Cloud Federation

Cloud Federation connects and organizes ZStack Cloud, ZSphere, ZStack Zaku, ZStack ZStone, ZStack ZNS, and other components or ecosystem services in ZCF. After components are connected, ZCF can provide unified authentication, resource collection, operations analysis, and ecosystem service access, and can provide component ownership, connection status, and version context for later-version upgrade capabilities in Lifecycle Management.

This chapter describes how to connect and maintain components or services, configure SSO, view region information, and connect ecosystem services such as Anheng Tianchi. Unified authentication, cross-component access, and later-version upgrade maintenance depend on Cloud Federation access relationships and component status. Infrastructure components must still be upgraded according to their own release notes and upgrade requirements.

Core Concepts

Concept	Description
ZCF Cloud Federation	Connects and organizes ZStack Cloud, ZSphere, ZStack Zaku, ZStack ZStone, ZNS, and ecosystem services. After a platform is connected, SSO, resource collection, and observability analysis can use the established connection.
Connected Platform	A component instance or ecosystem service managed by ZCF Cloud Federation. After it is connected, the object appears on the Platform Access page.
Access Configuration	Information used to connect to a target component or ecosystem service, including its endpoint, port, authentication method, credentials, scope, and enabled capabilities.
Connection Status	Indicates whether ZCF can access the connected platform. If the connection is abnormal, check the target endpoint, port, network connectivity, and authentication information.
Enabled Capabilities	Capabilities enabled when a platform is connected, such as resource collection, metric collection, log collection, alarm integration, or SSO federation. Available capabilities depend on the page and the connected object.
Platform Details	A page for viewing the connection information, enabled capabilities, resource statistics, and synchronization status of a connected platform. Use this page to verify the connection and troubleshoot access issues.
Authentication Server	A server that provides SSO capabilities for an SSO configuration. The current version uses ZIAM as the authentication server and establishes SSO with ZIAM through OIDC.
SSO Configuration	A ZIAM-based SSO configuration. After the configuration is saved, the system generates the authentication parameters, and the configuration can be applied to eligible connected platforms.
Identity Preset Mode	Determines how a platform provisions identity and access control data. SCIM, JIT, or both modes can be enabled. With SCIM, the identity source provisions users, groups, organizations, projects, and related access assignments in advance. With JIT, the platform creates or updates user accounts and access assignments when users sign in through SSO.
SSO Configuration Association	The association between an SSO configuration and a connected platform. After the configuration is applied, view its configuration and synchronization status on the Platform tab of the SSO configuration details.
Region	A management view that represents resource ownership. The Region Management page shows the Default Region, bound Cloud, associated platform count, asset count, and synchronization status.
Lifecycle Management	A management capability used after components and ecosystem services are connected to maintain readiness for later ZCF version upgrades. Administrators can manage ZCF Bundles and view version paths, component connection and version status, risk-check results, and history records. The supported upgrade scope is determined by the target Bundle and the page check results.
Ecosystem Service Access	Brings ecosystem services such as Anheng Cloud-Tianchi into the ZCF access and authentication system. After the service is connected and the SSO configuration is applied, users can access its console from the ecosystem service page in the Default Region.

Connect Components and Ecosystem Services

Use Platform Access to connect components such as ZStack Cloud, ZSphere, ZStack Zaku, ZStack ZStone, and ZStack ZNS, and ecosystem services such as Anheng Tianchi, to Cloud Federation. After the connection is complete, you can maintain connection relationships from the platform access list and configure SSO, resource collection, or ecosystem service access based on the product type.

This section describes how to connect infrastructure components, maintain connection relationships, and connect ecosystem services.

Connect Platforms

Before you connect a platform, complete the following preparations:

Make sure the management address of the target product or ecosystem service is reachable from the ZCF environment.
Prepare the authentication information of the target product or ecosystem service, such as username and password, AK/SK, or Token.
Confirm the features to enable, such as resource collection, metric collection, log collection, event alarm integration, or SSO federation. Available options depend on the page and the connected object support.

Use Platform Access to connect components such as ZStack Cloud, ZSphere, ZStack Zaku, ZStack ZStone, and ZStack ZNS, and ecosystem services to Cloud Federation. After a component or service is connected, ZCF can identify resource sources, apply related configurations, and provide resource, metric, or log data for Observability based on the access relationship.

In the upper-right corner of the main menu, switch to Global Management.
Go to Cloud Federation > Platform Management.
In the Platform Access list or area, use the page entry as prompted.

Configure the access information as prompted.

Item	Description
Product Type	Select the component or ecosystem service to connect, such as ZStack Cloud, ZSphere, ZStack Zaku, ZStack ZStone, ZStack ZNS, or Anheng Tianchi. Parameters and available features may vary by type.
Name	Display name of the connected component or service in Cloud Federation. Use a name that identifies the environment or purpose.
Endpoint	Management or service address of the target product or ecosystem service. Enter an address that is reachable from the ZCF environment.
Port	Service port of the connected component or service. The page may display a default port or placeholder based on the product type. If your environment uses a custom port, enter the actual port.
Authentication Method	Authentication method used to access the connected component or service. Different product types may use username and password, AK/SK, Token, or other methods.
Scope	Scope of the connected component or service. Infrastructure components are typically associated with a region. Platform capability components or ecosystem services can be associated with Global Management. Available options are displayed on the page.
Enabled Features	Features to enable after access, such as resource collection, metric collection, log collection, event alarm integration, or SSO federation. Available features depend on the component type, deployment status, and license status.

Test the connection to verify that the component or service is reachable and the authentication information is valid.
After you save the access configuration, check the connection status in the Platform Access list.

After the platform is connected, check the connection status in the Platform Access list, and open platform details to view the scope, enabled features, resource statistics, and synchronization status. If dashboards, reports, Metrics Explorer, or Log Explorer do not show expected data, first check whether the platform is connected, whether the connection is normal, and whether the required collection features are enabled.

Note: If the connection test fails, check the endpoint, port, network connectivity, and authentication information. Save the access configuration after the connection test succeeds to reduce failures in resource collection, SSO configuration, or observability analysis.

Manage Platform Access

After a component or service is connected, use the Platform Access list to view connection status, product type, enabled features, and update time, and to maintain access information. This page is also the starting point for troubleshooting SSO configuration issues and missing resource, metric, or log data.

Operation	Description
Search and filter	Find a connected component or service by name, address, product type, or connection status.
View details	View connection information, scope, enabled features, resource statistics, and synchronization status to confirm whether the component or service is connected as expected.
Test connection	Check whether the component or service is reachable and whether the current authentication information is valid.
Edit access information	Modify the endpoint, authentication information, scope, or enabled features. After modification, test the connection again and confirm whether related collection or SSO configurations still meet expectations.
Delete connected component or service	Remove the access relationship between ZCF and the component or service. This operation does not delete the underlying product instance or any created region.

If resource, metric, or log data is missing in Observability, first check whether the connection is normal and whether the corresponding collection feature is enabled on the Platform Access page. If SSO is unavailable, confirm that the component or service is connected and that the SSO configuration has been applied.

Connect Ecosystem Services

Use Platform Access to connect ecosystem services such as Anheng Cloud-Tianchi to Cloud Federation. After the service is connected and the SSO configuration is applied, users can access the corresponding console from the Default Region.

In the upper-right corner of the main menu, switch to Global Management.
Go to Cloud Federation > Platform Access.

When adding a connected service, enter the Anheng Cloud-Tianchi access information as prompted.

Item	Description
Product Type	Select Anheng Cloud-Tianchi to identify the connected object as an ecosystem service.
Service Address	Access address of the Anheng Cloud-Tianchi service. Enter an address that is reachable from the ZCF environment.
Port	Service port of Anheng Cloud-Tianchi. Enter the port used in the actual environment.
AK/SK	Access credentials used to connect to Anheng Cloud-Tianchi. Use an AK/SK pair with the required access permissions.
SSO Configuration	Applies a ZIAM-based SSO configuration to Anheng Cloud-Tianchi. After the configuration is applied, users can access the Anheng Cloud-Tianchi console through SSO.

Test the connection to verify that the Anheng Cloud-Tianchi service is reachable and the authentication information is valid.
After you save the access configuration, check the connection status in the Platform Access list.
Navigate to Cloud Federation > SSO Configuration and apply an SSO configuration that uses only JIT to Anheng Cloud-Tianchi.
Switch to the Default Region, and go to Security > Anheng Cloud-Tianchi to open the Anheng Cloud-Tianchi console.

After the service is connected, verify the following items:

The Anheng Cloud-Tianchi connection status is normal in the Platform Access list.
The SSO configuration has been applied to Anheng Cloud-Tianchi.
The current account has permission to access the Anheng Cloud-Tianchi console.
After switching to the Default Region, you can open the Anheng Cloud-Tianchi console from Security > Anheng Cloud-Tianchi.

Lifecycle Management

Lifecycle Management is used after components and ecosystem services are connected to maintain the basic information and readiness required for later ZCF version upgrades. Administrators can use this capability to manage ZCF Bundles and view version paths, component connection and version status, risk-check results, and history records to determine whether later upgrade maintenance is ready.

The current version mainly provides ZCF Bundle management and a visual upgrade framework as the foundation for later platform upgrade maintenance. The actual upgrade path, upgrade scope, and blocking items depend on target Bundle metadata, component status in Cloud Federation, and page check results. This capability does not replace the product-side upgrade workflows of infrastructure components such as ZStack Cloud, ZStack ZStone, ZStack Zaku, and ZStack ZNS.

Manage Upgrade Packages

Before uploading an upgrade package, obtain the ZCF Bundle that matches the planned maintenance version and current environment architecture, and confirm that the file is complete and usable. Do not create an upgrade plan from a Bundle with an unknown source or unsupported version constraints.

The Package Management area on the Upgrade Management page is used to upload, view, and manage ZCF Bundles. Upgrade plans are created based on available Bundles. The system checks Bundle metadata, the current ZCF version, and component status in Cloud Federation to determine whether upgrade requirements are met.

In the upper-right corner of the main menu, switch to Global Management.
Go to Lifecycle Management > ZCF Upgrade.
View the name, version, status, and upload time of uploaded Bundles.

To add a Bundle, click Upload Bundle and select the ZCF Bundle file.

Item	Description
Version Information	Confirm the Bundle version, component versions, and declared applicable upgrade path.
Verification Status	Confirm whether the file is complete, the format is correct, and the Bundle can be used to create an upgrade plan.
Reference Status	Confirm whether the Bundle is already used by an upgrade plan. A referenced Bundle is not recommended for deletion.

Wait until the system completes package verification. After verification passes, you can create an upgrade plan based on this Bundle.
If the Bundle is no longer needed and is not referenced by an upgrade plan, delete it as needed.

Create an Upgrade Plan

Before creating an upgrade plan, make sure the target Bundle has been uploaded and verified, no upgrade plan is currently running in the environment, and an upgrade window and required data backups have been arranged. If infrastructure component versions do not meet the target ZCF version requirements, upgrade or maintain them through the corresponding product-side workflow first.

Upgrade Management is used to create and execute later-version ZCF upgrade plans. Before an upgrade, the system checks the version path, component status, resources, backups, and risks to help administrators identify blocking conditions in advance. Whether the upgrade can be executed depends on page check results.

In the upper-right corner of the main menu, switch to Global Management.
Go to Lifecycle Management > ZCF Upgrade.
View the current version, available upgrade packages, and current upgrade plan status.
Click Create Upgrade Plan and select the target Bundle.

When selecting a Bundle, confirm that the target version, upgrade path, and component versions meet the upgrade goal. If the page reports that no available Bundle exists, upload and verify the Bundle from the Package Management area first.

Complete pre-upgrade checks as prompted.

Check Item	Description
Version Path	Confirm whether the current ZCF version matches the upgrade path declared by the target Bundle.
Component Status	Confirm that the connection, version, and health status of related components in Cloud Federation meet the prerequisites for this ZCF upgrade. Infrastructure components are not upgraded individually in this plan.
Backup and Resources	Confirm that the required backups, disks, networks, and system resources meet upgrade requirements.
Risk Confirmation	Shows the impact scope and recovery boundary that administrators need to confirm.

After confirming the check result and risk prompts, submit the upgrade plan.

If blocking items exist, resolve them as prompted and run the check again. If risks require confirmation, confirm the impact scope, recovery method, and maintenance window before continuing.
Click Execute Upgrade to start the upgrade plan, and continuously view execution progress on the page.

View Upgrade Progress and History

During upgrade execution, users can view plan status, step progress, recent logs, and failure reasons. After an upgrade completes, is terminated, or fails, history records retain plan information for audit and troubleshooting.

In the upper-right corner of the main menu, switch to Global Management.
Go to Lifecycle Management > ZCF Upgrade.

In the current plan, view overall progress and component step status.

Item	Description
Plan Status	View whether the upgrade plan is pending, running, paused, failed, completed, or terminated.
Execution Progress	View the current execution stage, step progress, start time, and elapsed time.
Risk Check Result	View whether pre-upgrade checks passed and whether risks require confirmation.
Execution Logs	View recent logs and failure reasons to locate where an exception occurred.

If the upgrade is paused or failed, open the failed step to view the failure reason and recommended action.
Based on the page actions, retry the current step, recheck components, or terminate the plan.
Terminating a plan only stops the current upgrade workflow. It does not roll back completed operations. To recover, follow page prompts and your operations procedure.
Click View History to view completed or terminated upgrade plans.
Open a historical plan as needed to view the target version, used Bundle, execution result, and key logs.

Note: Before handling an upgrade exception, confirm the risk boundary and recovery recommendation displayed on the page. Do not manually modify ZCF components, access relationships, or packages involved in the upgrade before the upgrade task ends. Handle infrastructure component issues through the corresponding product-side workflow.

Configure SSO

The SSO Configuration page lets you manage ZIAM-based SSO configurations and apply them to eligible connected platforms. After the configuration is complete, users can access the corresponding platforms from Unified Portal by using SSO.

Configuring SSO typically involves the following tasks:

When you open the SSO Configuration page for the first time, confirm the fallback authentication method, the impact of overwriting existing configurations, and the prerequisites for deleting a configuration.
Use the built-in Default configuration, or add an SSO configuration and select the required identity preset mode.
Apply the SSO configuration to connected platforms. If the configuration includes SCIM, confirm the sync scope and perform a SCIM connection test.
From the SSO configuration details, check configuration and synchronization status and manage the configuration and its platform associations.

Add an SSO Configuration

Before adding an SSO configuration, make sure that:

The ZIAM SSO service is deployed in the current environment.
ZIAM is available and its OIDC discovery endpoint is accessible.
The current administrator has the required Cloud Federation and SSO configuration permissions.

An SSO configuration establishes an SSO relationship between ZCF and ZIAM. You can apply the built-in Default configuration directly. To use a different name, description, or identity preset mode, add an SSO configuration. Saving a configuration does not automatically apply it to connected platforms.

Switch to Global Management in the upper-right corner of the main menu.
Navigate to Cloud Federation > SSO Configuration.
When you open the SSO Configuration page for the first time, complete the confirmation before configuring SSO.
If you have already completed the confirmation, the SSO Configuration page opens directly.
1. Select Local Accounts as Fallback Authentication to confirm that local accounts can be used as a fallback when the identity provider is unavailable.
2. Select Applying Overwrites Existing Configuration to confirm that applying an SSO configuration overwrites the existing SSO configuration on the target platform.
3. Select Keep a Fallback Method Before Deletion to confirm that another authentication method must remain available before an SSO configuration is deleted.
4. Click Start Configuration.
Click Add SSO Configuration.

Configure the SSO settings.

Parameter	Description
Name	Display name used to identify the SSO configuration in the list and on the details page.
Description	Optional description of the SSO configuration. You can enter up to 256 characters.
Authentication Server	Fixed to `ZIAM`. If the page indicates that the authentication server is unavailable, check the ZIAM deployment and service status.
Authentication Protocol	Fixed to `OIDC`. The current version uses OIDC to establish SSO with ZIAM.
Identity Preset Mode	Select how the platform provisions identity and access control data. SCIM and JIT are selected by default, and at least one mode is required. SCIM: The target platform must support SCIM. The identity source provisions users, groups, organizations, projects, and related access assignments in advance. The actual scope is determined when the configuration is applied. JIT: When users sign in through SSO, the platform creates or updates their accounts and access assignments in real time based on information from the identity source. When only JIT is selected, the configuration can be applied to Cloud or Anheng Cloud-Tianchi platforms. When SCIM is included, it can be applied only to Cloud platforms.

Click OK to save the configuration.

The configuration appears on the SSO Configuration page. Click the configuration name and open the Overview tab to view the Client ID, Client Secret, Identity Preset Mode, OpenID Configuration URL, Callback URL, and other information.

To use the configuration on a connected platform, apply it to the target platform.

Note: If ZIAM is unavailable or the authentication parameters cannot be obtained, you cannot add, edit, or apply SSO configurations. Resolve the ZIAM service issue and try again.

Apply an SSO Configuration

Before applying an SSO configuration, make sure that:

The target platform is connected to ZCF Cloud Federation and its connection status is normal.
An available SSO configuration exists.
The target platform is supported by the current identity preset mode.
A local account or another fallback authentication method remains available.

After an SSO configuration is applied, the target platform can use the ZIAM-based SSO settings. If SCIM is enabled, identity and access control data is synchronized one way from ZIAM to the target platform.

Warning: Applying an SSO configuration overwrites the existing SSO configuration on the target platform. Before applying the configuration, make sure that the target platform has a fallback authentication method available.

Switch to Global Management in the upper-right corner of the main menu.
Navigate to Cloud Federation > SSO Configuration.
Click the name of the SSO configuration that you want to apply.
Click Apply Configuration.
Click + Add Platform and select the target platform.

The available platforms depend on the options displayed on the page. When only JIT is selected, the configuration can be applied to Cloud or Anheng Cloud-Tianchi platforms. When SCIM is included, it can be applied only to Cloud platforms.
If the SSO configuration includes SCIM, confirm the Sync Scope for the target platform and perform a SCIM Connection Test.

The sync scope is determined by the target platform type. We recommend confirming that the test result is Connection Succeeded before applying the configuration.
Click Apply Configuration.
On the Platform tab of the SSO configuration details, check the configuration status, synchronization status, and last synchronization time.

After the configuration is applied, the target platform appears on the Platform tab and uses the SSO configuration for authentication. If the configuration includes SCIM, the system also synchronizes identity and access control data according to the configured sync scope.

Note: Identity data is synchronized from ZIAM to the connected platform. Identity changes made on the platform are not written back to ZIAM.

Manage SSO Configurations

Manage Configurations

From Global Management > Cloud Federation > SSO Configuration, use the action menu of an SSO configuration to perform the following operations:

Operation	Description
Edit Name and Description	Change the name and description of a custom SSO configuration. This operation is not available for the built-in `Default` configuration.
Modify Identity Preset Mode	Change the SCIM and JIT modes used by a custom SSO configuration. After the modes are changed, reapply the configuration to associated platforms for the new identity preset mode to take effect.
Apply Configuration	Apply the SSO configuration to a new target platform. This operation is available for both built-in and custom configurations.
Delete	Delete a custom SSO configuration. If the configuration has associated platforms, first remove all associations from the Platform tab of the configuration details. Before deleting the configuration, make sure that another authentication method remains available. The built-in configuration cannot be deleted.

Warning: After SCIM is disabled and the updated configuration is reapplied successfully, subsequent identity data synchronization to the target platform stops. Data previously synchronized to the target platform through SCIM is not deleted, disabled, rolled back, or cleaned up.

View Configuration Details

Click an SSO configuration name and use the following tabs to view its configuration and operational status:

Overview: View the Authentication Server, Authentication Protocol, Status, Identity Preset Mode, Client ID, Client Secret, OpenID Configuration URL, Callback URL, and other information.
Platform: View the configuration status, synchronization status, and last synchronization time of associated platforms, and manage platform associations.
Audit: View operation records related to the SSO configuration.

Manage Associated Platforms

On the Platform tab of the SSO configuration details, use the action menu of an associated platform to perform the following operations:

Operation	Description
Edit SCIM Configuration	Modify the SCIM Base URL, Bearer Token, and sync scope of an associated platform. This operation is available only when the SSO configuration includes SCIM and the target platform supports SCIM. Test the connection before saving, and reapply the configuration after saving for the changes to take effect.
Reapply Configuration	Reapply the configuration when the configuration status is Update Pending or Apply Failed. This operation is unavailable while the platform is applying or synchronizing a configuration. If the pending configuration includes SCIM, complete the SCIM configuration first.
Resync	Trigger identity data synchronization again when the SCIM synchronization status is Sync Failed or Exception. This operation is unavailable while the platform is applying or synchronizing a configuration.
Remove	Remove the association between the SSO configuration and the target platform. This operation is unavailable while the platform is applying or synchronizing a configuration.

View region information

Use Region Management to view the default region and its access relationships. After infrastructure components such as ZStack Cloud, ZStack Zaku, and ZStack ZStone are connected, use this page to verify whether the product environments are associated with the expected region and whether asset and synchronization status are normal.

Item	Description
default region	Carries infrastructure component access relationships in the current environment.
Bound Platform	Shows the ZStack Cloud bound to the default region and the number of related platforms such as ZStack Zaku and ZStack ZStone.
Asset Count	Shows the number of identified resources in the region.
Synchronization Status	Shows the latest synchronization status, which helps verify whether resource ownership and asset data are updated as expected.

In the upper-right corner of the main menu, switch to Global Management.
Go to Cloud Federation > Region Management.
View the default region, bound platforms, connected platform count, asset count, and synchronization status.

If region information or asset count is not as expected, return to the Platform Access page and check connection status, scope, and enabled features.

PreviousUnified Portal