Highlights

The highlights of ZStack ZSphere 5.1.0 include:

• VM Encryption

  ZStack ZSphere 5.1.0 supports encryption at rest and in transit for VMs. Encryption at rest protects data stored in virtual disks, snapshots, and backups. Encryption in transit protects memory and disk data during VM hot migration.

• Platform Service Management

  ZStack ZSphere 5.1.0 allows you to deploy and manage ZLR and ZCenter services in the UI. ZCenter deployed through Platform Services supports automatic database backup.

• Third-Party Backup Software Integration

  This release adds Commvault integration for VM backup and restore and further improves Veeam backup and restore capabilities.

New Features

This release includes the following new features.

• VM Encryption

  ZStack ZSphere 5.1.0 adds encryption at rest and in transit for VMs to protect stored VM data and data transmitted during hot migration.

  Key capabilities include:

  • Encryption at Rest: Encrypts and decrypts data stored in virtual disks, snapshots, and backups at the hypervisor layer. No Guest OS adaptation is required.
  • Key Providers: Supports external KMS providers and the built-in NKP. All storage types except ZHPS support VM and disk encryption.
  • Encryption State Changes and Lifecycle Management: Allows you to enable or disable encryption when a VM is stopped and perform lifecycle operations such as snapshot, backup, and clone on encrypted VMs. Snapshots and backups are automatically encrypted and inherit the source DEK.
  • Encryption in Transit: Encrypts memory and disk data during VM hot migration. TLS encryption is mandatory for encrypted VMs and can be enabled as needed for unencrypted VMs.
• Platform Service Management

  ZStack ZSphere 5.1.0 adds Platform Service Management, allowing you to deploy ZLR and ZCenter services in the ZStack ZSphere UI. Automatic backup applies only to ZCenter deployed through Platform Services. Each day at 00:00, the system backs up the ZCenter database, synchronizes the backup file to the management node, and retains only the latest backup.

• Commvault Backup and Restore

  This release supports backup and restore of ZStack ZSphere VMs through Commvault 11.40.51, expanding integration with third-party data protection software.

Improvements

This release includes the following improvements.

• Log Server Enhancements

  The log server supports multi-level alarms, tiered notifications, and platform operation logs. Logs and alarms of different levels can be delivered to external logging systems for centralized storage, query, and analysis.

• Block Device Performance Monitoring

  You can view performance metrics for NVMe and FC block devices, including throughput, IOPS, and latency, to understand block device status and troubleshoot performance issues.

• Built-In QXL Driver in VMTools

  VMTools includes a QXL driver for UEFI VMs. When used with a QXL video device and the SPICE remote desktop protocol, the driver provides 2D graphics acceleration and allows screen resolution adjustment.

• VM Console Permission Control

  You can separately configure permissions for pasting local commands, using command tools, managing VM power, and enabling read-only mode in the VM console. This enhancement allows console operations to be controlled by role.

• Data Disk Storage Relocation

  You can migrate only the data disks of a VM. Both cold and hot migration are supported from SAN storage to SAN storage. Cold migration is supported between NFS storage systems or between ZCE distributed storage systems. This enhancement lets you relocate data disks based on capacity, performance, or service planning without migrating the system disk.

• Network and Hostname Configuration During VM Cloning

  When cloning a VM, you can customize network interface parameters and specify the VM hostname, reducing network and operating system configuration after cloning.

• Veeam Backup and Restore Performance

  This release optimizes the Veeam backup and restore path to improve backup and restore efficiency.

Resolved Issues

This release resolves the following issues.

VM Management

• Fixes an issue where periodically collecting network interface status on a Windows VM with VMTools installed might cause PowerShell processes to accumulate and CPU usage to become excessively high.
• Fixes an issue where VM uptime might be reset after hot migration, host change, host reconnection, or management node restart.

Storage Management

• Fixes an issue where creating a shared disk from a disk image on SAN storage might fail due to incorrect format conversion handling during disk creation.
• Fixes an issue where an image storage might not be deleted after it becomes disconnected because the system cannot clean up the remote OVA package.
• Fixes an issue where the virtual allocatable capacity of a storage pool might not be updated automatically after an unexpected shutdown of a ZStone storage node or reconnection of data storage. This issue might cause resource creation to fail.
• Fixes an issue where a timer ID overflow after libvirt runs for an extended period might cause libvirt to become abnormal and affect operations such as disk expansion.

Backup and Restore

• Fixes an issue where metadata such as the operating system type and motherboard type might differ from the source VM after the VM is restored through Veeam or Commvault. Due to compatibility restrictions, a source VM using UEFI + I440FX is converted to Legacy + I440FX during restore.
• Fixes an issue where Windows file-level restore (FLR) cannot be selected after a Windows VM is backed up in Veeam 12.
• Fixes an issue where a backup task might fail with Job ID already in use because the system periodically removes the backup task lock file from the temporary directory.
• Fixes an issue where a CBT backup on thin-provisioned SAN storage might unexpectedly expand a disk and pause the VM.
• Fixes an issue where a VM might crash during backup.
• Fixes an issue where a backup task might fail due to a false I/O Hung detection when block job progress remains unchanged for a short period.
• Fixes an issue where a restore task might fail during high-concurrency Veeam restore because a system call is interrupted when the API Proxy Data Agent writes to an NBD volume.
• Fixes an issue where connection refused might be displayed during API Proxy installation before the service is ready, potentially causing users to incorrectly assume that the deployment has failed.
• Fixes an issue where concurrent CBT export or CBT enablement tasks might fail due to NBD port contention.
• Fixes an issue where NBD export might fail during Veeam backup of a VM with a snapshot chain on SAN storage because the system does not activate the complete disk snapshot chain.

Platform O&M

• Fixes an issue where KVM Agent memory usage might continue to increase after extended operation, affecting the stability of host task execution.
• Fixes an issue where custom attribute values might be empty in CSV files exported from VM, host, data storage, bare metal host, distributed switch, or distributed storage resource lists.

Security Updates

This release includes the following security updates.

• Updates the kernels of Kylin V10 SP3 and Kylin V10 SP3 2403 to fix CVE-2026-46333 and CVE-2026-43494.
• Updates the H84r kernel to fix Linux KVM vulnerabilities CVE-2026-53359 and CVE-2026-46113.
• Updates the Linux kernels and related drivers of supported operating systems to fix CVE-2026-31431 and CVE-2026-43284.
• Upgrades Redis to 7.2.11 to fix CVE-2025-49844.
• Updates the Kylin V10 SP3 2403 kernel to fix CVE-2026-46331.

Enhancements

This release includes the following enhancements.

• Migration Service Enhancements

  This release adds support for ZMigrate 1.10.126 and improves migration network configuration and task progress visibility.

  The following enhancements are included:

  • Supports specifying a gateway for a temporary IP address.
  • Displays data synchronization progress in the migration task list.
• Data Storage Capacity Query Permission Enhancement

  Regular users can now query data storage capacity. This allows them to check available capacity and expand a VM whose storage location has been specified.

• Event Alarm Enhancement

  The Host Disk Abnormal event alarm now evaluates disks configured as hot spares.

Resolved Issues

This release resolves the following issues.

• Fixes an issue where Migration Service authentication could occasionally fail when the management node had multiple NICs.
• Fixes Linux kernel KVM vulnerability CVE-2026-53359 in H84r environments.
• Fixes an issue where Veeam backups failed when the backing LV was not activated during NBD export from SAN storage.
• Fixes an issue where SAN storage usage continued to grow after CBT was enabled and a backup job filled the guest file system.
• Fixes an LV lock error that occurred when Veeam restored a VM backed up from VMware to the ZStack ZSphere platform and started it on a specified host.
• Fixes an issue where an incorrect username was passed in User Data when a Windows VM was created with a password.
• Fixes an issue where custom attribute values were empty in an exported VM CSV file.

Enhancements

Resolved Issues

Enhancements

Resolved Issues

Enhancements

Resolved Issues

Highlights

New Features

This release includes the following new features.

Security

Enterprise KMS Integration

Enterprise KMS integration supports integration with mainstream KMS platforms, such as Thales, Entrust, and HashiCorp, through the standard KMIP protocol. With this capability, ZStack ZSphere can reuse existing enterprise key management infrastructure and reduce the cost of deploying and maintaining additional security systems.

Key capabilities include:

• Supports mutual trust based on CA certificates between ZStack ZSphere and KMS platforms.
• Supports TLS-based encrypted transmission to protect key distribution and management channels.
• Supports DEK and KEK layered protection to manage data encryption keys and key encryption keys separately.
• Supports key isolation by KMS account for multi-service or multi-tenant environments.
• Supports key rotation to meet periodic key update and security compliance requirements.

Use cases:

• Production environments where an enterprise KMS has already been deployed.
• Virtualization environments that require unified key lifecycle management.
• Industry scenarios with compliance requirements for data encryption, key isolation, and key rotation.

Native Key Provider (NKP)

Native Key Provider (NKP) is a built-in key management service. You can enable virtual machine disk encryption in ZStack ZSphere without integrating with a third-party KMS.

Key capabilities include:

• Supports enabling key management services in the platform without relying on an external KMS.
• Supports DEK and KEK layered protection.
• Supports the AES-256 encryption algorithm.
• Supports NKP backup and restore to help recover key resources in disaster recovery scenarios.

Use cases:

• Private deployments where no external KMS has been deployed.
• Small and medium-sized environments that need to quickly enable virtual machine disk encryption.
• Scenarios that require built-in key management as a basic encryption capability or a supplemental key management option.

Virtual Machine Secure Boot and vTPM

Virtual Machine Secure Boot and virtual TPM (vTPM) improve trust in the virtual machine boot process and virtualized runtime environment. vTPM complies with TPM 2.0 and provides trusted computing capabilities for virtual machines without physical TPM hardware.

Key capabilities include:

• Supports Secure Boot to help prevent untrusted firmware, boot loaders, or drivers from loading during startup.
• Supports virtual TPM devices that comply with TPM 2.0.
• Supports lifecycle operations for vTPM virtual machines, such as clone, snapshot, migration, and high availability.
• Supports automatic vTPM reset when deploying vTPM virtual machines from clones or templates to reduce the risk of key conflicts.
• Supports Rekey operations to rotate vTPM-related keys.

Use cases:

• Operating systems that depend on TPM capabilities, such as Windows 11 and Windows Server 2022.
• Production environments that require trusted virtual machine startup and key protection.
• Scenarios such as finance and government where virtual machine security baselines are explicitly required.

Migration

Migration Service

Migration Service migrates virtual machines from VMware environments to ZStack ZSphere. The tool is included with ZStack ZSphere and does not require a separate migration system.

Key capabilities include:

• Agentless migration: The migration process does not require agents on source virtual machines, which reduces impact on production systems.
• Continuous data synchronization and final cutover: Supports virtual machine data synchronization during migration and final cutover within a service window.
• Resumable transfer: Uses block-level data transfer and can resume after network interruption or instability, avoiding repeated migration of completed data blocks.
• Pre-cutover validation: Supports test cutover before the final cutover to validate the availability of migrated virtual machines and business systems.
• Operating system compatibility: Supports mainstream Windows and Linux operating systems, including China-developed operating systems such as Kylin, UOS, and Euler.

Use cases:

• VMware replacement and virtualization platform migration.
• Data center consolidation or cross-platform migration.
• Production environments that require multiple rounds of service validation before migration.

User Management

This release enhances account management and permission control to improve platform administration security.

• Supports two-factor authentication login for domain users based on one-time passwords.
• Adds the read-only administrator role for audit, inspection, and read-only access scenarios.
• Supports promoting regular users to administrators.
• Supports automatically transferring resources owned by a deleted user to an administrator to prevent unmanaged resources.

Installation and Deployment

This release enhances the installation and deployment process. You can install and deploy the platform through a TUI graphical interface, which reduces command-line deployment complexity.

Storage

Storage Registration and Virtual Machine Registration

Storage registration and virtual machine registration support resource management based on existing data and metadata. These capabilities apply to remote recovery, lightweight disaster recovery, and quick onboarding of existing resources.

Key capabilities include:

• Storage registration: Supports registering storage resources that already contain data so that the target environment can identify and use existing data.
• Virtual machine registration: Supports managing and starting virtual machines based on metadata, which applies to lightweight disaster recovery cutover and backup site recovery.
• Storage type support: Supports multiple storage types, such as NFS and SAN.

Use cases:

• Disaster recovery drills and backup site recovery.
• Cross-site data recovery.
• Quick onboarding of existing storage resources and virtual machine resources.

Enhancements

Compatibility Notes

New Guest OS Support

This release expands the list of supported Guest OS versions to include multiple mainstream Linux distributions, enterprise Linux distributions, and China-developed operating system versions.