DocsKnowledge BaseSecurityAPI Explorer
Documentation›ZCF›ZStack Zaku›User Guide
ZCF

Settings

Theme Appearance

General

You can customize the theme appearance of the platform, such as the platform title and the Logo.

Customizing Theme Appearance

This section describes how to customize the Logo and the release information of the platform.

  1. Enter the theme appearance page.

    In the ZStack Zaku main menu, click Settings > Theme Appearance to enter the Theme Appearance page.

  2. On the theme appearance page, you can refer to the following example to set the required content:
    • Global appearance
      • Appearance theme: set the theme color of the interface. Eight theme colors are available.
        Note: A theme color takes effect on the interface appearance of all the administrators and users of the platform.
    • Title settings
      • Browser:
        • Chinese title: customize the Chinese title text of the browser.
          Note: The title text must be within 30 characters.
        • English title: customize the English title text of the browser.
          Note: The title text must be within 30 characters.
        • Favicon: customize the icon of the browser.
          Note: Only the .ico format is supported, and the file size cannot exceed 2M.
      • Login page:
        • Chinese title: customize the Chinese title text of the login page.
          Note: The title text must be within 30 characters.
        • English title: customize the English title text of the login page.
          Note: The title text must be within 30 characters.
        • Logo: customize the Logo image of the login page.
          Note: Only the .jpg/.jpeg/.png/.svg formats are supported. The image size must be within 250*70 px, and the file size cannot exceed 2M.
      • Platform page:
        • Chinese title: customize the Chinese title text of the platform page.
          Note: The title text must be within 30 characters.
        • English title: customize the English title text of the platform page.
          Note: The title text must be within 30 characters.
        • Text size: customize the title text size of the platform page. Large, medium and small can be set, and the default is medium.
        • Logo: customize the title Logo image of the platform page.
          Note:
          • The .jpg/.jpeg/.png/.svg formats are supported. The image size must be within 110*40 px, and the file size cannot exceed 2M.
          • On a dark background, it is recommended to use a white or light-colored Logo.
  3. Resetting the theme appearance

    In the ZStack Zaku main menu, click Settings > Theme Appearance to enter the Theme Appearance page. Click Restore Default Settings to clear the current customized settings with one click and restore the default settings.

Email Server

General

Email server: to create an endpoint of the Email type on the platform, an email server must be set, which is used to send alarm messages and other message emails.

Adding an Email Server

In the ZStack Zaku main menu, click Settings > Email Server to enter the Email Server page. Click Add Email Server to enter the Add Email Server page.

You can refer to the following example to enter the required information:
  • Name: set the name of the email server. Naming rules: the length is limited to 1 to 128 characters, and the input can contain only Chinese characters, English letters, digits and the following 7 characters: (-) (_) (.) (() ()) (:) (+).
  • Description: optional. Add the information related to the email server.
  • Email Server Type: the system default is SMTP.
  • Email Server: enter the address of the email server.
  • Email Server Port: enter the port of the email server. The default is 25.
  • Email Username: enter the username of the email server. This username is used as the sender when an email is sent.
  • Password: enter the password corresponding to the username.
    Note: If a third-party mailbox is used as the email server, the SMTP service must be enabled in the settings of the third-party mailbox in advance, and the authorization code obtained must be entered in the password box.
  • Encryption Type: optional. Set an encrypted connection for the port of the email server. The encryption types include STARTTLS, SSL/TLS and NONE.
    • The STARTTLS encryption type and port 25 are selected by default.
    • When the SSL/TLS encryption type is selected, the default port is 465.
    • If the SMTP server does not use an encrypted connection, NONE can be selected.

Managing Email Servers

Click Settings > Email Server to enter the Email Server page.

Email servers support the following operations:
Operation Description
Modify Configuration Modify the name, the description, the email server, the email server port, the email username, the password and the encryption type of the email server.
Delete Email Server Delete the email server.
Note: After the email server is deleted, the messages that were originally sent by email are not sent. Perform this operation with caution.

3rd-Party Authentication

General

Third-party authentication is the third-party login authentication service provided by the platform. It supports seamless integration with third-party login authentication systems. The corresponding third-party users can log in to the platform with single sign-on without a password, and use the platform resources conveniently.

Adding a 3rd-Party Authentication Server

In the ZStack Zaku main menu, click Settings > Third-Party Authentication to enter the Third-Party Authentication page. Click Add Third-Party Authentication Server to enter the Add Third-Party Authentication Server page.

Adding a third-party authentication server includes the following types:
  • Adding an OIDC server
  • Adding a CAS server

Adding an OIDC Server

You can refer to the following example to enter the required information:
  • Name: set the name of the third-party authentication server. Naming rules: the length is limited to 1 to 128 characters, and the input can contain only Chinese characters, English letters, digits and the following 7 characters: (-) (_) (.) (() ()) (:) (+).
  • Description: optional. Add the information related to the third-party authentication server.
  • Type: select OIDC.
  • Client ID: the unique identifier allocated to the platform by the authentication system.
  • Client Secret: the secret key allocated to the platform by the authentication system.
  • Authorization Request URL: the request URL used to obtain the authorization in the authorization code (Authorization Code) mode.
  • Token Request URL: the request URL used to obtain the access token (Access Token) from the authentication server.
  • JWK Request URL: the request URL used to obtain the signature key from the authentication server.
  • Userinfo Request URL: the request URL used to obtain the user information from the authentication server.
  • Logout URL: it is used to call the Logout URL to log out of the session after you log out of the platform, and you need to log in to the third-party authentication system again the next time you log in to the platform. If it is left blank, the login information is not cleaned up immediately after you log out of the platform, and you can still log in to the platform again without a password within the validity period of the session.
  • User Mapping Rule: after third-party users are synchronized to the platform, they have the local attributes of the platform. A mapping rule is used to establish the mapping relationship between the third-party attributes and the local attributes.
    • Username: set the mapping relationship between the username of a platform user and an attribute of the user in the OIDC authentication server. A username uniquely identifies a user within the global scope of the platform, so make sure to enter a user attribute that also has a unique identifier in the authentication system. For example, if the username is mapped to preferred_username, the usernames of the users synchronized to the platform use the values corresponding to preferred_username (for example, xiaoming).

Adding a CAS Server

You can refer to the following example to enter the required information:
  • Name: set the name of the third-party authentication server. Naming rules: the length is limited to 1 to 128 characters, and the input can contain only Chinese characters, English letters, digits and the following 7 characters: (-) (_) (.) (() ()) (:) (+).
  • Description: optional. Add the information related to the third-party authentication server.
  • Type: select CAS.
  • CAS Server Address: the base URL address of the CAS server, which must contain the protocol and the context path, for example, https://cas.example.com/cas.
  • Login Path: the relative path of the login address of the CAS server. The default is generally /login.
  • Validation Path: the relative path of the ticket validation address of the CAS server. The default is generally /p3/serviceValidate.
  • Logout Path: optional. The relative path of the logout address of the CAS server. The default is generally /logout. It is called to log out of the session after you log out of the platform, and you need to log in to the third-party authentication system again the next time you log in to the platform. If it is left blank, the login information is not cleaned up immediately after you log out of the platform, and you can still log in to the platform again without a password within the validity period of the session.
  • Skip SSL Certificate Check: set whether to skip the SSL certificate check. If it is enabled, all the SSL certificate checks are skipped when the platform connects to the CAS server.
  • User Mapping Rule: after third-party users are synchronized to the platform, they have the local attributes of the platform. A mapping rule is used to establish the mapping relationship between the third-party attributes and the local attributes.
    • Username: set the mapping relationship between the username of a platform user and an attribute of the user in the CAS authentication server. A username uniquely identifies a user within the global scope of the platform, so make sure to enter a user attribute that also has a unique identifier in the authentication system. For example, if the local username is mapped to the third-party username, the username of a third-party user on this platform uses the value of the username on the corresponding third-party platform.

Managing 3rd-Party Authentication Servers

In the ZStack Zaku main menu, click Settings > Third-Party Authentication to enter the Third-Party Authentication page.

Third-party authentication servers support the following operations:
Operation Description
Modify Configuration Modify the name, the description and other configuration information of the third-party authentication server.
Note:
  • If the third-party authentication server is replaced, the system synchronizes the users under the new server to this platform, and the users synchronized before the replacement can no longer log in to this platform.
  • If a user under the new server has the same name as a user synchronized before, this user inherits all the permissions of the original user with the same name on this platform.
  • If the third-party authentication server is not replaced, the users that have been synchronized can still log in to this platform normally and are not affected.
Delete Third-Party Authentication Server Delete the third-party authentication server.
Note:
  • Before deleting a third-party authentication server, all the third-party users on the platform must be deleted first. Deleting the third-party users on the platform does not affect the users in the source third-party authentication server.
  • After the deletion, users cannot log in to this platform through the third-party authentication server. Perform this operation with caution.

Console Access Configuration

General

Console Access Configuration allows you to configure the domain name, protocol, port, and HTTPS certificate used to access the platform console.

In the ZStack Zaku main menu, click Settings > Console Access Configuration to enter the Console Access Configuration page. You can view the following information:

  • Access URL configuration: view the console VIP, domain name, access protocol, port, and HTTP redirect settings.
  • SSO service URLs: view and copy the authorization, token, user information, and logout URLs for integration with other systems.
    Note: When using the Logout URL to configure a client logout callback, append the client login or redirect URL. For example: https://test.com/ze/logout?post_logout_redirect_uri=http://app.com/login.
  • Certificate information: when using HTTPS, view the certificate status, associated domain names, issuer, validity period, and other details.
Note: Only the admin user can configure console access and manage certificates.

Modifying Console Access Configuration

In the ZStack Zaku main menu, click Settings > Console Access Configuration to enter the Console Access Configuration page. Click Modify Configuration to enter the Modify Configuration page.

Refer to the following descriptions to enter the required information:

  • Console VIP: the VIP currently used by the console. It cannot be modified.
  • Enable Domain: specify whether to use a domain name to access the console. If enabled, enter a Console Domain. If disabled, use the VIP to access the console.
    • Console Domain: enter the domain name used by the console. It must be 3 to 253 characters long and can contain only English letters, digits, and the separators "-" and ".". Separators cannot be consecutive or appear at the beginning or end. The domain name must contain ".", and each label must be no more than 63 characters long.
    Note: After you enable a domain name, you must use it to access the console. Access through the VIP is no longer supported.
  • Access Protocol: select HTTP or HTTPS. A certificate is required for HTTPS.
  • Port: specify the console access port. The default is 80 for HTTP and 443 for HTTPS. Enter an integer from 1 to 65535.
    Note: The following ports are unavailable: 21, 22, 23, 25, 53, 69, 110, 143, 6000, 8081, 10000, 10043, 10080, 10081, 10082, and 10090. HTTPS cannot use port 80, and HTTP cannot use port 443.
  • HTTP Redirect: available when using HTTPS and disabled by default. If enabled, HTTP requests are automatically redirected to HTTPS. If disabled, only HTTPS access is supported.
  • Certificate Source: configure this option when using HTTPS. You can import a certificate manually or have the platform generate one automatically.
    • Manual Import: provide a certificate and its matching private key, and a certificate chain if needed. You can enter the content directly or import local files.
      • Certificate File: enter or import a certificate in .crt or .pem format.
      • Certificate private key: enter or import the private key that matches the certificate. The .key and .pem formats are supported.
      • Certificate Chain: optional. Enter or import a certificate chain in .crt or .pem format.
    • Auto-generate: select the certificate validity period, which defaults to one year. The platform renews the certificate automatically.
    Note: Use a certificate within its validity period and make sure that the private key matches it. If you use a domain name to access the console, the certificate must include the console domain name.

Review the configuration and click OK. Review the message and confirm to save the configuration.

Note:
  • Changes take effect immediately, and all users who are currently logged in must log in again. Make sure that the domain name, port, and certificate are configured correctly to avoid losing console access or being unable to log in.
  • If 3rd-party authentication is configured, copy the new platform passwordless login URL and platform logout URL, and update them on the 3rd-Party Authentication Server to avoid affecting single sign-on.
  • If you use single sign-on for systems such as DevOps or Data Services, update the SSO configuration of those systems accordingly.

Managing Console Access Configuration

In the ZStack Zaku main menu, click Settings > Console Access Configuration to enter the Console Access Configuration page.

The following operations are available for console access configuration:

Operation Description
Modify Configuration Modify the console domain name, access protocol, port, and certificate settings. For more information, see Modifying Console Access Configuration.
Update Certificate When using HTTPS, you can import a certificate again or have the platform generate one. Click Update Certificate, select a certificate source, and enter the required information. For configuration requirements, see the certificate source descriptions in Modifying Console Access Configuration.
Note: For a manual import, provide the certificate, private key, and certificate chain (if any) again.
Download Certificate When using HTTPS, you can download a certificate archive containing the certificate, private key, and CA root certificate (if any).

Global Settings

Global Settings provides platform-level configuration options. Changes apply across the platform.

In the ZStack Zaku main menu, click Settings > Global Settings to enter the Global Settings page. Click the edit button next to a configuration item to modify it.

Note: Only the admin user and administrators can modify global settings.

Global Setting Items

Name Description
Kubernetes Audit Log Disabled by default. Specify whether to collect and save Kubernetes audit logs from self-built clusters, including the management cluster. Once enabled, you can query the logs under Container O&M > operation log > Audit Log.
Note:
  • Collecting Kubernetes audit logs from integrated clusters is not supported.
  • If any self-built cluster is abnormal, upgrading, preparing for an upgrade, or in the upgrade failed state, wait until the cluster returns to normal before changing this setting.
  • Audit logs share the log pvc with container logs and Kubernetes events of the management cluster. When the threshold for stopping log writes is reached, audit log writing also stops. Expand or free up log storage space first, and then resume log data writing in the advanced settings of the management cluster.
Kubernetes Audit Log Retention Defaults to 30 days. Specify how long to retain Kubernetes audit logs. Logs older than this period are automatically deleted. Enter an integer from 1 to 36500, in days.
Note: This setting does not affect the retention periods of container logs or Kubernetes events. Set an appropriate period based on the remaining space of the log pvc and the volume of audit logs generated, to prevent insufficient space from interrupting log writing.
Platform Ingress Bidirectional Bandwidth Limit Defaults to 150M. Set the inbound and outbound bandwidth limits at the platform entry point. The same limit applies to both directions. Enter an integer from 1 to 1500, in M.
Note:
  • Actual transfer speeds depend on network conditions, storage performance, and concurrent workloads. Set the limit according to your environment. A limit that is too low restricts image transfers. A limit that is too high may cause network congestion or overload storage, affecting platform access and image uploads and downloads.
  • Console access and transfers may be briefly interrupted while the setting is being changed. Ongoing transfers may need to be retried.
Artifact Repository Data Volume Capacity Expand all pvcs used by the artifact repository to the same capacity. Supported units are Gi and Ti. Enter a positive integer. The new capacity must be greater than the current capacity of each pvc and must not exceed the expansion limit shown on the page.
Note:
  • This setting specifies the capacity of each pvc, not the total or remaining capacity of the artifact repository. Refer to the statistics on the page for available capacity.
  • Only expansion is supported; shrinking is not supported. Make sure that the storage driver and associated storage class support pvc expansion and that sufficient storage space is available.
  • If the pvcs have different capacities, you cannot modify them together. Contact an administrator to check their capacities and expansion status. Try again once their capacities are consistent.
  • Expansion takes time. Check the capacities after it completes. If some pvcs fail to expand, the pvcs already expanded will not shrink automatically. Contact an administrator for assistance.

AccessKey Management

General

An AccessKey is an identity credential for accessing platform APIs. It has the same platform permissions as the current user, and consists of an AccessKey ID and an AccessKey Secret.
Note:
  • An AccessKey is a key factor for the platform to verify the security of API requests. Keep it properly.
  • If an AccessKey is at risk of leakage, it is recommended to delete the AccessKey and generate a new one in time.
  • An AccessKey has all the permissions of its creator. Each user, including an administrator, can view and manage only the AccessKeys created by the user.
  • You can enable, disable or delete the AccessKeys created by yourself at any time.

Managing AccessKey

In the ZStack Zaku main menu, click Settings > AccessKey Management to enter the AccessKey Management page.

AccessKeys support the following operations:
Operation Description
Generate AccessKey Generate a new AccessKey.
Enable AccessKey Enable an AccessKey in the disabled state.
Disable AccessKey Disable the selected AccessKey. A disabled AccessKey cannot be used to call APIs to access the platform resources.
Delete AccessKey Delete the selected AccessKey. A deleted AccessKey cannot be used to call APIs to access the platform resources.
PreviousProject ManagementNextBest Practices