Huawei Cloud SWR Image Automation

Overview

This skill provides image automation capabilities for Huawei Cloud SWR (Software Repository for Container) using the hcloud CLI, including cross-region image sync and trigger-based auto-deployment.

Architecture: hcloud CLI → SWR Service API → SyncRepo/Trigger/SyncJob/SyncRegion resources

Related Skills:

• huawei-cloud-swr-image-management - Image lifecycle management (namespaces, repos, tags, auth, quotas)

• huawei-cloud-swr-image-governance - Image governance (permissions, retention, sharing, tags, immutable rules)

• huawei-cloud-swr-enterprise-instance - Enterprise instance management

• Configure auto-sync to replicate images across regions on push

• Manually sync specific image tags to target regions

• List available sync target regions

• Check sync job execution status

• Create and manage triggers for auto-deploy to CCE/CCI workloads

• Enable/disable triggers and update trigger configurations

Typical Use Cases:

• "Set up auto-sync for my image repository to cn-east-3"
• "Manually sync image tags v1.0 and v2.0 to another region"
• "List available regions for image sync"
• "Check the status of my image sync job"
• "Create a trigger to auto-update my CCE deployment when a new image is pushed"
• "List all triggers for a repository"
• "Disable a trigger temporarily"
• "Delete an old trigger configuration"
• "Configure image replication across multiple regions"

Prerequisites

1. hcloud CLI Requirements (MANDATORY)

• hcloud CLI installed (version >= 7.2.2)
• Run hcloud version to verify installation
• First-time usage: printf "y\n" | hcloud version to accept privacy statement

2. Credential Configuration

• Valid Huawei Cloud credentials (AK/SK mode)
• Security Rules:
  • 🚫 Never expose AK/SK values in code, conversation, or commands
  • 🚫 Never use echo $HUAWEI_CLOUD_AK or echo $HUAWEI_CLOUD_SK to check credentials
  • ✅ Use environment variables: HUAWEI_CLOUD_AK, HUAWEI_CLOUD_SK, HUAWEI_CLOUD_REGION
  • ✅ Prefer IAM users over root account for cloud operations
  • ✅ Enable MFA for sensitive operations

Configuration Method (Environment Variables Only):

export HUAWEI_CLOUD_AK=<your-ak>
export HUAWEI_CLOUD_SK=<your-sk>
export HUAWEI_CLOUD_REGION=cn-north-4

⚠️ Important Security Notes:

• Never commit credentials to version control
• Use IAM users with minimal required permissions
• Enable MFA for sensitive operations
• Rotate AK/SK regularly

3. IAM Permission Requirements

See IAM Permission Policies for complete policy JSON.

Permission Failure Handling:

1. When any command fails due to permission errors, read references/iam-policies.md
2. Display the required permission list and policy JSON to the user
3. Guide the user to create a custom policy in the IAM console and grant authorization
4. Pause execution and wait for user confirmation that permissions have been granted

Core Commands

1. Auto Sync (Cross-region Image Replication)

See Task: Image Sync for detailed workflows.

# List available sync target regions
hcloud SWR ListSyncRegions --cli-region=cn-north-4

# Configure auto-sync for a repository to target region
hcloud SWR CreateImageSyncRepo --namespace=group-dev --repository=my-app --remoteRegionId=cn-east-3 --remoteNamespace=group-dev --override=false --syncAuto=true --cli-region=cn-north-4

# List auto-sync configurations for a repository
hcloud SWR ListImageAutoSyncReposDetails --namespace=group-dev --repository=my-app --cli-region=cn-north-4

# Delete auto-sync configuration
hcloud SWR DeleteImageSyncRepo --namespace=group-dev --repository=my-app --remoteRegionId=cn-east-3 --remoteNamespace=group-dev --cli-region=cn-north-4

Auto Sync Behavior: When syncAuto=true, every new image push to the source repository automatically triggers a sync to the target region. When syncAuto=false, sync only occurs on manual trigger.

2. Manual Sync

# Manually sync specific image tags to target region
hcloud SWR CreateManualImageSyncRepo --namespace=group-dev --repository=my-app --remoteRegionId=cn-east-3 --remoteNamespace=group-dev --imageTag.1=v1.0 --imageTag.2=v2.0 --override=false --cli-region=cn-north-4

⚠️ Important: --imageTag uses indexed array format, NOT plain value format:

• ✅ CORRECT: --imageTag.1=v1.0 --imageTag.2=v2.0
• ❌ WRONG: --imageTag=v1.0 (missing index)
• ❌ WRONG: --imageTag=v1.0,v2.0 (comma-separated not supported)

3. Sync Regions

# List all regions available as sync targets
hcloud SWR ListSyncRegions --cli-region=cn-north-4

Response Format (verified against actual API):

[
  {
    "regionID": "cn-north-4"
  }

Returns all regions where you can sync images. Use the regionID field value as the --remoteRegionId parameter.

4. Sync Job Status

# Check sync job status
hcloud SWR ShowSyncJob --namespace=group-dev --repository=my-app --cli-region=cn-north-4

Response format to be verified. Use --help for parameter details.

5. Trigger Management (Auto-deploy to CCE/CCI)

See Task: Trigger Management for detailed workflows.

# Create a trigger for auto-deploy to CCE
hcloud SWR CreateTrigger --namespace=group-dev --repository=my-app --name=deploy-trigger --trigger_type=all --condition=".*" --action=update --app_type=deployments --application=my-deployment --cluster_ns=default --enable=true --trigger_mode=cce --cluster_id=<cluster-id> --cluster_name=<cluster-name> --cli-region=cn-north-4

# List all triggers for a repository
hcloud SWR ListTriggersDetails --namespace=group-dev --repository=my-app --cli-region=cn-north-4

# Show trigger details
hcloud SWR ShowTrigger --namespace=group-dev --repository=my-app --trigger=deploy-trigger --cli-region=cn-north-4

# Update a trigger (enable/disable or modify configuration)
hcloud SWR UpdateTrigger --namespace=group-dev --repository=my-app --trigger=deploy-trigger --enable=false --cli-region=cn-north-4

# Delete a trigger
hcloud SWR DeleteTrigger --namespace=group-dev --repository=my-app --trigger=deploy-trigger --cli-region=cn-north-4

Trigger Types:

• all: Trigger on any image push (condition=".*")
• tag: Trigger on specific tag push (condition=tag-name)
• regular: Trigger on tag matching regex (condition=regex-pattern)

Trigger Modes:

• cce: Deploy to CCE (Cloud Container Engine) cluster — requires --cluster_id
• cci: Deploy to CCI (Cloud Container Instance) — no cluster ID needed

Parameter Reference

Common Parameters

Auto Sync Parameters

Manual Sync Parameters

Trigger Parameters

Output Format

ListSyncRegions (verified)

Response is a flat JSON array of region objects:

[
  {
    "regionID": "cn-north-4",
    "region_name": "north-1"
  }
]

Note: Returns all available sync target regions. Use region_id as --remoteRegionId.

ListImageAutoSyncReposDetails

Response format to be verified — returns list of sync repo configurations when they exist. Returns empty when no auto sync configured.

ListTriggersDetails

Response format to be verified — returns list of trigger objects when they exist. Returns empty when no triggers configured.

ShowTrigger

Response format to be verified. Use --namespace, --repository, --trigger (trigger name) as parameters.

ShowSyncJob

Response format to be verified. Use --namespace, --repository as primary parameters.

Verification

See Verification Method for step-by-step verification.

Common Region IDs

Best Practices

1. Auto-sync for production repos: Set syncAuto=true for production repositories to ensure images are automatically replicated to target regions
2. Manual sync for selective replication: Use CreateManualImageSyncRepo when you only need to sync specific tags (e.g., production releases)
3. Override caution: Only set override=true when you intentionally want to overwrite existing images in the target region
4. Trigger naming: Use descriptive trigger names (e.g., prod-deploy-trigger, staging-update-trigger)
5. Trigger condition design: Use trigger_type=regular with regex for flexible matching (e.g., v\d+\.\d+\.\d+ for semver tags)
6. Disable before delete: Disable a trigger (enable=false) before deleting to avoid unintended deployments during cleanup
7. Verify target namespace: Ensure the target namespace exists in the target region before creating sync configurations
8. Regional namespace alignment: Use identical namespace names across regions for easier cross-region management
9. Check sync regions first: Always run ListSyncRegions before creating sync configurations to verify the target region is available

Reference Documents

Notes

• Auto-sync is persistent — once configured, it automatically triggers on every new push until deleted
• Manual sync is one-time — each CreateManualImageSyncRepo invocation syncs specified tags once
• --imageTag.[N] uses indexed array format — NOT plain value or comma-separated
• Sync target namespace must exist — create the namespace in the target region before syncing
• AK/SK must never be hardcoded — credentials should only be obtained via environment variables
• hcloud CLI is the only supported method — all operations use hcloud SWR <Operation> format
• Trigger requires CCE/CCI cluster — triggers only work with existing CCE clusters or CCI instances
• Response formats pending verification — ListImageAutoSyncReposDetails, ListTriggersDetails, ShowTrigger, ShowSyncJob response formats need live verification

Common Pitfalls

See Common Pitfalls & Solutions for detailed troubleshooting guides.

Quick Reference: