A sub-account can be created by the admin or synced from a
SSO system and is managed by the admin. Resources created
under a sub-account are managed by the sub-account. You
can use a sub-account to create and delete resources under its management and implement
fine-grained control over the permissions on resources.
Figure 1. Sub-account Management
Concepts
admin: The admin has super privileges over resources and shall be owned
by the IT system administrator.
The admin can share instance offerings, disk offerings, networks,
images, and other cloud resources with sub-accounts or revoke the
resources from sub-accounts. Sub-accounts can only manage resources to
which they are granted access.
The admin can modify resource quotas granted to a sub-account based on
different business scenarios.
After the admin created a VXLAN pool, sub-accounts can create VXLAN
networks based on the VXLAN pool.
Changing the owner of a VM instance will change the owner properties of
the EIPs associated with the VM instance.
Sub-account:
Sub-accounts can be categorized into local sub-accounts and SSO
sub-accounts:
A local sub-account is created by the admin. A SSO
sub-account is synced from a SSO
server.
SSO: The SSO
authentication service, powered by the Cloud, supports
seamless access to SSO systems.
Through the service, related users can directly login to
the Cloud and manage cloud resources. Currently, OIDC
servers can be added.
OIDC server: A SSO server
that applies the OIDC protocol. It authenticates
and authorizes SSO users to log into the
Cloud without password and syncs user information
to the Cloud based on the mapping rule.
A sub-account has management permissions on VM instances,
images, volumes, and security groups created under the
sub-account. A sub-account can perform read operations on
resources shared by the admin, but cannot delete the
resources.
Deleting a sub-account will delete all resources created by the
sub-account, such as VM instances, volumes, and images.
The names of sub-accounts must be unique.
Resource quotas that the admin shares with a sub-account is
displayed on the homepage of the sub-account.
Before a sub-account can create a VM instance, the admin must
share an instance offering, disk offering, network, and other
required resources with the sub-account. Otherwise, a VM
instance cannot be created.
A sub-account can use an image that it adds to the Cloud or use
an image shared by the admin.
Quota:
Resource quotas that the admin shares with a sub-account specify
the maximum resources that the sub-account can manage, including computing
resource quotas, storage resource quotas, network resource quotas, and other
resource quotas.
The admin uses the preceding resource quota settings
to manage the maximum resources granted to sub-accounts. If a resource is
deleted but not expunged, the resource still occupies storage space of
primary storage and volumes.
Sub-Account
Create a Sub-Account
On the main menu of ZStack Cloud, choose Settings > Sub-Account Setting > Sub-Account Management. On the Sub-Account page, click Create
Sub-Account. Then, the Create Sub-Account page is
displayed.
On the displayed page, set the following parameters:
Type: Select the sub-account type.
Note:ZStack Cloud supports two sub-account types.
Local Sub-account: The account information is stored locally. If you
add a ZStack IAM server, you cannot create a local sub-account.
SSO Sub-account: The account information is synchronized to the SSO
server for cross-platform SSO. You can create an SSO sub-account
only after you add a ZStack IAM server.
Name: Enter a name for the local sub-account.
Description: Optional. Enter a description for the local
sub-account.
Password: Enter a password for the local
sub-account.
Confirm Password: Confirm the local sub-account
password.
Pricing List: Optional. Select a pricing list. If left
blank, the default pricing list is used.
Figure 2. Create Local Sub-account
Manage a Sub-Account
On the main menu of ZStack Cloud, choose Settings > Sub-Account Setting > Sub-Account Management. Then, the Sub-Account page is displayed.
Manage a Local Sub-Account
The following table lists the actions that you can perform on a local
sub-account.
Action
Description
Create Sub-Account
Create a new sub-account.
Change Password
Change the password of an account.
Note: After
changing the password of admin, you need to log out of the
account and log in again to take effect.
Change Pricing List
Change a pricing list attached by an
account.
Delete Sub-Account
If you delete a sub-account, the sub-account
cannot be used to log in to the platform. VPC vRouters managed
by the sub-account will be deleted. VM instances and volumes
will be deleted based on the policy configured by the admin:
If the deletion policy is set to
Direct, deleting a
sub-account will expunge VM instances and volumes
managed by the sub-account.
If the deletion policy is set to
Delay, deleting a sub-account
will change the state of VM instances and volumes
managed by the sub-account to Deleted and change their
owner to admin.
If the deletion policy is set to
Never, deleting a sub-account
will change the state of VM instances and volumes
managed by the sub-account to Deleted and change their
owner to admin.
Manage a 3rd-Party Sub-Account
The following table lists the actions that you can perform on a 3rd-party
sub-account.
Action
Description
Change Pricing List
Change a pricing list attached by an
account.
Delete Sub-Account
If you delete a sub-account, the sub-account
cannot be used to log in to the platform. VPC vRouters managed
by the sub-account will be deleted. VM instances and volumes
will be deleted based on the policy configured by the admin:
If the deletion policy is set to
Direct, deleting a
sub-account will expunge VM instances and volumes
managed by the sub-account.
If the deletion policy is set to
Delay, deleting a sub-account
will change the state of VM instances and volumes
managed by the sub-account to Deleted and change their
owner to admin.
If the deletion policy is set to
Never, deleting a sub-account
will change the state of VM instances and volumes
managed by the sub-account to Deleted and change their
owner to admin.
If you delete a 3rd-party sub-account, the source
sub-account in the 3rd-party authentication server is
not affected.
3rd-Party Authentication
Add an SSO Server
On the main menu of ZStack Cloud, choose Settings > Sub-Account Setting > Single Sign On. On the Single Sign On page, click Add
SSO Server. Then, the Add SSO Server page is
displayed.
The following lists the SSO server addition scenarios:
Add SSO Server | ZStack IAM
Add SSO Server | Other Identity Provider
Add SSO Server | ZStack IAM
On the displayed page, set the following parameters:
Name: Enter a name for the SSO server.
Description: Optional. Enter a description for the SSO
server.
Type: Only supports OIDC Server. It is an SSO server
that applies the OIDC protocol. It authenticates and authorizes SSO users to
log into the Cloud without password and syncs user information to the Cloud
based on the mapping rule.
Identity Provider: Select ZStack IAM.
Note: The ZStack
IAM server is dedicated to SSO across multiple regions.
Server Address: Enter the ZStack IAM server address.
Enter a complete URL.
Figure 3. Add SSO Server | ZStack IAM
Add SSO Server | Other Identity Provider
On the displayed page, set the following parameters:
Name: Enter a name for the SSO server.
Description: Optional. Enter a description for the
SSO server.
Type: Only supports OIDC Server. It is an SSO server
that applies the OIDC protocol. It authenticates and authorizes SSO users to
log into the Cloud without password and syncs user information to the Cloud
based on the mapping rule.
Identity Provider: An IdP collects and stores user
identity information, such as usernames and passwords, and authenticates
users during login. Supported identity providers include default, ZFIAM,
Alibaba Cloud IDaaS (Private), MaxKey SSO System, and uploaded SSO
plugins.
Redirect URL: The URL
used to redirect to the Cloud when the authentication server is
certified.
Redirect Template: The
redirect template used to realize a password-free login inside
the cloud platform system. You can modify the IP address and
port of this parameter when the Cloud is configured with a
reverse proxy.
Client ID: Enter the unique ID that the
authentication system assigns to the Cloud.
Client Secret: Enter the secret that the
authentication system assigns to the Cloud.
Scope: The Scope is used to specify the scope of user
attributes to be obtained when requesting an access token or ID token, such
as name, email, phone number, and so on. After specifying the scope, the
returned token will contain the corresponding attributes.
Authorization Request URL: Enter the request URL used
to obtain an authorization grant in authorization code mode.
Token Request URL: Enter the request URL used to
obtain an access token from the authentication server.
Userinfo Request URL: The request URL used to obtain
the user information from the authentication server.
Logout URL: The URL used to log off sessions after
logging out of the Cloud. When logging in to the Cloud again, you need to
re-enter the authentication server. If left blank, the login information
will not be immediately cleared after logging out of the Cloud, and you can
still log in to the Cloud without a password as long as the session is
valid.
User Mapping Rule: Through the user mapping rule, the
SSO user has local user attributes after it is synced to the Cloud. The rule
used to map SSO attributes of an SSO user to Cloud local attributes.
Name: Specify a rule to map the attribute of
OIDC users to the name of Cloud users. The name is the unique
identification of a user. Make sure that the name that you fill in
also has a unique identity in the authentication system.
For
example, if a Name maps username, the Name whose user is created
in the Cloud can use the value (such as Xiaoming) matching
username.
Description: Optional. Specify a rule to map
the attribute of OIDC users to the description of Cloud users.
For
example, if a Description maps description, the Description
whose user is created in the Cloud can use the value (such as
dev-backend) matching description.
Figure 4. Add SSO Server
Manage a SSO Server
On the main menu of ZStack Cloud, choose Settings > Sub-Account Setting > SSO. Then, the SSO page is
displayed.
The following table lists the actions that you can perform on a SSO
server.
Action
Description
Edit SSO Server
Edit the name and description of a SSO
authentication server.
Delete SSO Server
Delete a SSO
server.
Note: Deleting a SSO server also
deletes the related SSO user information. The source
user and organization information is not
affected.
Theme and Appearance
What is Theme and Appearance?
You can customize the theme and appearance of the
Cloud.
Customize Theme and Appearance
Prerequisites
This scenario describes how to customize the product logo and release information
after you install ZStack Cloud.
Procedure
Enter the Theme and Appearance page.
On the main menu of ZStack Cloud, choose Settings > System Setting > Theme and Appearance. Then, the Theme and Appearance page is
displayed.
Figure 5. Theme and Appearance
On the Theme and Appearance page, you can customize
following settings:
Global Appearance:
Theme: Choose a global theme color. 8
options are provided.
Note: This setting takes effect on pages
displayed to all Cloud managers, accounts, and
users.
Title Setting:
Browser:
Favicon: Upload an icon for the
browser.
Note: You can upload a
file only in ICO format and the file must no greater
than 2 MB in size.
Chinese Title: Enter a Chinese
title for the browser.
Note: The title must be 1 to 25
characters in length.
English Title: Enter an English
title for the browser.
Note: The title must be 1 to 25
characters in length.
Login Interface:
Logo: Upload a logo for the login
interface.
Note: You can upload
a JPG, JPEG, ,or SVG image that is within 250*70px
and 2 MB.
Chinese Title: Enter a Chinese
title for the login interface.
Note: The title must be 1
to 25 characters in length.
English Title: Enter an English
title for the login interface.
Note: The title must be 1
to 25 characters in length.
Platform Interface:
Logo: Upload a logo for the
platform interface.
Note:
You can upload a JPG, JPEG, PNG, or SVG image
that is within 110*40px and 2 MB.
We recommend that you upload a white or
light-colored logo on a dark background.
Chinese Title: Enter a Chinese
title for the platform interface.
Note: The title must be
1 to 25 characters in length.
English Title: Enter an English
title for the platform interface.
Note: The title must be
1 to 25 characters in length.
Front Size: Select a front size
for the platform interface title. Valid values: Large,
Medium, and Small. Default: Medium.
Monitor:
Title and Appearance:
Chinese Title: Enter a Chinese
title for the monitor.
Note: The title must be 1 to 18
characters in length.
English Title: Enter an English
title for the monitor.
Note: The title must be 1 to 18
characters in length.
Theme: Choose an appearance for
the monitor. Valid values: Classic and Technology.
Default: Classic.
Monitoring Mode: Choose a monitoring
mode. Valid values: External Monitoring and Internal Monitoring.
Default: External Monitoring.
Reset to default settings.
You can cancel all custom settings and reset the product theme and appearance
to default configurations by clicking Reset to Default
Settings.
Note: After you click Reset to Default
Settings, all custom logo images and release information
stored in /var/lib/zstack/static are
deleted.
Time Management
What is Time Management?
Time Management: Manages the Cloud system time and allows you to configure
time servers for the Cloud. After you configure NTP time servers for the Cloud, the
clock of the time servers is synced with all nodes of the Cloud.
Concepts
Time management involves the following concepts：
Internal time server: Uses a management mode or host as an NTP time server
of the Cloud system time so the other nodes of the Cloud may sync time with
the time server.
External time server: Uses a node that does not belong to the Cloud as an
NTP time server, which directly syncs time with all nodes of the Cloud or
syncs time with the Cloud nodes via the internal time server.
Time sync: The process in which the time of a node on the Cloud is synced
with a time server.
Fundamentals
The time sync of the nodes on the Cloud with a time server is achieved mainly via
network time protocol (NTP) and related algorithms. The following lists the sync
process:
You configure an internal or external time server for time sync.
The nodes on the Cloud connect to the time server to obtain its timestamp
information.
Based on the timestamp, the nodes on the Cloud calculate their time
difference with the time server.
Based on their respective time difference, the nodes on the Cloud alter
their local time to achieve time sync.
The nodes on the Cloud implement process 2 to 4 regularly for sustained time
sync.
The Cloud supports the following three time protocol modes:
Internal: Uses a management mode or host as an NTP time server of the Cloud
system time so the other nodes of the Cloud may sync time with the time
server. You can add up to 2 internal time servers for the Cloud.
Internal and External: Uses a node that does not belong to the Cloud as an
NTP time server and uses a management mode or host as an NTP time server of
the Cloud system time. The external time server syncs time with the internal
time server first and then the internal time server syncs time with the
other nodes of the Cloud. You can add up to 2 internal time servers and 2
external time servers for the Cloud.
External: Uses a node that does not belong to the Cloud as an NTP time
server, which syncs time with all nodes of the Cloud. You can add up to 2
external time servers for the Cloud.
Benefits
Time management has the following benefits:
Accurate: The time clock adjustment algorithm used ensures an accurate time
sync.
Automatic: The time sync mechanism is auto implemented regularly. Manual
interference is not required.
Reliable: You can configure multiple time servers to ensure the reliability
and stability of the time sync mechanism.
Intuitive: Time server configuration and its relationship with the Cloud
time are displayed in a topology. In addition, the current Cloud time and
the time zone are displayed.
Scenarios
Time management applies to the following scenarios:
Network management: The logs collected from different network devices
require accurate time records for efficient troubleshooting. The time sync
mechanism provided can well satisfy this demand.
Billing: Time management can ensure consistent and accurate time records for
billing systems so that the billing info is correct.
Collaboration: Time management can ensure unified time for multiple systems
so that they can well collaborate with each other based on the preconfigured
execution time sequence when handling a complex task.
Manage Time Server
On the main menu of ZStack Cloud, choose Settings > System Setting > Time Management. Then, the Time Management page is displayed.
The following table lists the actions that time management supports:
Action
Description
Modify NTP Time Server
Modify NTP time servers. The following three modes are
supported:
Internal: Uses a management mode or host as an NTP time
server of the Cloud system time so the other nodes of the
Cloud may sync time with the time server.
Internal and External: Uses a node that does not belong to
the Cloud as an NTP time server and uses a management mode
or host as an NTP time server of the Cloud system time. The
external time server syncs time with the internal time
server first and then the internal time server syncs time
with the other nodes of the Cloud.
External: Uses a node that does not belong to the Cloud as
an NTP time server, which syncs time with all nodes of the
Cloud. You can add up to 2 external time servers for the
Cloud.
Note:
You can add up to 2 internal time servers and 2 external
time servers for the Cloud. You can enter an IP address
or domain name of an external time server.
Before you modify a time server, make sure that the
management node is in Connected status.
Modifying an NTP time server may cause the time of the
nodes on the Cloud inconsistent with each other and
monitoring data errored or corrupted, and may affect
operating tasks. Proceed with caution.
Forced Sync Time by Force
If the system time has relatively large difference with the time
of the NTP time server, The auto time consistency adjustment may
take a while. You can implement forced time sync to eliminate the
time difference in a short time.
Email Server
What is Email Server?
If you select Email as the endpoint of an alarm, you need
to set an email server. Then alarm messages are sent to the email
server.
Add an Email Server
On the main menu of ZStack Cloud, choose Settings > System Setting > Email Server. On the Email Server page, click Add
Email Server. Then, the Add Email Server page is
displayed.
On the displayed page, set the following parameters:
Name: Enter a name for the email server.
Description: Optional. Enter a description for the email
server.
User Name: Enter a user name.
Password: Enter the password for the user.
Note: If you
add a third-party email server to the Cloud, you need to enable the SMTP
service in advance. In addition, enter the authentication code in the
Password field.
Email Server Type: Valid value: smtp.
Email Server: Enter the IP address of the email
server.
Port: Enter the port of the email server. Default value:
25.
Encryption Type: Optional. Select an
encryption type to encrypt data communications of the email server port. Valid
values: STARTTLS, SSL/TLS, and NONE.
STARTTLS is selected by default. The corresponding port is 25 by
default.
If you select SSL/TLS, the corresponding port is 465 by default.
If you do not need encrypted communications, select NONE.
Figure 6. Add Email Server After you click OK, the system automatically checks whether
the user name, password, email server IP address and port, and encryption type
parameters are correct. The response time is expected to be no longer than five seconds.
If a parameter setting is incorrect, modify the setting based on the tips propped out on
the upper-right corner of the page and then submit again. If the configuration settings
are correct, you are automatically redirected to the Email Server
page. The email server is successfully added to the Cloud.
Note:
Configure the settings as needed. Contact the email server provider for support
in case of any email server related problems.
Manage an Email Server
On the main menu of ZStack Cloud, choose Settings > System Setting > Email Server. Then, the Email Server page is displayed.
The following table lists the actions that you can perform on an email server.
Action
Description
Add Email Server
Add an email server.
Enable Email Server
Enable a disabled email server.
Disable Email Server
Disable an enabled email server.
Edit Email Server
Edit the name and description of an email
server.
Set Sharing Mode
Share an email server to all projects/accounts
(if you have installed the Tenant Management license).
Change Owner
Change the owner of an email server.
Test
Check whether an email server is
connected.
Delete Email Server
Delete an email server.
Log Server
What is Log Server?
A log server is used to collect logs of the management
node. You can add a log server to the cloud and use the collected logs to locate
errors and exceptions. This makes your O&M more efficient.
Add a Log Server
On the main menu of ZStack Cloud, choose Settings > System Setting > Log Server. On the Log Server page, click Add Log
Server. Then, the Add Log Server page is
displayed.
On the displayed page, set the following parameters:
Name: Enter a name for the log server. The name must be 1 to 128 characters in length and can
contain Chinese characters, letters, digits, spaces, hyphens (-), underscores
(_), periods (.), parenthesis (), colons (:), and plus signs (+) and cannot
begin or end with spaces.
Description: Optional. Enter a description for the log
server.
IP Address: Enter the IP address of the log server.
UDP Port: Enter a port that uses the UDP protocol to
provide services.
Log Identifier: Specify the log identifier. The log
identifier is customized in the local system based on your business needs. Valid
values: LOCAL0 to LOCAL7. It has nothing to do with log severity such as DEBUG,
INFO, and ERROR, but is used to match log servers.
Note: The log severity must be
consistent with the setting configured in the log server. Otherwise, log
information cannot be received as expected.
Test Connection: Check whether the configured IP address
is reachable.
Note:
If the IP address is unreachable, check whether the IP address is
correct, the network is normal, and the log severity setting is
consistent.
Configure the settings as needed. Contact the log server provider
for support in case of any email server related problems.
Figure 7. Add Log Server
SNMP Management
What is SNMP Management
SNMP Management: SNMP Management is a service that allows a 3rd-party platform to monitor
resources and events on ZStack Cloud, as well as receive alarms
from ZStack Cloud.
Concept
The following are concepts involved in SNMP Management
SNMP: SNMP stands for Simple Network Management Protocol, a protocol used to
manage the devices in the network. In SNMP Management, it is through this
protocol that the 3rd-party platform obtains the monitoring data of ZStack Cloud resources and receives alarms from ZStack Cloud.
NMS: NMS stands for Network Management System, a system that monitors and
manages the devices in the network through SNMP. NMS sends requests to the
agent of managed devices to query the device parameters, and receives the
trap messages sent from the agent. In SNMP Management, NMS refers to a
3rd-party platform.
SNMP Agent: The agent of the managed objects. This agent is responsible for
response to the requests from the NMS and send Trap message to the trap
receivers proactively. In SNMP management, the management nodes of ZStack Cloud undertakes the role of SNMP agent.
Managed Object: In SNMP Management, Managed Object refers to resources on
ZStack Cloud.
MIB: MIB is a database that is maintained by the SNMP Agent and defines the
properties of managed objects, such as the object name, state, access
permission, and object data type. A 3rd-party platform uses the MIB as a
reference to collect the monitoring data ZStack Cloud
resources and parse the alarms received. ZStack Cloud
provides its dedicated MIB for you to download and refer to.
SNMP Trap Receiver: SNMP trap receiver is a 3rd-party server used to receive
alarms pushed by Cloud. You can add an SNMP trap receiver as an endpoint and
attached to alarms, so that Cloud can push specified alarm messages to this
SNMP trap receiver.
Enable SNMP Service
On the main menu of ZStack Cloud, click Settings > Platform Setting > SNMP Management. On the SNMP Management page, click
Enable. Then, the Enable SNMP Management
page is displayed.
Set the following parameters on the displayed page:
SNMP Agent Port: Set an SNMP agent port to receive and
response to the request from the 3rd-pafrty platform.
Note: SNMP SNMP Agent port
is a port on the management node. Default: 1161. Valid values:
1024-65565.
Protocol Version: Select a SNMP version. Supported two
protocol version: v2c and v3.
If you choose v2c, set the following parameters:
Community: Set a community. This
community is used for the connectivity authentication between
ZStack Cloud and the 3rd-party
platform.
If you choose v3v, set the following parameters:
Username: Set the username.
User Authentication: Optional. If set to
true, a security authentication is enabled for the connectivity
between ZStack Cloud and the 3rd-party
platform and you need to set the following parameters:
Authentication Protocol: Select
an authentication protocol. Supported protocols: MD5,
SHA, SHA224, SHA256, SHA384, and SHA512.
Authentication Password: Set an
authentication password.
Confirm Password: Enter the
password again to confirm it.
Data Encryption: Optional. Choose whether
to encrypt the data transmitted between ZStack Cloud and the 3rd-party platform. To
enable Data Encryption, you need to enable User Authentication
first and set the following parameters:
Encryption Protocol: Choose an
encryption protocol. Supported protocols: DES,AES128,
AES192, AES256, and 3DES.
Encryption Password: Set an
encryption password.
Confirm Password: Enter the
password again to confirm it.
SNMP Trap Receiver: Optional. Enter the IP address and
port of a 3rd-party server which is used to received alarms sent from ZStack Cloud.
Figure 8. Enable SNMP Management
Manage SNMP Service
On the main menu of ZStack Cloud, choose Settings > System Setting > SNMP Management. Then, the SNMP Management page is displayed.
The following lists the actions you can perform on the SNMP
Management page:
Action
Description
Enable SNMP Management
Enable the SNMP management.
Modify SNMP Config
Modify the SNMP protocol configurations, such as
the SNMP agent port, protocol version, community, and
username.
Add SNMP Trap Receiver
Add a new SNMP trap receiver.
An SNMP trap
receiver can be added as an endpoint and attached to alarms, so
as ZStack Cloud can push specified alarm
messages to the SNMP trap receiver.
Edit SNMP Trap Receiver
Modify the IP address and port of the SNMP trap
receiver.
Delete SNMP Trap Receiver
Delete an SNMP trap receiver.
Note: If the SNMP
trap receiver has been added as an alarm endpoint, this alarm
endpoint will be deleted synchronously.
Download MIB
Download the MIB file provided by ZStack Cloud. The 3rd-party platform relies on
this file to collect the data of ZStack Cloud
resources and parse alarms from ZStack Cloud.
Disable SNMP Management
Disable the SNMP management.
After the enabling, the 3rd-party platform will no longer
collect resource data from ZStack Cloud proactively. However, the SNMP trap receivers added as
alarm endpoints can continue received alarms sent from
ZStack Cloud.
ZStack Cloud will keeps the SNMP
parameters you set so as you can re-enable the SNMP service
conveniently on the next time.
Version Detection
What is Version Detection?
ZStack Cloud Version Detection periodically detects the latest
version and provides information about the version number and the highlights if the
latest version is available.
Overview
ZStack Cloud Version Detection provides information about the
current product version, including license version, version number, and the
installation time of the current version. You can specify the detection duration and
pull strategy. If you enable Version Detection, the Cloud auto detects if a new
production environment recommended version or technical preview version is available
based on the specified duration and pull strategy. This way, you can be informed of
the highlights of the new product version. You can also implement manual detection.
If you do, the Cloud detects version updates for one time based on the specified
version pull strategy.
Enable Version Detection
On the main menu of ZStack Cloud, choose Settings > System and Security > Version Detection. Then, the Version Detection page is
displayed. Click the version detection button, the Version Auto Detection window is
displayed.
On the displayed window, set the following parameters:
Check Network Connectivity: Check whether the management node is connected
with ZStack Cloud Version Maintenance Center which
hosts version information.
Note: If the management node is disconnected from
the Center, Version Detection cannot be enabled.
Version Pull Strategy: Specify the type of version whose information is to
be pulled. The following two types of versions are supported:
Production Environment Recommended: If you specify this version
type, the Cloud auto detects if a new production environment
recommended version is available. If there is one available, the
latest production environment recommended version is pulled. This
version type is for production environments with high requirements
for stability and reliability and does not include the latest
features.
Technical Preview: If you specify this version type, the Cloud auto
detects if a new technical preview version is available. If there is
one available, the latest technical preview version is pulled. This
version type is for testing and internal environments and includes
all the latest features.
Auto Detection Duration: Specify the auto detection duration. Unit: day,
week, month, and year. The default detection duration is once every
month.
Version Push
If you enable Version Detection and uses auto or manual detection for a potential new
version, and if a new one is available, the information of this version is displayed
on a window.
If the version type is Production Environment Recommended, highlights of
this version are provided. If you need to upgrade to this version, contact
the technical support.
If the version type is Technical Preview, highlights of this version are
provided. You can also scan the QR code or click the link provided on the
window to view more information about the highlights. If you need to upgrade
to this version, contact the technical support.
Disable Version Detection
ZStack Cloud disables Version Detection by default. If you
enabled this feature and want to disable it again, turn off the switch.
Global Setting
Global Setting allows you to configure settings that take
effect on the whole platform.
In the top-right corner of the Global Setting page, click
Reset to Default Settings. Then all settings are reset to the
initial settings.
Global Setting provides Basic and Advanced
settings. ZStack Cloud provides over a hundred of advanced
settings. You can configure the settings based on your business needs.
Scenario Template
Scenario Template provides multiple templates that
encapsulate scenario-based global settings. You can apply a template globally with
one click based on your business needs. This improves your O&M
efficiency.
Certificate Management
Certificate Management
ZStack Cloud allows you to configure and manage SSL certificate.
After successfully configuring the SSL certificate, you can log in to the UI via HTTPS
protocol. The HTTPS protocol ensures that data transmission is effectively encrypted for
the Cloud.
You can import a SSL certificate by one of the following modes:
Import a third-party certificate.
Import a system self-signed certificate.
Add a Certificate
On the main menu of ZStack Cloud, choose Setting > System and Security > Certificate Management. On the Certificate Management page, click
Add Certificate. The Add Certificate
page appears.
The following lists the two certificate addition scenarios:
Add a third-party certificate
Add a system self-signed certificate
Add a Third-Party Certificate
On the displayed page, set the following parameters:
Import Mode: Select Third-Party
Certificate.
Certificate Document: Enter or import a certificate content.
Note:
The imported certificate must be in CTR or PEM format.
The certificate starts with ----BEGIN
CERTIFICATE---- and ends with ----END
CERTIFICATE----.
Certificate Private Key: Enter or import a
certificate private key.
Note:
The certificate private key must be in CTR or PEM format.
The certificate starts with ----BEGIN (RSAIEC) PRIVATE
KEY---- and ends with ----END (RSAIEC)
PRIVATE KEY----.
Certificate Chain: Optional. Enter or import a
certificate chain.
Note:
The certificate chain must be in CTR or PEM format.
The certificate starts with ----BEGIN
CERTIFICATE---- and ends with ----END
CERTIFICATE----.
HTTP Redirection: Optional. If enabled, requests are
redirected by default from port 5000 of the HTTP address to port 5443 of the
HTTPS address.
Note: When you update the certificate, the system automatically detects the new
certificate path and write the certificate information into this path.
Figure 9. Add a Third-Party Certificate
Add a system self-signed certificate
On the displayed page, set the following parameters:
Import Mode: Select System Self-Signed
Certificate.
Duration: You can specify a validation duration for
the system self-signed certificate. Valid values: 3 months, 1 year, 3 years,
5 years, and 10 years. By default, 10 years is selected.
HTTP Redirection: Optional. If enabled, requests are
redirected by default from port 5000 of the HTTP address to port 5443 of the
HTTPS address.
Custom Certificate Information: Optional. If enabled,
you can customize your self-signed certificate information.
Common Name: Optional. Set a common name. By
default, the common name is localhost.
Note: The input must be 1 to
64 characters in length and can contain letters, digits, and
special characters. Supported special characters include
~`@#$%^&*()-_+={}[]|:;'<>.?/
Organization Name: Optional. Set a name for
your organization. By default, the organization name is
localhost.
Note: The input must be 1 to 64 characters in length
and can contain Chinese characters, letters, digits, and special
characters. Supported special characters include
~`@#$%^&*()-_+={}[]|:;'<>.?/
Organization Unit Name: Optional. Set a name
for your organization unit.
Note: The input must be 1 to 64
characters in length and can contain Chinese characters,
letters, digits, and special characters. Supported special
characters include
~`@#$%^&*()-_+={}[]|:;'<>.?/
Country/Region Name: The country/region name
can only be set as CN.
State/Province Name: Optional. Set the state
or province name.
Note: The input must be 1 to 128 characters in
length and can contain Chinese characters, letters, digits, and
special characters. Supported special characters include
~`@#$%^&*()-_+={}[]|:;'<>.?/
Locality Name: Optional. Set a city
name.
Note: The input must be 1 to 128 characters in length and
can contain Chinese characters, letters, digits, and special
characters. Supported special characters include
~`@#$%^&*()-_+={}[]|:;'<>.?/
Email Address: Optional. Set an email
address.
Figure 10. Add a System Self-Signed Certificate
Manage a Certificate
On the main menu of ZStack Cloud, choose Setting > System and Security > Certificate Management. Then, the Certificate Management page is
displayed.
The following table lists the actions that you can perform on a certificate.
Action
Description
Add Certificate
Add a SSL certificate.
Note:
You can add a maximum of one SSL certificate.
After you add a certificate, the Cloud will
automatically redirect to port 5443 for login.
Update Certificate
Update the current SSL certificate.
Switch back to HTTP
Switch back to HHTP to log in to the Cloud
UI.
Note: The session is reestablished after you switch to HTTP.
You need to log in to the UI again via HTTP
protocol.
Experience Improvement Program
What is Experience Improvement Program
Experience Improvement Program: Experience improvement program is launched with the
purpose to improve the product performance and using experience. After you agree to
relevant terms and conditions and join in the program, ZStack Cloud begins to make a statistic on your Cloud usage data. The statistic and the analysis
based on it will be used for the product optimization and help us provide an even better
service in the future.Figure 11. Experience Improvement Program
Statistic Scope
After you join the experience improvement program, the following data is
collected:
Product Configuration Data: gathers your product information, browser
information, and access terminal information.
Product Information: product name, type, and version number.
Browser Information: browser name, version, language, and
encoding.
Access Terminal Information: access terminal OS, OS version, and
screen resolution.
Feature Usage Data: gathers your feature usage habits and page activities on
the Cloud, including your username, user UUID, and user type; the current
page URL, previous page URL, visit duration, dwell duration, and button
click records.
Product Performance Data: gathers the Cloud performance and page response
indicators, including the page loading duration.
Note: The program aims to analyze your feature usage habits, and the collected
data does not contain any sensitive resource or personal information. The
statistic begins after you join in the program and end as soon as you opt out
from the program.
Data Storage and Use
The data collected mentioned above is retained locally by default and will not
be uploaded to any other platform or storage media automatically.
Only when you authorize official technical supports to perform platform
maintenance, fault checks, configuration changes, inspection, or other actions
that require analysis based on the above data will them be transmitted to the
specific storage media.
The experience improvement program aims to guide a better service provided by
ZStack Cloud, and the statistic and analysis based on
it are used only for the optimization of the product features and using
experience.
Join in and Opt out from Experience Improvement Program
Join in Experience Improvement Program
On the main menu of ZStack Cloud, choose Settings > System and Security > Experience Improvement Program. On the Experience Improvement Program, click
Join In. Then, the Join in Experience
Improvement Program page is displayed.
Before you confirm to join the program, read Customer Agreement and Personal
Information Authorization Letter carefully, and make sure that you fully understand
and agree to all terms and conditions. Then, select the check box I have
read and agree to Customer Agreement and Personal Information Authorization
Letter and click OK to join in the experience
improvement program.
Note: If you join in the experience improvement program through
any other method, you are deemed to agree to all terms and conditions in
Customer Agreement and Personal Information Authorization Letter and allow
ZStack Cloud to make relevant statistics.
Opt out from Experience Improvement Program
You can click Opt Out on the Experience Improvement
Program page to opt out from the experience improvement program
whenever you want.
After you opt out from the program, ZStack Cloud stops the
statistics on your product usage data.
Note: ZStack Cloud supports two sub-account types.
