huawei-cloud-swr-enterprise-instance

Huawei Cloud SWR enterprise instance management skill using hcloud CLI. Use this skill when the user wants to: (1) manage SWR enterprise instances - create/list/show/delete/update configuration, (2) manage instance namespaces - create/list/show/update/delete with security scanning settings, (3) manage instance registries (sync targets) - create/list/show/update/delete, (4) manage instance repositories - list/show/delete/update, (5) manage instance artifacts (image versions) - list/show/delete/scan, (6) manage instance credentials - long-term and temporary, (7) manage instance endpoints - internal/public access, (8) manage instance domains - add/list/show/delete/update, (9) check instance statistics and job status. Trigger: user mentions "SWR enterprise instance", "SWR 企业实例", "SWR 企业版", "企业仓库实例", "SWR instance", "SWR 专业版", "swr.ee", "instance namespace", "instance registry", "instance repository", "instance artifact", "instance credential", "instance endpoint", "instance domain", "企业仓库", "实例管理", "同步目标仓库", "sync target"

huaweicloud-skills-team@huaweiclouddev

Install

openclaw skills install @huaweiclouddev/huawei-cloud-swr-enterprise-instance

Huawei Cloud SWR Enterprise Instance Management

Overview

This skill provides lifecycle management capabilities for Huawei Cloud SWR (Software Repository for Container) enterprise instances using the hcloud CLI. Enterprise instances provide dedicated, isolated container registry environments with advanced features like security scanning, replication policies, and custom domain support.

Note: Some features (e.g., replication policies) are managed via the SWR enterprise instance console, not through CLI. See Out of Scope above.

Architecture: hcloud CLI → SWR Service API → Instance/Namespace/Registry/Repository/Artifact/Credential/Endpoint/Domain resources

Related Skills:

huawei-cloud-swr-image-management - Image lifecycle management (basic SWR namespaces, repos, tags, auth, quotas)
huawei-cloud-swr-image-governance - Image governance (permissions, retention, sharing, tags, immutable rules)
huawei-cloud-swr-image-automation - Image automation ops (sync, triggers, domains)

Out of Scope:

This skill does NOT support the following operations. If the user requests any of these, inform them and suggest the correct skill:

Operation	Use Instead	Reason
Manage basic (non-enterprise) SWR namespaces	`huawei-cloud-swr-image-management`	Basic SWR namespace lifecycle
Push/pull images (docker login/push/pull)	Docker CLI (use this skill to get credentials first)	Docker CLI operation, not API
Build images	CodeArts Build, CCE, or local Docker	SWR is a registry, not a build service
Manage namespace/repo permissions	`huawei-cloud-swr-image-governance`	Permission governance is a separate skill
Create retention/aging policies on basic SWR	`huawei-cloud-swr-image-governance`	Retention governance for basic SWR
Create image sync rules on basic SWR	`huawei-cloud-swr-image-automation`	Sync automation for basic SWR
Create/Delete triggers on basic SWR	`huawei-cloud-swr-image-automation`	Trigger automation for basic SWR
Manage SWR agency delegation for basic SWR	`huawei-cloud-swr-image-governance`	Agency delegation for basic SWR

Create and manage SWR enterprise instances
Manage instance namespaces with security scanning and vulnerability blocking
Configure instance registries for cross-instance image sync
Query and manage instance repositories and artifacts
Obtain instance access credentials (long-term and temporary)
Configure instance network access (internal VPC endpoints, public access with whitelist)
Manage custom domains for instance access
Monitor instance statistics and job status

Typical Use Cases:

"Create an SWR enterprise instance for my organization"
"Create a namespace with auto-scan and vulnerability blocking"
"Configure a registry for syncing images to another instance"
"Get docker login credentials for my instance"
"Add a VPC internal endpoint or custom domain to my instance"

Prerequisites

1. hcloud CLI Requirements (MANDATORY)

hcloud CLI installed (version >= 7.2.2)
Run hcloud version to verify installation
First-time usage: printf "y\n" | hcloud version to accept privacy statement

2. Credential Configuration

hcloud CLI supports two credential modes. See references/credential-configuration.md for full details.

Quick setup (choose one):

bash

# Mode A — Long-term AK/SK
export HUAWEI_CLOUD_AK=<your-ak>
export HUAWEI_CLOUD_SK=<your-sk>
export HUAWEI_CLOUD_REGION=cn-north-4

# Mode B — Temporary AK/SK + SecurityToken
export HUAWEI_CLOUD_AK=<your-temp-ak>
export HUAWEI_CLOUD_SK=<your-temp-sk>
export HUAWEI_CLOUD_SECURITY_TOKEN=<your-security-token>
export HUAWEI_CLOUD_REGION=cn-north-4

Security rules: Never expose AK/SK/SecurityToken values. Use hcloud configure list to check presence only.

3. SWR Enterprise Service Activation (MANDATORY)

Before creating SWR enterprise instances, the user must first activate the SWR enterprise service in the Huawei Cloud console. This is a one-time enablement step per account/region.

Activation Steps:

Access the SWR enterprise instance console via direct URL: https://console.huaweicloud.com/swr-instance
- Important: The SWR enterprise instance console is not available from the main console navigation menu. Users must use this direct URL to access it.
If prompted, review and accept the SWR enterprise service terms
Confirm the service is activated by verifying the console loads successfully
If activation is not available in the target region, the console will display an error or the service will not be listed

Verification: After activation, run hcloud SWR ListInstance --cli-region=<region> — if the service is activated, this returns an empty list (or existing instances). If not activated, an error will be returned.

Console Access:

SWR Enterprise Instance Console: https://console.huaweicloud.com/swr-instance
This URL provides access to instance management, namespace configuration, repository browsing, and replication policy setup
The console is region-aware — select the target region in the top-right corner after opening the URL

4. IAM Permission Requirements

This skill requires SWR enterprise instance permissions (instance, namespace, registry, repository, artifact, credential, endpoint, domain, job, statistic operations). See IAM Permission Policies for the complete permission table and policy JSON.

Permission Failure Handling:

When any command fails due to permission errors, read references/iam-policies.md
Display the required permission list and policy JSON to the user
Guide the user to create a custom policy in the IAM console and grant authorization
Pause execution and wait for user confirmation that permissions have been granted

Core Commands

1. Instance Lifecycle

See Task: Instance Lifecycle for detailed workflows.

bash

# Create an enterprise instance
# ⚠️ hcloud CLI CreateInstance has a known bug (duplicate --project_id parameter).
# Use the Python SDK helper script instead:
python scripts/swr_instance_helper.py create --name=my-instance --spec=swr.ee.professional \
    --vpc_id=<vpc-id> --subnet_id=<subnet-id> --enterprise_project_id=0 --cli-region=cn-north-4

# Alternatively, use --cli-jsonInput (see references/common-pitfalls.md Pitfall 15)
# hcloud SWR CreateInstance --cli-jsonInput=create_instance.json --cli-region=cn-north-4

# List all instances
hcloud SWR ListInstance --cli-region=cn-north-4

# List instances with status filter
hcloud SWR ListInstance --status=Running --cli-region=cn-north-4

# Show instance details
# Show instance details
hcloud SWR ShowInstance --instance_id=<instance-id> --cli-region=cn-north-4

**Note**: `ShowInstance` does not return endpoint information. To view network access endpoints, use:
- `hcloud SWR ListInstanceInternalEndpoints --instance_id=<instance-id> --cli-region=cn-north-4` for internal VPC endpoints
- `hcloud SWR ShowInstanceEndpointPolicy --instance_id=<instance-id> --cli-region=cn-north-4` for public access status and whitelist

# View instance configuration
hcloud SWR ShowInstanceConfiguration --instance_id=<instance-id> --cli-region=cn-north-4

# Update instance configuration (anonymous access)
# Update instance configuration (anonymous access)
hcloud SWR UpdateInstanceConfiguration --instance_id=<instance-id> --anonymous_access=false --cli-region=cn-north-4

**Configuration Scope**: `UpdateInstanceConfiguration` only supports the `--anonymous_access` parameter (boolean). This is the sole instance-level configuration option available via API. Other settings (spec, VPC, encryption) are set at creation time and cannot be modified afterward.

# Delete instance (CAUTION: removes all data permanently)
hcloud SWR DeleteInstance --instance_id=<instance-id> --cli-region=cn-north-4

Instance Naming Rules:

Start with lowercase letter
Followed by lowercase letters, digits, or hyphens (-)
No consecutive hyphens
Cannot end with hyphen
Length: 3-48 characters

Instance Spec Options: swr.ee.basic (basic edition), swr.ee.professional (professional edition)

Spec and Region Availability:

Not all specs (flavors) are available in all regions. Before creating an instance, verify that the desired spec is supported in the target region.
Use hcloud SWR ListInstance --cli-region=<region> to check if the SWR enterprise service is available in a region. If the API returns an error, the service may not be available in that region.
Use hcloud SWR ListSyncRegions --cli-region=<region> to list regions where SWR service is available for cross-region sync.
Common regions with SWR enterprise support include: cn-north-4, cn-north-1, cn-east-3, cn-south-1, cn-east-2, cn-southwest-2, cn-north-9, ap-southeast-1, ap-southeast-2, ap-southeast-3.
If instance creation fails with spec/region errors, try a different spec or region. The error message will indicate if the spec is not supported in the target region.

Billing Details:

WARNING: Creating an SWR enterprise instance incurs hourly costs. The user must be informed of this before proceeding.
--charge_mode: Only postPaid (on-demand/pay-as-you-go) is supported. No prepaid or annual/monthly billing available.
--spec=swr.ee.basic: Basic edition — suitable for small teams, limited features. Lower hourly cost.
--spec=swr.ee.professional: Professional edition — full features including security scanning, replication, custom domains. Higher hourly cost.
Costs are incurred per hour based on instance spec. No upfront payment required. Billing starts when the instance enters Running status.
To stop billing: delete the instance with hcloud SWR DeleteInstance. Billing stops immediately after deletion.
Use --enterprise_project_id to associate the instance with an enterprise project for cost tracking and attribution.
For detailed pricing information, refer to the Huawei Cloud SWR pricing page or consult the SWR enterprise instance console at https://console.huaweicloud.com/swr-instance.

Instance Status Values: Initial, Creating, Running, Unavailable

2. Instance Namespaces

See Task: Instance Namespaces for detailed workflows.

bash

# Create a namespace with auto-scan and vulnerability blocking
hcloud SWR CreateInstanceNamespace --instance_id=<instance-id> --namespace_name=group-dev --metadata.public=false --metadata.auto_scan=true --metadata.prevent_vul=true --metadata.severity=high --cli-region=cn-north-4

# List namespaces
hcloud SWR ListInstanceNamespaces --instance_id=<instance-id> --cli-region=cn-north-4

# List namespaces with filter
hcloud SWR ListInstanceNamespaces --instance_id=<instance-id> --public=false --limit=20 --offset=0 --cli-region=cn-north-4

# Show namespace details
hcloud SWR ShowInstanceNamespace --instance_id=<instance-id> --namespace_name=group-dev --cli-region=cn-north-4

# Update namespace (change visibility, scan settings)
hcloud SWR UpdateInstanceNamespace --instance_id=<instance-id> --namespace_name=group-dev --metadata.public=true --metadata.prevent_vul=false --cli-region=cn-north-4

# Delete namespace (CAUTION: removes all repositories under it)
hcloud SWR DeleteInstanceNamespace --instance_id=<instance-id> --namespace_name=group-dev --cli-region=cn-north-4

Namespace Naming Rules:

Start with lowercase letter or digit
Followed by lowercase letters, digits, dots, underscores, or hyphens
Dots, underscores, hyphens cannot be directly connected
End with lowercase letter or digit
Length: 1-64 characters

Vulnerability Severity Levels: none, low, medium, high, critical

3. Instance Registries (Sync Targets)

See Task: Instance Registries for detailed workflows.

bash

# Create a registry (sync target for another SWR enterprise instance)
hcloud SWR CreateInstanceRegistry --instance_id=<instance-id> --name=target-instance --type=swr-pro-internal --url=<target-url> --credential.type=basic --credential.access_key=<ak> --credential.access_secret=<sk> --insecure=false --instance_id=<target-instance-id> --project_id=<target-project-id> --region_id=cn-east-3 --cli-region=cn-north-4

# Create a registry for open-source Harbor
hcloud SWR CreateInstanceRegistry --instance_id=<instance-id> --name=harbor-target --type=swr-pro --url=https://harbor.example.com --credential.type=basic --credential.access_key=<username> --credential.access_secret=<password> --insecure=false --cli-region=cn-north-4

# List registries
hcloud SWR ListInstanceRegistries --instance_id=<instance-id> --cli-region=cn-north-4

# Show registry details
hcloud SWR ShowInstanceRegistry --instance_id=<instance-id> --registry_id=<registry-id> --cli-region=cn-north-4

# Update registry
hcloud SWR UpdateInstanceRegistry --instance_id=<instance-id> --registry_id=<registry-id> --name=new-name --url=<new-url> --credential.type=basic --credential.access_key=<new-ak> --credential.access_secret=<new-sk> --insecure=false --type=swr-pro --cli-region=cn-north-4

# Delete registry
hcloud SWR DeleteInstanceRegistry --instance_id=<instance-id> --registry_id=<registry-id> --cli-region=cn-north-4

Registry Types: swr-pro (open-source Harbor), swr-pro-internal (another SWR enterprise instance), huawei-SWR (basic SWR)

Credential Acquisition for Target Registries:

For swr-pro-internal (another SWR enterprise instance): Use CreateInstanceLtCredential on the target instance to obtain access_key (credential name) and access_secret (credential password).
For huawei-SWR (basic SWR): Use CreateInstanceTempCredential or basic SWR CreateAuthorizationToken to get temporary credentials.
For swr-pro (Harbor): Use the Harbor account username and password.
Credentials are stored securely by the instance and used for replication operations only.

4. Instance Repositories

See Task: Instance Registries for repository section.

bash

# List repositories in instance
hcloud SWR ListInstanceRepositories --instance_id=<instance-id> --cli-region=cn-north-4

# List repositories with filter
hcloud SWR ListInstanceRepositories --instance_id=<instance-id> --namespace_id=<ns-id> --limit=20 --offset=0 --order_column=updated_at --order_type=desc --cli-region=cn-north-4

# Show repository details
hcloud SWR ShowInstanceRepository --instance_id=<instance-id> --namespace_name=group-dev --repository_name=my-app --cli-region=cn-north-4

# Update repository description
hcloud SWR UpdateInstanceRepository --instance_id=<instance-id> --namespace_name=group-dev --repository_name=my-app --description="Updated description" --cli-region=cn-north-4

# Delete repository (CAUTION: removes all artifacts)
hcloud SWR DeleteInstanceRepository --instance_id=<instance-id> --namespace_name=group-dev --repository_name=my-app --cli-region=cn-north-4

5. Instance Artifacts (Image Versions)

See Task: Instance Artifacts for detailed workflows.

bash

# List artifacts in a repository
hcloud SWR ListInstanceArtifacts --instance_id=<instance-id> --namespace_name=group-dev --repository_name=my-app --cli-region=cn-north-4

# List artifacts with filter
hcloud SWR ListInstanceArtifacts --instance_id=<instance-id> --namespace_name=group-dev --repository_name=my-app --type=IMAGE --limit=20 --offset=0 --cli-region=cn-north-4

# Show artifact details
hcloud SWR ShowInstanceArtifact --instance_id=<instance-id> --namespace_name=group-dev --repository_name=my-app --reference=<digest> --cli-region=cn-north-4

# Show artifact with scan overview
hcloud SWR ShowInstanceArtifact --instance_id=<instance-id> --namespace_name=group-dev --repository_name=my-app --reference=<digest> --with_scan_overview=true --cli-region=cn-north-4

# Get artifact build history
hcloud SWR ShowInstanceArtifactAddition --instance_id=<instance-id> --namespace_name=group-dev --repository_name=my-app --reference=<digest> --addition=build_history --cli-region=cn-north-4

# List artifact vulnerabilities
hcloud SWR ListInstanceArtifactVulnerabilities --instance_id=<instance-id> --namespace_name=group-dev --repository_name=my-app --reference=<digest> --cli-region=cn-north-4

# Start manual vulnerability scan
hcloud SWR StartManualScanning --instance_id=<instance-id> --namespace_name=group-dev --repository_name=my-app --reference=<digest> --cli-region=cn-north-4

# Delete artifact (CAUTION: removes the image version permanently)
hcloud SWR DeleteInstanceArtifact --instance_id=<instance-id> --namespace_name=group-dev --repository_name=my-app --reference=<digest> --cli-region=cn-north-4

Artifact Types: IMAGE (container image), CHART (Helm chart)

⚠️ Image Vulnerability Scanning Limitation: Image vulnerability scanning depends on Huawei Cloud HSS (Host Security Service). The current skill does not support HSS configuration or management. To use scanning features:

Basic edition (swr.ee.basic): Scanning is not supported. Upgrade to professional edition.

Professional edition (swr.ee.professional): Scanning requires HSS to be enabled. Please activate HSS in the Huawei Cloud console first, then use the SWR enterprise instance console (https://console.huaweicloud.com/swr-instance) to verify scanning is functional before relying on it in automation workflows.

If scanning fails on a professional edition instance, check HSS service status and ensure HSS is properly activated for the target region.

6. Instance Credentials

See Task: Instance Credentials for detailed workflows.

bash

# Create a long-term access credential
hcloud SWR CreateInstanceLtCredential --instance_id=<instance-id> --name=my-credential --cli-region=cn-north-4

# Create a temporary access credential
hcloud SWR CreateInstanceTempCredential --instance_id=<instance-id> --cli-region=cn-north-4

# List long-term credentials
hcloud SWR ListInstanceLtCredentials --instance_id=<instance-id> --cli-region=cn-north-4

# Enable/disable a long-term credential
hcloud SWR UpdateInstanceLtCredential --instance_id=<instance-id> --credential_id=<cred-id> --enable=false --cli-region=cn-north-4

# Delete a long-term credential
hcloud SWR DeleteInstanceLtCredential --instance_id=<instance-id> --credential_id=<cred-id> --cli-region=cn-north-4

Credential Naming Rules (same as namespace): lowercase/digit start, 1-64 chars

7. Instance Endpoints (Network Access)

See Task: Instance Endpoints for detailed workflows.

bash

# Create internal VPC endpoint
hcloud SWR CreateInstanceInternalEndpoint --instance_id=<instance-id> --vpc_id=<vpc-id> --subnet_id=<subnet-id> --project_id=<vpc-project-id> --cli-region=cn-north-4

# List internal endpoints
hcloud SWR ListInstanceInternalEndpoints --instance_id=<instance-id> --cli-region=cn-north-4

# Show internal endpoint details
hcloud SWR ShowInstanceInternalEndpoint --instance_id=<instance-id> --internal_endpoints_id=<endpoint-id> --cli-region=cn-north-4

# Delete internal endpoint
hcloud SWR DeleteInstanceInternalEndpoint --instance_id=<instance-id> --internal_endpoints_id=<endpoint-id> --cli-region=cn-north-4

# Enable public access
hcloud SWR CreateInstanceEndpointPolicy --instance_id=<instance-id> --enable=true --cli-region=cn-north-4

# Disable public access
hcloud SWR CreateInstanceEndpointPolicy --instance_id=<instance-id> --enable=false --cli-region=cn-north-4

# View public access status and whitelist
hcloud SWR ShowInstanceEndpointPolicy --instance_id=<instance-id> --cli-region=cn-north-4

# Update public access whitelist (full replacement)
hcloud SWR UpdateInstanceEndpointPolicy --instance_id=<instance-id> --ip_list.1.ip=10.0.0.0/8 --ip_list.1.description="Internal network" --ip_list.2.ip=192.168.0.0/16 --ip_list.2.description="VPN network" --cli-region=cn-north-4

8. Instance Domains

See Task: Instance Domains for detailed workflows.

bash

# Add a custom domain
hcloud SWR AddDomainName --instance_id=<instance-id> --domain_name=registry.example.com --certificate_id=<scm-cert-id> --cli-region=cn-north-4

# List all domains
hcloud SWR ListDomainNames --instance_id=<instance-id> --cli-region=cn-north-4

# Get domain overview
hcloud SWR ShowDomainOverview --cli-region=cn-north-4

# Delete a domain (default domain cannot be deleted)
hcloud SWR DeleteDomainName --instance_id=<instance-id> --domainname_id=<domain-id> --cli-region=cn-north-4

# Update domain certificate
hcloud SWR UpdateDomainName --instance_id=<instance-id> --domainname_id=<domain-id> --certificate_id=<new-cert-id> --cli-region=cn-north-4

9. Instance Statistics and Jobs

bash

# Get instance statistics
hcloud SWR ListInstanceStatistics --instance_id=<instance-id> --cli-region=cn-north-4

# List instance jobs (async operations)
hcloud SWR ListInstanceJobs --cli-region=cn-north-4

# Show job details
hcloud SWR ShowInstanceJob --job_id=<job-id> --cli-region=cn-north-4

# Delete a job record
hcloud SWR DeleteInstanceJob --job_id=<job-id> --cli-region=cn-north-4

10. Instance Audit Logs

SWR enterprise instances provide built-in audit logging via ListAuditLogs API (pull/delete/create operations). No dependency on CTS required.

bash

hcloud SWR ListAuditLogs --instance_id=<instance-id> --project_id=<project-id> --operation=pull --cli-region=cn-north-4
# --operation: pull, delete, or create; --limit/--offset for pagination

See API Guide for full details.

Parameter Reference

See Parameter Reference for complete parameter tables including: common parameters, instance creation (name, spec, VPC, subnet, encryption), namespace (public, auto_scan, prevent_vul, severity), registry (type, url, credential), and endpoint whitelist parameters.

Output Format

See Output Format for detailed response format examples (Instance List, Instance Details, Namespace List, Internal Endpoint List, Domain Name List, Long-term Credential).

Verification

See Verification Method for step-by-step verification.

Best Practices

Instance naming & VPC: Use descriptive names (prod-instance, dev-instance); choose VPC/subnet matching your workload environment
Namespace security: Enable auto_scan=true and prevent_vul=true for production; set severity=high/critical for prod, none/low for dev
Credentials: Store registry credentials securely and rotate periodically; use CreateInstanceLtCredential for CI/CD, CreateInstanceTempCredential for temp access
Public access: Always configure IP whitelist when enabling public access via UpdateInstanceEndpointPolicy; use SCM certificates for custom domain HTTPS
Delete with caution: Deleting an instance removes ALL data permanently; deleting a namespace removes ALL repositories
Instance spec: Use swr.ee.basic for small teams; swr.ee.professional for enterprise with advanced features

参数确认

Operation	CLI Command	Risk Level	Confirmation Required
CreateInstance	`hcloud SWR CreateInstance`	High	Creating a paid instance incurs costs. Confirm instance spec (`swr.ee.basic` or `swr.ee.professional`), VPC/subnet configuration, and enterprise project before proceeding.
UpdateInstanceConfiguration	`hcloud SWR UpdateInstanceConfiguration --anonymous_access=true`	High	Enabling anonymous access allows unauthenticated users to pull images, reducing security. Confirm this is intended before proceeding.
CreateInstanceEndpointPolicy	`hcloud SWR CreateInstanceEndpointPolicy --enable=true`	Medium	Enabling public access exposes the instance to the internet. Must configure IP whitelist via `UpdateInstanceEndpointPolicy` to restrict access. Confirm before proceeding.
DeleteInstanceLtCredential	`hcloud SWR DeleteInstanceLtCredential`	Medium	Deleting a credential immediately revokes access for CI/CD pipelines using it. Recommend disabling the credential first (`UpdateInstanceLtCredential --enable=false`), verifying no active pipelines, then deleting.
CreateInstanceRegistry	`hcloud SWR CreateInstanceRegistry`	Medium	Creating a sync target registry stores the target registry authentication credentials (`access_key`/`access_secret`). Confirm the target registry URL and credential information before proceeding.

工作流

This skill follows a standard workflow for SWR enterprise instance management:

⚠️ Billing Confirmation (MANDATORY) — Before executing any operation, inform the user of potential billing implications and obtain explicit consent:
- Instance creation incurs hourly costs: swr.ee.basic (~~¥0.35/hour) and swr.ee.professional (~~¥1.05/hour) are paid specs. There is no free tier for enterprise instances.
- Storage costs: Images stored in enterprise instances incur OBS storage fees.
- Network costs: Cross-region sync and public access may incur traffic fees.
- Ask the user to confirm: "Do you understand the billing implications and wish to proceed? (yes/no)"
- Only proceed if the user explicitly confirms. If the user declines, stop and do not execute any operations.
Prerequisites Check — Verify hcloud CLI installation and credential configuration
Instance Identification — List or show existing instances to obtain instance_id
Operation Execution — Execute the requested operation (create/update/delete/query)
Result Verification — Confirm the operation succeeded by querying the resulting state
Credential Management — For write operations, obtain and securely store any returned credentials
Cleanup Confirmation — For destructive operations, confirm with the user before proceeding

KooCLI命令格式标准

All CLI commands use hcloud SWR <Operation> --param1=value1 --cli-region=<region> format.

Key rules: Use --key=value format, always specify --cli-region, never expose AK/SK, confirm before write operations, use --cli-output=json for structured output.

Known CLI Limitation: CreateInstance has a known hcloud CLI bug (duplicate --project_id parameter). Use the Python SDK helper script (scripts/swr_instance_helper.py) as the primary method, or --cli-jsonInput with path/body sections as an alternative. Other commands with same-name parameter conflicts (CreateInstanceInternalEndpoint, CreateInstanceRegistry) can use --cli-jsonInput. See Common Pitfalls (Pitfall 15) and CLI Format Guide for full details.

Reference Documents

Command Reference — Complete hcloud SWR command reference with examples
Parameter Reference — All API parameters with types and descriptions
SWR Instance API Guide — hcloud SWR instance API reference
Output Format — Response format examples
Credential Configuration — Credential setup (long-term & temporary AK/SK)
IAM Permission Policies — Required permissions and policy JSON
Verification Method — Step-by-step verification
Common Pitfalls — Troubleshooting guides
Task: Instance Lifecycle — Instance create/list/show/update config
Task: Instance Namespaces — Namespace CRUD workflows
Task: Instance Registries — Registry CRUD and repositories
Task: Instance Artifacts — Artifact management and scanning
Task: Instance Credentials — Credential management workflows
Task: Instance Endpoints — Internal and public access configuration
Task: Instance Domains — Custom domain management
CLI Installation Guide — hcloud CLI installation and configuration
Acceptance Criteria — Success criteria for all operations

Notes

Instance/Namespace/Artifact deletion is irreversible — removes all data permanently
Default domain cannot be deleted — only custom domains can be removed
AK/SK must never be hardcoded — use environment variables only
Pagination offset must be multiple of limit — offset must be 0 or a multiple of limit
Registry credential.access_secret is sensitive — never expose or log access secrets

Common Pitfalls

See Common Pitfalls & Solutions for detailed troubleshooting guides covering: invalid instance names, VPC/subnet errors, instance creation state, pagination offset rules, registry credential issues, domain certificate problems, public access whitelist format, SWR service activation, and spec availability.