Concepts

• admin: The admin has super privileges over resources and shall be owned by the IT system administrator.
  • The admin can share instance offerings, disk offerings, networks, images, and other cloud resources with sub-accounts or revoke the resources from sub-accounts. Sub-accounts can only manage resources to which they are granted access.
  • The admin can modify resource quotas granted to a sub-account based on different business scenarios.
  • After the admin created a VXLAN pool, sub-accounts can create VXLAN networks based on the VXLAN pool.
  • Changing the owner of a VM instance will change the owner properties of the EIPs associated with the VM instance.
• Sub-account:
  • Sub-accounts can be categorized into local sub-accounts and SSO sub-accounts:
    • A local sub-account is created by the admin. A SSO sub-account is synced from a SSO server.
      • SSO: The SSO authentication service, powered by the Cloud, supports seamless access to SSO systems. Through the service, related users can directly login to the Cloud and manage cloud resources. Currently, OIDC servers can be added.
        • OIDC server: A SSO server that applies the OIDC protocol. It authenticates and authorizes SSO users to log into the Cloud without password and syncs user information to the Cloud based on the mapping rule.
    • A sub-account has management permissions on VM instances, images, volumes, and security groups created under the sub-account. A sub-account can perform read operations on resources shared by the admin, but cannot delete the resources.
    • Deleting a sub-account will delete all resources created by the sub-account, such as VM instances, volumes, and images.
    • The names of sub-accounts must be unique.
    • Resource quotas that the admin shares with a sub-account is displayed on the homepage of the sub-account.
    • Before a sub-account can create a VM instance, the admin must share an instance offering, disk offering, network, and other required resources with the sub-account. Otherwise, a VM instance cannot be created.
    • A sub-account can use an image that it adds to the Cloud or use an image shared by the admin.
• Quota:

  Resource quotas that the admin shares with a sub-account specify the maximum resources that the sub-account can manage, including computing resource quotas, storage resource quotas, network resource quotas, and other resource quotas.

  The admin uses the preceding resource quota settings to manage the maximum resources granted to sub-accounts. If a resource is deleted but not expunged, the resource still occupies storage space of primary storage and volumes.

Manage a Local Sub-Account

The following table lists the actions that you can perform on a local sub-account.

Action	Description
Create Sub-Account	Create a new sub-account.
Change Password	Change the password of an account. Note: After changing the password of admin, you need to log out of the account and log in again to take effect.
Change Pricing List	Change a pricing list attached by an account.
Delete Sub-Account	If you delete a sub-account, the sub-account cannot be used to log in to the platform. VPC vRouters managed by the sub-account will be deleted. VM instances and volumes will be deleted based on the policy configured by the admin: If the deletion policy is set to Direct, deleting a sub-account will expunge VM instances and volumes managed by the sub-account. If the deletion policy is set to Delay, deleting a sub-account will change the state of VM instances and volumes managed by the sub-account to Deleted and change their owner to admin. If the deletion policy is set to Never, deleting a sub-account will change the state of VM instances and volumes managed by the sub-account to Deleted and change their owner to admin.

Manage an SSO Sub-Account

Add SSO Server | ZStack IAM

On the displayed page, set the following parameters:

• Name: Enter a name for the SSO server.
• Description: Optional. Enter a description for the SSO server.
• Type: Only supports OIDC Server. It is an SSO server that applies the OIDC protocol. It authenticates and authorizes SSO users to log into the Cloud without password and syncs user information to the Cloud based on the mapping rule.
• Identity Provider: Select ZStack IAM.
  Note: The ZStack IAM server is dedicated to SSO across multiple regions.
• Server Address: Enter the ZStack IAM server address. Enter a complete URL.

Add SSO Server | Other Identity Provider

Concepts

Fundamentals

Benefits

Scenarios

Concept

Concepts

Fundamentals

Characteristics

Scenarios

The following describes the scenarios of the HA Policy feature.

• Host Business NIC Turns Down:
  If a host business NIC turns down, to ensure high availability of business, all VM instances associated with this NIC are expected to migrate to other hosts.

  • For example, your business VM instances are running MySQL database service which is required to achieve high availability. In this case, you can set the HA mode of these VM instances to NeverStop and turn on the switch corresponding to Abnormal Business NIC Status. Then as long as host resources are sufficient, in case that a host business NIC associated with these VM instances turns down, these VM instances will be auto started on other hosts.
• VM Unexpectedly Stops:
  If a VM instance is unexpectedly stopped, it is expected to auto HA start.

  • For example, your VM instances are running important business applications. To ensure business auto-recovery in case of VM stops due to reasons such as host powered-offs or business overloads, you can set the HA mode of these VM instances to NeverStop. Then if these VM instances are stopped, they are auto started.

HA Policy|Failover Policy

On the Enable HA Policy page or the Overview page of HA Policy, you can modify the following true table to configure failover policies for VM instances.

Management Network Connectivity Status	Storage Network Connectivity Status	Business NIC Status	Fail Over
Normal	Normal	Abnormal	Yes/No
Normal	Abnormal	Normal	Yes/No Note: If the storage type is SharedBlock and this status is Abnormal, VM instances will auto fail over regardless of this configuration.
Normal	Abnormal	Abnormal	Yes/No Note: The failover policy of this scenario follows the preceding two failover policies of this table. If you set both the preceding two policies to No, then this failover policy is set to No. If you set either of the two to Yes, then this failover policy is set to Yes.
Abnormal	Normal	Normal	No Note: If the management network is in Abnormal status, you cannot set this failover policy.

Note:

• For Storage Network Connectivity Status, only shared storage is detected. Local storage is not supported.
• If an L2 network of a VM instance is of the VXLAN type or the L2 network applies the SR-IOV or Smart NIC, and errors occur to the host business NIC associated with this L2 network or occur to the switch port directly connecting to the host business NIC, this VM instance will not fail over.

HA Policy|Advanced Settings

On the Enable HA Policy page or the Overview page of HA Policy, you can modify the advanced settings of HA Policy. They can be classified into the following two categories:

Category	Name	Description
VM Instance	VM Cross-Cluster HA	Specifies whether to enable VM migration across clusters to achieve high availability. Default: false. If set to true, hosts across clusters can be detected to achieve VM high availability. Note: Before you enable this feature, make sure that clusters are well connected.
	Maximum GC Retry Interval of NeverStop VM	The maximum interval of garbage collection (GC) attempts to start up NeverStop VM instances that are stopped unexpectedly. Default: 300. Unit: second.
	Delay of NeverStop VM Startup Attempt	The delay of another retry to start up a NeverStop VM instance after the last startup attempt fails. Default: 60. Unit: second.
	NeverStop VM Scanning Interval	The interval of scanning NeverStop VM instances that fail to start up. Default: 60. Unit: second.
	Sync Speed of HA VM State Update	The synchronization speed of the state of highly available VM instances on the UI. Default: 1. Valid values: -1 to 5, integer. A higher value indicates a lower synchronization speed. However, a higher value lowers system loads because outdated status update notifications are ignored. The value -1 indicates the state of HA VM instances on the UI does not automatically change.
	VM HA Mode Default Value	Sets the default value of HA mode when creating VM instances. Valid values: None and NeverStop. None: The HA mode of a newly created VM instance is set as None by default. If an unexpected stopping occurs, the VM instance does not reboot automatically. NeverStop: The HA mode of a newly created VM instance is set as NeverStop by default. The VM instance attempts to reboot automatically when it is unexpectedly stopped because of its own errors. The VM instance attempts to migrate to another host automatically if errors occur to the compute, network, or storage resource it is residing on. The VM instance does not reboot automatically if it is stopped manually or through a scheduled job. Note: If you choose NeverStop, make sure that you have enabled HA Policy in Platform Setting. Otherwise, the NeverStop mode does not take effect. You can modify the HA mode of a VM instance individually during or after the creation. After the modification, the VM instance uses the HA mode you specified for it and is not affected by this default value.
Host	Abnormal Host Check Interval	The interval at which the system detects and updates status changes of abnormal hosts. Default: 5 seconds. If this interval is too long, updates of abnormal host status may be delayed. We recommend that you keep this value consistent with Host Self-Inspection Interval on the Overview page.
	Maximum Attempts to Determine Host Disconnection	The maximum number of failed connections that are required to determine that a host is disconnected. Default: 12.
	Host Successful Connection Period	The time period of a successful connection to a host. Default: 5. Unit: second. If a connection request is responded within the specified time, the connection succeeds.
	Host Successful Connection Possibility	The possibility of successful connections in contrast to failed connections that determine whether a host is successfully connected. Default: 50. Unit: %.
	Minimum Attempts to Determine Successful Host Connection	The minimum number of successful connections that are required to determine that a host is successfully connected. Default: 5.
	Timeout Period of Primary Storage Inspection by Host	The timeout period that a host checks its connection with primary storages. Default: 5. Unit: second.

Add a Third-Party Certificate

Note: When you update the certificate, the system automatically detects the new certificate path and write the certificate information into this path.

Add a system self-signed certificate

Overview

ZStack Cube Ultimate Version Detection provides information about the current product version, including license version, version number, and the installation time of the current version. You can specify the detection duration and pull strategy. If you enable Version Detection, the Cloud auto detects if a new production environment recommended version or technical preview version is available based on the specified duration and pull strategy. This way, you can be informed of the highlights of the new product version. You can also implement manual detection. If you do, the Cloud detects version updates for one time based on the specified version pull strategy.

Enable Version Detection

On the main menu of ZStack Cube Ultimate, choose Settings > System and Security > Version Detection. Then, the Version Detection page is displayed. Click the version detection button, the Version Auto Detection window is displayed.

Version Push

Disable Version Detection

ZStack Cube Ultimate disables Version Detection by default. If you enabled this feature and want to disable it again, turn off the switch.

Statistic Scope

After you join the experience improvement program, the following data is collected:

• Product Configuration Data: gathers your product information, browser information, and access terminal information.
  • Product Information: product name, type, and version number.
  • Browser Information: browser name, version, language, and encoding.
  • Access Terminal Information: access terminal OS, OS version, and screen resolution.
• Feature Usage Data: gathers your feature usage habits and page activities on the Cloud, including your username, user UUID, and user type; the current page URL, previous page URL, visit duration, dwell duration, and button click records.
• Product Performance Data: gathers the Cloud performance and page response indicators, including the page loading duration.

Note: The program aims to analyze your feature usage habits, and the collected data does not contain any sensitive resource or personal information. The statistic begins after you join in the program and end as soon as you opt out from the program.

Data Storage and Use

• The data collected mentioned above is retained locally by default and will not be uploaded to any other platform or storage media automatically.
• Only when you authorize official technical supports to perform platform maintenance, fault checks, configuration changes, inspection, or other actions that require analysis based on the above data will them be transmitted to the specific storage media.
• The experience improvement program aims to guide a better service provided by ZStack Cube Ultimate, and the statistic and analysis based on it are used only for the optimization of the product features and using experience.

Join in Experience Improvement Program

On the main menu of ZStack Cube Ultimate, choose Settings > System and Security > Experience Improvement Program. On the Experience Improvement Program, click Join In. Then, the Join in Experience Improvement Program page is displayed.

Before you confirm to join the program, read Customer Agreement and Personal Information Authorization Letter carefully, and make sure that you fully understand and agree to all terms and conditions. Then, select the check box I have read and agree to Customer Agreement and Personal Information Authorization Letter and click OK to join in the experience improvement program.

Note: If you join in the experience improvement program through any other method, you are deemed to agree to all terms and conditions in Customer Agreement and Personal Information Authorization Letter and allow ZStack Cube Ultimate to make relevant statistics.

Opt out from Experience Improvement Program

You can click Opt Out on the Experience Improvement Program page to opt out from the experience improvement program whenever you want.

After you opt out from the program, ZStack Cube Ultimate stops the statistics on your product usage data.