repository nameN/A

Auto Sync Parameters#

ParameterRequiredDescriptionConstraints--namespaceYesSource namespaceExisting namespace name--repositoryYesSource repositoryExisting repository name--remoteRegionIdYesTarget region IDMust be from ListSyncRegions result--remoteNamespaceYesTarget namespaceNamespace name in target region--overrideNoOverwrite existing imagestrue or false (default false)--syncAutoNoAuto sync on pushtrue or false (default false)

Manual Sync Parameters#

ParameterRequiredDescriptionConstraints--namespaceYesSource namespaceExisting namespace name--repositoryYesSource repositoryExisting repository name--remoteRegionIdYesTarget region IDMust be from ListSyncRegions result--remoteNamespaceYesTarget namespaceNamespace name in target region--imageTag.[N]YesTag list (indexed array)--imageTag.1=v1.0 --imageTag.2=v2.0``--overrideNoOverwrite existing imagestrue or false (default false)

Trigger Parameters#

ParameterRequiredDescriptionConstraints--namespaceYesSWR namespaceExisting namespace name--repositoryYesImage repositoryExisting repository name--nameYesTrigger nameUnique within repository--trigger_typeYesTrigger typeall, tag, regular``--conditionYesMatch condition.* for all, tag name for tag, regex for regular--actionYesTrigger actionupdate``--app_typeYesApplication typedeployments or statefulsets``--applicationYesCCE/CCI application nameExisting deployment name--cluster_nsYesApplication namespaceKubernetes namespace (e.g., default)--enableYesEnable triggertrue or false``--trigger_modeNoDeploy targetcce (default) or cci``--cluster_idCCE onlyCCE cluster IDRequired for cce mode, empty for cci--cluster_nameNoCCE cluster nameOptional cluster name--containerNoTarget containerSpecific container name (default: all)

Output Format#

ListSyncRegions (verified)#

Response is a flat JSON array of region objects:

json

[
  {
    "regionID": "cn-north-4",
    "region_name": "north-1"
  }
]

Note: Returns all available sync target regions. Use region_id as --remoteRegionId.

ListImageAutoSyncReposDetails#

Response format to be verified — returns list of sync repo configurations when they exist. Returns empty when no auto sync configured.

ListTriggersDetails#

Response format to be verified — returns list of trigger objects when they exist. Returns empty when no triggers configured.

ShowTrigger#

Response format to be verified. Use --namespace, --repository, --trigger (trigger name) as parameters.

ShowSyncJob#

Response format to be verified. Use --namespace, --repository as primary parameters.

Verification#

See Verification Method for step-by-step verification.

Common Region IDs#

Region NameRegion IDNorth China - Beijing 4cn-north-4North China - Beijing 1cn-north-1East China - Shanghai 1cn-east-3East China - Shanghai 2cn-east-2South China - Guangzhoucn-south-1South China - Shenzhencn-south-4Southwest China - Guiyang 1cn-southwest-2Asia Pacific - Bangkokap-southeast-2Asia Pacific - Singaporeap-southeast-1Asia Pacific - Hong Kongap-southeast-3Europe - Pariseu-west-0

Best Practices#

1. Auto-sync for production repos: Set syncAuto=true for production repositories to ensure images are automatically replicated to target regions
2. Manual sync for selective replication: Use CreateManualImageSyncRepo when you only need to sync specific tags (e.g., production releases)
3. Override caution: Only set override=true when you intentionally want to overwrite existing images in the target region
4. Trigger naming: Use descriptive trigger names (e.g., prod-deploy-trigger, staging-update-trigger)
5. Trigger condition design: Use trigger_type=regular with regex for flexible matching (e.g., v\d+\.\d+\.\d+ for semver tags)
6. Disable before delete: Disable a trigger ( enable=false) before deleting to avoid unintended deployments during cleanup
7. Verify target namespace: Ensure the target namespace exists in the target region before creating sync configurations
8. Regional namespace alignment: Use identical namespace names across regions for easier cross-region management
9. Check sync regions first: Always run ListSyncRegions before creating sync configurations to verify the target region is available

Reference Documents#

DocumentDescriptionSWR Automation API Guidehcloud SWR automation API referenceIAM Permission PoliciesRequired permissions and policy JSONVerification MethodStep-by-step verificationCommon PitfallsTroubleshooting guidesTask: Image SyncAuto/manual sync workflowsTask: Trigger ManagementTrigger workflows

Notes#

• Auto-sync is persistent — once configured, it automatically triggers on every new push until deleted
• Manual sync is one-time — each CreateManualImageSyncRepo invocation syncs specified tags once
• --imageTag.[N] uses indexed array format — NOT plain value or comma-separated
• Sync target namespace must exist — create the namespace in the target region before syncing
• AK/SK must never be hardcoded — credentials should only be obtained via environment variables
• hcloud CLI is the only supported method — all operations use hcloud SWR <Operation> format
• Trigger requires CCE/CCI cluster — triggers only work with existing CCE clusters or CCI instances
• Response formats pending verification — ListImageAutoSyncReposDetails, ListTriggersDetails, ShowTrigger, ShowSyncJob response formats need live verification

Common Pitfalls#

See Common Pitfalls & Solutions for detailed troubleshooting guides.

Quick Reference:

PitfallSymptomQuick Fix--imageTag wrong formatManual sync failsUse indexed: --imageTag.1=v1.0Target namespace missingSync creation failsCreate namespace in target region firstInvalid remoteRegionIdSync creation failsCheck with ListSyncRegionsCCE cluster not foundTrigger creation failsVerify cluster_id with CCE consoleTrigger already exists409 ConflictUse ShowTrigger to check firstAuto-sync unwantedImages sync unexpectedlySet syncAuto=false or delete sync config