• Name: Enter a name for the image.
• Description: Optional. Enter a description for the image.
• Image Type: Select an image type. Here, select System Image.
• Image Format: Select an image format. Here, Select iso.
• CPU Architecture: Select a CPU architecture for the image. VM instances created from the image use this CPU architecture.
• Platform: Select an image platform. Here, select Linux.
• OS: Select an operating system that is consistent with the image.
• VirtIO: Choose whether to enable VirtIO according to your actual operating system and platform. Here, enable VirtIO.
• Image Storage: Select an image storage added before.
• Image Path: Specify an image URL or upload a local file.
  • URL: Enter a specified URL to add an image. You can enter a URL by using either of the following syntax:
    • A URL starting with http or https:
      • Syntax: http://host[:port]/path/file or https://host[:port]/path/file.
    • A URL starting with ftp:
      • Syntax that does not specify the user: ftp://hostname[:port]/path/file.
      • Syntax that specifies the user: ftp://user:password@hostname[:port]/path/file.
    • A URL starting with sftp:
      • Syntax that specifies the user identity: sftp://user:password@hostname[:port]/path/file.
      • User-identity-free syntax: sftp://user@hostname[:port]/path/file.
    • The absolute path of an image file that is stored on an image storage. The image storage can be an ImageStore image storage.

      Syntax: file:///path/file.

    Note:

    • Make sure that the URL entered is accessible to the image storage and the image file exists.
    • When using a URL that starts with stfp and does not specify user identity, make sure that you enable mutual password-free SSH login between the image storage and the SFTP server.
    • For the progress bar and resumption from breakpoints features:
      • Both ImageStore and Ceph image storage support a progress bar to display the upload progress. And both ImageStore and Ceph image storage support the resumption from breakpoints.
    • If you specify a URL with the file:/// syntax to add an image:
      • Ceph image storage does not support the file:/// syntax currently.
      • The three forward slashes (/) in file:/// represents the absolute path of a file on an image storage. For example, if you want to specify the URL file:///opt/dvd/image-1.4.qcow2, the /opt/dvd path of the image storage must contain such a file named image-1.4.qcow2.
  • Local file: Select a local image file that the current browser can access to and upload the image file to the specified image storage. The image storage that stores the image file can be an ImageStore or a Ceph image storage.
    Note: When you add a local file as an image, your local browser is serving as a transit point to upload the image. Do not refresh or close the current browser, nor stop the service of the management node. Otherwise, the operation may fail.
• BIOS Mode: Select a BIOS mode. Here, select Legacy.

• Name: Enter a name for the disk offering.
• Description: Optional. Enter a description for the disk offering.
• Disk Size: Set the capacity of a volume.
  Note: Select an appropriate disk size as needed. This disk size will serve to create the system disks for the CentOS 8 VM instances.

  • If you are installing a command line interface of CentOS 8, we recommend that you choose a disk size greater or equal to 40 GB.
  • If you are installing a graphical interface of CentOS 8 (GNOME), we recommend that you choose a disk size greater or equal to 60 GB.
• Set Disk Bandwidth: Optional. Set an upper limit for the I/O bandwidth of a volume.
• Set Disk IOPS: Optional. Set an upper limit of the disk reads/writes per second (IOPS).
• Advanced Parameter: Optional. You can set this parameter by configuring a JSON file.

[root@localhost ~]# sed -i '/ONBOOT=/cONBOOT=yes' /etc/sysconfig/network-scripts/ifcfg-ens3     #Set the NIC to be activated automatically at boot
[root@localhost ~]# sed -i '/^UUID'/d /etc/sysconfig/network-scripts/ifcfg-ens3    #Delete the UUID in the NIC configuration file
[root@localhost ~]# sed -i '/^HWADDR'/d /etc/sysconfig/network-scripts/ifcfg-ens3    #Delete the MAC in the NIC configuration file

1. Check whether the patch is on.
   Run grep . /sys/devices/system/cpu/vulnerabilities/*. You can check whether the patch is on by viewing /sys. For example:

   # grep . /sys/devices/system/cpu/vulnerabilities/*
   /sys/devices/system/cpu/vulnerabilities/itlb_multihit:KVM: Mitigation: Split huge pages
   /sys/devices/system/cpu/vulnerabilities/l1tf:Mitigation: PTE Inversion; VMX: conditional cache flushes, SMT disabled
   /sys/devices/system/cpu/vulnerabilities/mds:Mitigation: Clear CPU buffers; SMT Host state unknown
   /sys/devices/system/cpu/vulnerabilities/meltdown:Mitigation: PTI
   /sys/devices/system/cpu/vulnerabilities/spec_store_bypass:Mitigation: Speculative Store Bypass disabled via prctl and seccomp
   /sys/devices/system/cpu/vulnerabilities/spectre_v1:Mitigation: usercopy/swapgs barriers and __user pointer sanitization
   /sys/devices/system/cpu/vulnerabilities/spectre_v2:Mitigation: Full generic retpoline, IBPB: conditional, IBRS_FW, STIBP: disabled, RSB filling
   /sys/devices/system/cpu/vulnerabilities/srbds:Not affected
   /sys/devices/system/cpu/vulnerabilities/tsx_async_abort:Mitigation: Clear CPU buffers; SMT Host state unknown

   You can check the patch status through the last result returned. Mitigation means that the patch is on, while vulnerable means the patch is closed.

2. View the vulnerability fix method.
   If the patch is on, check the bug fix method through the last result returned in the previous step. There are two bug fix methods: Retpoline without IBPB and Enhanced IBRS.

   • Retpoline without IBPB: This method has a smaller impact on the performance of the system. You can either close the patch or keep it on. This depends on your needs.
   • Enhanced IBRS: This method has a greater impact on the performance of the system. We recommend that you close the patch to improve the system performance. (The performance can improve by about 30% as measured.)
3. Close the vulnerability patch.
   To close the vulnerability patch, following these steps:

   1. In the /etc/default/grub file, set the value as noibrs noibpb nopti spectre_v2=off nospectre_v1 l1tf=off nospec_store_bypass_disable no_stf_barrier mds=off mitigations=off for the parameter GRUB_CMDLINE_LINUX.
   2. Run grub2-mkconfig > /boot/grub2/grub.cfg to apply the configuration.
   3. Reboot the VM instance to make the configuration effective.

   Refer to the following example:

   [root@10-0-5-87 ~]# cat /etc/default/grub      #view /etc/default/grub file configuration.Make configurations based on your needs.
   GRUB_TIMEOUT=5
   GRUB_DISTRIBUTOR="$(sed 's, release .*$,,g' /etc/system-release)"
   GRUB_DEFAULT=saved
   GRUB_DISABLE_SUBMENU=true
   GRUB_TERMINAL_OUTPUT="console"
   GRUB_CMDLINE_LINUX="crashkernel=auto rd.lvm.lv=zstack/root rd.lvm.lv=zstack/swap rhgb quiet noibrs noibpb nopti spectre_v2=off nospectre_v1 l1tf=off nospec_store_bypass_disable
           no_stf_barrier mds=off mitigations=off"
   GRUB_DISABLE_RECOVERY="true"
   [root@10-0-5-87 ~]# grub2-mkconfig > /boot/grub2/grub.cfg     #Apply the configuration
   [root@10-0-5-87 ~]# reboot     #Restart the VM instance to make the configuration effective

• Name: Enter a name for the image.
• Description: Optional. Enter a description for the image.
• Image Type: Select System Image here.
• Image Storage: Select an image storage created before.

• ImageStore image storage.

  On the Image page, choose Actions > Export Image. This button helps export the image.

  After generating the image, you can copy the URL of the image exported on the Overview page to download the image. Or, you can copy the URL of the exported image on the Exported page. You can also click Download on the page to download the image directly.

• Ceph image storage. If you use a Ceph image storage, you can export the image on the UI or from the image storage.
  • Export on the UI:

    On the Image page, choose Actions > Export Image. This button helps export the image.

    After generating the image, you can copy the URL of the image exported on the Overview page to download the image. Or, you can copy the URL of the exported image on the Exported page. You can also click Download on the page to download the image directly.

  • Export from the image storage:
    1. On the Overview page of the created image, copy Installation Path.
    2. Login to the terminal of the Ceph image storage, run rbd export to export the image. For example:
       If you obtain the installation path ceph://bak-t-cac5eee23a204c1a914d1743f1584644/7232237c0059409babcd1c7a69452b98, you can run the following commands to export the image:

       [root@ceph-node1 ~]# rbd export bak-t-cac5eee23a204c1a914d1743f1584644/7232237c0059409babcd1c7a69452b98 /root/export-test.qcow2
       [root@ceph-node1 ~]# # bak-t indicates the installation path of the image
       [root@ceph-node1 ~]# # /root/export-test.qcow2 indicates the target path and the file name of the exported image

       Note: The command rbd export does not include such a prefix as ceph://.