Preparation

Procedure

1. Purchase a license.

   Purchase a license of Alibaba Cloud Hybrid Cloud Management and install it on ZStack Cloud.

2. Add the following items to your firewall allowlist so that the ZStack Cloud management node can access Alibaba Cloud APIs:
   • *.aliyuncs.com
3. Create an Alibaba Cloud account.

   Create an Alibaba Cloud account. For more information, see Create an Alibaba Cloud Account.

   If you are unfamiliar with the main account and sub-account system of Alibaba Cloud, see What is RAM. We recommend that you follow this process to finish the account creation:

   1. Create a main account on Alibaba Cloud.
   2. Use the main account to log on to the Alibaba Cloud Console, and choose Access Control.
   3. On the navigation bar on the left, choose Users > Create User, and create a user named zstack-user.
   4. On the navigation bar, choose Groups > Create Group, and create a group named zstack-developer-group.
   5. Click the group you create, and click the Permissions tab. On the displayed tab page, click Grant Permission. Grant at least the following permissions to the group:
      • AliyunRAMFullAccess
      • AliyunECSFullAccess
      • AliyunEIPFullAccess
      • AliyunVPCFullAccess
      • AliyunOSSFullAccess
      • AliyunExpressConnectFullAccess
      • AliyunVPNGatewayFullAccess
   6. Click the Group Members tab and add the user you created to the group.
   7. On the navigation bar, click Users. On the User page, click the user you created. On the details page of the user, choose the Authentication tab page and click Create AccessKey. Then, an AccessKey pair is generated. Save the AccessKey ID and AccessKey Secret (AK) well for they will not be displayed again after you exist the creation page.

   Note:

   • ZStack Cloud does not record your Alibaba Cloud account information. It only uses the AK to call Alibaba Cloud APIs.
   • We recommend that you comply with the RAM rules of Alibaba Cloud to improve the resource security.
   • The most important security principle is Do not use the main account AK for any actions.
4. Apply for the permission to upload custom images.

   On the main menu of Alibaba Cloud Console, click Tickets > Submit Ticket. On the Submit Ticket page, choose the question attribution as Elastic Compute Service. Choose question type as Image and Operating System. Then, choose Create/Delete Image and Import/Export Image. On the displayed page, enter a question description like "We are applying for your image import service. Please help add us to your image import allowlist." This ticket is proceeded manually, which takes quite some time.

5. Apply for the OSS service and create an OSS Bucket.
   A ZStack Cloud image is stored in an Alibaba Cloud OSS before it is used to create an Alibaba Cloud ECS instance. You can use a Bucket in the OSS to upload ZStack Cloud images to Alibaba Cloud.

   Note:

   • Make sure that the ZStack Cloud images to be uploaded support Online Password Modification (Qemu-guest-agent).
   • Make sure that the images do not use an EFI or LVM partitioning scheme.
   • Make sure that the images encapsulate Linux or Windows operating systems.
6. Add Alibaba Cloud AccessKey to ZStack Cloud Hybrid Cloud.
   On the main menu of ZStack Cloud, choose Resource Center > Hybrid Cloud Management > Setting > AccessKey Management. On the AccessKey Management page, click Add AccessKey, and add the Alibaba Cloud AccessKey you generated in the step3.

   Note: The AccessKey added for the first time is automatically set as the default AccessKey.
7. Add a region.

   On the main menu of Hybrid Cloud Management, choose Data Center > Region and add an Alibaba Cloud region or a Private Alibaba Cloud region.

8. Synchronize data.
   On the main menu of Hybrid Cloud Management, click Sync Data to synchronize data in the corresponding Alibaba Cloud data center to ZStack Cloud for a local management.

   • Make sure that you have added a region and zone to ZStack Cloud Hybrid Cloud before you exercise the data synchronization.
   • This action synchronizes the Alibaba Cloud resources that can be accessed with the AccessKey and in the added regions and zones, such as ECS instances, volumes, VPCs, vSwithes, security groups, images, EIPs, VPNs, virtual border routers, and router interfaces.
   • ZStack Cloud automatically synchronized the resources in a region or zone when you add it to local for the first time.
   • The data synchronization takes a relatively long time when you have added multiple regions and zones.