Image Management Service. User Guide. Issue 08. Date

Transcription

1 Issue 08 Date

2 Contents Contents 1 Overview Concept What Is Image Management Service? OSs for Public Images Supported by IMS Image Format and OS Types of External Image Files IMS Access and Usage Accessing IMS IMS Relationships with Other Services Introduction Creating a Private Image Using a Windows ECS Overview Configuring a Windows ECS Installing Cloudbase-Init Creating a Private Windows Image Creating a Private Image Using a Linux ECS Overview Querying and Configuring NIC Attributes Querying and Deleting Network Rule Files Installing Cloud-Init Querying and Detaching EVS Data Disks from the ECS Creating a Private Linux Image Creating a Private Windows Image Using an External Image File Overview Uploading an External Image File Registering the Image File as a Private Image Creating an ECS Configuring a Windows ECS Installing Tools on the Windows ECS Creating a Private Image Using an ECS (Optional) Cleaning Up the Environment Creating a Private Linux Image Using an External Image File Issue 08 ( ) ii

3 Contents Overview Uploading an External Image File Registering an External Image File as a Private Image Creating an ECS Configuring a Linux ECS Creating a Private Image Using an ECS (Optional) Cleaning Up the Environment Management Modifying Image Attributes Creating an ECS Using an Image Deleting an Image Sharing an Image Overview Obtaining the Project ID Sharing Specified Images Accepting or Refusing Shared Images Removing Accepted Images Canceling Image Sharing Adding Tenants Who Can Use Shared Images Deleting Tenants Who Can Use Shared Images Exporting an Image Encrypting an Image Overview Creating an Encrypted Image FAQs Image FAQs How Many Private Images Can Be Created Using One Account? Can Specifications of ECSs Created Using a Private Image Differ from Those of ECSs Used to Create the Image? How Long Does It Take to Create a Private Image Using an ECS? Should I Stop the ECS Before Creating a Private Image Using that ECS? What Can I Do If I Configure an Incorrect OS or System Disk Size During Private Image Registration Using an Image File? Must I Install Tools on the ECS? What May Cause a Tools Installation Failure? What Are the Impacts If the ECS That Has Not Been Configured Is Used to Create the Private Image? Can I Use Images in Formats Other Than Those Specified in This Document? What Can I Do If the Disks of ECS Created Using a CentOS Image Cannot Be Found? How Can a Refused Image Be Used? What Changes Will Be Made to an Image File Used for Registering a Private Image? What Should I Do If No Partition Is Found During the Startup of an ECS Created Using a Private Image That Is Created Using an External Image File? Issue 08 ( ) iii

4 Contents What Initial Configuration Needs to Be Performed for an External Image File Used to Create a Private Image? OS FAQs Can I Specify the Size of the EVS System Disk When Using a Private Image to Create an ECS? What Are the Usage Requirements of Each Type of OS? Why Is the Sysprep Operation Required for Creating Private Images Using a Windows ECS? What Impact Will Be Brought by an Inconsistency Between the Image OS I Select or Identified by the System and That of the Actual Image During Creation of a Private Image Using an External Image File? A Change History B Glossary Issue 08 ( ) iv

5 1 Overview 1 Overview 1.1 Concept What Is Image Management Service? Image and IMS Image Type An image is an Elastic Cloud Server (ECS) template containing mandatory software, such as the operating system (OS). The template may also contain application software, such as database software, and proprietary software. Images are classified into public images, private images, and shared images. The system provides public images by default, and you can create private images by yourself. Image Management Service (IMS) provides easy-to-use self-service image management functions. You can create an ECS using either a private image or a public image. You can also create a private image using an existing ECS or an external image file. Table 1-1 Image type Image Type Public image Private image Description A widely used, standard image. It contains an OS and pre-installed public applications and is visible to all users. You can configure the OS and software in the public image as needed. Contains an OS, pre-installed public applications, and users' private applications. It is visible only to the user who creates it. Using a private image to create an ECS can eliminate the time required for repeatedly configuring the ECS. You can create private images using one of the two methods: Using ECSs Using external image files You can upload external image files and register the images on the platform to make them function as private images. External image files can be in VMDK, VHD, QCOW2, or ZVHD format. Issue 08 ( ) 5

6 1 Overview Image Type Sharing images Description A private image that is shared by other tenants and accepted by you as your own private image IMS Functions IMS has the following functions: Provides public images that contain mainstream OSs. For details about supported OSs, see OSs for Public Images Supported by IMS. Creates private images. Creating private images using ECSs Creating private images using image files Manages images. Modifying attributes of private images Deleting existing private images Sharing images Exporting images Creates an ECS using an image. For details, see the Elastic Cloud Server OSs for Public Images Supported by IMS IMS supports the OSs listed in Table 1-2 for public images. Table 1-2 OSs supported by IMS for public images OS CentOS Version bit bit bit bit bit bit Debian bit bit bit Fedora Novell SUSE Enterprise Linux Server 23 64bit 12 SP2 64bit Issue 08 ( ) 6

7 1 Overview OS Version 12 SP1 64bit 11 SP4 64bit 11 SP3 64bit OpenSUSE bit bit Oracle Linux Server release bit bit bit Ubuntu Server bit bit Windows Server 2008 R2 Windows Server 2012 R2 Windows Server 2016 EulerOS Standard 64bit Enterprise 64bit Datacenter 64bit EulerOS bit The OS of a public image used to create an ECS must meet the following requirements: Table 1-3 Special ECSs and OSs supported by them ECS Large-Memory ECS Supported OS CentOS bit CentOS bit CentOS bit CentOS bit CentOS bit CentOS bit SUSE Enterprise Linux Server 11 SP3 64bit SUSE Enterprise Linux Server 11 SP4 64bit SUSE Enterprise Linux Server 12 SP1 64bit SUSE Enterprise Linux Server 12 SP2 64bit GPU-optimized ECS Windows Server 2008 Windows Server 2012 Windows Server 2016 Disk-intensive ECS CentOS bit CentOS bit Issue 08 ( ) 7

8 1 Overview ECS High-performance ECS Supported OS CentOS bit SUSE Enterprise Linux Server 11 SP3 64bit SUSE Enterprise Linux Server 11 SP4 64bit SUSE Enterprise Linux Server 12 SP1 64bit SUSE Enterprise Linux Server 12 SP2 64bit CentOS bit CentOS bit CentOS bit Windows Server 2008 Windows Server 2012 Windows Server 2016 SUSE Enterprise Linux Server 11 SP3 64bit SUSE Enterprise Linux Server 11 SP4 64bit SUSE Enterprise Linux Server 12 SP1 64bit SUSE Enterprise Linux Server 12 SP2 64bit Image Format and OS Types of External Image Files Image Format OS Type External image files in VMDK, VHD, QCOW2, or ZVHD format can be used to create private images. You can use a supported image file to create private images based on your service requirements. The supported OSs are Windows and Linux. You can select a registered image to be uploaded on the console. For Windows, only the versions listed in Table 1-4 can be used. For Linux, if the required version is not listed in Table 1-4, Other Linux will be selected automatically. For how to register an image, see sections Registering the Image File as a Private Image and Registering an External Image File as a Private Image. OSs not listed in Table 1-4 may not support image uploading. You are advised to contact customer service. Table 1-4 Supported image formats and OSs OS Type Windows OS Version Windows Server 2012 R2 Standard 64bit Windows Server 2012 R2 Essentials 64bit Issue 08 ( ) 8

9 1 Overview OS Type SUSE Oracle Linux Redhat Ubuntu OpenSUSE CentOS OS Version Windows Server 2012 R2 Datacenter 64bit Windows Server 2012 Datacenter 64bit Windows Server 2012 Standard 64bit Windows Server 2008 R2 WEB 64bit Windows Server 2008 R2 Standard 64bit Windows Server 2008 R2 Enterprise 64bit Windows Server 2008 R2 Datacenter 64bit SUSE Linux Enterprise Server 12 SP1 64bit SUSE Linux Enterprise Server 11 SP4 64bit SUSE Linux Enterprise Server 11 SP3 64bit SUSE Linux Enterprise Server 11 SP3 32bit Oracle Linux Server release bit Oracle Linux Server release bit Oracle Linux Server release bit Redhat bit Redhat bit Redhat bit Redhat bit Redhat bit Redhat bit Redhat bit Redhat bit Redhat bit Ubuntu server 64bit Ubuntu server 64bit Ubuntu server 32bit Ubuntu server 64bit Ubuntu server 32bit Ubuntu server 64bit Ubuntu server 32bit Ubuntu server 64bit Ubuntu server 32bit OpenSUSE bit OpenSUSE bit OpenSUSE bit CentOS bit CentOS bit CentOS bit Issue 08 ( ) 9

10 1 Overview OS Type Debian Fedora EulerOS OS Version CentOS bit CentOS bit CentOS bit CentOS bit CentOS bit CentOS bit CentOS bit CentOS bit CentOS bit CentOS bit CentOS bit CentOS bit Debian bit Debian bit Debian bit Debian bit Fedora 24 64bit Fedora 23 64bit Fedora 22 64bit EulerOS bit CoreOS CoreOS CoreOS If you upload an image file not listed in Table 1-4, the OS type will be set to Other Linux (64bit). CoreOS and are supported. Ensure that coreos-cloudinit is installed on CoreOS. If the OS of an image is upgraded automatically, ECSs created using the image may not run properly. Therefore, you need to disable the automatic update function of the image. 1.2 IMS Access and Usage Accessing IMS The system provides web-based service management. You can use the management console or HTTPS-based application programming interfaces (APIs) to manage the services. API You can access IMS using APIs. For details, see the Image Management Service API Reference. Management console Issue 08 ( ) 10

11 1 Overview You can use the management console to perform other operations. If you have registered an account in the system, log in to the management console and choose Image Management Service on the homepage IMS Relationships with Other Services Elastic Cloud Server (ECS) You can use an image to create an ECS or convert an ECS to an image. Object Storage Service (OBS) Images are stored in OBS buckets. Key Management Service (KMS) Keys used for encrypting images are provided by KMS. Issue 08 ( ) 11

12 2.1 Introduction Public images are the standard images provided by the system. Users can use these images to create ECSs. Private images are visible only to their creators. Private images contain OSs, pre-installed public applications, and users' private applications. Creating ECSs using private images reduces ECS configuration time. Private images can be created using an ECS or an external image file. This chapter describes the following private image creation methods: Create a private image using a Windows ECS. Create a private image using a Linux ECS. Create a private Windows image using an external image file. Create a private Linux image using an external image file. 2.2 Creating a Private Image Using a Windows ECS Overview You can create a private Windows image using an ECS running Windows. If the Windows ECS that will be used to create the private image is using a static IP address, you must log in to the ECS and configure the ECS NIC to obtain an IP address using DHCP before using the ECS to create a private image. The following describes how to configure a Windows ECS and use it to create a private Windows image Configuring a Windows ECS Scenarios If the Windows ECS that will be used to create a private image is using a static IP address, configure the ECS NIC to obtain an IP address using DHCP. Issue 08 ( ) 12

13 This section uses Windows Server 2008 R2 as an example to describe how to configure DHCP on an ECS running Windows. For details about how to configure DHCP on ECSs running other OSs, see the relevant OS documentation. Prerequisites You have logged in to the ECS that will be used to create the private Windows image. For how to log in to an ECS, see the Elastic Cloud Server. Procedure 1. On the ECS, choose Start > Control Panel. 2. Click Network and Internet Connections. 3. Click Network and Sharing Center. Figure 2-1 shows the Network and Sharing Center window. Figure 2-1 Network and Sharing Center 4. Select the connection configured with the static IP address. For example, click Local Area Connection 2. Issue 08 ( ) 13

14 Figure 2-2 Local Area Connection 2 Status 5. Click Properties and select the configured Internet protocol version. 6. On the General tab, select Obtain an IP address automatically and Obtain DNS server address automatically and click OK. Figure 2-3 shows the dialog box for configuring the IP address obtaining mode. You are advised to record the original network information so that you can restore it if necessary. Issue 08 ( ) 14

15 Figure 2-3 Configuring the IP address obtaining mode The system will automatically obtain an IP address. (Optional) Install the GPU driver. If an independent GPU is configured for the ECS, you must first install the GPU driver before creating the ECS image. 7. Visit the official NVIDIA website to obtain the GPU driver software package. Select 4.1 as the NVIDIA GRID version and software package GRID for UVP. 8. Copy the Windows driver package in the downloaded software package to the ECS. The driver package version must match the ECS OS version. 9. Install the driver on the ECS. 10. Set the ECS resolution to 1920 x 1080 (recommended) or smaller. (Optional) Enable the Remote Desktop Connection function. You must enable the Remote Desktop Connection function of the ECSs if you want to connect to them using this function subsequently. This function must be enabled for GPU-deployed ECSs. 11. Choose Start, right-click Computer, and choose Properties from the shortcut menu. 12. Click Remote settings. 13. In the Remote tab, select Allow connections from computers running any version of Remote Desktop (less secure). 14. Click OK. 15. Choose Start > Control Panel and navigate to Windows Firewall. 16. Choose Allow a program or feature through Windows Firewall in the left pane. 17. Select programs and features that are allowed through by the Windows firewall for Remote Desktop based on user network requirements and click OK in the lower part. Issue 08 ( ) 15

16 Figure 2-4 Configuring Remote Desktop Installing Cloudbase-Init Scenarios To ensure that ECSs support custom configurations, you are advised to install Cloudbase-Init before creating private images. To install Cloudbase-Init on an ECS running Windows, download Cloudbase-Init from the official website. You will need to configure an elastic IP address for the ECS. If you do not install Cloudbase-Init, you can log in to the ECS only with the original image password, and you will be unable to customize ECS configurations. Prerequisites Procedure An elastic IP address has been bound to the Windows ECS. You have logged in to the Windows ECS. DHCP has been enabled for the Windows ECS. 1. On the Windows Start menu, choose Control Panel > Programs >Programs and Features to check whether Cloudbase-Init is installed. If yes, go to 13. If no, go to Download the Cloudbase-Init installation package. Download the appropriate version of Cloudbase-Init installation package based on the OS bit version. The Cloudbase-Init official website is Cloudbase-Init has two versions, the stable and Beta version. The current stable version v0.9.9 uses fixed passwords for its internal accounts, posing security vulnerabilities. You are advised to install v or the Beta version. To obtain the stable version, visit the following paths: Issue 08 ( ) 16

17 64-bit: 32-bit: To obtain the Beta version, visit the following paths: 64-bit: 32-bit: 3. Double-click the Cloudbase-Init installation package. 4. Click Next. 5. Select I accept the terms in the License Agreement, and click Next. 6. Retain the default path and click Next. 7. In the Configuration options window, enter Administrator for Username and select COM1 for Serial port for logging. Figure 2-5 shows the parameters to be specified. Figure 2-5 Parameters 8. Click Next. 9. Click Install. 10. In the Files in Use dialog box, select Close the application and attempt to restart them and click OK. 11. In the Completed the Cloudbase-Init Setup Wizard window, ensure that Run Sysprep to create a generalized Image. This is necessary if you plan to duplicate this instance, for example by creating a Glance image and Shutdown when Sysprep terminates are not selected. Figure 2-6 shows the installation completion page. Issue 08 ( ) 17

18 Figure 2-6 Completing the Cloudbase-Init installation 12. Click Finish. 13. Add configuration item netbios_host_name_compatibility=false to the last row in the C:\Program Files\Cloudbase Solutions\Cloudbase-Init\conf\cloudbase-init.conf file. This will allow the host name to contain a maximum of 63 characters. NetBIOS is limited by Windows and can contain at most 15 characters. 14. Release the current DHCP address so that created ECSs can obtain the correct addresses. In the Windows command line, run the following command to release the current DHCP address: ipconfig /release This operation will interrupt network connection and adversely affect the use of the ECS. After the ECS is restarted, network connection will restore. 15. Check whether the ECS needs to be added to a domain. If yes, go to 16. If no, the installation is complete. 16. Perform the following Sysprep operations on Windows: Enter the Cloudbase-Init installation directory. In this example, C:\Program Files\Cloudbase Solutions\ is the Cloudbase-Init installation directory. Switch to the root directory of drive C:\ and run the following command to enter the installation directory: cd C:\Program Files\Cloudbase Solutions\Cloudbase-Init\conf Run the following command to encapsulate Windows: Issue 08 ( ) 18

19 C:\Windows\System32\sysprep\sysprep.exe /generalize /oobe /unattend:unattend.xml After the command is executed, the ECS will stop automatically. Ensure that /unattend:unattend.xml is contained in the preceding command. Otherwise, the username, password, and other important configuration information of the ECS will be reset, and you must configure the OS manually when you use the ECS created using the Windows private image. After the Sysprep operation is performed on the ECS running Windows Server 2012 or Windows Server 2012 R2, the administrator account and password of the ECS will be deleted. You need to log in to the ECS and configure the password of the administrator account. After this, the ECS password configured on the management console will become invalid. Keep the new password secure. If the domain account is required to log in to Windows, perform the Sysprep operation before creating the private image. For details about the impact of the Sysprep operation, see Why Is the Sysprep Operation Required for Creating Private Images Using a Windows ECS?. Do not start a Windows ECS on which the Sysprep operation has been performed. Otherwise, you need to perform the Sysprep operation again on the ECS. The cloudbase-init account of a Windows ECS is an internal account of the Cloudbase-Init agent. This account is used for obtaining metadata and completing relevant configuration when the Windows ECS starts. If you modify or delete this account, or uninstall the Cloudbase-Init agent, you will be unable to inject the initialized customized information into an ECS created using a Windows private image. Therefore, you are advised not to modify or delete the cloudbase-init account Creating a Private Windows Image Scenarios Create a private Windows image using an ECS. Prerequisites Procedure A Windows ECS is available and is stopped. The IP address assignment mode of the Windows ECS NIC has been set to DHCP. For details, see Configuring a Windows ECS. Cloudbase-Init has been installed. 1. Log in to the management console. 2. Under Computing, click Image Management Service. 3. On the Image Mgmt Service page, click Create Private Image. 4. Retain the default image source ECS. 5. On the image configuration page, click Select and select the required ECS on the displayed page. Set the required information, such as Name and Description on the displayed page shown in Figure 2-7. Issue 08 ( ) 19

20 Figure 2-7 Creating an image 6. Click Create Now. 7. Confirm image parameters and click Submit. 8. Switch back to the Image Mgmt Service page to view the image status. The time required to create the image varies depending on the image file size. Normally, creating an image takes about 20 minutes. The image is created when the image status on the Image Mgmt Service changes to Normal. Do not perform any operations on the selected ECS or its associated resources during image creation. An ECS created using an encrypted image is an encrypted ECS. The key of the encrypted ECS is the same as that of the encrypted image. 2.3 Creating a Private Image Using a Linux ECS Overview You can create a private Linux image using an ECS running Linux. Before creating the private Linux image, you need to log in to the Linux ECS used to create the image and perform the following operations: Query and configure NIC attributes. Query and delete files in the network rule directory. Install Cloud-Init. Query and detach EVS data disks from the ECS. The following introduces how to configure a Linux ECS and use it to create a private Linux image. Issue 08 ( ) 20

21 2.3.2 Querying and Configuring NIC Attributes Scenarios Prerequisites If the Linux ECS that will be used to create a private image is using a static IP address, configure the ECS NIC to obtain an IP address using DHCP. The configuration method varies depending on OSs For Red Hat, CentOS, Oracle Enterprise Linux, and EulerOS OSs, use vi editor to add PERSISTENT_DHCLIENT="y" to configuration file /etc/sysconfig/network-scripts/ifcfg-ethx. For SUSE Linux Enterprise OSs, use vi editor to set DHCLIENT_USE_LAST_LEASE to no in configuration file /etc/sysconfig/network/dhcp. For Ubuntu 12.04, upgrade dhclient to ISC dhclient so that the NIC can consistently obtain IP addresses from the DHCP server. For detailed upgrade method, see associated OS documentations. The following uses Ubuntu14.04 as an example to describe how to query and configure NIC attributes. You have logged in to the ECS used to create the private Linux image. For how to log in to an ECS, see the Elastic Cloud Server. Procedure 1. Run the following command on the ECS to open the /etc/network/interfaces file using the vi editor and query the IP address assignment mode: vi /etc/network/interfaces If the IP address assignment mode of all NICs is DHCP, as shown in Figure 2-8, enter :q to exit the vi editor. Figure 2-8 DHCP IP address assignment mode If the IP address assignment mode of a NIC is static, as shown in Figure 2-9, go to 2. Issue 08 ( ) 21

22 Figure 2-9 Static IP address assignment mode 2. Press i to enter the editing mode. 3. Delete the static IP address and configure the NIC to obtain an IP address using DHCP. Figure 2-10 shows the configuration commands. You can insert the pound sign (#) before each line of the static IP address configuration to comment it out. Figure 2-10 Configuring the NIC to obtain an IP address using DHCP If the ECS has multiple NICs, configure all other NICs in the same way. Figure 2-11 shows the configuration commands. Figure 2-11 Configuring other NICs to obtain an IP address using DHCP 4. Press Esc. Type :wq and press Enter. The system saves the configuration and exits the vi editor. Issue 08 ( ) 22

23 2.3.3 Querying and Deleting Network Rule Files Scenarios This section describes how to view and delete network rule files when using an ECS to create a private Linux image. Prerequisites You have logged in to the ECS that is used to create the private Linux image. Procedure 1. Run the following command on the ECS to view the files in the network rule directory: ls -l /etc/udev/rules.d Check whether the command output contains the following information (the file name contains both persistent and net): 70-persistent-net.rules If yes, go to 2. If no, you do not need to clear the files in the network rule directory. 2. Run the following commands to delete the rule files whose names contain persistent and net: rm /etc/udev/rules.d/30-net_persistent-names.rules rm /etc/udev/rules.d/70-persistent-net.rules The italic content in the commands varies based on your service environment Installing Cloud-Init Scenarios Do not restart the ECS after deleting the network rule files. Otherwise, the deleted rule files will be generated again. To ensure that ECSs created using private images support custom configurations, you are advised to install Cloud-Init before creating private images. To install Cloud-Init on an ECS running Linux, download Cloud-Init from the official website. Therefore, you need to configure an elastic IP address for the ECS. If you do not install Cloud-Init, you can log in to the ECS only with the original image password, and cannot customize ECS configuration. Prerequisites An elastic IP address has been bound to the Linux ECS. You have logged in to the Linux ECS. DHCP has been enabled for the Linux ECS. Procedure Check whether Cloud-Init is installed. Issue 08 ( ) 23

24 The methods of checking whether Cloud-Init is installed vary depending on the OSs. Take the CentOS 6 as an example. Run the following command to check whether Cloud-Init is installed: rpm -qa grep cloud-init Cloud-Init has been installed if the following command output is displayed: cloud-init el6.centos.2.x86_64 Check whether to continue to use the certificate in the ECS OS. If the certificate is no longer used, delete it. If the certificate is stored in a directory of user root, such as.ssh/authorized_keys in the /$path/$to/$root directory, run the following commands: cd /root/.ssh rm authorized_keys If the certificate is not stored in a directory of user root, such as.ssh/authorized_keys in the /$path/$to/$none-root directory, run the following commands: cd /home/centos/.ssh rm authorized_keys Run the following command to ensure that the ECS created using the Linux image supports login using the certificate: sudo rm -rf /var/lib/cloud/* After the configuration is complete, do not restart the ECS. Otherwise, you must configure the ECS again. If Cloud-Init has not been installed, install it. Install Cloud-Init. The methods of installing Cloud-Init on ECSs running different OSs vary. Perform the installation operations as user root. The following describes how to install Cloud-Init on ECSs running SUSE Linux, CentOS, Red Hat, Fedora, Debian, and Ubuntu. For other types of OSs, install the required type of Cloud-Init. For example, you need to install coreos-cloudinit on ECSs running CoreOS. SUSE Linux Table 2-1 lists the Cloud-Init's network installation addresses for different versions of SUSE Linux OSs. Table 2-1 Cloud-Init's network installation addresses for different versions of SUSE Linux OSs OS Type Version How to Obtain SUSE SUSE Enterprise Linux Server 11 SP3 s/cloud:/tools/sle_11_sp3/cloud:tools.re po OpenSUSE OpenSUSE s/cloud:/tools/opensuse_13.2/cloud:tool s.repo Issue 08 ( ) 24

25 Take the SUSE Enterprise Linux Server 11 SP3 as an example. Perform the following steps to install Cloud-Init: a. Log in to the ECS used to create the private Linux image. b. Run the following command to install the network installation source for SUSE Enterprise Linux Server 11 SP3: zypper ar d:tools.repo c. Run the following command to update the network installation source: zypper refresh d. Run the following command to install Cloud-Init: zypper install cloud-init e. Run the following command to enable Cloud-Init to automatically start upon system startup: service cloud-init-local start; service cloud-init start; service cloud-config start; service cloud-final start chkconfig cloud-init-local on; chkconfig cloud-init on; chkconfig cloud-config on; chkconfig cloud-final on f. Run the following command to check whether Cloud-Init will automatically start when the system starts: service cloud-init-local status; service cloud-init status; service cloud-config status; service cloud-final status CentOS and RedHat Table 2-2 lists the Cloud-Init's network installation addresses for CentOS and RedHat. Table 2-2 Cloud-Init's network installation addresses for CentOS and RedHat OS Type Version How to Obtain CentOS 7 series 4/e/epel-release-7-8.noarch.rpm 6 series 32-bit pel-release-6-8.noarch.rpm 6 series 64-bit 4/epel-release-6-8.noarch.rpm RedHat 7 series 4/e/epel-release-7-8.noarch.rpm 6 series 32-bit pel-release-6-8.noarch.rpm 6 series 64-bit 4/epel-release-6-8.noarch.rpm Issue 08 ( ) 25

26 The following uses CentOS bit as an example to describe how to install Cloud-Init. CentOS bit i. Log in to the ECS used to create the private Linux image. ii. Fedora Run the following command to install the network installation source for CentOS bit: yum install m iii. Run the following command to install Cloud-Init: yum install cloud-init Before installing Cloud-Init, ensure that the network installation source address has been configured for the OS by checking whether the /etc/yum.repo.d/fedora.repo file contains the installation source address of the software package. If it does not, configure the installation source address of the software package by following the instructions at the Fedora official website. Run the following command to install Cloud-Init: yum install cloud-init Debian and Ubuntu Before installing Cloud-Init, ensure that the network installation source address has been configured for the OS by checking whether the /etc/apt/sources.list file contains the installation source address of the software package. If it does not, configure the installation source address of the software package by following the instructions at the Debian or Ubuntu official website. Run the following command to install Cloud-Init: apt-get update apt-get install cloud-init You can complete the following optional configurations as required. After the configuration is complete, you can use the configured password to log in to the ECS. Otherwise, you can only use the original image password to log in to the ECS using VNC. CentOS 6 is used to describe the configuration steps. 1. Disable the use of passwords to remotely log in to the ECS. The detailed operations are as follows: a. Run the following command to open the sshd_config file using the vi editor: vi /etc/ssh/sshd_config b. Change the value of PasswordAuthentication in the sshd_config file to no. If you need to log in to the ECS using the password, do not change the value of PasswordAuthentication to no. If you use SUSE or OpenSUSE OS to create an image, make the following changes in the sshd_config file to disable the remote login using a password: Change the value of PasswordAuthentication to no. Change the value of ChallengeResponseAuthentication to no. Change the value of UsePAM to yes. 2. Run the following command to open the /etc/cloud/cloud.cfg file using the vi editor: vi /etc/cloud/cloud.cfg Issue 08 ( ) 26

27 Disable the SSH permission of user root. The field disable_root in the configuration file specifies whether the SSH permission is enabled. 1 indicates that the SSH permission is disabled, and 0 indicates that it is enabled. Set the value of disable_root to 1. On some OSs, true indicates that Cloud-Init is disabled, and false indicates that Cloud-Init is enabled. users: - default disable_root: 1 ssh_pwauth: 0 3. Add the common login user to the configuration file, and configure a password and assign the sudo permission to the user. The following table lists the configuration items to be modified or added. For more details about the Cloud-Init configuration items, visit Configuration Item name lock_passwd groups passwd Description Specifies the login username. Specifies whether login using the password is disabled. Specifies the group to which the user used for login belongs. This parameter is mandatory. If you want to add centos to another user group, enter the name of the target user group. Specifies the hash value of the password used for login (not the password itself). Example Value or Generation Method An example value is centos. The added username cannot be the same as the group name in the system. An example value is false, which indicates that login using the password is available. The default value is true, which indicates that login using the password is disabled. The default value is empty. To configure this parameter, ensure that the current user group exists. 1. Generate the salt of a character string (it is suggested that the character string contains at least 9 characters), such as d47c. 2. Log in to Linux and run the following command to generate the encrypted password: The encryption method SHA-512, login user password cloud , and salt d47c are used in the following example: For python2.x: python -c "import crypt;print crypt.crypt('cloud ', '\$6\$379085d47c')" For python3.x: python3 -c "import Issue 08 ( ) 27

28 Configuration Item sudo Description Specifies the permission of running the sudo command. Example Value or Generation Method crypt;print(crypt.crypt('cloud ', '\$6\$379085d47c'))" $6 indicates the SHA-512 synchronization algorithm. The encryption result is as follows: $6$379085d47c$oZ349T5HQfT4gDCq6GL EoW7aRCsO6GIWh3vylAe.r4tvb.eaDyO5p 37145UfRy3qsrXwE4SJlGxvJYldPe2Sm. The default value is empty. You are advised to enter the required sudo permission. For example, run the following command to enable the user to have all permissions of user root: ALL=(ALL) NOPASSWD:ALL. To add multiple rules, use the following format: sudo: - ALL=(ALL) NOPASSWD:/bin/mysql - ALL=(ALL) ALL Figure 2-12 indicates that the current user is centos, and password login is available. Figure 2-12 User settings Check whether the configuration related to Cloud-Init is correct. Run the following command (if no error occurs, Cloud-Init is properly configured): cloud-init init --local If Cloud-Init is properly installed, the version information will be displayed and no error information, such as a message indicating lack of files, will be displayed. If a message is displayed indicating a configuration error, contact technical support. Issue 08 ( ) 28

29 2.3.5 Querying and Detaching EVS Data Disks from the ECS Scenarios This section describes how to detach all data EVS data disks from the ECS. Prerequisites You have logged in to the ECS used to create the private Linux image. Procedure 1. Run the following command to check the EVS disks attached to the ECS: mount If the command output does not contain any EVS disk information, no EVS data disks need to be detached. If information similar to the following is displayed, go to 2: /dev/xvde1 on /mnt/test type ext4 (rw) 2. Ensure that no data read and write operations are being performed on the EVS disks that will be detached. Otherwise, the detaching operation will fail. Run the following command to detach the EVS data disks attached to the ECS: umount /dev/xvde1 3. Run the following command to edit the fstab file: vi /etc/fstab 4. Delete the configuration information of the EVS data disks from the fstab file. The /etc/fstab file contains information about the file systems and storage devices automatically attached to the ECS when the ECS starts. The configuration information about data disks automatically attached to the ECS needs to be deleted. For example, the last row shown in Figure 2-13 is the data disk configuration information to be deleted from the fstab file. Figure 2-13 EVS configuration information contained in the fstab file 5. Run the following command to check the data partitions attached to the ECS: mount If the command output does not contain information about the EVS data disks, they have been successfully detached. Issue 08 ( ) 29

30 2.3.6 Creating a Private Linux Image Scenarios Create a private Linux image using an ECS. Prerequisites Procedure A Linux ECS is available and is stopped. The IP address assignment mode of the Linux ECS NIC has been set to DHCP. The udev rules on the Linux ECS have been deleted. Cloud-Init has been installed and configured. All EVS data disks attached to the Linux ECS have been detached. 1. Log in to the management console. 2. Under Computing, click Image Management Service. 3. On the Image Mgmt Service page, click Create Private Image. 4. Retain the default image source ECS. 5. On the image configuration page, click Select and select the required ECS on the displayed page. 6. Set the required information, such as Name and Description on the displayed page shown in Figure Figure 2-14 Creating an image 7. Click Create Now. 8. Confirm image parameters and click Submit. 9. Switch back to the Image Mgmt Service page to view the image status. Issue 08 ( ) 30

31 The time required to create the image varies depending on the image file size. Normally, creating an image takes about 20 minutes. The image is created when the image status on the Image Mgmt Service changes to Normal. Do not perform any operations on the selected ECS or its associated resources during image creation. An ECS created using an encrypted image is an encrypted ECS. The key of the encrypted ECS is the same as that of the encrypted image. 2.4 Creating a Private Windows Image Using an External Image File Overview Application Scenarios Creation Process If you have an external Windows image file that meets the type and OS requirements listed in Image Format and OS Types of External Image Files, you can use this external image file to create a private Windows image. To initialize an image, configure the network attribute, install Cloudbase-Init, enable the Remote Desktop connection function, and install Tools. For details, see section What Initial Configuration Needs to Be Performed for an External Image File Used to Create a Private Image?. The procedure of creating a private image using an external image file varies depending on whether the image file has been initialized. If the external image file has been initialized, the procedure of creating a private image is as follows. Figure 2-15 Creating a private image using an initialized image file As shown in the preceding figure, the following steps are required to register an external image file as a private image: a. Upload the external image file to your OBS bucket. For details, see Uploading an External Image File. Issue 08 ( ) 31

32 b. On the management console, select the uploaded image file and register it as a private image. For details, see Registering an External Image File as a Private Image. If the external image file has not been initialized, the procedure of creating a private image is as follows. Figure 2-16 Creating a private image using an uninitialized image file As shown in the preceding figure, the following steps are required to register an external image file as a private image: a. Upload the external image file to your OBS bucket. For details, see Uploading an External Image File. b. On the management console, select the uploaded image file and register it as a private image that has not been initialized. For details, see Registering the Image File as a Private Image. c. Use the private image to create an ECS. For details, see Creating an ECS. d. Remotely log in to the ECS created in c, configure the ECS, and install Open Telekom Cloud Tools on the ECS. For details, see Configuring a Windows ECS and Installing Tools on the Windows ECS. Open Telekom Cloud Tools must be installed on Windows ECSs running on the Open Telekom Cloud platform. For how to log in to an ECS, see the Elastic Cloud Server. e. Create a private image using the ECS. For details, see Creating a Private Image Using an ECS. Issue 08 ( ) 32

33 Restrictions and Limitations Obtaining Software Image files in QCOW2 format must not be encrypted. Images with EVS data disks cannot be created. External image files contain only EVS system disks. An external image file cannot be greater than 128 GB. The external image file system disk size must be greater than 1 GB and less than or equal to 255 GB. The administrator account and its password must have been configured for the external image file using Windows. In subsequent operations, you may use the username and password to log in to and configure the ECS. The image must support the Integrated Drive Electronics (IDE) device driver. The driver must be automatically loaded when the system starts. The boot partition and system partition of the image must be on the same disk. You must use BIOS to boot the ECS used to create the image. Ensure that the image file contains the password or certificate used to log in to the ECS created using the image, or ensure that Cloudbase-Init has been installed and configured in the image file. To prevent ECSs created using the image file from being attacked, ensure that the initial password of the image file contains at least the following types of characters: Uppercase letters Lowercase letters Digits Special characters, including!@$%^-_=+[{}]:,./? If the disk of the external image file uses specific encryption mechanisms, the ECS created using the private image may become unavailable. Some drivers are not supported on the public cloud platform. Therefore, you cannot use external image files containing OEM OSs to create private images. OSs in external image files cannot be bound to specified hardware. The OSs in your external image files must support full virtualization. Before creating a private Windows image using an external image file, you must install Tools. Table 2-3 lists download paths for the required software packages. Table 2-3 Required software packages and download paths Software Package Description How to Obtain pvdriver-win2008r2-64b it exe pvdriver-win bit exe For private images using Windows Server 2008 R2 For private images using Windows Server er/pvdriver/windows/pvdriver-win2 008R2-64bit exe er/pvdriver/windows/pvdriver-win bit exe Issue 08 ( ) 33

34 2.4.2 Uploading an External Image File Upload the external image file to your OBS bucket. For details, see the Object Storage Service. Any image file uploaded to an OBS bucket must be an unencrypted one or one encrypted using SSE-KMS Registering the Image File as a Private Image Scenarios Prerequisites This section describes how to register an uninitialized image file as an uninitialized private image on the public cloud platform, or register an initialized image file as a private image in normal state. You have uploaded the image file to the OBS bucket. Procedure 1. Log in to the management console. 2. Under Computing, click Image Management Service. 3. On the Image Mgmt Service page, click Create Private Image. 4. Select Image file shown in Figure 2-17 to use an external image file as the source. Figure 2-17 Registering an image 5. Click Select to choose the external image file. 6. Select the bucket that stores the image file in the left navigation tree and select the image file. Figure 2-18 shows the page for you to select the bucket and the image file. Issue 08 ( ) 34

35 Figure 2-18 Select Image File 7. Click OK. 8. Enter the image name. 9. (Optional) Select the OS required by the image. To ensure that images can be created and used, select the OS consistent with that of the image file. If you do not select an OS for the image file, the system will automatically identify the OS of the image file. If the system detects that the image file OS is different from that you configure, the OS detected by the system will prevail. If the system cannot detect the OS of the image file, the OS you select will prevail. If the OS you select or identified by the system is inconsistent with that of the actual image, ECSs created using this image may be affected. For detailed impact, see section What Impact Will Be Brought by an Inconsistency Between the Image OS I Select or Identified by the System and That of the Actual Image During Creation of a Private Image Using an External Image File?. 10. (Optional) Encrypt the image. If the image needs to be encrypted, select KMS encryption and select the key to be used from the list of keys. For how to encrypt an image, see section 3.6 Encrypting an Image. 11. Select a system disk size and enter the image description as required. 12. Select Enable automatic configuration. The system will perform the following operations on the image file: Restore the IDE driver to enable the system to use the IDE driver for its initial start. Delete the registry keys of the mouse and keyboard and generate the registry keys on the new platform to ensure that the mouse and keyboard are available. Restore the PV Driver registry key to rectify the failure to install drivers and Xen driver conflict. 13. Click Create Now. 14. On the Confirm Specifications page, confirm the specifications and then click Submit. The time required for image registration is determined by the image file size. You may need to wait a long period of time for the image to be successfully registered as a private image that is not initialized. Issue 08 ( ) 35

36 2.4.4 Creating an ECS Scenarios Prerequisites Create an ECS using a private image that is not initialized. A private image that is not initialized is available. Procedure 1. Log in to the management console. 2. Under Computing, click Image Management Service. 3. On the Image Management Service page, click the Private Image tab to switch to the page that displays all private images. 4. Locate the row that contains the newly registered private image that is not initialized, and click Create ECS in the Operation column to create an ECS. 5. Complete ECS creation as prompted. During ECS creation, you must configure an elastic IP address for the ECS so that you can upload the Tools installation package to the ECS or download the Tools installation package on the ECS. For how to create an ECS, see the Elastic Cloud Server. If the image file system has Cloudbase-Init installed and configured, log in to the ECS using the password as prompted. If the image file system does not have Cloudbase-Init installed, log in to the ECS using the password or certificate contained in the image file. To ensure ECS security, each ECS is added to the default security group after being created. By default, a security group denies all access requests to it. Therefore, you need to add inbound rules to allow inbound access to the ECS from an external location. For detailed configurations, see the security group configuration for private clouds Configuring a Windows ECS Scenarios Prerequisites On the public cloud platform, configure the ECS created using the uninitialized private image to ensure that ECSs created subsequently are available. You have logged in to the Windows ECS using Virtual Network Computing (VNC). For how to log in to an ECS, see the Elastic Cloud Server. Procedure 1. On the ECS, choose Start > Control Panel. 2. Click Network and Internet Connections. 3. Click Network and Sharing Center. Figure 2-19 shows the Network and Sharing Center window. Issue 08 ( ) 36

37 Figure 2-19 Network and Sharing Center 4. Select the connection that uses the static IP address. Figure 2-20 shows the connection. Figure 2-20 Local Area Connection 2 Status 5. Click Properties and select the configured Internet protocol version. 6. On the General tab, select Obtain an IP address automatically and Obtain DNS server address automatically and click OK. Figure 2-21 shows the dialog box for configuring the IP address obtaining mode. Issue 08 ( ) 37

38 Figure 2-21 Configuring the IP address obtaining mode The ECS will automatically obtain an IP address. You are advised to save the static IP address information so that you can restore the settings later. 7. (Recommended) Disable your antivirus and intrusion detection software. After Tools is installed, you can enable the software. 8. Install Cloudbase-Init and complete required configurations. For details, see Installing Cloudbase-Init. (Optional) Install the GPU driver. If an independent GPU is configured for the ECS, you must first install the GPU driver before creating the ECS image. 9. Visit the official NVIDIA website to obtain the GPU driver software package. Select 4.1 as the NVIDIA GRID version and software package GRID for UVP. 10. Copy the Windows driver package in the downloaded software package to the ECS. The driver package version must match the ECS OS version. 11. Install the driver on the ECS. 12. Set the ECS resolution to 1920 x 1080 (recommended) or smaller. (Optional) Enable the Remote Desktop Connection function. You must enable the Remote Desktop Connection function of the ECSs if you want to connect to them using this function subsequently. This function must be enabled for GPU-deployed ECSs. 13. Choose Start, right-click Computer, and choose Properties from the shortcut menu. 14. Click Remote settings. 15. In the Remote tab, select Allow connections from computers running any version of Remote Desktop (less secure). 16. Click OK. Issue 08 ( ) 38

39 17. Choose Start > Control Panel and navigate to Windows Firewall. 18. Choose Allow a program or feature through Windows Firewall in the left pane. 19. Select programs and features that are allowed through by the Windows firewall for Remote Desktop based on user network requirements and click OK in the lower part. Figure 2-22 Configuring Remote Desktop Installing Tools on the Windows ECS Scenarios Tools is required to ensure that an ECS can properly run. To create a private image using an image file, you must install Tools provided by the public cloud system. If Tools is not installed on the ECS, the ECS performance deteriorates and some functions of the ECS become unavailable. When registering a private Windows image, you must install Tools. You can download the installation package of Open Telekom Cloud Tools and upload the package to the ECS using RDP. Alternatively, you can download the installation package of Tools directly on the ECS. This section uses the uploaded Tools installation package as an example to describes how to install Tools on a Windows ECS. Prerequisites Procedure The IP address assignment mode of the Windows ECS NIC has been set to DHCP. The RDP protocol has been enabled on the Windows ECS. Cloudbase-Init has been installed and configured. 1. To ensure that Open Telekom Cloud Tools is installed correctly on the ECS, uninstall third-party virtualization platform tools, such as the Citrix Xen Tools and VMware Tools. For details about how to uninstall the third-party virtualization platform Tools, see the corresponding documents of the cloud platform. Issue 08 ( ) 39

40 2. Use RDP to upload the installation package of Open Telekom Cloud Tools to the ECS or download the installation package to the ECS from a specified download path. Table 2-4 lists the mapping between OSs and required Tools installation packages. Ensure that the system disk of the ECS has at least 300 MB remaining space for installing Tools, and ensure that you have performed 1 before the installation. Table 2-4 Mapping between OSs and required Tools installation packages OS Windows Server 2008 R2 Windows Server 2012 Tools Installation Package pvdriver-win2008r2-64bit exe pvdriver-win bit exe If an incorrect tool is uploaded, Tools installation may fail or exceptions may occur during the running of the ECS. You must ensure that you have uploaded the correct Tools for your OS. 3. Log in to the Windows ECS. For how to log in to an ECS, see the Elastic Cloud Server. You can use only the remote login function provided by the public cloud platform to log in to the Windows ECS to install Tools. If you log in to the Windows ECS using RDP, you cannot install Tools on it. If the image file system has Cloudbase-Init installed and configured, log in to the ECS using the password configured during the ECS creation. If the image file system does not have Cloudbase-Init installed, log in to the ECS using the password or certificate contained in the image file. 4. Click Tools installation package pvdriver-win*.exe stored in the local directory to install Tools. If the ECS runs Windows Server 2008, the Found New Hardware dialog box shown in Figure 2-23 is displayed. Select Don't show this message again for this device in the displayed dialog box. Figure 2-23 Found New Hardware 5. Restart the ECS as prompted to make the installed Tools take effect. If the ECS runs Windows Server 2008, you must restart the ECS twice to make the installation take effect. Issue 08 ( ) 40

41 2.4.7 Creating a Private Image Using an ECS Select an appropriate method to create a private image based on the ECS OS. If the ECS runs Windows, create a private image using the ECS by following the steps provided in Creating a Private Windows Image (Optional) Cleaning Up the Environment Scenarios The private image registered in Registering the Image File as a Private Image and the ECS created in Creating an ECS incur additional fees. Therefore, you are advised to perform the following steps to clean up the environment after the private image is created. Procedure 1. Delete the uninitialized private image registered using the image file. For details, see 3.3 Deleting an Image. 2. Delete the ECS created in Creating an ECS. For details, see the Elastic Cloud Server. 3. Delete the image file stored in the OBS bucket. For details, see the Object Storage Service. 2.5 Creating a Private Linux Image Using an External Image File Overview Application Scenarios Creation Process If you have an external Linux image file and the file meets the type and OS requirements listed in Image Format and OS Types of External Image Files, you can use this external image file to create a private Linux image. To initialize an image, delete network rule files, configure the NIC attribute, and install and configure Cloud-Init. For details, see section What Initial Configuration Needs to Be Performed for an External Image File Used to Create a Private Image?. The procedure of creating a private image using an external image file varies depending on whether the image file has been initialized. If the external image file has been initialized, the procedure of creating a private image is as follows. Issue 08 ( ) 41

42 Figure 2-24 Creating a private image using an initialized image file The procedure is as follows: a. Upload the external image file to your OBS bucket. For details, see Uploading an External Image File. b. On the management console, select the uploaded image file and register it as a private image. For details, see Registering an External Image File as a Private Image. If the external image file has not been initialized, the procedure of creating a private image is as follows. Figure 2-25 Creating a private image using an uninitialized image file The procedure is as follows: a. Upload the external image file to your OBS bucket. For details, see Uploading an External Image File. b. On the management console, select the uploaded image file and register it as a private image that has not been initialized. For details, see Registering an External Image File as a Private Image. c. Use the private image to create an ECS. For details, see Creating an ECS. d. Log in to the ECS created in c remotely and configure it. For details, see Configuring a Linux ECS. Linux ECSs running on the public cloud platform must use PVOPS. Issue 08 ( ) 42

43 Restrictions and Limitations e. Create a private image in normal state using the ECS. For details, see Creating a Private Image Using an ECS. Image files in QCOW2 format must not be encrypted. Images with EVS data disks cannot be created. Therefore, external image files contain only EVS system disks. If the private image uses Linux, the /etc/fstab file must not contain configuration items for automatic data disk attaching. Otherwise, ECSs created using a private image cannot be logged in to. An external image file cannot be greater than 128 GB. The external image file system disk size must be greater than 1 GB and less than or equal to 255 GB. Ensure that the image file contains the password or certificate used to log in to the ECS created using the image, or ensure that Cloud-Init has been installed and configured in the image system. Username root and its password must have been configured for the private image that uses Linux. In subsequent operations, you may use the username and password to log in to and configure the ECS. To prevent ECSs created using the image file from being attacked, ensure that the initial password of the image file contains at least the following types of characters: Uppercase letters Lowercase letters Digits Special characters, including!@$%^-_=+[{}]:,./? The image must support the Integrated Drive Electronics (IDE) and ParaVirtual OPerationS (PVOPS) device driver. The driver must be automatically loaded when the system starts. The boot partition and system partition of the image must be on the same disk. You must use BIOS to boot the ECS used to create the image. If the disk of the external image file uses specific encryption mechanisms, the ECS created using the private image may become unavailable. Some drivers are not supported on the public cloud platform. Therefore, you cannot use external image files containing OEM OSs to create private images. OSs in external image files cannot be bound to specified hardware. The OSs in your external image files must support full virtualization. If the external image file uses the LVM as the system disk, ECSs created using the private image from the external image file do not support file injection Uploading an External Image File Upload the external image file to your OBS bucket. For details, see the Object Storage Service. Any image file uploaded to an OBS bucket must be an unencrypted one or one encrypted using SSE-KMS. Issue 08 ( ) 43

44 2.5.3 Registering an External Image File as a Private Image Scenarios Prerequisites This section describes how to register an uninitialized image file as an uninitialized private image on the public cloud platform, or register an initialized image file as a private image in normal state. You have uploaded the external image file to the OBS bucket. Procedure 1. Log in to the management console. 2. Under Computing, click Image Management Service. 3. On the Image Mgmt Service page, click Create Private Image. Select Image file to use an external image file as the source. Figure 2-26 Registering an image 4. Click Select to choose the external image file. 5. Select the bucket that stores the external image file in the left navigation tree and select the external image file. Figure 2-27 shows the page for you to select the bucket and the external image file. Issue 08 ( ) 44

45 Figure 2-27 Select Image File 6. Click OK. 7. Enter the image name. 8. (Optional) Select the OS required by the image. To ensure that images can be created and used, select the OS consistent with that of the image file. If you do not select an OS for the image file, the system will automatically identify the OS of the image file. If the system detects that the image file OS is different from that you configure, the OS detected by the system will prevail. If the system cannot detect the OS of the image file, the OS you select will prevail. If the OS you select or identified by the system is inconsistent with that of the actual image, ECSs created using this image may be affected. For detailed impact, see section What Impact Will Be Brought by an Inconsistency Between the Image OS I Select or Identified by the System and That of the Actual Image During Creation of a Private Image Using an External Image File?. 9. (Optional) Encrypt the image. If the image needs to be encrypted, select KMS encryption and select the key to be used from the list of keys. For how to encrypt an image, see section 3.6 Encrypting an Image. 10. Enter a system disk size and the image description as required. 11. Select Enable automatic configuration. The system will perform the following operations on the image file: Modify the grub and syslinux configuration files to add the OS kernel boot parameters and change the disk partition name to UUID=UUID of the disk partition. Change the names of the disk partitions in the /etc/fstab file to UUID=UUID of the disk partition. Check whether the initrd file has the Xen and IDE drivers. If no, load the Xen and IDE drivers. Modify the xwindows configuration file /etc/x11/xorg.conf to prevent display failures. Delete services of VMware tools. Issue 08 ( ) 45

46 If the image file has the preceding configuration, you can choose not to select Enable automatic configuration. Otherwise, select Enable automatic configuration. 12. Click Create Now. 13. On the Confirm Specifications page, confirm the specifications and then click Submit Creating an ECS Scenarios Prerequisites The time required for image registration is determined by the image file size. You may need to wait a long period of time for the external image file to be successfully registered as a private image that is not initialized. Create an ECS using a private image that is not initialized. The private image that is not initialized is available. Procedure 1. Log in to the management console. 2. Under Computing, click Image Management Service. 3. On the Image Management Service page, click the Private Image tab to switch to the page that displays all private images. 4. Locate the row that contains the newly registered private image that is not initialized, and click Create ECS in the Operation column to create an ECS. 5. Complete ECS creation as prompted. For how to create an ECS, see the Elastic Cloud Server. If the image file system has Cloud-Init installed and configured, log in to the ECS using the password as prompted. If the image file system does not have Cloud-Init installed, log in to the ECS using the password or certificate contained in the image file. To ensure ECS security, each ECS is added to the default security group after being created. By default, a security group denies all access requests to it. Therefore, you need to add inbound rules to allow inbound access to the ECS from an external location. For detailed configurations, see the security group configuration for private clouds Configuring a Linux ECS Scenarios Configure the ECS created using the private image which is not initialized on the public cloud platform to ensure that the ECS can be properly used. The following describes how to configure a Linux ECS. Procedure 1. Log in to the Linux ECS. For how to log in to an ECS, see the Elastic Cloud Server. Issue 08 ( ) 46

47 2. Check whether the private IP address of the ECS is consistent with that displayed on the management console. The methods of checking this vary depending on the OSs. Take CentOS 6 as an example and run the following command to check the private IP address of the ECS: ifconfig If the IP address is incorrect, check and delete network udev rules on the Linux ECS. For details, see Querying and Deleting Network Rule Files. 3. Check and configure the IP address assignment mode of the ECS NIC to DHCP. If the Linux ECS is using a static IP address, configure it by following the instructions provided in Querying and Configuring NIC Attributes. 4. Enable SSH for remote access and ensure that your host firewall (such as Linux iptables) allows access to SSH. 5. Check whether Cloudbase-Init has been installed and configured: If yes, go to 6. If no, install and configure Cloudbase-Init by following the instructions in Installing Cloud-Init. 6. Perform the following steps to check and delete automatic attaching information about data disks in the /etc/fstab configuration file to prevent adverse impacts on future data disk attaching operations: Run the following command to edit the fstab file: vi /etc/fstab Delete the configuration information about relevant data disks from the fstab file. The /etc/fstab file contains configuration information about all disks automatically attached to the ECS when the ECS starts. Such configuration information needs to be deleted. For example, the last row shown in Figure 2-28 is the data disk configuration information which needs to be deleted from the fstab file. Figure 2-28 EVS configuration information contained in the fstab file Creating a Private Image Using an ECS Select the private image creation method based on the ECS OS. If the ECS runs Linux, create a private image using the ECS by following the steps provided in Creating a Private Linux Image. Issue 08 ( ) 47

48 2.5.7 (Optional) Cleaning Up the Environment Scenarios The private image registered in Registering an External Image File as a Private Image and the ECS created in Creating an ECS incur additional fees. Therefore, you are advised to perform the following steps to clean up the environment after the private image is created. Procedure 1. Delete the uninitialized private image registered using the external image file. For details, see 3.3 Deleting an Image. 2. Delete the ECS created in Registering an External Image File as a Private Image. For details, see the Elastic Cloud Server. 3. Delete the image file stored in the OBS bucket. For details, see the Object Storage Service. Issue 08 ( ) 48

49 3 Management 3 Management 3.1 Modifying Image Attributes Scenarios Procedure You can only modify private images that are in Normal or Normal (Uninitialized) state. You can modify the name, description, and status of a private image. You can modify the name and description of a private image using either of the following methods: Method 1: 1. Log in to the management console. 2. Under Computing, click Image Management Service. 3. Click Private Image to display the image list. 4. Locate the row that contains the image and click Modify in the Operation column. 5. Modify the image name and description. Method 2: 1. Log in to the management console. 2. Under Computing, click Image Management Service. 3. Click Private Image to display the image list. In the image list on the Private Image page, locate the row that contains the image, click on the left of the row, and click the modification icon highlighted in Figure 3-1. Issue 08 ( ) 49

50 3 Management Figure 3-1 Modifying attributes of an image You can change the image status based on whether initial configuration has been performed for the image. 1. Log in to the management console. 2. Under Computing, click Image Management Service. 3. Click Private Image to display the image list. 4. Locate the row that contains the image and click Modify in the Operation column. 5. Check whether initial configuration has been performed for the image. If yes, select Initial configuration has been performed for this image. and change the image status to Normal. If no, deselect Initial configuration has been performed for this image. and change the image status to Normal (Uninitialized). For how to perform initial configuration for an image, see What Initial Configuration Needs to Be Performed for an External Image File Used to Create a Private Image?. 6. Click OK. 3.2 Creating an ECS Using an Image Scenarios You can use a private or public image to create an ECS. The difference is as follows: If you use a public image to create an ECS, the ECS contains only the OS and pre-installed public applications. You will need to install your private applications if required. If you use a private image to create an ECS, the ECS contains the OS, pre-installed public applications, and your private applications. Procedure 1. Log in to the management console. 2. Under Compute, click Image Management Service. 3. Click Public Image or Private Image to display the image list. Issue 08 ( ) 50

51 3 Management 4. Locate the row that contains the target image and click Create ECS in the Operation column. For how to create an ECS, see the Elastic Cloud Server. 3.3 Deleting an Image Scenarios Delete an image if it is unneeded. You can delete only private images that are in the Normal or Normal (Uninitialized) state. Procedure 1. Log in to the management console. 2. Under Computing, click Image Management Service. 3. Click Public Image or Private Image to display the image list. To delete a single image, go to 4. To delete images in batches, go to Locate the row that contains the image, click More in the Operation column and select Delete. Go to Select the image you are to delete on the image list. 6. Click Delete on top of the image list. 7. Click OK. 3.4 Sharing an Image Overview Application Scenarios Procedure Users can use the image sharing function to share their private images with other users. The image provider can share specified images, cancel sharing images, and add or delete tenants with whom they share images. The recipient can choose to accept or refuse images shared by other users, and can remove the images they have accepted. User A (image provider) shares a private image with user B (image recipient). The procedure is as follows: 1. User B provides the project ID to user A. 2. User A shares an image with user B. 3. User B accepts the shared image. 4. User B uses the image shared by user A to perform operations, such as creating ECSs. Issue 08 ( ) 51

52 3 Management Restrictions and Limitations 1. A user can share 30 images at most. 2. A user can only share images with other users within the same region. 3. An image can be shared with 128 users at most. 4. Users can cancel image sharing anytime. 5. Users can delete images they have shared anytime. 6. An encrypted image cannot be shared Obtaining the Project ID Scenarios Before user A shares a private image with user B, user B must provide the project ID to user A. This section describes how user B can obtain the project ID. Procedure 1. User B logs in to the management console. 2. Click the username and choose My Credential from the drop-down list. On the My Credential page, view the project ID in the project list. Figure 3-2 Viewing the project ID Sharing Specified Images Scenarios After user A obtains the project ID from user B, user A can share specified private images with user B. A user can share a single image or share images in batches based on your requirements. Issue 08 ( ) 52

53 3 Management Prerequisites User A has obtained user B's project ID. Procedure 1. User A logs in to the management console. 2. Under Computing, click Image Management Service. 3. On the Image Management Service page, click the Private Image tab to switch to the page that displays all private images. 4. Perform either of the following operations on this page: To share images in batches, go to 5. To share a single image, go to Select the private images to share, click Share on top of the image list. Figure 3-3 shows the page for sharing images in batches. Figure 3-3 Sharing images in batches 6. In the Share Image window, enter user B's project ID. Perform 9. Figure 3-4 Share Image window Issue 08 ( ) 53

54 3 Management 7. Locate the row that contains the private image you are to share, click More in the Operation column and select Share. 8. In the Share Image window, enter user B's project ID. Figure 3-5 shows the page for sharing an image. Figure 3-5 Share Image window 9. Click OK Accepting or Refusing Shared Images Scenarios Prerequisites After user A shares specified images, user B will receive a message. User B can choose to accept or refuse all or part of the shared images. User B can only use accepted images. User A has shared specified images. Procedure 1. User B logs in to the management console. 2. Under Computing, click Image Management Service. 3. On the Image Management Service page, click the Shared Image tab to switch to the page that displays all private images. 4. A message is displayed on top of the image list inquiring whether user B wants to accept the shared images. Figure 3-6 shows the page for accepting a shared image. Issue 08 ( ) 54

55 3 Management Figure 3-6 Message asking whether to accept the shared images To refuse all shared images, click Refuse All. To accept the shared images or refuse part of the shared images, click View details and then go to Accept the shared images or refuse part of the shared images. To accept the shared images, select the images on the Shared Image page and click Accept. You can use images only after you have accepted them. Figure 3-7 shows the image details page. To refuse part of the shared images, select the images on the Shared Image page and click Refuse. Figure 3-7 Shared Image page Removing Accepted Images Scenarios Prerequisites After you have accepted images shared by other users, you can remove them from the image list if you no longer need them. You have accepted images shared by other users. Procedure 1. Log in to the management console. 2. Under Computing, click Image Management Service. 3. On the Image Management Service page, click the Shared Image tab to switch to the page that displays all private images. Issue 08 ( ) 55

56 3 Management 4. Perform either of the following operations on this page: To remove images in batches, go to 5. To remove a single image, go to Select the images you are to remove and click Delete on top of the image list. Perform 7. Figure 3-8 Removing images in batches 6. Locate the row that contains the private image you are to remove, click More in the Operation column and select Delete. 7. In the displayed dialog box, confirm the images you are to remove and click OK Canceling Image Sharing Application Scenarios Prerequisites Cancel sharing of images with other users. You have shared private images with other users. Procedure 1. Log in to the management console. 2. Under Computing, click Image Management Service. 3. On the Image Management Service page, click the Private Image tab to switch to the page that displays all private images. 4. Locate the row that contains the private images whose sharing you are to cancel, click More in the Operation column and select Stop Sharing. 5. In the displayed dialog box, confirm the images and click OK Adding Tenants Who Can Use Shared Images Scenarios Add tenants who can use the shared images. Prerequisites You have shared private images. You have obtained the project ID of the tenant to be added. Issue 08 ( ) 56

57 3 Management Procedure 1. Log in to the management console. 2. Under Computing, click Image Management Service. 3. On the Image Management Service page, click the Private Image tab to switch to the page that displays all private images. 4. Click to view the image details. 5. In the image details area, click Add Tenant. Figure 3-9 shows the image details page. Figure 3-9 Image details 6. In the displayed Add Tenant window, enter the project ID of the tenant to be added. Figure 3-10 shows the page for adding a tenant. Figure 3-10 Add Tenant window 7. Click OK Deleting Tenants Who Can Use Shared Images Scenarios Delete tenants who can use shared images. Prerequisites You have shared private images. Issue 08 ( ) 57

58 3 Management You have obtained the project ID of the tenant to be deleted. Procedure 1. Log in to the management console. 2. Under Computing, click Image Management Service. 3. On the Image Management Service page, click the Private Image tab to switch to the page that displays all private images. 4. Click to view the image details. 5. In the image details area, click the number of tenants with whom the images are shared. Figure 3-11 shows the image details page. Figure 3-11 Image details 6. In the displayed Tenant List window, perform either of the following operations Figure 3-12 shows the Tenant List page. To delete a single tenant, click Delete in the row that contains the tenant. To delete all tenants, click Delete All on top of the tenant list. Figure 3-12 Tenant List Issue 08 ( ) 58

59 3 Management 3.5 Exporting an Image Scenarios If you need to export private images to specified storage devices or use private images on other platforms, you can use the image export function. You can export private images in available status to OBS buckets and specify the export format, and download images in OBS buckets to specified storage devices. Images exported in different formats may vary in size. The Object Storage Service (OBS) will charge you for storage based on the exported image size. Restrictions and Limitations Prerequisites You can export private images in available status, which can be Normal or Normal (Uninitialized). You cannot export public images (such as Windows, SUSE Linux, Oracle Linux, and Ubuntu) or private images created using these public images. You can only export images smaller than 128 GB. You can export images in VMDK, VHD, QCOW2, and ZVHD formats. You have an OBS bucket. For details, see the Object Storage Service. Procedure 1. Log in to the management console. 2. Under Computing, click Image Management Service. 3. On the Image Mgmt Service page, click the Private Image tab to switch to the page that displays all private images. 4. Locate the row that contains the image to be exported, click More in the Operation column and select Export. 5. In the displayed Export Image dialog box, enter the name of the image file to be exported. 6. Select the format of the image to be exported. 7. Select the bucket in which the image is to be stored. 8. Click OK. 9. You can view the image export progress on the Task Center console. After the image is successfully exported, you can download the image from the OBS bucket on the OBS console or client. Issue 08 ( ) 59

60 3 Management 3.6 Encrypting an Image Overview Application Scenarios Image encryption can improve data security. You can create an encrypted image to ensure security of the image data. Restrictions and Limitations 1. KMS has been enabled. 2. An encrypted image cannot be shared with other users. 3. An encrypted image cannot be published in the Marketplace. 4. If an ECS has an encrypted system disk, the private image created using the ECS is also encrypted. 5. The key used for encrypting an image cannot be changed. 6. If the key used for encrypting an image is disabled or deleted, the image is unavailable. 7. The system disk of an ECS created using an encrypted image is also encrypted, and its key is the same as the image key Creating an Encrypted Image You can create an encrypted image using an encrypted ECS or an external image file. Create an encrypted image using an encrypted ECS. When you use an ECS to create a private image, if the system disk of the ECS is encrypted, the private image created using the ECS is also encrypted. The key used for encrypting the image is the one used for creating the system disk. For details, see sections 2.2 Creating a Private Image Using a Windows ECS and 2.3 Creating a Private Image Using a Linux ECS. Create an encrypted image using an external image file. When you use an external image file that has been uploaded to an OBS bucket to create a private image, you can select KMS encryption and the key when registering the image to encrypt the image. For details, see 2.4 Creating a Private Windows Image Using an External Image File and 2.5 Creating a Private Linux Image Using an External Image File. Issue 08 ( ) 60

61 4 FAQs 4 FAQs 4.1 Image FAQs How Many Private Images Can Be Created Using One Account? In this version, you can create a maximum of 100 private images per account per region Can Specifications of ECSs Created Using a Private Image Differ from Those of ECSs Used to Create the Image? You can modify hardware specifications as required when using a private image to create an ECS How Long Does It Take to Create a Private Image Using an ECS? It takes about 20 minutes to create a private image using an ECS Should I Stop the ECS Before Creating a Private Image Using that ECS? You must stop the ECS when creating a private image using that ECS. If the ECS is running, the ECS memory may buffer data to be read, which may result in data loss in the created image. To prevent this issue, stop the ECS before creating an image What Can I Do If I Configure an Incorrect OS or System Disk Size During Private Image Registration Using an Image File? If you select an incorrect OS during private image registration using an image file, ECS creation using the registered private image may fail. If you configure a system disk size smaller than the size of the image file system disk during private image registration using an image file, ECS creation using the registered private image will fail. Issue 08 ( ) 61

62 4 FAQs If this happens, delete the incorrect image and create a private image again using the correct parameter settings Must I Install Tools on the ECS? Installing Open Telekom Cloud Tools on the ECS enhances user experience in ECS usage and ensures high availability and stability for the ECS. Tools must be installed on the ECS running Windows. ECSs running Linux use PVOPS provided by the public cloud platform. PVOPS may affect ECS running. For details, see the Bug List of Linux Distributions. You can obtain this document from: If you neither install Open Telekom Cloud Tools nor the PVOPS driver, the created ECS may not start or cannot be used after the startup. The public cloud platform does not guarantee the availability of such OSs What May Cause a Tools Installation Failure? The cause for a Tools installation failure on an ECS may be any of the following: 1. If your image file is exported from a VMware VM, VMware Tools may not be uninstalled or not completely uninstalled. 2. You have downloaded an incorrect version of Tools for your ECS running Windows. 3. If the available disk space is insufficient, the installation may fail. Therefore, ensure that the disk where the Tools is installed has at least 300 MB available space What Are the Impacts If the ECS That Has Not Been Configured Is Used to Create the Private Image? If the IP address assignment mode of the ECS NIC is not set to DHCP or the network udev rules are not deleted, the ECS created using the registered private image may fail to obtain the correct network configuration, or the ECS NIC is not started from eth0. Then, you must log in remotely to the ECS and configure it. If you do not configure the image used for creating the ECS running Linux before the creation, the following conditions may occur: Customized passwords cannot be injected. Certificated cannot be injected. Some customized ECS configurations may not be supported. If you do not delete the automatic attaching detection information of user disks from the fstab file, the ECS created using the private image may fail to start Can I Use Images in Formats Other Than Those Specified in This Document? No, you cannot. Currently, only VMDK, VHD, QCOW2, and ZVHD formats are supported. Issue 08 ( ) 62

63 4 FAQs What Can I Do If the Disks of ECS Created Using a CentOS Image Cannot Be Found? This is caused by the xen-blockfront.ko module not being installed before ECS startup. You need to modify OS kernel boot parameters. Log in to the ECS using VNC. The page shown in Figure 4-1 is displayed. Figure 4-1 VNC login page This step must be performed after the OS starts. Modify kernel boot parameters in the original ECS used for creating the image (recommended). Perform the following operations to modify OS kernel boot parameters: 1. Run the following command to log in to the OS: lsinitrd /boot/initramfs-os kernel version.img grep -i xen If the command output contains xen-blockfront.ko, contact technical support. If no command output is displayed, go to Back up the original GRUB configuration file grub.conf. If the ECS runs CentOS 6, run the following command: cp /boot/grub/grub.conf /boot/grub/grub.conf.bak If the ECS runs CentOS 7, run the following command: cp /boot/grub2/grub.conf /boot/grub2/grub.conf.bak 3. Use the vi editor to open the GRUB configuration file. Run the following command (using CentOS 7 as an example): vi /boot/grub2/grub.conf 4. Add xen_emul_unplug=never to the right of the related default boot kernel on the page shown in Figure 4-2. Issue 08 ( ) 63

64 4 FAQs Figure 4-2 Adding a parameter 5. Press Esc, enter :wq, and press Enter to exit the vi editor. 6. Create an image using the ECS, upload the created image, and register the image as a private image of the public cloud system How Can a Refused Image Be Used? If user B has refused an image shared by user A, but wants to use the image, user A must perform the following operations: 1. Delete user B's project ID from the tenant list of the shared image. For details, see section Deleting Tenants Who Can Use Shared Images. 2. Add user B again as a tenant with whom the image is shared. For details, see section Adding Tenants Who Can Use Shared Images What Changes Will Be Made to an Image File Used for Registering a Private Image? If you choose automatic configuration when registering a private image using an image file, the system will perform the following operations: For Linux: Modify the grub and syslinux configuration files to add the OS kernel boot parameters and change the disk partition name to UUID=UUID of the disk partition. Change the names of the disk partitions in the /etc/fstab file to UUID=UUID of the disk partition. Check whether the initrd file has the Xen and IDE drivers. If no, load the Xen and IDE drivers. Modify the xwindows configuration file /etc/x11/xorg.conf to prevent display failures. Delete services of VMware tools. For Windows: Issue 08 ( ) 64