first commit

.gitignore

@@ -0,0 +1,35 @@
+# 环境配置
+.env.local
+.env.*.local
+
+# 日志
+logs/
+*.log
+
+# 依赖
+node_modules/
+frontend/node_modules/
+
+# 编译输出
+backend/_output/
+backend/bin/
+frontend/dist/
+
+# IDE
+.vscode/
+.idea/
+*.swp
+*.swo
+*~
+
+# 系统文件
+.DS_Store
+Thumbs.db
+
+# 临时文件
+*.tmp
+*.temp
+.cache/
+
+# 前端开发配置
+frontend/dev.server.config.js

backend/.circleci/config.yml

@@ -0,0 +1,36 @@
+# Golang CircleCI 2.0 configuration file
+#
+# Check https://circleci.com/docs/2.0/language-go/ for more details
+version: 2
+jobs:
+  test:
+    requires:
+      - check
+    docker:
+      - image: yunion/alpine-build:3.22.0-go-1.24.6-1
+        environment:
+          ONECLOUD_CI_BUILD: "1"
+
+    #### TEMPLATE_NOTE: go expects specific checkout path representing url
+    #### expecting it in the form of
+    ####   /go/src/github.com/circleci/go-tool
+    ####   /go/src/bitbucket.org/circleci/go-tool
+    working_directory: /root/go/src/yunion.io/x/onecloud
+    resource_class: large
+    parallelism: 1
+    steps:
+      - checkout
+      - run:
+          command: |
+            make -j3 check
+            make test
+            targets="$(circleci tests glob "cmd/*" | grep -v cmd/host-image | circleci tests split)"
+            echo $targets | tr ' ' '\n'
+            make $targets
+            ls -lh _output/bin/
+
+workflows:
+  version: 2
+  build_and_test:
+    jobs:
+      - test

backend/.dockerignore

@@ -0,0 +1,7 @@
+ _output/alpine-build/_cache
+pkg
+vendor
+cmd
+locales
+docs
+scripts

backend/.drone.yml

@@ -0,0 +1,132 @@
+---
+kind: pipeline
+name: build
+
+clone:
+  depth: 1
+
+workspace:
+  base: /home/build/go
+  path: src/yunion.io/x/onecloud
+
+steps:
+- name: build
+  image: yunion/onecloud-ci:latest
+  commands:
+  - CGO_ENABLED=0 make -j 4 cmd/apigateway cmd/baremetal-agent cmd/climc cmd/keystone
+  - CGO_ENABLED=0 make -j 4 cmd/logger cmd/region cmd/scheduler cmd/webconsole
+  - CGO_ENABLED=0 make -j 4 cmd/yunionconf cmd/glance cmd/torrent
+
+- name: image-baremetal-agent
+  image: plugins/docker
+  settings:
+    repo: registry.cn-beijing.aliyuncs.com/yunionio/baremetal-agent
+    registry: registry.cn-beijing.aliyuncs.com
+    dockerfile: build/docker/Dockerfile.baremetal-agent
+    tags: "${DRONE_TAG}"
+    username:
+      from_secret: docker_username
+    password:
+      from_secret: docker_password
+
+- name: image-climc
+  image: plugins/docker
+  settings:
+    repo: registry.cn-beijing.aliyuncs.com/yunionio/climc
+    registry: registry.cn-beijing.aliyuncs.com
+    dockerfile: build/docker/Dockerfile.climc
+    tags: "${DRONE_TAG}"
+    username:
+      from_secret: docker_username
+    password:
+      from_secret: docker_password
+
+- name: image-keystone
+  image: plugins/docker
+  settings:
+    repo: registry.cn-beijing.aliyuncs.com/yunionio/keystone
+    registry: registry.cn-beijing.aliyuncs.com
+    dockerfile: build/docker/Dockerfile.keystone
+    tags: "${DRONE_TAG}"
+    username:
+      from_secret: docker_username
+    password:
+      from_secret: docker_password
+
+- name: image-logger
+  image: plugins/docker
+  settings:
+    repo: registry.cn-beijing.aliyuncs.com/yunionio/logger
+    registry: registry.cn-beijing.aliyuncs.com
+    dockerfile: build/docker/Dockerfile.logger
+    tags: "${DRONE_TAG}"
+    username:
+      from_secret: docker_username
+    password:
+      from_secret: docker_password
+
+- name: image-region
+  image: plugins/docker
+  settings:
+    repo: registry.cn-beijing.aliyuncs.com/yunionio/region
+    registry: registry.cn-beijing.aliyuncs.com
+    dockerfile: build/docker/Dockerfile.region
+    tags: "${DRONE_TAG}"
+    username:
+      from_secret: docker_username
+    password:
+      from_secret: docker_password
+
+- name: image-scheduler
+  image: plugins/docker
+  settings:
+    repo: registry.cn-beijing.aliyuncs.com/yunionio/scheduler
+    registry: registry.cn-beijing.aliyuncs.com
+    dockerfile: build/docker/Dockerfile.scheduler
+    tags: "${DRONE_TAG}"
+    username:
+      from_secret: docker_username
+    password:
+      from_secret: docker_password
+
+- name: image-yunionconf
+  image: plugins/docker
+  settings:
+    repo: registry.cn-beijing.aliyuncs.com/yunionio/yunionconf
+    registry: registry.cn-beijing.aliyuncs.com
+    dockerfile: build/docker/Dockerfile.yunionconf
+    tags: "${DRONE_TAG}"
+    username:
+      from_secret: docker_username
+    password:
+      from_secret: docker_password
+
+- name: image-apigateway
+  image: plugins/docker
+  settings:
+    repo: registry.cn-beijing.aliyuncs.com/yunionio/apigateway
+    registry: registry.cn-beijing.aliyuncs.com
+    dockerfile: build/docker/Dockerfile.apigateway
+    tags: "${DRONE_TAG}"
+    username:
+      from_secret: docker_username
+    password:
+      from_secret: docker_password
+
+- name: image-glance
+  image: plugins/docker
+  settings:
+    repo: registry.cn-beijing.aliyuncs.com/yunionio/glance
+    registry: registry.cn-beijing.aliyuncs.com
+    dockerfile: build/docker/Dockerfile.glance
+    tags: "${DRONE_TAG}"
+    username:
+      from_secret: docker_username
+    password:
+      from_secret: docker_password
+
+trigger:
+  event:
+  - tag
+  status:
+  - success

backend/.editorconfig

@@ -0,0 +1,3 @@
+[*.sh]
+indent_style = space
+indent_size = 4

backend/.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,20 @@
+---
+name: Bug report
+about: 报告代码缺陷/Create a bug report to help us improve
+title: '[BUG]'
+labels: bug
+assignees: ''
+
+---
+
+**问题描述/What happened**:
+
+**环境/Environment**:
+
+- OS (e.g. `cat /etc/os-release`):
+- Kernel (e.g. `uname -a`):
+- Host: (e.g. `dmidecode | egrep -i 'manufacturer|product' |sort -u`)
+- Service Version (e.g. `kubectl exec -n onecloud $(kubectl get pods -n onecloud | grep climc | awk '{print $1}') -- climc version-list`):
+<!--
+- Version (e.g. `climc version-list`):
+-->

backend/.github/ISSUE_TEMPLATE/document_request.md

@@ -0,0 +1,12 @@
+---
+name: 文档问题/Document Request
+about: 文档相关缺陷改进/Document request to this project
+title: '[文档/Docs]'
+labels:
+- area/docs
+- enhancement
+assignees: ''
+
+---
+
+**What part of the document needs to be added**:

backend/.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,10 @@
+---
+name: 新特性/Feature Request
+about: 建议新功能特性/Suggest an idea for this project
+title: '[Feature]'
+labels: feature
+assignees: ''
+
+---
+
+**What would you like to be added**:

backend/.github/ISSUE_TEMPLATE/support-request.md

@@ -0,0 +1,10 @@
+---
+name: 求助/Support Request
+about: 求助使用中遇到的问题/Support request relating to this project
+title: '[求助/Help]'
+labels: question
+assignees: ''
+
+---
+
+

backend/.github/pull_request_template.md

@@ -0,0 +1,19 @@
+**What this PR does / why we need it**:
+
+<!--
+- [ ] Smoke testing completed
+- [ ] Unit test written
+-->
+
+**Does this PR need to be backport to the previous release branch?**:
+
+<!--
+If no, just write "NONE".
+
+If don't know, write "UNKNOWN", and let the reviewer decide.
+
+If yes, write the release branches name in the below format and submit the related cherry-pick PR:
+- release/3.11
+
+Take a look at "https://www.cloudpods.org/en/docs/contribute/contrib/" to learn how to submit a cherry-pick PR. 
+-->

backend/.github/workflows/ci-pr-build-test.yml

@@ -0,0 +1,38 @@
+name: Building and test for PR
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+jobs:
+  build_and_test:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+
+    - name: Setup Go
+      uses: actions/setup-go@v4
+      with:
+        go-version: '1.25'
+
+    - name: Install check tools
+      shell: bash
+      run: |
+        set -o xtrace
+        git clone --branch master --depth 4 https://github.com/yunionio/tools && cd tools
+        go build ./cmd/goimports && sudo cp goimports /usr/bin/ && cd .. && rm -rf tools
+        git clone --depth 4 https://github.com/yousong/y18n && cd y18n
+        go build . && sudo cp y18n /usr/bin && cd .. && rm -rf y18n
+
+    
+    - name: Test and build
+      shell: bash
+      run: |
+        set -o xtrace
+        export GO111MODULE=on
+        make -j3 check
+        make test
+        targets="$(find cmd -mindepth 1 -maxdepth 1 -type d | grep -v cmd/host-image | grep -v torrent)"
+        echo $targets | tr ' ' '\n'
+        make $targets
+        ls -lh _output/bin

backend/.github/workflows/docker_apigateway.yml

@@ -0,0 +1,52 @@
+name: Apigateway Docker Image
+
+on:
+  push:
+    branches:
+      - 'releases/**'
+      - 'main'
+      - 'master'
+    paths:
+      - 'pkg/appsrv/**.go'
+      - 'pkg/cloudcommon/db/**.go'
+      - 'pkg/apigateway/**.go'
+      - 'pkg/apis/apigateway/**.go'
+      - 'pkg/mcclient/modules/**.go'
+jobs:
+  build_apigateway:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v3
+      with:
+        fetch-depth: 8
+        
+    - uses: actions/setup-go@v4
+      with:
+        go-version: '1.25'
+        
+    - name: Set up QEMU
+      uses: docker/setup-qemu-action@v2
+      
+    - name: Set up Docker Buildx
+      id: buildx
+      uses: docker/setup-buildx-action@v2
+      
+    - name: Login to Aliyun Container Registry (ACR)
+      uses: docker/login-action@v2
+      with:
+        registry: https://registry.us-west-1.aliyuncs.com
+        username: ${{ secrets.ACR_USERNAME }}
+        password: ${{ secrets.ACR_PASSWORD }}
+       
+    - name: Build And Push Docker Image
+      shell: bash
+      run: |
+          set -o xtrace
+          export GO111MODULE=on
+          branch="${GITHUB_REF#refs/heads/}"
+          timestamp=`TZ="Asia/Shanghai" date +"%Y%m%d%H%M%S"`
+          export VERSION="$branch-$timestamp-solo"
+          export GOOS=linux
+          export ARCH=all
+          export REGISTRY=registry.us-west-1.aliyuncs.com/yunion-dev
+          make image apigateway

backend/.github/workflows/docker_climc.yml

@@ -0,0 +1,50 @@
+name: Climc Docker Image
+
+on:
+  push:
+    branches:
+      - 'releases/**'
+      - 'main'
+      - 'master'
+    paths:
+      - 'cmd/climc/**.go'
+      - 'pkg/mcclient/**.go'
+      - 'vendor/yunion.io/x/structarg/**.go'
+jobs:
+  build_climc:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v3
+      with:
+        fetch-depth: 8
+        
+    - uses: actions/setup-go@v4
+      with:
+        go-version: '1.25'
+        
+    - name: Set up QEMU
+      uses: docker/setup-qemu-action@v2
+      
+    - name: Set up Docker Buildx
+      id: buildx
+      uses: docker/setup-buildx-action@v2
+      
+    - name: Login to Aliyun Container Registry (ACR)
+      uses: docker/login-action@v2
+      with:
+        registry: https://registry.us-west-1.aliyuncs.com
+        username: ${{ secrets.ACR_USERNAME }}
+        password: ${{ secrets.ACR_PASSWORD }}
+        
+    - name: Build And Push Docker Image
+      shell: bash
+      run: |
+          set -o xtrace
+          export GO111MODULE=on
+          branch="${GITHUB_REF#refs/heads/}"
+          timestamp=`TZ="Asia/Shanghai" date +"%Y%m%d%H%M%S"`
+          export VERSION="$branch-$timestamp-solo"
+          export GOOS=linux
+          export ARCH=all
+          export REGISTRY=registry.us-west-1.aliyuncs.com/yunion-dev
+          make image climc

backend/.github/workflows/docker_cloudmon.yml

@@ -0,0 +1,51 @@
+name: Cloudmon Docker Image
+
+on:
+  push:
+    branches:
+      - 'releases/**'
+      - 'main'
+      - 'master'
+    paths:
+      - 'pkg/appsrv/**.go'
+      - 'pkg/cloudmon/**.go'
+      - 'vendor/yunion.io/x/cloudmux/pkg/multicloud/loader/**.go'
+
+jobs:
+  build_webconsole:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v3
+      with:
+        fetch-depth: 8
+        
+    - uses: actions/setup-go@v4
+      with:
+        go-version: '1.25'
+        
+    - name: Set up QEMU
+      uses: docker/setup-qemu-action@v2
+      
+    - name: Set up Docker Buildx
+      id: buildx
+      uses: docker/setup-buildx-action@v2
+      
+    - name: Login to Aliyun Container Registry (ACR)
+      uses: docker/login-action@v2
+      with:
+        registry: https://registry.us-west-1.aliyuncs.com
+        username: ${{ secrets.ACR_USERNAME }}
+        password: ${{ secrets.ACR_PASSWORD }}
+        
+    - name: Build And Push Docker Image
+      shell: bash
+      run: |
+          set -o xtrace
+          export GO111MODULE=on
+          branch="${GITHUB_REF#refs/heads/}"
+          timestamp=`TZ="Asia/Shanghai" date +"%Y%m%d%H%M%S"`
+          export VERSION="$branch-$timestamp-solo"
+          export GOOS=linux
+          export ARCH=all
+          export REGISTRY=registry.us-west-1.aliyuncs.com/yunion-dev
+          make image cloudmon

backend/.github/workflows/docker_esxi_agent.yml

@@ -0,0 +1,49 @@
+name: Esxi Agent Docker Image
+
+on:
+  push:
+    branches:
+      - 'releases/**'
+      - 'main'
+      - 'master'
+    paths:
+      - 'pkg/esxi/**.go'
+
+jobs:
+  build_webconsole:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v3
+      with:
+        fetch-depth: 8
+        
+    - uses: actions/setup-go@v4
+      with:
+        go-version: '1.25'
+        
+    - name: Set up QEMU
+      uses: docker/setup-qemu-action@v2
+      
+    - name: Set up Docker Buildx
+      id: buildx
+      uses: docker/setup-buildx-action@v2
+      
+    - name: Login to Aliyun Container Registry (ACR)
+      uses: docker/login-action@v2
+      with:
+        registry: https://registry.us-west-1.aliyuncs.com
+        username: ${{ secrets.ACR_USERNAME }}
+        password: ${{ secrets.ACR_PASSWORD }}
+        
+    - name: Build And Push Docker Image
+      shell: bash
+      run: |
+          set -o xtrace
+          export GO111MODULE=on
+          branch="${GITHUB_REF#refs/heads/}"
+          timestamp=`TZ="Asia/Shanghai" date +"%Y%m%d%H%M%S"`
+          export VERSION="$branch-$timestamp-solo"
+          export GOOS=linux
+          export ARCH=all
+          export REGISTRY=registry.us-west-1.aliyuncs.com/yunion-dev
+          make image esxi-agent

backend/.github/workflows/docker_glance.yml

@@ -0,0 +1,53 @@
+name: Glance Docker Image
+
+on:
+  push:
+    branches:
+      - 'releases/**'
+      - 'main'
+      - 'master'
+    paths:
+      - 'pkg/appsrv/**.go'
+      - 'pkg/cloudcommon/db/**.go'
+      - 'pkg/image/**.go'
+      - 'pkg/apis/image/**.go'
+      - 'vendor/yunion.io/x/sqlchemy/**.go'
+      - 'vendor/yunion.io/x/jsonutils/**.go'
+jobs:
+  build_glance:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v3
+      with:
+        fetch-depth: 8
+        
+    - uses: actions/setup-go@v4
+      with:
+        go-version: '1.25'
+        
+    - name: Set up QEMU
+      uses: docker/setup-qemu-action@v2
+      
+    - name: Set up Docker Buildx
+      id: buildx
+      uses: docker/setup-buildx-action@v2
+      
+    - name: Login to Aliyun Container Registry (ACR)
+      uses: docker/login-action@v2
+      with:
+        registry: https://registry.us-west-1.aliyuncs.com
+        username: ${{ secrets.ACR_USERNAME }}
+        password: ${{ secrets.ACR_PASSWORD }}
+        
+    - name: Build And Push Docker Image
+      shell: bash
+      run: |
+          set -o xtrace
+          export GO111MODULE=on
+          branch="${GITHUB_REF#refs/heads/}"
+          timestamp=`TZ="Asia/Shanghai" date +"%Y%m%d%H%M%S"`
+          export VERSION="$branch-$timestamp-solo"
+          export GOOS=linux
+          export ARCH=all
+          export REGISTRY=registry.us-west-1.aliyuncs.com/yunion-dev
+          make image glance

backend/.github/workflows/docker_host.yml

@@ -0,0 +1,49 @@
+name: Host Docker Image
+
+on:
+  push:
+    branches:
+      - 'releases/**'
+      - 'main'
+      - 'master'
+    paths:
+      - 'pkg/hostman/**.go'
+      - 'pkg/apis/host/**.go'
+jobs:
+  build_host:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v3
+      with:
+        fetch-depth: 8
+        
+    - uses: actions/setup-go@v4
+      with:
+        go-version: '1.25'
+        
+    - name: Set up QEMU
+      uses: docker/setup-qemu-action@v2
+      
+    - name: Set up Docker Buildx
+      id: buildx
+      uses: docker/setup-buildx-action@v2
+
+    - name: Login to Aliyun Container Registry (ACR)
+      uses: docker/login-action@v2
+      with:
+        registry: https://registry.us-west-1.aliyuncs.com
+        username: ${{ secrets.ACR_USERNAME }}
+        password: ${{ secrets.ACR_PASSWORD }}
+        
+    - name: Build And Push Docker Image
+      shell: bash
+      run: |
+          set -o xtrace
+          export GO111MODULE=on
+          branch="${GITHUB_REF#refs/heads/}"
+          timestamp=`TZ="Asia/Shanghai" date +"%Y%m%d%H%M%S"`
+          export VERSION="$branch-$timestamp-solo"
+          export GOOS=linux
+          export ARCH=all
+          export REGISTRY=registry.us-west-1.aliyuncs.com/yunion-dev
+          make image host

backend/.github/workflows/docker_keystone.yml

@@ -0,0 +1,53 @@
+name: Keystone Docker Image
+
+on:
+  push:
+    branches:
+      - 'releases/**'
+      - 'main'
+      - 'master'
+    paths:
+      - 'pkg/appsrv/**.go'
+      - 'pkg/cloudcommon/db/**.go'
+      - 'pkg/keystone/**.go'
+      - 'pkg/apis/identity/**.go'
+      - 'vendor/yunion.io/x/sqlchemy/**.go'
+      - 'vendor/yunion.io/x/jsonutils/**.go'
+jobs:
+  build_keystone:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v3
+      with:
+        fetch-depth: 8
+        
+    - uses: actions/setup-go@v4
+      with:
+        go-version: '1.25'
+        
+    - name: Set up QEMU
+      uses: docker/setup-qemu-action@v2
+      
+    - name: Set up Docker Buildx
+      id: buildx
+      uses: docker/setup-buildx-action@v2
+      
+    - name: Login to Aliyun Container Registry (ACR)
+      uses: docker/login-action@v2
+      with:
+        registry: https://registry.us-west-1.aliyuncs.com
+        username: ${{ secrets.ACR_USERNAME }}
+        password: ${{ secrets.ACR_PASSWORD }}
+       
+    - name: Build And Push Docker Image
+      shell: bash
+      run: |
+          set -o xtrace
+          export GO111MODULE=on
+          branch="${GITHUB_REF#refs/heads/}"
+          timestamp=`TZ="Asia/Shanghai" date +"%Y%m%d%H%M%S"`
+          export VERSION="$branch-$timestamp-solo"
+          export GOOS=linux
+          export ARCH=all
+          export REGISTRY=registry.us-west-1.aliyuncs.com/yunion-dev
+          make image keystone

backend/.github/workflows/docker_logger.yml

@@ -0,0 +1,53 @@
+name: Logger Docker Image
+
+on:
+  push:
+    branches:
+      - 'releases/**'
+      - 'main'
+      - 'master'
+    paths:
+      - 'pkg/appsrv/**.go'
+      - 'pkg/cloudcommon/db/**.go'
+      - 'pkg/logger/**.go'
+      - 'pkg/apis/logger/**.go'
+      - 'vendor/yunion.io/x/sqlchemy/**.go'
+      - 'vendor/yunion.io/x/jsonutils/**.go'
+jobs:
+  build_webconsole:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v3
+      with:
+        fetch-depth: 8
+        
+    - uses: actions/setup-go@v4
+      with:
+        go-version: '1.25'
+        
+    - name: Set up QEMU
+      uses: docker/setup-qemu-action@v2
+      
+    - name: Set up Docker Buildx
+      id: buildx
+      uses: docker/setup-buildx-action@v2
+      
+    - name: Login to Aliyun Container Registry (ACR)
+      uses: docker/login-action@v2
+      with:
+        registry: https://registry.us-west-1.aliyuncs.com
+        username: ${{ secrets.ACR_USERNAME }}
+        password: ${{ secrets.ACR_PASSWORD }}
+        
+    - name: Build And Push Docker Image
+      shell: bash
+      run: |
+          set -o xtrace
+          export GO111MODULE=on
+          branch="${GITHUB_REF#refs/heads/}"
+          timestamp=`TZ="Asia/Shanghai" date +"%Y%m%d%H%M%S"`
+          export VERSION="$branch-$timestamp-solo"
+          export GOOS=linux
+          export ARCH=all
+          export REGISTRY=registry.us-west-1.aliyuncs.com/yunion-dev
+          make image logger

backend/.github/workflows/docker_notify.yml

@@ -0,0 +1,53 @@
+name: Notify Docker Image
+
+on:
+  push:
+    branches:
+      - 'releases/**'
+      - 'main'
+      - 'master'
+    paths:
+      - 'pkg/appsrv/**.go'
+      - 'pkg/cloudcommon/db/**.go'
+      - 'pkg/notify/**.go'
+      - 'pkg/apis/notify/**.go'
+      - 'vendor/yunion.io/x/sqlchemy/**.go'
+      - 'vendor/yunion.io/x/jsonutils/**.go'
+jobs:
+  build_notify:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v3
+      with:
+        fetch-depth: 8
+        
+    - uses: actions/setup-go@v4
+      with:
+        go-version: '1.25'
+        
+    - name: Set up QEMU
+      uses: docker/setup-qemu-action@v2
+      
+    - name: Set up Docker Buildx
+      id: buildx
+      uses: docker/setup-buildx-action@v2
+      
+    - name: Login to Aliyun Container Registry (ACR)
+      uses: docker/login-action@v2
+      with:
+        registry: https://registry.us-west-1.aliyuncs.com
+        username: ${{ secrets.ACR_USERNAME }}
+        password: ${{ secrets.ACR_PASSWORD }}
+
+    - name: Build And Push Docker Image
+      shell: bash
+      run: |
+          set -o xtrace
+          export GO111MODULE=on
+          branch="${GITHUB_REF#refs/heads/}"
+          timestamp=`TZ="Asia/Shanghai" date +"%Y%m%d%H%M%S"`
+          export VERSION="$branch-$timestamp-solo"
+          export GOOS=linux
+          export ARCH=all
+          export REGISTRY=registry.us-west-1.aliyuncs.com/yunion-dev
+          make image notify

backend/.github/workflows/docker_region.yml

@@ -0,0 +1,54 @@
+name: Region Docker Image
+
+on:
+  push:
+    branches:
+      - 'releases/**'
+      - 'main'
+      - 'master'
+    paths:
+      - 'pkg/appsrv/**.go'
+      - 'pkg/cloudcommon/db/**.go'
+      - 'pkg/compute/**.go'
+      - 'pkg/apis/compute/**.go'
+      - 'vendor/yunion.io/x/cloudmux/**.go'
+      - 'vendor/yunion.io/x/sqlchemy/**.go'
+      - 'vendor/yunion.io/x/jsonutils/**.go'
+jobs:
+  build_region:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v3
+      with:
+        fetch-depth: 8
+        
+    - uses: actions/setup-go@v4
+      with:
+        go-version: '1.25'
+        
+    - name: Set up QEMU
+      uses: docker/setup-qemu-action@v2
+      
+    - name: Set up Docker Buildx
+      id: buildx
+      uses: docker/setup-buildx-action@v2
+      
+    - name: Login to Aliyun Container Registry (ACR)
+      uses: docker/login-action@v2
+      with:
+        registry: https://registry.us-west-1.aliyuncs.com
+        username: ${{ secrets.ACR_USERNAME }}
+        password: ${{ secrets.ACR_PASSWORD }}
+        
+    - name: Build And Push Docker Image
+      shell: bash
+      run: |
+          set -o xtrace
+          export GO111MODULE=on
+          branch="${GITHUB_REF#refs/heads/}"
+          timestamp=`TZ="Asia/Shanghai" date +"%Y%m%d%H%M%S"`
+          export VERSION="$branch-$timestamp-solo"
+          export GOOS=linux
+          export ARCH=all
+          export REGISTRY=registry.us-west-1.aliyuncs.com/yunion-dev
+          make image region

backend/.github/workflows/docker_scheduler.yml

@@ -0,0 +1,50 @@
+name: Scheduler Docker Image
+
+on:
+  push:
+    branches:
+      - 'releases/**'
+      - 'main'
+      - 'master'
+    paths:
+      - 'pkg/scheduler/**.go'
+      - 'pkg/apis/scheduler/**.go'
+
+jobs:
+  build_webconsole:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v3
+      with:
+        fetch-depth: 8
+        
+    - uses: actions/setup-go@v4
+      with:
+        go-version: '1.25'
+        
+    - name: Set up QEMU
+      uses: docker/setup-qemu-action@v2
+      
+    - name: Set up Docker Buildx
+      id: buildx
+      uses: docker/setup-buildx-action@v2
+      
+    - name: Login to Aliyun Container Registry (ACR)
+      uses: docker/login-action@v2
+      with:
+        registry: https://registry.us-west-1.aliyuncs.com
+        username: ${{ secrets.ACR_USERNAME }}
+        password: ${{ secrets.ACR_PASSWORD }}
+        
+    - name: Build And Push Docker Image
+      shell: bash
+      run: |
+          set -o xtrace
+          export GO111MODULE=on
+          branch="${GITHUB_REF#refs/heads/}"
+          timestamp=`TZ="Asia/Shanghai" date +"%Y%m%d%H%M%S"`
+          export VERSION="$branch-$timestamp-solo"
+          export GOOS=linux
+          export ARCH=all
+          export REGISTRY=registry.us-west-1.aliyuncs.com/yunion-dev
+          make image scheduler

backend/.github/workflows/docker_webconsole.yml

@@ -0,0 +1,53 @@
+name: Webconsole Docker Image
+
+on:
+  push:
+    branches:
+      - 'releases/**'
+      - 'main'
+      - 'master'
+    paths:
+      - 'pkg/appsrv/**.go'
+      - 'pkg/cloudcommon/db/**.go'
+      - 'pkg/webconsole/**.go'
+      - 'pkg/apis/webconsole/**.go'
+      - 'vendor/yunion.io/x/sqlchemy/**.go'
+      - 'vendor/yunion.io/x/jsonutils/**.go'
+jobs:
+  build_webconsole:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v3
+      with:
+        fetch-depth: 8
+        
+    - uses: actions/setup-go@v4
+      with:
+        go-version: '1.25'
+        
+    - name: Set up QEMU
+      uses: docker/setup-qemu-action@v2
+      
+    - name: Set up Docker Buildx
+      id: buildx
+      uses: docker/setup-buildx-action@v2
+      
+    - name: Login to Aliyun Container Registry (ACR)
+      uses: docker/login-action@v2
+      with:
+        registry: https://registry.us-west-1.aliyuncs.com
+        username: ${{ secrets.ACR_USERNAME }}
+        password: ${{ secrets.ACR_PASSWORD }}
+        
+    - name: Build And Push Docker Image
+      shell: bash
+      run: |
+          set -o xtrace
+          export GO111MODULE=on
+          branch="${GITHUB_REF#refs/heads/}"
+          timestamp=`TZ="Asia/Shanghai" date +"%Y%m%d%H%M%S"`
+          export VERSION="$branch-$timestamp-solo"
+          export GOOS=linux
+          export ARCH=all
+          export REGISTRY=registry.us-west-1.aliyuncs.com/yunion-dev
+          make image webconsole

backend/.github/workflows/issue-check-inactive.yml

@@ -0,0 +1,17 @@
+name: Issue Check Inactive
+
+on:
+  schedule:
+    - cron: "0 0 * * *"
+
+jobs:
+  issue-check-inactive:
+    runs-on: ubuntu-latest
+    steps:
+      - name: check-inactive
+        uses: actions-cool/issues-helper@v2
+        with:
+          actions: 'check-inactive'
+          inactive-label: 'stale'
+          inactive-day: 30
+          exclude-labels: 'announcement'

backend/.github/workflows/issue-close-require.yml

@@ -0,0 +1,20 @@
+name: Issue Close Require
+
+on:
+  schedule:
+    - cron: "0 1 * * *"
+
+jobs:
+  issue-close-require:
+    runs-on: ubuntu-latest
+    steps:
+      - name: need reproduce
+        uses: actions-cool/issues-helper@v2
+        with:
+          actions: 'close-issues'
+          labels: 'stale,state/awaiting user feedback'
+          inactive-day: 7
+          body: |
+            If you do not provide feedback for more than 37 days, we will close the issue and you can either reopen it or submit a new issue.
+
+            您超过 37 天未反馈信息，我们将关闭该 issue，如有需求您可以重新打开或者提交新的 issue。

backend/.github/workflows/issue-close.yml

@@ -0,0 +1,16 @@
+name: Issue Close Check
+
+on:
+  issues:
+    types: [closed]
+
+jobs:
+  issue-closed-remove-labels:
+    runs-on: ubuntu-latest
+    if: "!contains(github.event.issue.labels.*.name, 'stale')"
+    steps:
+      - name: Remove statle labels when issue that hasn't stale label is closed
+        uses: actions-cool/issues-helper@v2
+        with:
+          actions: 'remove-labels'
+          labels: 'state/awaiting processing,state/awaiting user feedback'

backend/.github/workflows/issue-comment.yml

@@ -0,0 +1,38 @@
+on:
+  issue_comment:
+    types: [created]
+
+name: Add issues workflow labels
+
+jobs:
+  add-label-if-is-author:
+    runs-on: ubuntu-latest
+    if: (github.event.issue.user.id == github.event.comment.user.id) && !github.event.issue.pull_request && (github.event.issue.state == 'open')
+    steps:
+      - name: Add require handle label
+        uses: actions-cool/issues-helper@v2
+        with:
+          actions: 'add-labels'
+          labels: 'state/awaiting processing'
+
+      - name: Remove require reply label
+        uses: actions-cool/issues-helper@v2
+        with:
+          actions: 'remove-labels'
+          labels: 'state/awaiting user feedback,stale'
+
+  add-label-if-not-author:
+    runs-on: ubuntu-latest
+    if: (github.event.issue.user.id != github.event.comment.user.id) && !github.event.issue.pull_request && (github.event.issue.state == 'open') && (!contains(github.event.comment.body, '/keep-state'))
+    steps:
+      - name: Add require replay label
+        uses: actions-cool/issues-helper@v2
+        with:
+          actions: 'add-labels'
+          labels: 'state/awaiting user feedback'
+
+      - name: Remove require handle label
+        uses: actions-cool/issues-helper@v2
+        with:
+          actions: 'remove-labels'
+          labels: 'state/awaiting processing,stale'

backend/.github/workflows/issue-notify.yml

@@ -0,0 +1,17 @@
+on:
+  issue_comment:
+    types: [created]
+
+jobs:
+  notify-author-comment:
+    runs-on: ubuntu-latest
+    if: (github.event.issue.user.id == github.event.comment.user.id) && !github.event.issue.pull_request
+    # find context from: https://docs.github.com/en/webhooks/webhook-events-and-payloads#issue_comment
+    steps:
+      - name: feishu notify
+        uses: zexi/action-issues-notify@v1
+        with:
+          url: ${{ secrets.FEISHU_BOT_WEBHOOK_URL }}
+          issue_title: "${{ github.event.comment.user.login }} 回复了 issue: ${{ github.event.issue.title }}"
+          issue_body: "${{ tojson(github.event.comment.body) }}"
+          issue_link_url: "${{github.event.comment.html_url}}"

backend/.github/workflows/issue-open.yml

@@ -0,0 +1,33 @@
+name: Issue Open Check
+
+on:
+  issues:
+    types: [opened, reopened]
+
+jobs:
+  issue-open-add-labels:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Add labels
+        uses: actions-cool/issues-helper@v2
+        if: ${{ !github.event.comment.pull_request.pull_request }}
+        with:
+          actions: 'add-labels'
+          labels: 'state/awaiting processing'
+
+      - name: Remove require reply label
+        uses: actions-cool/issues-helper@v2
+        with:
+          actions: 'remove-labels'
+          labels: 'state/awaiting user feedback,stale'
+
+  notify-author-comment:
+    runs-on: ubuntu-latest
+    steps:
+      - name: feishu notify
+        uses: zexi/action-issues-notify@v1
+        with:
+          url: ${{ secrets.FEISHU_BOT_WEBHOOK_URL }}
+          issue_title: "${{ github.event.issue.user.login }} 提交了 issue: ${{ github.event.issue.title }}"
+          issue_body: "${{ tojson(github.event.issue.body) }}"
+          issue_link_url: "${{github.event.issue.html_url}}"

backend/.gitignore

@@ -0,0 +1,45 @@
+# ---> Go
+# Compiled Object files, Static and Dynamic libs (Shared Objects)
+*.o
+*.a
+*.so
+*.swp
+
+# Folders
+_obj
+_test
+
+.VERSION
+.DS_Store
+# Architecture specific extensions/prefixes
+*.[568vq]
+[568vq].out
+
+*.cgo1.go
+*.cgo2.c
+_cgo_defun.c
+_cgo_gotypes.go
+_cgo_export.*
+
+_testmain.go
+
+*.exe
+*.test
+*.prof
+_output
+/relay
+/structargtest
+.idea
+.vscode
+intellij.yaml
+GPATH
+GRTAGS
+GTAGS
+pkg/generated
+
+*.orig
+
+# gotext extracted
+out.gotext.json
+
+pkg/notify/sender/email_test.go

backend/.travis.yml

@@ -0,0 +1,29 @@
+sudo: false
+
+dist: bionic
+
+addons:
+  apt:
+    sources:
+      - sourceline: "deb https://download.ceph.com/debian-luminous/ bionic main"
+        key_url: "https://download.ceph.com/keys/release.asc"
+    packages:
+      - build-essential
+      - libcephfs-dev
+      - librbd-dev
+      - librados-dev
+
+language: go
+go:
+  - 1.14.x
+go_import_path: yunion.io/x/onecloud
+cache:
+  directories:
+    - $HOME/.cache/go-build
+
+git:
+  depth: 8
+
+script:
+  - make -j$(nproc) ONECLOUD_CI_BUILD=1
+  - ls -lh _output/bin

backend/CODE_OF_CONDUCT.md

@@ -0,0 +1,128 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+We as members, contributors, and leaders pledge to make participation in our
+community a harassment-free experience for everyone, regardless of age, body
+size, visible or invisible disability, ethnicity, sex characteristics, gender
+identity and expression, level of experience, education, socio-economic status,
+nationality, personal appearance, race, religion, or sexual identity
+and orientation.
+
+We pledge to act and interact in ways that contribute to an open, welcoming,
+diverse, inclusive, and healthy community.
+
+## Our Standards
+
+Examples of behavior that contributes to a positive environment for our
+community include:
+
+* Demonstrating empathy and kindness toward other people
+* Being respectful of differing opinions, viewpoints, and experiences
+* Giving and gracefully accepting constructive feedback
+* Accepting responsibility and apologizing to those affected by our mistakes,
+  and learning from the experience
+* Focusing on what is best not just for us as individuals, but for the
+  overall community
+
+Examples of unacceptable behavior include:
+
+* The use of sexualized language or imagery, and sexual attention or
+  advances of any kind
+* Trolling, insulting or derogatory comments, and personal or political attacks
+* Public or private harassment
+* Publishing others' private information, such as a physical or email
+  address, without their explicit permission
+* Other conduct which could reasonably be considered inappropriate in a
+  professional setting
+
+## Enforcement Responsibilities
+
+Community leaders are responsible for clarifying and enforcing our standards of
+acceptable behavior and will take appropriate and fair corrective action in
+response to any behavior that they deem inappropriate, threatening, offensive,
+or harmful.
+
+Community leaders have the right and responsibility to remove, edit, or reject
+comments, commits, code, wiki edits, issues, and other contributions that are
+not aligned to this Code of Conduct, and will communicate reasons for moderation
+decisions when appropriate.
+
+## Scope
+
+This Code of Conduct applies within all community spaces, and also applies when
+an individual is officially representing the community in public spaces.
+Examples of representing our community include using an official e-mail address,
+posting via an official social media account, or acting as an appointed
+representative at an online or offline event.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported to the community leaders responsible for enforcement at
+abuse@cloudpods.org.
+All complaints will be reviewed and investigated promptly and fairly.
+
+All community leaders are obligated to respect the privacy and security of the
+reporter of any incident.
+
+## Enforcement Guidelines
+
+Community leaders will follow these Community Impact Guidelines in determining
+the consequences for any action they deem in violation of this Code of Conduct:
+
+### 1. Correction
+
+**Community Impact**: Use of inappropriate language or other behavior deemed
+unprofessional or unwelcome in the community.
+
+**Consequence**: A private, written warning from community leaders, providing
+clarity around the nature of the violation and an explanation of why the
+behavior was inappropriate. A public apology may be requested.
+
+### 2. Warning
+
+**Community Impact**: A violation through a single incident or series
+of actions.
+
+**Consequence**: A warning with consequences for continued behavior. No
+interaction with the people involved, including unsolicited interaction with
+those enforcing the Code of Conduct, for a specified period of time. This
+includes avoiding interactions in community spaces as well as external channels
+like social media. Violating these terms may lead to a temporary or
+permanent ban.
+
+### 3. Temporary Ban
+
+**Community Impact**: A serious violation of community standards, including
+sustained inappropriate behavior.
+
+**Consequence**: A temporary ban from any sort of interaction or public
+communication with the community for a specified period of time. No public or
+private interaction with the people involved, including unsolicited interaction
+with those enforcing the Code of Conduct, is allowed during this period.
+Violating these terms may lead to a permanent ban.
+
+### 4. Permanent Ban
+
+**Community Impact**: Demonstrating a pattern of violation of community
+standards, including sustained inappropriate behavior,  harassment of an
+individual, or aggression toward or disparagement of classes of individuals.
+
+**Consequence**: A permanent ban from any sort of public interaction within
+the community.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage],
+version 2.0, available at
+https://www.contributor-covenant.org/version/2/0/code_of_conduct.html.
+
+Community Impact Guidelines were inspired by [Mozilla's code of conduct
+enforcement ladder](https://github.com/mozilla/diversity).
+
+[homepage]: https://www.contributor-covenant.org
+
+For answers to common questions about this code of conduct, see the FAQ at
+https://www.contributor-covenant.org/faq. Translations are available at
+https://www.contributor-covenant.org/translations.

backend/CONTRIBUTING.md

@@ -0,0 +1,51 @@
+# Contribution Guide
+
+[English](CONTRIBUTING.md) | [中文](CONTRIBUTING_zh.md)
+
+You can help to make Cloudpods better! There are many things you can do:
+
+## Help others know Cloudpods
+
+First of all, the easiest way to contribute to Cloudpods is to let more people know Cloudpods. To share your experience of Cloudpods. Hopefully Cloudpods may help resolve the issues in their daily jobs.
+
+## Report Bugs
+
+Cloudpods is an infrastructure management tool. Even though it has been thourougly tested and codes have been peer reviwed before merge, due to its complexity, you may still encounter bugs when using Cloudpods. This is frustrating. However, please do not hesitate to submit a issue at Github. The issue may help developers to improve the codes and make Cloudpods more and more robust. Meanwhile, the answer to the issues may also help others who have the similar bugs.
+
+## Answer issues
+
+You may answer issues at Github and help those who encounter issues when using Cloudpods. Sometimes, the issues are not due to bugs in codes but simplely because of misconfigurations, environment or misunderstandings.
+
+## Contribute codes
+
+You are welcome to contribute codes to Cloudpods. Please refers to [CONTRIBUTING](https://www.cloudpods.org/en/docs/development/contrib/) for more details on how to contribute codes to Cloudpods.
+
+### Fix Issues
+
+You may help solve bugs by submiting patches.
+
+
+### New Features
+
+You may help improve the codes of Cloudpods, including:
+
+* Develop new [features for Cloudpods](https://github.com/yunionio/cloudpods/issues?q=is%3Aopen+is%3Aissue+label%3Afeature).
+* Recode some part of Cloudpods so as to make the code easier to be understood, or less error-prone, or more efficient.
+
+## Documentation
+
+You may help improve documentations of Cloudpds by directly make pull request to documentations. Once the Pull Request is accepted and merged, the documentations will be updated immediately.
+
+## Translation
+
+You may help translate the UI texts or documents of Cloudpds to other languages. Currently, we support Simplified Chinese and English.
+
+## Write articles
+
+You are also welcome to write articles about Cloudpods and sharing your experience with others. The content of the articles may include the following but not be limited to:
+* Your user experiences with Cloudpods
+* Your opinion about the direction and area of Cloudpods
+* Comparison with other cloud platforms
+* Benchmarks
+
+

backend/CONTRIBUTING_zh.md

@@ -0,0 +1,48 @@
+# 贡献指南
+
+[English](CONTRIBUTING.md) | [中文](CONTRIBUTING_zh.md)
+
+如果您对Cloudpods感兴趣并且愿意为Cloudpods贡献，可以通过以下任意方式贡献您的力量，使得Cloudpods变得更完善。
+
+## 让别人知道Cloudpods
+
+最简单的方式就是让更多的人知道Cloudpods，向他们分享您对Cloudpds的看法和使用经验，向他们推荐Cloudpods。很有可能，在您的推荐下，他们开始使用Cloudpods，并解决了他们在工作中遇到的基础设施管理问题。
+
+## 报告BUG
+
+Cloudpods是一款开源的基础设施管理工具软件，运行场景复杂。尽管在开发阶段开发者很有可能已经进行了详尽的测试，但难免在实际运行中还会遇到各种意想不到的bug。遇到这种情况，请不要犹豫在Github上提交一个issue。这能帮助开发者更好地改进代码逻辑，使得Cloudpods越来越鲁棒。同时，issue的解答记录也能帮助到遇到类似问题的其他人。
+
+## 回答问题
+
+有时候，人们在使用Cloudpods中遇到的问题并不是因为Cloudpods软件缺陷造成的，而是因为配置错误，环境因素或者误会导致的。这样的问题也许只需要简单地一两句就能解答，不需要代码的修改。您可以在Github回答issue或者社区群中回答提问，帮助那些在使用Cloudpods中遇到问题的人。
+
+## 贡献代码
+
+我们非常欢迎和感谢开发者向项目提交代码PR，流程细节请查看 [CONTRIBUTING](https://www.cloudpods.org/docs/development/contrib/).
+
+### 修复BUG
+
+您可以通过提交代码补丁来修复Cloudpods存在的BUG。
+
+### 开发新的功能特性
+
+不仅仅是修复BUG，您也可以通过提交代码以改进Cloudpods，包括但不限于：
+* 开发新的功能特性，您可以在[feature issues](https://github.com/yunionio/cloudpods/issues?q=is%3Aopen+is%3Aissue+label%3Afeature)查找需要的功能。
+* 重构代码，使得代码更加简洁易读，更加低健壮，或者执行起来更加高效。
+
+## 文档
+
+您也可以通过给文档提交PR来改进Cloudpods的文档。一旦您的PR被接收并合并，Cloudpods的在线文档就能及时地自动更新。
+
+## 翻译
+
+您也可以帮助翻译Cloudpods，要么翻译UI界面的i18n配置文件，要么翻译文档，使得Cloudpods支持更多的语言。目前，Cloudpods支持简体中文和英文。
+
+## 写文章
+
+另外，欢迎您写关于Cloudpods的文章，通过文字分享您使用Cloudpods的经验和技巧。文章可以包括但不限于如下内容：
+* 使用Cloudpods的体验
+* Cloudpods技术领域的观点
+* 和其他竞品的比较
+* 性能评测
+

backend/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

backend/Makefile

@@ -0,0 +1,332 @@
+#####################################################
+
+REPO_PREFIX := yunion.io/x/onecloud
+VERSION_PKG := yunion.io/x/pkg/util/version
+ROOT_DIR := $(CURDIR)
+BUILD_DIR := $(ROOT_DIR)/_output
+BIN_DIR := $(BUILD_DIR)/bin
+BUILD_SCRIPT := $(ROOT_DIR)/build/build.sh
+DEB_BUILD_SCRIPT := $(ROOT_DIR)/build/build_deb.sh
+
+ifeq ($(ONECLOUD_CI_BUILD),)
+	GIT_COMMIT := $(shell git rev-parse --short HEAD)
+	GIT_BRANCH := $(shell git branch -r --contains | head -1 | sed -E -e "s%(HEAD ->|origin|upstream)/?%%g" | xargs)
+	GIT_VERSION := $(shell git describe --always --tags --abbrev=14 $(GIT_COMMIT)^{commit})
+	GIT_TREE_STATE := $(shell s=`git status --porcelain 2>/dev/null`; if [ -z "$$s" ]; then echo "clean"; else echo "dirty"; fi)
+	BUILD_DATE := $(shell date -u +'%Y-%m-%dT%H:%M:%SZ')
+else
+	GIT_COMMIT:=x
+	GIT_BRANCH:=x
+	GIT_VERSION:=x
+	BUILD_TREE_STATE:=clean
+	BUILD_DATE=2099-07-01T07:11:09Z
+endif
+
+LDFLAGS := "-w \
+	-X $(VERSION_PKG).gitVersion=$(GIT_VERSION) \
+	-X $(VERSION_PKG).gitCommit=$(GIT_COMMIT) \
+	-X $(VERSION_PKG).gitBranch=$(GIT_BRANCH) \
+	-X $(VERSION_PKG).buildDate=$(BUILD_DATE) \
+	-X $(VERSION_PKG).gitTreeState=$(GIT_TREE_STATE) \
+	-X $(VERSION_PKG).gitMajor=0 \
+	-X $(VERSION_PKG).gitMinor=0"
+
+
+#####################################################
+ifneq ($(DLV),)
+	GO_BUILD_FLAGS += -gcflags "all=-N -l"
+	LDFLAGS = ""
+endif
+GO_BUILD_FLAGS+=-mod vendor -ldflags $(LDFLAGS)
+GO_BUILD := go build $(GO_BUILD_FLAGS)
+GO_INSTALL := go install -ldflags $(LDFLAGS)
+GO_TEST := go test
+
+PKGS := go list ./...
+
+CGO_CFLAGS_ENV = $(shell go env CGO_CFLAGS)
+CGO_LDFLAGS_ENV = $(shell go env CGO_LDFLAGS)
+
+export GOOS ?= linux
+export GO111MODULE:=on
+export CGO_CFLAGS = ${X_CGO_CFLAGS}
+export CGO_LDFLAGS = ${X_CGO_LDFLAGS}
+
+UNAME := $(shell uname)
+
+ifeq ($(UNAME), Linux)
+XARGS_FLAGS = --no-run-if-empty
+endif
+
+cmdTargets:=$(wildcard cmd/*)
+rpmTargets:=$(foreach b,$(patsubst cmd/%,%,$(cmdTargets)),$(if $(shell [ -f "$(CURDIR)/build/$(b)/vars" ] && echo 1),rpm/$(b)))
+debTargets:=$(foreach b,$(patsubst cmd/%,%,$(cmdTargets)),$(if $(shell [ -f "$(CURDIR)/build/$(b)/vars" ] && echo 1),deb/$(b)))
+
+all: build
+
+
+install: prepare_dir
+	@for PKG in $$( $(PKGS) | grep -w "$(filter-out $@,$(MAKECMDGOALS))" ); do \
+		echo $$PKG; \
+		$(GO_INSTALL) $$PKG; \
+	done
+
+
+gencopyright:
+	@bash scripts/gencopyright.sh pkg cmd
+
+test:
+	@go test $(GO_BUILD_FLAGS) $(shell go list ./... | egrep -v 'host-image|hostimage|torrent')
+
+vet:
+	go vet ./...
+
+# cmd/esxi-agent: prepare_dir
+# 	CGO_ENABLED=0 $(GO_BUILD) -o $(BIN_DIR)/$(shell basename $@) $(REPO_PREFIX)/$@
+
+cmd/%: prepare_dir
+	CGO_ENABLED=0 $(GO_BUILD) -o $(BIN_DIR)/$(shell basename $@) $(REPO_PREFIX)/$@
+
+rpm/%: cmd/%
+	$(BUILD_SCRIPT) $*
+
+deb/%: cmd/%
+	$(DEB_BUILD_SCRIPT) $*
+
+pkg/%: prepare_dir
+	$(GO_INSTALL) $(REPO_PREFIX)/$@
+
+build:
+	$(MAKE) $(cmdTargets)
+
+rpm:
+	$(MAKE) $(rpmTargets)
+
+deb:
+	$(MAKE) $(debTargets)
+
+rpmclean:
+	rm -fr $(BUILD_DIR)/rpms
+
+prepare_dir: bin_dir
+
+
+bin_dir: output_dir
+	@mkdir -p $(BUILD_DIR)/bin
+
+
+output_dir:
+	@mkdir -p $(BUILD_DIR)
+
+
+.PHONY: all build prepare_dir clean rpm
+
+
+clean:
+	@rm -fr $(BUILD_DIR)
+
+
+fmt:
+	@git ls-files --exclude '*' '*.go' \
+		| grep -v '^vendor/' \
+		| while read f; do \
+			if ! grep -m1 -q '^// Code generated .* DO NOT EDIT\.$$' "$$f"; then \
+				echo "$$f"; \
+			fi ; \
+		done \
+		| xargs $(XARGS_FLAGS) gofmt -w
+
+fmt-check: fmt
+	@if git status --short | grep -E '^.M .*/[^.]+.go'; then \
+		git diff | cat; \
+		echo "$@: working tree modified (possibly by gofmt)" >&2 ; \
+		false ; \
+	fi
+.PHONY: fmt fmt-check
+
+gendocgo:
+	@sh build/gendoc.sh
+
+adddocgo:
+	@git ls-files --others '*/doc.go' | xargs $(XARGS_FLAGS) -- git add
+
+gendocgo-check: gendocgo
+	@n="$$(git ls-files --others '*/doc.go' | wc -l)"; \
+	if test "$$n" -gt 0; then \
+		git ls-files --others '*/doc.go' | sed -e 's/^/  /'; \
+		echo "$@: untracked doc.go file(s) exist in working directory" >&2 ; \
+		false ; \
+	fi
+.PHONY: gendocgo adddocgo gendocgo-check
+
+goimports-check:
+	@goimports -w -local "yunion.io/x/:yunion.io/x/onecloud" pkg cmd; \
+	if git status --short | grep -E '^.M .*/[^.]+.go'; then \
+		git diff | cat; \
+		echo "$@: working tree modified (possibly by goimports)" >&2 ; \
+		echo "$@: " >&2 ; \
+		echo "$@: import spec should be grouped in order: std, 3rd-party, yunion.io/x, yunion.io/x/onecloud" >&2 ; \
+		echo "$@: goimports should be installed by: \
+		echo "$@: git clone --depth 4 https://github.com/yunionio/tools && cd tools && go install ./cmd/goimports ; \
+		false ; \
+	fi
+.PHONY: goimports-check
+
+vet-check:
+	./scripts/vet.sh gen
+	./scripts/vet.sh chk
+.PHONY: vet-check
+
+comma:=,
+space:=$(space) $(space)
+# NOTE: keep y18n-packages in alphabetical order
+y18n-src-lang := en-US
+y18n-lang     := en-US,zh-CN
+y18n-packages := \
+		yunion.io/x/onecloud/cmd/apigateway \
+		yunion.io/x/onecloud/cmd/keystone \
+		yunion.io/x/onecloud/cmd/monitor \
+		yunion.io/x/onecloud/cmd/region \
+		yunion.io/x/onecloud/cmd/yunionconf \
+
+define y18n-gen
+	set -o errexit; \
+	set -o pipefail; \
+	export GO111MODULE=off; \
+	y18n \
+		-chdir $(CURDIR) \
+		-dir ./locales/ \
+		-out ./locales/locales.go \
+		-lang $(y18n-lang) \
+		$(y18n-packages) \
+		; \
+	$(foreach lang,$(filter-out $(y18n-src-lang),$(subst $(comma), ,$(y18n-lang))),cp ./locales/$(lang)/{out,messages}.gotext.json;) \
+
+endef
+
+y18n-gen:
+	$(y18n-gen)
+	$(y18n-gen)
+
+.PHONY: y18n-gen
+
+y18n-check:
+	$(y18n-gen)
+	if git status --short ./locales | sed 's/^/$@: /' | grep .; then \
+		echo "$@: Locales content needs care" >&2 ; \
+		false; \
+	fi
+
+.PHONY: y18n-check
+
+define hostdeployer-grpc-gen
+	set -o errexit; \
+	set -o pipefail; \
+	protoc -I pkg/hostman/hostdeployer/apis \
+		--go_out=pkg/hostman/hostdeployer/apis \
+		--go_opt=paths=source_relative \
+		--go-grpc_out=pkg/hostman/hostdeployer/apis \
+		--go-grpc_opt=paths=source_relative \
+		pkg/hostman/hostdeployer/apis/deploy.proto
+
+endef
+
+hostdeployer-grpc-gen:
+	$(hostdeployer-grpc-gen)
+
+check: fmt-check
+check: gendocgo-check
+#check: goimports-check
+#check: vet-check
+#check: y18n-check
+.PHONY: check
+
+
+define depDeprecated
+OneCloud now requires using go-mod for dependency management.  dep target,
+vendor files will be removed in future versions
+
+Follow the following link to find out more about go-mod
+
+ - https://blog.golang.org/using-go-modules
+ - https://github.com/golang/go/wiki/Modules
+
+Switching to "make mod"...
+
+endef
+
+dep: export depDeprecated:=$(depDeprecated)
+dep:
+	@echo "$$depDeprecated"
+	@$(MAKE) mod
+
+RELEASE_BRANCH:=master
+GOPROXY ?= direct
+
+mod:
+	GOPROXY=$(GOPROXY) GONOSUMDB=yunion.io/x go get yunion.io/x/cloudmux@$(RELEASE_BRANCH)
+	GOPROXY=$(GOPROXY) GONOSUMDB=yunion.io/x go get $(patsubst %,%@master,$(shell GO111MODULE=on go mod edit -print  | sed -n -e 's|.*\(yunion.io/x/[a-z].*\) v.*|\1|p' | grep -v '/cloudmux$$'))
+	GOPROXY=$(GOPROXY) GONOSUMDB=yunion.io/x go mod tidy
+	GOPROXY=$(GOPROXY) GONOSUMDB=yunion.io/x go mod vendor -v
+
+define helpText
+Build with docker
+
+	make docker-alpine-build F='-j4'
+	make docker-alpine-build F='-j4 cmd/host cmd/host-deployer'
+	make docker-alpine-build-stop
+
+Tidy up go modules and vendor directory
+
+	make mod
+endef
+
+help: export helpText:=$(helpText)
+help:
+	@echo "$$helpText"
+
+.PHONY: help
+
+gen-model-api-check:
+	which model-api-gen || (GO111MODULE=off go get -u yunion.io/x/code-generator/cmd/model-api-gen)
+
+gen-model-api: gen-model-api-check
+	$(ROOT_DIR)/scripts/codegen.py model-api
+
+gen-swagger-check:
+	which swagger || (GO111MODULE=off go get -u github.com/go-swagger/go-swagger/cmd/swagger)
+	which swagger-gen || (GO111MODULE=off go get -u yunion.io/x/code-generator/cmd/swagger-gen)
+	which swagger-serve || (GO111MODULE=off go get -u yunion.io/x/code-generator/cmd/swagger-serve)
+
+gen-swagger: gen-swagger-check
+	$(ROOT_DIR)/scripts/codegen.py swagger-code
+	$(ROOT_DIR)/scripts/codegen.py swagger-yaml
+
+swagger-serve-only:
+	$(ROOT_DIR)/scripts/codegen.py swagger-serve
+
+swagger-serve: gen-model-api gen-swagger swagger-serve-only
+
+swagger-site: gen-model-api gen-swagger
+	$(ROOT_DIR)/scripts/codegen.py swagger-site
+
+.PHONY: gen-model-api-check gen-model-api gen-swagger-check gen-swagger swagger-serve swagger-site
+
+REGISTRY ?= "registry.cn-beijing.aliyuncs.com/yunionio"
+VERSION ?= $(shell git describe --exact-match 2> /dev/null || \
+                git describe --match=$(git rev-parse --short=8 HEAD) --always --dirty --abbrev=8)
+
+image:
+	mkdir -p $(ROOT_DIR)/_output
+	DEBUG=$(DEBUG) ARCH=$(ARCH) TAG=$(VERSION) REGISTRY=$(REGISTRY) $(ROOT_DIR)/scripts/docker_push.sh $(filter-out $@,$(MAKECMDGOALS))
+
+.PHONY: image
+
+image-telegraf-raid-plugin:
+	VERSION=v4.0-20260115.0 GOOS=linux ARCH=all make image telegraf-raid-plugin
+
+%:
+	@:
+
+ModName:=yunion.io/x/onecloud
+include $(CURDIR)/Makefile.common.mk

backend/Makefile.common.mk

@@ -0,0 +1,66 @@
+ifeq ($(__inc_Makefile_common_mk),)
+__inc_Makefile_common_mk:=1
+
+ifeq ($(ModName),)
+  $(error ModName must be set, e.g. yunion.io/x/onecloud)
+endif
+
+ModBaseName:=$(notdir $(ModName))
+
+DockerImageRegistry?=registry.cn-beijing.aliyuncs.com
+DockerImageAlpineBuild?=$(DockerImageRegistry)/yunionio/alpine-build:3.22.2-go-1.24.9-0
+
+EnvIf=$(if $($(1)),$(1)=$($(1)))
+
+define dockerCentOSBuildCmd
+set -o xtrace
+set -o errexit
+set -o pipefail
+git config --global --add safe.directory /root/go/src/yunion.io/x/$(ModBaseName)
+cd /root/go/src/yunion.io/x/$(ModBaseName)
+env \
+	$(call EnvIf,GOARCH) \
+	$(call EnvIf,GOOS) \
+	$(call EnvIf,CGO_ENABLED) \
+	make $(1)
+chown -R $(shell id -u):$(shell id -g) _output
+endef
+
+tmpName=$(ModBaseName)-$(shell date +"%Y%m%d.%H%M%S%3N")
+
+
+define dockerAlpineBuildCmd
+set -o xtrace
+set -o errexit
+set -o pipefail
+git config --global --add safe.directory /root/go/src/yunion.io/x/$(ModBaseName)
+cd /root/go/src/yunion.io/x/$(ModBaseName)
+git config --global --add safe.directory /root/go/src/yunion.io/x/onecloud
+env \
+	$(call EnvIf,GOARCH) \
+	$(call EnvIf,GOOS) \
+	$(call EnvIf,CGO_ENABLED) \
+	make $(1)
+chown -R $(shell id -u):$(shell id -g) _output
+endef
+
+docker-alpine-build: export dockerAlpineBuildCmd:=$(call dockerAlpineBuildCmd,$(F))
+docker-alpine-build:
+	docker rm --force docker-alpine-build-$(tmpName) &>/dev/null || true
+	docker run \
+		--rm \
+		--name docker-alpine-build-$(tmpName) \
+		-v $(CURDIR):/root/go/src/yunion.io/x/$(ModBaseName) \
+		-v $(CURDIR)/_output/alpine-build:/root/go/src/yunion.io/x/$(ModBaseName)/_output \
+		-v $(CURDIR)/_output/alpine-build/_cache:/root/.cache \
+		$(DockerImageAlpineBuild) \
+		/bin/sh -c "$$dockerAlpineBuildCmd"
+	ls -lh _output/alpine-build/bin
+
+docker-alpine-build-stop:
+	docker stop --time 0 docker-alpine-build-$(tmpName) || true
+
+.PHONY: docker-alpine-build
+.PHONY: docker-alpine-build-stop
+
+endif # __inc_Makefile_common_mk

backend/OWNERS

@@ -0,0 +1,6 @@
+# See the OWNERS docs at https://go.k8s.io/owners
+approvers:
+  - swordqiu
+  - Zexi
+  - ioito
+  - wanyaoqi

backend/README-CN.md

@@ -0,0 +1,113 @@
+# Cloudpods
+
+[![CircleCI](https://circleci.com/gh/yunionio/cloudpods.svg?style=svg)](https://circleci.com/gh/yunionio/cloudpods)
+[![Go Report Card](https://goreportcard.com/badge/github.com/yunionio/cloudpods)](https://goreportcard.com/report/github.com/yunionio/cloudpods)
+
+ [简体中文](./README-CN.md) | [English](./README.md)
+
+## Cloudpods是什么?
+
+<img src="https://v1.cloudpods.org/images/cloudpods_logo_green.png" alt="Cloudpods" height="100">
+
+Cloudpods是一个开源的Golang实现的云原生的融合多云/混合云的云平台，也就是一个”云上之云”。Cloudpods不仅可以管理本地的虚拟机和物理机资源，还可以管理多个云平台和云账号。Cloudpods隐藏了这些异构基础设施资源的数据模型和API的差异，对外暴露了一套统一的API，允许用户就像用一个云一样地访问多云。从而大大降低了访问多云的复杂度，提升了管理多云的效率。
+
+Cloudpods还提供了 **AI 云**，一个面向大语言模型（LLM）推理与 AI 容器应用的统一管理平台，帮助企业在同一平台完成 AI 工作负载的部署、调度与运维，与 Cloudpods 私有云/多云资源体系无缝集成。
+
+## 谁需要Cloudpods?
+
+* 将几台物理服务器虚拟化成一个私有云平台
+* 需要一个紧凑而且功能相对完整的物理机全生命周期管理工具
+* 将VMware vSphere虚拟化集群转换为一个可以自服务的私有云平台
+* 在混合云的场景，能够在一个界面访问私有云和公有云
+* 通过一个集中的入口访问分布在多个公有云平台上的多个账号
+* 当前只使用一个云公有云账号但希望将来使用多云的用户
+* 需要部署和管理 LLM 推理服务及 AI 容器应用，并需要 GPU 调度支持的用户
+
+## 功能
+
+请访问[产品介绍](https://www.cloudpods.org/docs/introduction/)页面了解详细信息。
+
+### AI 云
+
+* **AI 推理服务**：部署和管理 LLM 推理实例，支持 GPU 调度、模型挂载与推理服务地址分配。
+* **AI 应用管理**：一站式部署 LLM 应用编排、智能体助手、图像生成等 AI 容器应用。
+* **模型库**：统一管理模型来源、版本与缓存，支持多实例复用、离线分发，避免重复下载。
+* **模板与镜像**：通过模板定义 CPU/内存/GPU 等资源规格，通过镜像管理容器运行环境，实现标准化交付。
+* **GPU 运维**：GPU 设备自动探测与注册，支持 NVIDIA/CUDA 环境的统一配置与管理。
+
+支持的 AI 应用：
+* AI 推理：Ollama
+* AI 应用：OpenClaw、Dify、ComfyUI
+
+### 支持的云平台
+
+* 公有云:
+  * AWS
+  * Azure
+  * Google Cloud Platform
+  * 阿里云
+  * 华为云
+  * 腾讯云
+  * UCloud
+  * 天翼云
+  * 移动云
+  * 京东云
+* 私有云:
+  * OpenStack
+  * ZStack
+  * Alibaba Cloud Aspara (阿里飞天)
+  * Huawei HCSO (华为HCSO)
+  * Nutanix
+* 本地基础设施资源:
+  * 基于 KVM 实现的轻量级私有云
+  * VMWare vSphere vCenter/ESXi
+  * Baremetals (IPMI, Redfish API)
+  * Object storages (Minio, Ceph, XSky)
+  * NAS (Ceph)
+
+### 支持的云资源
+
+* Servers: instances, disks, network interfaces, networks, vpcs, storages, hosts, wires, snapshots, snapshot policies, security groups, elastic IPs, SSH keypairs, images
+* Load Balancers: instances, listeners, backend groups, backends, TLS certificates, ACLs
+* Object Storage: buckets, objects
+* NAS: file_systems, access_groups, mount_targets
+* RDS: instances, accounts, backups, databases, parameters, privileges
+* Elastic Cache: instances, accounts, backups, parameters
+* DNS: DNS zones, DNS records
+* VPC: VPCs, VPC peering, inter-VPC network, NAT gateway, DNAT/SNAT rules, route tables, route entries
+
+## 安装部署
+
+请参考文档[安装部署](https://www.cloudpods.org/docs/getting-started/)选择合适的场景部署。
+
+## 文档
+
+* [Cloudpods文档](https://www.cloudpods.org/zh)
+
+* [Swagger API文档](https://www.cloudpods.org/zh/docs/swagger/)
+
+## 谁在使用Cloudpods？
+
+请在[这里](https://github.com/yunionio/cloudpods/issues/11427)查看Cloudpods用户列表。如果你正在使用Cloudpods，欢迎回复留下你的信息。谢谢对Cloudpods的支持！
+
+## 联系我们
+
+* 请查看[联系我们](https://www.cloudpods.org/docs/contact/)。
+
+* TG群: [cloudpods](https://t.me/cloudpods_org)
+
+## 版本历史
+
+请查看[发布日志](https://www.cloudpods.org/docs/release-notes/)和[Changelog](https://www.cloudpods.org/docs/development/changelog/)。
+
+## 贡献
+
+欢迎和感谢任何形式的贡献，不局限于贡献代码，流程细节请查看 [CONTRIBUTING](./CONTRIBUTING_zh.md)。
+
+## License
+
+Apache license 2.0，详情请看 [LICENSE](./LICENSE)。
+
+## AI生成文档
+
+[DeepWiki](https://deepwiki.com/yunionio/cloudpods) 提供了对本项目代码详细和全面的AI解读，可以参考。

backend/README.md

@@ -0,0 +1,115 @@
+# Cloudpods
+
+[![CircleCI](https://circleci.com/gh/yunionio/cloudpods.svg?style=svg)](https://circleci.com/gh/yunionio/cloudpods)
+[![Go Report Card](https://goreportcard.com/badge/github.com/yunionio/cloudpods)](https://goreportcard.com/report/github.com/yunionio/cloudpods)
+
+[English](./README.md) | [简体中文](./README-CN.md)
+
+## What is Cloudpods?
+
+<img src="https://v1.cloudpods.org/images/cloudpods_logo_green.png" alt="Cloudpods" height="100">
+
+Cloudpods is a cloud-native open source unified multi/hybrid-cloud platform developed with Golang, i.e. Cloudpods is *a cloud on clouds*. Cloudpods is able to manage not only on-premise KVM/baremetals, but also resources from many cloud accounts across many cloud providers. It hides the differences of underlying cloud providers and exposes one set of APIs that allow programatically interacting with these many clouds.
+
+Cloudpods also provides **AI Cloud**, a unified management platform for large language model (LLM) inference and AI container applications, helping enterprises deploy, schedule, and operate AI workloads on a single platform, seamlessly integrated with the Cloudpods private cloud / multi-cloud resource ecosystem.
+
+## Who needs Cloudpods?
+
+* Those who need a simple solution to virtualize a few physical servers into a private cloud
+* Those who need a compact and fully automatic baremetal lift-cycle management solution
+* Those who want to turn a VMware vSphere virtualization cluster into a private cloud
+* Those who need a cohesive view of both public and private cloud in a hybrid cloud setup
+* Those who need a centric portal to access multiple acccounts from multiple public clouds
+* Those who is currently using a single cloud account, but will not lose the possibility to adopt multicloud strategy
+* Those who need to deploy and manage LLM inference services and AI container applications with GPU support
+
+## Features
+
+See [Introduction](https://www.cloudpods.org/docs/introduction/) for details.
+
+### AI Cloud
+
+* **AI Inference Services**: Deploy and manage LLM inference instances with GPU scheduling, model mounting, and inference service address allocation.
+* **AI Application Management**: One-stop deployment of LLM application orchestration, agent assistants, image generation, and other AI container applications.
+* **Model Library**: Unified management of model sources, versions, and caches, supporting multi-instance reuse and offline distribution.
+* **Templates and Images**: Define resource specifications (CPU/memory/GPU) through templates, manage container runtime environments through images.
+* **GPU Operations**: Automatic GPU device detection and registration, unified NVIDIA/CUDA environment configuration and management.
+
+Supported AI applications:
+* AI Inference: Ollama
+* AI Applications: OpenClaw, Dify, ComfyUI
+
+### Supported cloud providers
+
+* Public Clouds:
+  * AWS
+  * Azure
+  * Google Cloud Platform
+  * Alibaba Cloud
+  * Huawei Cloud
+  * Tencent Cloud
+  * UCloud
+  * Ctyun (China Telecom)
+  * ECloud (China Mobile)
+  * JDCloud
+* Private Clouds:
+  * OpenStack
+  * ZStack
+  * Alibaba Cloud Aspara
+  * Huawei HCSO
+  * Nutanix
+* On-premise resources:
+  * Lightweight private cloud built on KVM
+  * VMWare vSphere vCenter/ESXi
+  * Baremetals (IPMI, Redfish API)
+  * Object storages (Minio, Ceph, XSky)
+  * NAS (Ceph)
+
+### Supported resources
+
+* Servers: instances, disks, network interfaces, networks, vpcs, storages, hosts, wires, snapshots, snapshot policies, security groups, elastic IPs, SSH keypairs, images
+* Load Balancers: instances, listeners, backend groups, backends, TLS certificates, ACLs
+* Object Storage: buckets, objects
+* NAS: file_systems, access_groups, mount_targets
+* RDS: instances, accounts, backups, databases, parameters, privileges
+* Elastic Cache: instances, accounts, backups, parameters
+* DNS: DNS zones, DNS records
+* VPC: VPCs, VPC peering, inter-VPC network, NAT gateway, DNAT/SNAT rules, route tables, route entries
+
+## Getting started
+
+Please refer to the document [Getting Started](https://www.cloudpods.org/en/docs/getting-started/) to select the appropriate scenario for installation.
+
+## Documentations
+
+* [Cloudpods Documents](https://www.cloudpods.org/en)
+
+* [Swagger API](https://www.cloudpods.org/en/docs/swagger/)
+
+
+## Who is using Cloudpods?
+
+Please check this [issue](https://github.com/yunionio/cloudpods/issues/11427) for the user list of Cloudpods. If you are using Cloudpods, you are welcome to leave your information by responding the issue. Thank you for your support.
+
+## Contact
+
+* See [Contact Us](https://www.cloudpods.org/en/docs/contact/) for details.
+
+* Telegram: [cloudpods](https://t.me/cloudpods_org)
+
+## Changelog
+
+See [Relase Notes](https://www.cloudpods.org/en/docs/release-notes/) and [Changelog](https://www.cloudpods.org/en/docs/development/changelog/) for details.
+
+## Contribution
+
+You are welcome to do any kind of contribution to the project. Please refer to [CONTRIBUTING](./CONTRIBUTING.md) for guidelines.
+
+## License
+
+Apache License 2.0. See [LICENSE](./LICENSE).
+
+## AI-generated doc
+
+[DeepWiki](https://deepwiki.com/yunionio/cloudpods) provides an amazing AI-generated doc of this project, you may refer to it for more detailed and comprehensive understanding of codes.
+

backend/build/aliyuncli/vars

@@ -0,0 +1 @@
+DESCRIPTION="ALIYUN Command Line Utility"

backend/build/ansibleserver/root/etc/yunion/ansibleserver.conf.sample

@@ -0,0 +1,10 @@
+region = 'Yunion'
+address = '10.168.222.136'
+port = 8890
+auth_uri = 'http://10.168.222.136:35357/v3'
+admin_user = 'yunionansible'
+admin_password = 'xxxxxxxxxxxxxxxx'
+admin_tenant_name = 'system'
+sql_connection = 'mysql+pymysql://yunionansible:9YuQL9KEZn1mppaK@localhost:3306/yunionansible?charset=utf8'
+
+auto_sync_table = True

backend/build/ansibleserver/vars

@@ -0,0 +1,5 @@
+DESCRIPTION="Yunion Ansible Controller"
+
+REQUIRES=(
+	"ansible"
+)

backend/build/awscli/vars

@@ -0,0 +1 @@
+DESCRIPTION="AWS Command Line Utility"

backend/build/azurecli/vars

@@ -0,0 +1 @@
+DESCRIPTION="Azure Command Line Utility"

backend/build/baremetal-agent/vars

@@ -0,0 +1,6 @@
+DESCRIPTION="Baremetal Agent Command Line Utility"
+
+REQUIRES=(
+    ipmitool
+    mkisofs
+)

backend/build/build.sh

@@ -0,0 +1,200 @@
+#!/bin/sh
+
+set -e
+
+if [ -z "$ROOT_DIR" ]; then
+	pushd $(dirname $(readlink -f "$BASH_SOURCE")) > /dev/null
+	ROOT_DIR=$(cd .. && pwd)
+	popd > /dev/null
+fi
+
+SRC_BIN=$ROOT_DIR/_output/bin
+SRC_BUILD=$ROOT_DIR/build
+OUTPUT_DIR=$ROOT_DIR/_output/rpms
+
+PKG=$1
+BIN_PATH=${2:-/opt/yunion/bin}
+
+if [ -z "$PKG" ]; then
+    echo "Usage: $0 <package>"
+    exit 1
+fi
+
+BIN="$SRC_BIN/$PKG"
+ROOT="$SRC_BUILD/$PKG"
+
+if [ ! -x "$BIN" ]; then
+    echo "$BIN not exists"
+    exit 1
+fi
+
+if [ ! -x "$ROOT" ]; then
+    echo "$ROOT not exists"
+    exit 1
+fi
+
+. $ROOT/vars
+
+BUILDROOT=$(mktemp -d 2>/dev/null || mktemp -d -t 'yunion')
+function cleanup {
+  rm -rf "$BUILDROOT"
+  echo "Deleted temp working directory $BUILDROOT"
+}
+# register the cleanup function to be called on the EXIT signal
+trap cleanup EXIT
+
+echo "Build root ${BUILDROOT}"
+
+# BRANCH=$(git rev-parse --abbrev-ref HEAD)
+# TAG=$(git describe --exact-match --tags)
+if [ -z "$VERSION" ]; then
+	TAG=$(git describe --abbrev=0 --tags || echo testing)
+	VERSION=${TAG/\//-}
+	if [[ "$VERSION" =~ ^v0. ]]; then
+		VERSION=${VERSION/v0./}
+	elif [[ "$VERSION" =~ ^v ]]; then
+		VERSION=${VERSION/v/}
+	fi
+	VERSION=${VERSION//-/.}
+fi
+RELEASE=`date +"%y%m%d%H"`
+
+SPEC_DIR=$BUILDROOT/SPECS
+SPEC_FILE=$SPEC_DIR/${PKG}.spec
+RPM_DIR=$BUILDROOT/RPMS
+
+if [ -z "$OWNER" ]; then
+	OWNER=yunion
+fi
+
+if [ -z "$SERVICE" ]; then
+    SERVICE="0"
+fi
+
+mkdir -p $SPEC_DIR
+
+echo "# Yunion RPM spec
+
+%global owner   $OWNER
+%global pkgname yunion-$PKG
+%global homedir /var/run/%{owner}
+%global use_systemd $SERVICE
+
+Name: %{pkgname}
+Version: $VERSION
+Release: $RELEASE
+Summary: %{pkgname}
+
+Group: Unspecified
+License: GPL
+URL: https://www.yunion.io/doc
+$(for req in "${REQUIRES[@]}"; do echo Requires: "$req"; done)
+%if %{use_systemd}
+Requires: systemd
+BuildRequires: systemd
+%endif
+
+%description
+$DESCRIPTION
+
+%prep
+
+%build
+
+%install
+install -D -m 0755 $BIN \$RPM_BUILD_ROOT$BIN_PATH/$PKG
+for bin in $EXTRA_BINS; do
+  install -D -m 0755 $SRC_BIN/\$bin \$RPM_BUILD_ROOT$BIN_PATH/\$bin
+done
+if [ -d $ROOT/root ]; then
+  rsync -a $ROOT/root/ \$RPM_BUILD_ROOT
+fi
+
+%pre" > $SPEC_FILE
+
+if [ -f $ROOT/preinst ]; then
+    cat $ROOT/preinst >> $SPEC_FILE
+else
+    echo "
+%if %{use_systemd}
+getent group %{owner} >/dev/null || /usr/sbin/groupadd -r %{owner}
+getent passwd %{owner} >/dev/null || /usr/sbin/useradd -r -s /sbin/nologin -d %{homedir} -M -g %{owner} %{owner}
+%endif
+" >> $SPEC_FILE
+fi
+
+echo "
+%post" >> $SPEC_FILE
+
+if [ -f $ROOT/postinst ]; then
+    cat $ROOT/postinst >> $SPEC_FILE
+else
+    echo "
+%if %{use_systemd}
+    /usr/bin/systemctl preset %{pkgname}.service >/dev/null 2>&1 ||:
+%endif
+" >> $SPEC_FILE
+fi
+
+echo "
+%preun" >> $SPEC_FILE
+
+if [ -f $ROOT/prerm ]; then
+    cat $ROOT/prerm >> $SPEC_FILE
+else
+    echo "
+%if %{use_systemd}
+    /usr/bin/systemctl --no-reload disable %{pkgname}.service >/dev/null 2>&1 || :
+    /usr/bin/systemctl stop %{pkgname}.service >/dev/null 2>&1 ||:
+%endif
+" >> $SPEC_FILE
+fi
+
+echo "
+%postun" >> $SPEC_FILE
+
+if [ -f $ROOT/postrm ]; then
+    cat $ROOT/postrm >> $SPEC_FILE
+else
+    echo "
+%if %{use_systemd}
+    /usr/bin/systemctl daemon-reload >/dev/null 2>&1 ||:
+%endif
+" >> $SPEC_FILE
+fi
+
+echo -n "
+%files
+%doc
+$BIN_PATH/$PKG
+" >> $SPEC_FILE
+
+for b in $EXTRA_BINS; do
+    echo $BIN_PATH/$b >> $SPEC_FILE
+done
+
+if [ -d $ROOT/root/ ]; then
+    find $ROOT/root/ -type f | sed -e "s:$ROOT/root::g" >> $SPEC_FILE
+fi
+
+TARGET=
+case "$GOARCH" in
+    "arm64" | "aarch64" | "arm")
+        TARGET="--target aarch64-redhat-linux"
+        ;;
+    "amd64" | "x86" | "i686" | "i386" | "x86_64")
+        TARGET="--target x86_64-redhat-linux"
+        ;;
+    "riscv64")
+        TARGET="--target riscv64-linux"
+        ;;
+esac
+
+rpmbuild --define "_topdir $BUILDROOT" -bb $SPEC_FILE $TARGET
+
+find $RPM_DIR -type f | while read f; do
+	d="$(dirname "$f")"
+	d="$OUTPUT_DIR/${d#$RPM_DIR}"
+	mkdir -p "$d"
+	cp $f $d
+done

backend/build/build_deb.sh

@@ -0,0 +1,175 @@
+#!/bin/bash
+
+set -e
+
+if [ -z "$ROOT_DIR" ]; then
+	pushd $(dirname $(readlink -f "$BASH_SOURCE")) > /dev/null
+	ROOT_DIR=$(cd .. && pwd)
+	popd > /dev/null
+fi
+
+SRC_BIN=$ROOT_DIR/_output/bin
+SRC_BUILD=$ROOT_DIR/build
+OUTPUT_DIR=$ROOT_DIR/_output/debs
+
+PKG=$1
+BIN_PATH=${2:-/opt/yunion/bin}
+
+if [ -z "$PKG" ]; then
+    echo "Usage: $0 <package>"
+    exit 1
+fi
+
+BIN="$SRC_BIN/$PKG"
+ROOT="$SRC_BUILD/$PKG"
+
+if [ ! -x "$BIN" ]; then
+    echo "$BIN not exists"
+    exit 1
+fi
+
+if [ ! -x "$ROOT" ]; then
+    echo "$ROOT not exists"
+    exit 1
+fi
+
+. $ROOT/vars
+
+case $(uname -m) in
+    x86_64)
+        CURRENT_ARCH=amd64
+        ;;
+    aarch64)
+        CURRENT_ARCH=arm64
+        ;;
+    riscv64)
+        CURRENT_ARCH=riscv64
+        ;;
+esac
+
+if [[ -n "$GOARCH" ]]; then
+    case "$GOARCH" in
+        "arm64" | "arm" | "aarch64")
+            CURRENT_ARCH="arm64"
+            ;;
+        "x86" | "x86_64" | "i686" | "i386" | "amd64")
+            CURRENT_ARCH="amd64"
+            ;;
+        "riscv64")
+            CURRENT_ARCH="riscv64"
+            ;;
+	esac
+fi
+
+if [ -z "$VERSION" ]; then
+    TAG=$(git describe --abbrev=0 --tags || echo 000000)
+    VERSION=${TAG/\//-}
+    VERSION=${VERSION/v/}
+    VERSION=${VERSION/master-/}
+fi
+RELEASE=`date +"%y%m%d%H"`
+FULL_VERSION=$VERSION-$RELEASE
+BUILDROOT=$OUTPUT_DIR/yunion-${PKG}-${FULL_VERSION}_${CURRENT_ARCH}
+function cleanup {
+  rm -rf "$BUILDROOT"
+  echo "Deleted temp working directory $BUILDROOT"
+}
+# register the cleanup function to be called on the EXIT signal
+trap cleanup EXIT
+
+rm -rf $BUILDROOT
+mkdir -p $BUILDROOT/DEBIAN
+mkdir -p $BUILDROOT/$BIN_PATH
+
+cp -rf $BIN $BUILDROOT/$BIN_PATH
+if [ -d $ROOT/root ]; then
+    cp -rf $ROOT/root/* $BUILDROOT/
+fi
+
+echo "Build root ${BUILDROOT}"
+
+echo "Package: yunion-$PKG
+Version: $FULL_VERSION
+Section: base
+Priority: optional
+Architecture: $CURRENT_ARCH
+Maintainer: wanyaoqi@yunionyun.com
+Description: $DESCRIPTION" > $BUILDROOT/DEBIAN/control
+if [ ${#REQUIRES[@]} -gt 0 ]; then
+    DEPS=$(IFS=, ; echo "${REQUIRES[*]}")
+    echo "Depends: $DEPS" >> $BUILDROOT/DEBIAN/control
+fi
+chmod 0755 $BUILDROOT/DEBIAN/control
+
+cat $BUILDROOT/DEBIAN/control
+
+echo "#!/bin/bash
+" > $BUILDROOT/DEBIAN/preinst
+if [ -f $ROOT/preinst ]; then
+    cat $ROOT/preinst >> $BUILDROOT/DEBIAN/preinst
+else
+    if [ "$SERVICE" == "yes" ] && [ -n "$OWNER" ]; then
+        echo "
+getent group ${OWNER} >/dev/null || /usr/sbin/groupadd -r ${OWNER}
+getent passwd ${OWNER} >/dev/null || /usr/sbin/useradd -r -s /sbin/nologin -d /home/${OWNER} -M -g ${OWNER} ${OWNER}
+" >> $BUILDROOT/DEBIAN/preinst
+    fi
+fi
+chmod 0755 $BUILDROOT/DEBIAN/preinst
+
+echo "#!/bin/bash
+" > $BUILDROOT/DEBIAN/postinst
+if [ -f $ROOT/postinst ]; then
+    cat $ROOT/postinst >> $BUILDROOT/DEBIAN/postinst
+else
+    if [ "$SERVICE" == "yes" ]; then
+        echo "
+/usr/bin/systemctl preset yunion-${PKG}.service >/dev/null 2>&1 ||:
+" >> $BUILDROOT/DEBIAN/postinst
+    fi
+fi
+chmod 0755 $BUILDROOT/DEBIAN/postinst
+
+echo "#!/bin/bash
+" > $BUILDROOT/DEBIAN/prerm
+if [ -f $ROOT/prerm ]; then
+    cat $ROOT/prerm >> $BUILDROOT/DEBIAN/prerm
+else
+    if [ "$SERVICE" == "yes" ]; then
+        echo "
+/usr/bin/systemctl --no-reload disable yunion-${PKG}.service >/dev/null 2>&1 || :
+/usr/bin/systemctl stop yunion-${PKG}.service >/dev/null 2>&1 ||:
+" >> $BUILDROOT/DEBIAN/prerm
+    fi
+fi
+chmod 0755 $BUILDROOT/DEBIAN/prerm
+
+echo "#!/bin/bash
+" > $BUILDROOT/DEBIAN/postrm
+if [ -f $ROOT/postrm ]; then
+    cat $ROOT/postrm >> $BUILDROOT/DEBIAN/postrm
+else
+    if [ "$SERVICE" == "yes" ]; then
+        echo "
+/usr/bin/systemctl daemon-reload >/dev/null 2>&1 ||:
+" >> $BUILDROOT/DEBIAN/postrm
+    fi
+fi
+chmod 0755 $BUILDROOT/DEBIAN/postrm
+
+dpkg-deb --build $BUILDROOT
+
+case "$CURRENT_ARCH" in
+    "amd64")
+        DSTARCH="x86_64"
+        ;;
+    "arm64")
+        DSTARCH="aarch64"
+        ;;
+    "riscv64")
+        DSTARCH="riscv64"
+        ;;
+esac
+
+mkdir -p ${OUTPUT_DIR}/${DSTARCH}
+mv ${BUILDROOT}.deb ${OUTPUT_DIR}/${DSTARCH}/

backend/build/climc/root/opt/climc-entrypoint.sh

@@ -0,0 +1,19 @@
+#!/bin/bash
+
+set -e
+
+BASHRC=/etc/profile.d/climc.sh
+
+grep -q rcadmin $BASHRC || echo 'source /etc/yunion/rcadmin' >> $BASHRC
+
+source $BASHRC
+
+climc sshkeypair-inject --admin --target-dir /root/
+
+mkdir -p /etc/dropbear
+
+mkdir -p /var/run/dropbear
+
+test -f /etc/dropbear/dropbear_rsa_host_key || dropbearkey -t rsa -f /etc/dropbear/dropbear_rsa_host_key
+
+dropbear -RFEjk -G root -p 22

backend/build/climc/root/opt/yunion/scripts/motd/climc.sh

@@ -0,0 +1,22 @@
+export PATH=/opt/yunion/bin:$PATH
+
+if [ -f /etc/profile.d/bash_completion.sh ]; then
+    source /etc/profile.d/bash_completion.sh
+fi
+
+test -f /etc/yunion/rcadmin && source /etc/yunion/rcadmin
+
+if [ -n "$OS_AUTH_TOKEN" ]; then
+    test -n "$OS_USERNAME" && unset OS_USERNAME
+    test -n "$OS_PASSWORD" && unset OS_PASSWORD
+    test -n "$OS_DOMAIN_NAME" && unset OS_DOMAIN_NAME
+    test -n "$OS_ACCESS_KEY" && unset OS_ACCESS_KEY
+    test -n "$OS_SECRET_KEY" && unset OS_SECRET_KEY
+fi
+
+source <(climc --completion bash)
+source <(kubectl completion bash)
+
+echo "Welcome to Cloud Shell :-) You may execute climc and other command tools in this shell."
+echo "Please exec 'climc' to get started"
+echo ""

backend/build/climc/root/opt/yunion/scripts/rbac/editor.yaml

@@ -0,0 +1,10 @@
+policy:
+  '*':
+    '*':
+      '*': allow
+      create: deny
+      delete: deny
+      perform:
+        purge: deny
+        clone: deny
+        '*': allow

backend/build/climc/root/opt/yunion/scripts/rbac/owner.yaml

@@ -0,0 +1,2 @@
+policy:
+  '*': allow

backend/build/climc/root/opt/yunion/scripts/rbac/viewer.yaml

@@ -0,0 +1,6 @@
+policy:
+  '*':
+    '*':
+      get: allow
+      list: allow
+      '*': deny

backend/build/climc/root/opt/yunion/scripts/tools/clean_account.sh

@@ -0,0 +1,42 @@
+#!/bin/bash
+
+set -e
+
+pushd $(dirname $BASH_SOURCE) > /dev/null
+CUR_DIR=$(pwd -P)
+popd > /dev/null
+
+
+ACCOUNT=$1
+
+if [ -z "$ACCOUNT" ]; then
+    echo "Usage: $0 <cloud-acount-id-or-name>"
+    exit 1
+fi
+
+ACCOUNT_ID=$(climc cloud-account-show $ACCOUNT | grep -w " id " | awk '{print $4}')
+ACCOUNT_NAME=$(climc cloud-account-show $ACCOUNT | grep -w " name " | awk '{print $4}')
+
+if [ -z "$ACCOUNT_ID" ]; then
+    echo "Cloud account $ACCOUNT not found"
+    exit 1
+fi
+
+
+echo "Ready to clean cloud account $ACCOUNT_NAME($ACCOUNT_ID)..."
+
+echo "1. Disable cloud account $ACCOUNT_NAME($ACCOUNT_ID) ..."
+
+climc cloud-account-disable $ACCOUNT_ID
+
+echo "2. Clean all providers ..."
+
+for provider_id in $(climc cloud-provider-list --account $ACCOUNT_ID --limit 0 | egrep '[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12}' | awk '{print $2}')
+do
+    echo "### to clean cloud provider $provider_id ..."
+    $CUR_DIR/clean_provider.sh $provider_id
+done
+
+echo "3. Delete cloud account ..."
+
+climc cloud-account-delete $ACCOUNT_ID

backend/build/climc/root/opt/yunion/scripts/tools/clean_eip.sh

@@ -0,0 +1,27 @@
+#/bin/bash
+
+set -e
+
+EIP=$1
+
+if [ -z "$EIP" ]; then
+    echo "Usage: $0 <eip_id_or_name>"
+    exit 1
+fi
+
+EIP_NAME=$(climc eip-show $EIP | grep -w " name " | awk '{print $4}')
+EIP_ID=$(climc eip-show $EIP | grep -w " id " | awk '{print $4}')
+
+if [ -z "$EIP_ID" ]; then
+    echo "Cannot find eip $EIP_ID"
+    exit 1
+fi
+
+echo "To clean eip $EIP_NAME($EIP_ID)..."
+
+clean_eip() {
+    local EID=$1
+    climc eip-purge $EID
+}
+
+clean_eip $EIP_ID

backend/build/climc/root/opt/yunion/scripts/tools/clean_host.sh

@@ -0,0 +1,85 @@
+#!/bin/bash
+
+set -e
+
+HOST=$1
+
+if [ -z "$HOST" ]; then
+    echo "Usage: $0 <host_id_or_name>"
+    exit 1
+fi
+
+error_exit() {
+    echo "Error: $1"
+    exit 1
+}
+
+HOSTID=$(climc host-show $HOST | grep -w " id " | awk '{print $4}')
+
+HOSTNAME=$(climc host-show $HOST | grep -w " name " | awk '{print $4}')
+
+if [ -z "$HOSTNAME" ]; then
+    error_exit "Cannot find host $HOST"
+fi
+
+if [ -z "$HOSTID" ]; then
+    error_exit "Cannot find host $HOST"
+fi
+
+echo "Ready to purge host $HOSTNAME($HOSTID)..."
+
+echo "1. Disable $HOSTNAME($HOSTID)"
+
+if ! climc host-disable $HOSTID > /dev/null; then
+    error_exit "Fail to disable $HOST"
+fi
+
+echo "2. Clean servers on $HOSTNAME($HOSTID)"
+
+for i in $(climc server-list --host $HOSTID --admin --limit 2048 --system | egrep '[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12}' | awk '{print $2}')
+do
+    climc server-update --delete enable $i > /dev/null
+    climc server-purge $i > /dev/null
+done
+
+for i in $(climc server-list --host $HOSTID --admin --limit 2048 --pending-delete --system | egrep '[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12}' | awk '{print $2}')
+do
+    climc server-purge $i > /dev/null
+done
+
+for i in $(climc server-list --admin --limit 2048 --system  --filter "backup_host_id.equals($HOSTID)" | egrep '[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12}' | awk '{print $2}')
+do
+    climc server-delete-backup $i > /dev/null
+done
+
+echo "3. Clean disks on $HOSTNAME($HOSTID)"
+
+for storageid in $(climc host-storage-list --host $HOSTID --show-emulated | egrep '[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12}' | awk '{print $4}')
+do
+    STORAGENAME=$(climc storage-show $storageid | grep -w " name " | awk '{print $4}')
+    STORAGE_TYPE=$(climc storage-show $storageid | grep -w " storage_type " | awk '{print $4}')
+    if [ "$STORAGE_TYPE" == "local" ]; then
+        for diskid in $(climc disk-list --admin --system --details --search $storageid --limit 2048 | egrep '[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12}' | awk '{print $2}')
+        do
+            climc disk-purge $diskid > /dev/null
+        done
+        for diskid in $(climc disk-list --admin --system --details --search $storageid --pending-delete --limit 2048 | egrep '[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12}' | awk '{print $2}')
+        do
+            climc disk-purge $diskid > /dev/null
+        done
+    fi
+done
+
+echo "4. Remove host $HOSTNAME($HOSTID)"
+
+BAREMETAL=$(climc host-show $HOSTID | grep -w " is_baremetal " | awk '{print $4}')
+
+HOSTTYPE=$(climc host-show $HOSTID | grep -w " host_type " | awk '{print $4}')
+
+if [ "$BAREMETAL" == "true" ] && [ "$HOSTTYPE" != "baremetal" ]; then
+    climc host-update --host-type baremetal $HOSTID > /dev/null
+fi
+
+climc host-delete $HOSTID > /dev/null
+
+echo "DONE."

backend/build/climc/root/opt/yunion/scripts/tools/clean_loadbalancer.sh

@@ -0,0 +1,27 @@
+#!/bin/bash
+
+set -e
+
+LB=$1
+
+if [ -z "$LB" ]; then
+    echo "Usage: $0 <loadbalancer_id_or_name>"
+    exit 1
+fi
+
+LB_ID=$(climc lb-show $LB | grep -w " id " | awk '{print $4}')
+LB_NAME=$(climc lb-show $LB | grep -w " name " | awk '{print $4}')
+
+if [ -z "$LB_ID" ]; then
+    echo "Loadbalancer $LB not found"
+    exit 1
+fi
+
+echo "Ready to remove loadbalancer $LB_NAME($LB_ID) ..."
+
+clean_loadbalancer() {
+    local LID=$1
+    climc lb-purge $LID
+}
+
+clean_loadbalancer $LB_ID

backend/build/climc/root/opt/yunion/scripts/tools/clean_loadbalancer_acl.sh

@@ -0,0 +1,27 @@
+#!/bin/bash
+
+set -e
+
+LB_ACL=$1
+
+if [ -z "$LB_ACL" ]; then
+    echo "Usage: $0 <loadbalancer_id_or_name>"
+    exit 1
+fi
+
+LB_ACL_ID=$(climc lbacl-show $LB_ACL | grep -w " id " | awk '{print $4}')
+LB_ACL_NAME=$(climc lbacl-show $LB_ACL | grep -w " name " | awk '{print $4}')
+
+if [ -z "$LB_ACL_ID" ]; then
+    echo "Loadbalancer ACL $LB_ACL_ID not found"
+    exit 1
+fi
+
+echo "Ready to remove loadbalancer acl $LB_ACL_NAME($LB_ACL_ID) ..."
+
+clean_loadbalancer_acl() {
+    local LID=$1
+    climc lbacl-purge $LID
+}
+
+clean_loadbalancer_acl $LB_ACL_ID

backend/build/climc/root/opt/yunion/scripts/tools/clean_loadbalancer_certificate.sh

@@ -0,0 +1,27 @@
+#!/bin/bash
+
+set -e
+
+LB_CERT=$1
+
+if [ -z "$LB_CERT" ]; then
+    echo "Usage: $0 <loadbalancer_id_or_name>"
+    exit 1
+fi
+
+LB_CERT_ID=$(climc lbcert-show $LB_CERT | grep -w " id " | awk '{print $4}')
+LB_CERT_NAME=$(climc lbcert-show $LB_CERT | grep -w " name " | awk '{print $4}')
+
+if [ -z "$LB_CERT_ID" ]; then
+    echo "Loadbalancer certificate $LB_CERT_ID not found"
+    exit 1
+fi
+
+echo "Ready to remove loadbalancer certificate $LB_CERT_NAME($LB_CERT_ID) ..."
+
+clean_loadbalancer_cert() {
+    local LID=$1
+    climc lbcert-purge $LID
+}
+
+clean_loadbalancer_cert $LB_CERT_ID

backend/build/climc/root/opt/yunion/scripts/tools/clean_provider.sh

@@ -0,0 +1,96 @@
+#!/bin/bash
+
+set -e
+
+pushd $(dirname $BASH_SOURCE) > /dev/null
+CUR_DIR=$(pwd -P)
+popd > /dev/null
+
+
+PROVIDER=$1
+
+if [ -z "$PROVIDER" ]; then
+    echo "Usage: $0 <cloud-provider-id-or-name>"
+    exit 1
+fi
+
+PROVIDER_ID=$(climc cloud-provider-show $PROVIDER | grep -w " id " | awk '{print $4}')
+PROVIDER_NAME=$(climc cloud-provider-show $PROVIDER | grep -w " name " | awk '{print $4}')
+
+if [ -z "$PROVIDER_ID" ]; then
+    echo "Cloud provider $PROVIDER not found"
+    exit 1
+fi
+
+
+echo "Ready to clean cloud provider $PROVIDER_NAME($PROVIDER_ID)..."
+
+echo "1. Disable cloud provider $PROVIDER_NAME($PROVIDER_ID) ..."
+
+climc cloud-provider-disable $PROVIDER_ID
+
+echo "2. Clean all hosts ..."
+
+for hostid in $(climc host-list --manager $PROVIDER_ID --admin --show-emulated --limit 0 | egrep '[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12}' | awk '{print $2}')
+do
+    $CUR_DIR/clean_host.sh $hostid
+done
+
+echo "3. Clean all loadbalancer ..."
+
+for lbid in $(climc lb-list --manager $PROVIDER_ID --admin --show-emulated --limit 0 | egrep '[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12}' | awk '{print $2}')
+do
+    $CUR_DIR/clean_loadbalancer.sh $lbid
+done
+
+echo "4. Clean all loadbalancer acl ..."
+
+for lbaclid in $(climc lbacl-list --manager $PROVIDER_ID --admin --show-emulated --limit 0 | egrep '[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12}' | awk '{print $2}')
+do
+    $CUR_DIR/clean_loadbalancer_acl.sh $lbaclid
+done
+
+echo "5. Clean all loadbalancer certificate ..."
+
+for lbcertid in $(climc lbcert-list --manager $PROVIDER_ID --admin --show-emulated --limit 0 | egrep '[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12}' | awk '{print $2}')
+do
+    $CUR_DIR/clean_loadbalancer_certificate.sh $lbcertid
+done
+
+echo "6. Clean all vpc ..."
+
+for vpcid in $(climc vpc-list --manager $PROVIDER_ID --admin --show-emulated --limit 0 | egrep '[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12}' | awk '{print $2}')
+do
+    $CUR_DIR/clean_vpc.sh $vpcid
+done
+
+echo "7. Clean all eips ..."
+for eipid in $(climc eip-list --admin --manager $PROVIDER_ID --admin --show-emulated --limit 0 | egrep '[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12}' | awk '{print $2}')
+do
+    $CUR_DIR/clean_eip.sh $eipid
+done
+
+echo "8. Clean all snapshots ..."
+for snapid in $(climc snapshot-list --admin --manager $PROVIDER_ID --admin --show-emulated --limit 0 | egrep '[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12}' | awk '{print $2}')
+do
+    echo "to clean snapshot $snapid ..."
+    $CUR_DIR/clean_snapshot.sh $snapid
+done
+
+echo "9. Clean all storagecache ..."
+
+for cacheid in $(climc storage-cache-list --manager $PROVIDER_ID --admin --show-emulated --limit 0 | egrep '[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12}' | awk '{print $2}')
+do
+    $CUR_DIR/clean_storagecache.sh $cacheid
+done
+
+echo "10. Clean all storages ..."
+
+for storeid in $(climc storage-list --manager $PROVIDER_ID --admin --show-emulated --limit 0 | egrep '[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12}' | awk '{print $2}')
+do
+    $CUR_DIR/clean_storage.sh $storeid
+done
+
+echo "Delete cloud provider ..."
+
+climc cloud-provider-delete $PROVIDER_ID

backend/build/climc/root/opt/yunion/scripts/tools/clean_snapshot.sh

@@ -0,0 +1,27 @@
+#/bin/bash
+
+set -e
+
+SNAPSHOT=$1
+
+if [ -z "$SNAPSHOT" ]; then
+    echo "Usage: $0 <snapshot_id_or_name>"
+    exit 1
+fi
+
+SNAPSHOT_NAME=$(climc snapshot-show $SNAPSHOT | grep -w " name " | awk '{print $4}')
+SNAPSHOT_ID=$(climc snapshot-show $SNAPSHOT | grep -w " id " | awk '{print $4}')
+
+if [ -z "$SNAPSHOT_ID" ]; then
+    echo "Cannot find snapshot $SNAPSHOT_ID"
+    exit 1
+fi
+
+echo "To clean snapshot $SNAPSHOT_NAME($SNAPSHOT_ID)..."
+
+clean_snapshot() {
+    local SNAP_ID=$1
+    climc snapshot-purge $SNAP_ID > /dev/null
+}
+
+clean_snapshot $SNAPSHOT_ID

backend/build/climc/root/opt/yunion/scripts/tools/clean_storage.sh

@@ -0,0 +1,34 @@
+#!/bin/bash
+
+set -e
+
+STORAGE=$1
+
+if [ -z "$STORAGE" ]; then
+    echo "Usage: $0 <storage_id_or_name>"
+    exit 1
+fi
+
+STORAGE_ID=$(climc storage-show $STORAGE | grep -w " id " | awk '{print $4}')
+STORAGE_NAME=$(climc storage-show $STORAGE | grep -w " name " | awk '{print $4}')
+
+if [ -z "$STORAGE_ID" ]; then
+    echo "Storage $STORAGE not found"
+    exit 1
+fi
+
+echo "Clean disks on storage $STORAGE_NAME($STORAGE_ID) ..."
+
+for disk_id in $(climc disk-list --admin --storage $STORAGE_ID --show-emulated --limit 2048 | egrep '[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12}' | awk '{print $2}')
+do
+    climc disk-purge $disk_id > /dev/null
+done
+
+for disk_id in $(climc disk-list --admin --storage $STORAGE_ID --show-emulated --pending-delete --limit 2048 | egrep '[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12}' | awk '{print $2}')
+do
+    climc disk-purge $disk_id > /dev/null
+done
+
+# CACHE_ID=$(climc storage-show $STORAGE_ID | grep -w " storagecache_id " | awk '{print $4}')
+
+climc storage-delete $STORAGE_ID > /dev/null

backend/build/climc/root/opt/yunion/scripts/tools/clean_storagecache.sh

@@ -0,0 +1,28 @@
+#!/bin/bash
+
+set -e
+
+CACHE=$1
+
+if [ -z "$CACHE" ]; then
+    echo "Usage: $0 <storage_cache_id_or_name>"
+    exit 1
+fi
+
+CACHE_ID=$(climc storage-cache-show $CACHE | grep -w " id " | awk '{print $4}')
+CACHE_NAME=$(climc storage-cache-show $CACHE | grep -w " name " | awk '{print $4}')
+
+if [ -z "$CACHE_ID" ]; then
+    echo "Storage cache $CACHE not found"
+    exit 1
+fi
+
+echo "Ready to remove storagecache $CACHE_NAME($CACHE_ID) ..."
+
+for imgid in $(climc storage-cached-image-list --storagecache $CACHE_ID --show-emulated --limit 0 | egrep '[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12}' | awk '{print $4}')
+do
+    climc storagecache-uncache-image $CACHE_ID $imgid --force # > /dev/null
+done
+
+climc storage-cache-delete $CACHE_ID > /dev/null
+

backend/build/climc/root/opt/yunion/scripts/tools/clean_vpc.sh

@@ -0,0 +1,55 @@
+#/bin/bash
+
+set -e
+
+VPC=$1
+
+if [ -z "$VPC" ]; then
+    echo "Usage: $0 <vpc_id_or_name>"
+    exit 1
+fi
+
+VPC_NAME=$(climc vpc-show $VPC | grep -w " name " | awk '{print $4}')
+VPC_ID=$(climc vpc-show $VPC | grep -w " id " | awk '{print $4}')
+
+if [ -z "$VPC_ID" ]; then
+    echo "Cannot find vpc $VPC"
+    exit 1
+fi
+
+echo "To clean vpc $VPC_NAME($VPC_ID)..."
+
+clean_network() {
+    climc network-purge $1 > /dev/null
+}
+
+
+clean_wire() {
+    local WIRE_ID=$1
+    for net_id in $(climc network-list --admin --wire $WIRE_ID --show-emulated | egrep '[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12}' | awk '{print $2}')
+    do
+        clean_network $net_id
+    done
+    climc wire-delete $wire_id > /dev/null
+}
+
+clean_vpc() {
+    local VPC_ID=$1
+    climc vpc-purge $VPC_ID > /dev/null
+}
+
+echo "1. Clean wires ..."
+
+for wire_id in $(climc wire-list --vpc $VPC_ID --show-emulated | egrep '[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12}' | awk '{print $2}')
+do
+    clean_wire $wire_id
+done
+
+echo "2. Clean route tables ..."
+for routetable_id in $(climc routetable-list --vpc $VPC_ID --show-emulated | egrep '[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12}' | awk '{print $2}')
+do
+    climc routetable-purge $routetable_id >/dev/null
+done
+
+echo "3. clean vpc ..."
+clean_vpc $VPC_ID

backend/build/climc/vars

@@ -0,0 +1 @@
+DESCRIPTION="Yunion Command Line Utility"

backend/build/cloudevent/vars

@@ -0,0 +1 @@
+DESCRIPTION="Yunion Cloudevent"

backend/build/cloudid/root/opt/yunion/share/notify_templates/cloudid/content@cn/CLOUD_USER_CREATED

@@ -0,0 +1,6 @@
+公有云子账号创建成功
+主账号：{{ .account }}<br>
+名称：{{ .name }}<br>
+密码：{{ .password }}<br>
+登录地址: {{ .iam_login_url }}<br>
+资源ID: {{ .id }}<br>

backend/build/cloudid/root/opt/yunion/share/notify_templates/cloudid/content@en/CLOUD_USER_CREATED

@@ -0,0 +1,6 @@
+Clouduser has been created successfully
+Root Account: {{ .account }}<br>
+Name：{{ .name }}<br>
+Password：{{ .password }}<br>
+IAM Login URL: {{ .iam_login_url }}<br>
+Resource ID: {{ .id }}<br>

backend/build/cloudid/root/opt/yunion/share/notify_templates/cloudid/title@cn/CLOUD_USER_CREATED

@@ -0,0 +1 @@
+公有云子账号 {{ .name }} 创建成功

backend/build/cloudid/root/opt/yunion/share/notify_templates/cloudid/title@en/CLOUD_USER_CREATED

@@ -0,0 +1 @@
+The clouduser {{ .name }} created successfully

backend/build/cloudid/root/opt/yunion/share/saml/sp-metadata/aliyun_role.xml

@@ -0,0 +1,47 @@
+<?xml version="1.0"?>
+<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" entityID="urn:alibaba:cloudcomputing">
+    <SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol" WantAssertionsSigned="true">
+        <KeyDescriptor use="signing">
+            <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+                <ds:X509Data>
+                    <ds:X509Certificate>MIIDXjCCAkagAwIBAgIEXHToLjANBgkqhkiG9w0BAQsFADBwMQswCQYDVQQGEwJDTjERMA8GA1UE
+                        CBMISGFuZ3pob3UxKTAnBgNVBAsTIEFsaWJhYmEgQ2xvdWQgQ29tcHV0aW5nIENvLiBMdGQuMSMw
+                        IQYDVQQDExp1cm46YWxpYmFiYTpjbG91ZGNvbXB1dGluZzAgFw0xOTAyMjYwNzE4MDZaGA8yMTE5
+                        MDIwMjA3MTgwNlowcDELMAkGA1UEBhMCQ04xETAPBgNVBAgTCEhhbmd6aG91MSkwJwYDVQQLEyBB
+                        bGliYWJhIENsb3VkIENvbXB1dGluZyBDby4gTHRkLjEjMCEGA1UEAxMadXJuOmFsaWJhYmE6Y2xv
+                        dWRjb21wdXRpbmcwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDDjD53ZENEHoYNXAOf
+                        OIbVBJhj7SCWKmdjnbnxq8WAFWEeZtS6hZLPpWh1z7b0NjJkvCf5oFVqBJYbbW5kEKV+9CpV6VHZ
+                        qOXmsIRlkvZB+Wnc3SduwiiiUR9JojSPxVQvSf4WLT+HDASlrBztuRV2vHj9utLbvy+6bgVBqF8g
+                        emL9Pcif1robDH8HlqUcADXLAt18E4MbToldVoHjpFc6fAKUXujWH5feAL8g0CKlmf/JVlHLEtu4
+                        vKPxBQ8sgkysk6EnrjXl6Q4a4t+vbPG5uczA1ouTkDupMCRlaWHIHaJL/AoDGabn8sVXdaVJUKC5
+                        54FNkRznBhRQll+Nuc2rAgMBAAEwDQYJKoZIhvcNAQELBQADggEBAE8k4S4HvOglthJwF3aMQXGi
+                        LKW6Becs9SljA0/5VtZQDrDf2By/1BIMvWfZ/dFnO+MylDLVdS6XWvWat/DW0fOGxU4s1WNfshX7
+                        DJDGR2G1XgtGoDZEYIDahUp5katAPypCkY57fGZlI0d3nq46/2qT/Zpne+pFE3DI/x8klZMniniw
+                        YjNXbG96y/M4DYi1J7RR8mLIfVvz5o1SMGT4Ta2p/USE2M9F6O7/zc2j62dQgXiYa9OONo31RiXR
+                        TmvGEUNuQoBZhVrFIvOnNjIfFT7Xd3CUowwJKP1floserrx4B5jScRAi9yK3x2a2lhfc+PksXfTs
+                        aqIr5TQL4OorLEE=</ds:X509Certificate>
+                </ds:X509Data>
+            </ds:KeyInfo>
+        </KeyDescriptor>
+        <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</NameIDFormat>
+        <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</NameIDFormat>
+        <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</NameIDFormat>
+        <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</NameIDFormat>
+        <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName</NameIDFormat>
+        <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:WindowsDomainQualifiedName</NameIDFormat>
+        <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:kerberos</NameIDFormat>
+        <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:entity</NameIDFormat>
+        <AssertionConsumerService index="1" isDefault="true" Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://signin.aliyun.com/saml-role/sso"/>
+        <AttributeConsumingService index="1">
+            <ServiceName xml:lang="en">Alibaba Cloud Console Single Sign-On</ServiceName>
+            <RequestedAttribute isRequired="true" Name="https://www.aliyun.com/SAML-Role/Attributes/Role" FriendlyName="RoleEntitlement"/>
+            <RequestedAttribute isRequired="true" Name="https://www.aliyun.com/SAML-Role/Attributes/RoleSessionName" FriendlyName="RoleSessionName"/>
+            <RequestedAttribute isRequired="false" Name="https://www.aliyun.com/SAML-Role/Attributes/SessionDuration" FriendlyName="SessionDuration"/>
+        </AttributeConsumingService>
+    </SPSSODescriptor>
+    <Organization>
+        <OrganizationName xml:lang="en">Alibaba Cloud Computing Co. Ltd.</OrganizationName>
+        <OrganizationDisplayName xml:lang="en">AlibabaCloud</OrganizationDisplayName>
+        <OrganizationURL xml:lang="en">https://www.aliyun.com</OrganizationURL>
+    </Organization>
+</EntityDescriptor>

backend/build/cloudid/root/opt/yunion/share/saml/sp-metadata/aws.xml

@@ -0,0 +1,67 @@
+<?xml version="1.0"?>
+<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" entityID="urn:amazon:webservices" validUntil="2021-06-02T00:00:00Z">
+  <SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol" WantAssertionsSigned="true">
+    <KeyDescriptor use="signing">
+      <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+        <ds:X509Data>
+          <ds:X509Certificate>MIIDbTCCAlWgAwIBAgIEFWIThjANBgkqhkiG9w0BAQsFADBnMR8wHQYDVQQDExZ1
+cm46YW1hem9uOndlYnNlcnZpY2VzMSIwIAYDVQQKExlBbWF6b24gV2ViIFNlcnZp
+Y2VzLCBJbmMuMRMwEQYDVQQIEwpXYXNoaW5ndG9uMQswCQYDVQQGEwJVUzAeFw0y
+MDA2MDIwMDAwMDBaFw0yMTA2MDIwMDAwMDBaMGcxHzAdBgNVBAMTFnVybjphbWF6
+b246d2Vic2VydmljZXMxIjAgBgNVBAoTGUFtYXpvbiBXZWIgU2VydmljZXMsIElu
+Yy4xEzARBgNVBAgTCldhc2hpbmd0b24xCzAJBgNVBAYTAlVTMIIBIjANBgkqhkiG
+9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwKA4yDh4wAjlkhjJoXARGX9DQWsGTgp9GzoX
+NebntY+DjB8H6hIkYRR3++yEDY90qldbZzOaOKRm2jyL7i+MgNt+ktx6wYGD7HBg
+e8Z0Zh6eHRIwKbvu4/heMLdqqu+hlXkrC15T4N/LqiwT5JhPTrO4V1KG3ljR1ONG
+7aLblVH2aRENV+X9la/AVAPesUpCnoUcTkuCJrcwHrv6hqWmadW8pJy/ISCCM4Fe
+JuOAJD0whxg0qRFvE6xcdnKBTWjR03VHqJnyYQGVUKXOlgj8HiKO0JaJkoUAs5ox
+WCRBZwSQW+qbP1VKSUfFeBtTMx/TSg4nBRYHinego/e8O1mu6wIDAQABoyEwHzAd
+BgNVHQ4EFgQUz1SuekLVxYNvvLpUDRXc/gp2WdAwDQYJKoZIhvcNAQELBQADggEB
+AIkUzM9MXr11vp9gBOOXyqyj7sBgoUQHW3mEfKD3DkEOZWUPW5UI7NM9ZHvhdOwd
+C1noUK/QMjLkTHp0QB2bxCIpgThXSNFDYNRxf1/aUqTfxQ8a+i0q7l/utRiWyY3p
+kLOFx0n81a2bSNz+B0nPS338xNaBtuNjHedXjxN6BjUCUfFHFsQmg/y6ZbBRN/9P
++i2yy3CjLduh0yeD0Of3vAoIh19MuNgnIy1pMsK/H59E8bAaCFvND9fnsqAfH29W
+ppmt9c8QaiAya5R7akl/C0Rx8khQrba+wMcSultqLU+6YVIAAEKZ/S/ZfN74wn5X
+RXwSXp4MSmOKYqRWshvRegQ=</ds:X509Certificate>
+        </ds:X509Data>
+      </ds:KeyInfo>
+    </KeyDescriptor>
+    <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</NameIDFormat>
+    <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</NameIDFormat>
+    <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</NameIDFormat>
+    <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</NameIDFormat>
+    <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName</NameIDFormat>
+    <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:WindowsDomainQualifiedName</NameIDFormat>
+    <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:kerberos</NameIDFormat>
+    <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:entity</NameIDFormat>
+    <AssertionConsumerService index="1" isDefault="true" Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://signin.aws.amazon.com/saml"/>
+    <AttributeConsumingService index="1">
+      <ServiceName xml:lang="en">AWS Management Console Single Sign-On</ServiceName>
+      <RequestedAttribute isRequired="true" Name="https://aws.amazon.com/SAML/Attributes/Role" FriendlyName="RoleEntitlement"/>
+      <RequestedAttribute isRequired="true" Name="https://aws.amazon.com/SAML/Attributes/RoleSessionName" FriendlyName="RoleSessionName"/>
+      <RequestedAttribute isRequired="false" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1" FriendlyName="eduPersonAffiliation"/>
+      <RequestedAttribute isRequired="false" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.2" FriendlyName="eduPersonNickname"/>
+      <RequestedAttribute isRequired="false" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.3" FriendlyName="eduPersonOrgDN"/>
+      <RequestedAttribute isRequired="false" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.4" FriendlyName="eduPersonOrgUnitDN"/>
+      <RequestedAttribute isRequired="false" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.5" FriendlyName="eduPersonPrimaryAffiliation"/>
+      <RequestedAttribute isRequired="false" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.6" FriendlyName="eduPersonPrincipalName"/>
+      <RequestedAttribute isRequired="false" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.7" FriendlyName="eduPersonEntitlement"/>
+      <RequestedAttribute isRequired="false" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.8" FriendlyName="eduPersonPrimaryOrgUnitDN"/>
+      <RequestedAttribute isRequired="false" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.9" FriendlyName="eduPersonScopedAffiliation"/>
+      <RequestedAttribute isRequired="false" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" FriendlyName="eduPersonTargetedID"/>
+      <RequestedAttribute isRequired="false" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.11" FriendlyName="eduPersonAssurance"/>
+      <RequestedAttribute isRequired="false" Name="urn:oid:1.3.6.1.4.1.5923.1.2.1.2" FriendlyName="eduOrgHomePageURI"/>
+      <RequestedAttribute isRequired="false" Name="urn:oid:1.3.6.1.4.1.5923.1.2.1.3" FriendlyName="eduOrgIdentityAuthNPolicyURI"/>
+      <RequestedAttribute isRequired="false" Name="urn:oid:1.3.6.1.4.1.5923.1.2.1.4" FriendlyName="eduOrgLegalName"/>
+      <RequestedAttribute isRequired="false" Name="urn:oid:1.3.6.1.4.1.5923.1.2.1.5" FriendlyName="eduOrgSuperiorURI"/>
+      <RequestedAttribute isRequired="false" Name="urn:oid:1.3.6.1.4.1.5923.1.2.1.6" FriendlyName="eduOrgWhitePagesURI"/>
+      <RequestedAttribute isRequired="false" Name="urn:oid:2.5.4.3" FriendlyName="cn"/>
+    </AttributeConsumingService>
+  </SPSSODescriptor>
+  <Organization>
+    <OrganizationName xml:lang="en">Amazon Web Services, Inc.</OrganizationName>
+    <OrganizationDisplayName xml:lang="en">AWS</OrganizationDisplayName>
+    <OrganizationURL xml:lang="en">https://aws.amazon.com</OrganizationURL>
+  </Organization>
+</EntityDescriptor>
+

backend/build/cloudid/root/opt/yunion/share/saml/sp-metadata/aws_cn.xml

@@ -0,0 +1,67 @@
+<?xml version="1.0"?>
+<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" entityID="urn:amazon:webservices:cn-north-1" validUntil="2021-05-13T00:00:00Z">
+  <SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol" WantAssertionsSigned="true">
+    <KeyDescriptor use="signing">
+      <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+        <ds:X509Data>
+          <ds:X509Certificate>MIIDfzCCAmegAwIBAgIEY1tz5jANBgkqhkiG9w0BAQsFADBwMSgwJgYDVQQDEx91
+cm46YW1hem9uOndlYnNlcnZpY2VzOmNuLW5vcnRoMSIwIAYDVQQKExlBbWF6b24g
+V2ViIFNlcnZpY2VzLCBJbmMuMRMwEQYDVQQIEwpXYXNoaW5ndG9uMQswCQYDVQQG
+EwJVUzAeFw0yMDA1MTMwMDAwMDBaFw0yMTA1MTMwMDAwMDBaMHAxKDAmBgNVBAMT
+H3VybjphbWF6b246d2Vic2VydmljZXM6Y24tbm9ydGgxIjAgBgNVBAoTGUFtYXpv
+biBXZWIgU2VydmljZXMsIEluYy4xEzARBgNVBAgTCldhc2hpbmd0b24xCzAJBgNV
+BAYTAlVTMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAm2HLuzEnEGVT
+C5W215HWuwFLM54v3oHoNy52GGN79VLn7sxm2Z0K+AVijV/rxCbPaNxO6tm/MmN6
+XJkU8g8p7ghT6p+EN/61WG+KgoXIHcl/aZBbkoNTKKPXRvR9EEcyAPdLDBJVJHF5
+lgCkSMHBL3VcCcrpVxFCtUhW+vT3pie2KHLEVb5Ocpq9pO8dNvY2iM7TSIvRu0kL
+IZWUbRF0bP4cpDIVoMEsSJ3gFBCD3yf53UfU2dxjp2mnMjphPucHwml3AcsXN3XT
+Y5j2qksO5xXgFrCZz76l3P7emj5eHIvkxuieU/7u+cYu0HppP+4xszzqvUcoHFRA
+1fC/eFFRAwIDAQABoyEwHzAdBgNVHQ4EFgQUZkQfgy0NWq7kAO8mTQPeSDayJ3Ew
+DQYJKoZIhvcNAQELBQADggEBACmLLD2qBA+KCxv7CiCfznT8XWOLAVf9xP3YMk0N
+WCnugpd30d0YzxtI2PA29cNB2pyuGbaVg+zGqpsfAznaBHvnnEx1fJHNyfXxhAry
+0MdabmbvhMfJPUYRFx/7r6Km8d52e+nv28pP/WrbWs4I0Swm+Rwaj3t32EgCBxQS
+8WWEkG+L00slRgSPkfY8OgOM4QkBThHjGgw0TKFTEvQNVqXOJKQREq0MejyarUSC
+4am+OJeRcWKtPcRo1jUlGWG6eun0ybuw232ZEZHUv33B247aRMuvTgcRTz3s6tUE
+7RoeaMpl3/Y1MKtB2qURiu0Cib27Rl1mckhmfdA+awl3s4s=</ds:X509Certificate>
+        </ds:X509Data>
+      </ds:KeyInfo>
+    </KeyDescriptor>
+    <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</NameIDFormat>
+    <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</NameIDFormat>
+    <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</NameIDFormat>
+    <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</NameIDFormat>
+    <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName</NameIDFormat>
+    <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:WindowsDomainQualifiedName</NameIDFormat>
+    <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:kerberos</NameIDFormat>
+    <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:entity</NameIDFormat>
+    <AssertionConsumerService index="1" isDefault="true" Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://signin.amazonaws.cn/saml"/>
+    <AttributeConsumingService index="1">
+      <ServiceName xml:lang="en">AWS Management Console Single Sign-On</ServiceName>
+      <RequestedAttribute isRequired="true" Name="https://aws.amazon.com/SAML/Attributes/Role" FriendlyName="RoleEntitlement"/>
+      <RequestedAttribute isRequired="true" Name="https://aws.amazon.com/SAML/Attributes/RoleSessionName" FriendlyName="RoleSessionName"/>
+      <RequestedAttribute isRequired="false" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.1" FriendlyName="eduPersonAffiliation"/>
+      <RequestedAttribute isRequired="false" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.2" FriendlyName="eduPersonNickname"/>
+      <RequestedAttribute isRequired="false" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.3" FriendlyName="eduPersonOrgDN"/>
+      <RequestedAttribute isRequired="false" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.4" FriendlyName="eduPersonOrgUnitDN"/>
+      <RequestedAttribute isRequired="false" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.5" FriendlyName="eduPersonPrimaryAffiliation"/>
+      <RequestedAttribute isRequired="false" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.6" FriendlyName="eduPersonPrincipalName"/>
+      <RequestedAttribute isRequired="false" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.7" FriendlyName="eduPersonEntitlement"/>
+      <RequestedAttribute isRequired="false" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.8" FriendlyName="eduPersonPrimaryOrgUnitDN"/>
+      <RequestedAttribute isRequired="false" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.9" FriendlyName="eduPersonScopedAffiliation"/>
+      <RequestedAttribute isRequired="false" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.10" FriendlyName="eduPersonTargetedID"/>
+      <RequestedAttribute isRequired="false" Name="urn:oid:1.3.6.1.4.1.5923.1.1.1.11" FriendlyName="eduPersonAssurance"/>
+      <RequestedAttribute isRequired="false" Name="urn:oid:1.3.6.1.4.1.5923.1.2.1.2" FriendlyName="eduOrgHomePageURI"/>
+      <RequestedAttribute isRequired="false" Name="urn:oid:1.3.6.1.4.1.5923.1.2.1.3" FriendlyName="eduOrgIdentityAuthNPolicyURI"/>
+      <RequestedAttribute isRequired="false" Name="urn:oid:1.3.6.1.4.1.5923.1.2.1.4" FriendlyName="eduOrgLegalName"/>
+      <RequestedAttribute isRequired="false" Name="urn:oid:1.3.6.1.4.1.5923.1.2.1.5" FriendlyName="eduOrgSuperiorURI"/>
+      <RequestedAttribute isRequired="false" Name="urn:oid:1.3.6.1.4.1.5923.1.2.1.6" FriendlyName="eduOrgWhitePagesURI"/>
+      <RequestedAttribute isRequired="false" Name="urn:oid:2.5.4.3" FriendlyName="cn"/>
+    </AttributeConsumingService>
+  </SPSSODescriptor>
+  <Organization>
+    <OrganizationName xml:lang="en">Amazon Web Services, Inc.</OrganizationName>
+    <OrganizationDisplayName xml:lang="en">AWS</OrganizationDisplayName>
+    <OrganizationURL xml:lang="en">https://aws.amazon.com</OrganizationURL>
+  </Organization>
+</EntityDescriptor>
+

backend/build/cloudid/root/opt/yunion/share/saml/sp-metadata/azure.xml

@@ -0,0 +1,60 @@
+<?xml version="1.0" encoding="utf-8"?>
+
+<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:alg="urn:oasis:names:tc:SAML:metadata:algsupport" ID="_1e55eaf7-5cb9-4601-b557-e322fdfb2baf" entityID="urn:federation:MicrosoftOnline">
+  <Signature xmlns="http://www.w3.org/2000/09/xmldsig#">
+    <SignedInfo>
+      <CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
+      <SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
+      <Reference URI="#_1e55eaf7-5cb9-4601-b557-e322fdfb2baf">
+        <Transforms>
+          <Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/>
+          <Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/>
+        </Transforms>
+        <DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
+        <DigestValue>fA33hUaj24/8F8bArDIkH6CpX0k=</DigestValue>
+      </Reference>
+    </SignedInfo>
+    <SignatureValue>p/rlVWxLRIYiHozzWUgsjmQ5ItMZ/ITeEOg/edeo50l7qU8wLM9JD55EHoLpVvxImBcCfY1CxKdq3s1o9Up1jvEcH9KjfYZea1q8hzTkQdt7F2XvxoqDFRLvVwyHHJjygaEvFRXXxml7IDgDx9ScSRhQeGUlTGhI9eAFSaGkChM/FPnmekZ3ngSwbVf4FsTLIArxMqEnV0lXNMTr5NHQ6VL5wZ/cHLNCkkBoY0qWyv2hnYiZiXa4TKjpAN+8QF5GDPv/0ExJwe+aoRAQhdBzhBUICQdQd+v3Rb5SuX++iVfmf4IPMqj8CK4uK7iYXNLCGEO8oFR2KlK/zBpHzw6yCQ==</SignatureValue>
+    <KeyInfo>
+      <X509Data>
+        <X509Certificate>MIIC/TCCAeWgAwIBAgIQF9xAVqfHt7dNSOnsMKYLDjANBgkqhkiG9w0BAQsFADApMScwJQYDVQQDEx5MaXZlIElEIFNUUyBTaWduaW5nIFB1YmxpYyBLZXkwHhcNMTkwNjE4MDAwMDAwWhcNMjEwNjE4MDAwMDAwWjApMScwJQYDVQQDEx5MaXZlIElEIFNUUyBTaWduaW5nIFB1YmxpYyBLZXkwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDLwL+mOk+zhgjHPFiZuDaU7coCOMkYyJyWS2B2KWYx7BMmy+SBSlFvvDHIiMXeLnv9DiUnQXtjClZXNqEo2amM/KdXfnCUlwdnqGa89TbB8kM6aBQKCh5Up7vejD+KRpPcOK7DqxWnm037zNKH+6liwRMUD/+lkBODoG1/ThuBVM0Kr1Oowfnkb4JYeF5xZk+2+ThR2dcQzdsz8dBW1GpGopdoM5G1amVhoRPBeNlYUqf0JUPE36Dx0iCmeXX00HTR2gd+/DJFVe34l/VxL4cqufmRcqWHy7axonbpt8svjAervGgueF5W/BVGcO4eVwFzFfnAz7bSaH/zbsNnQkFtAgMBAAGjITAfMB0GA1UdDgQWBBQlxmu/Hj1qB2A306p0Sz9up711AjANBgkqhkiG9w0BAQsFAAOCAQEAEhb+i+J69DvzCTfmC0Mn+uSGzBaW0ksMZNjM8/p/RFueytNo8/DY6TUb9W8l/HSVON782iGG7hIsG68RUIZ5q+/WAB9iBvKkKv5aGZ0bK/eD5boHwBwMa3udTjU68Vkai0A7naISEh22h+lQPvKiftCEzK1x9j2FoAXEMhACnpTwRrrj3SsJXCsMaOKcVw7sCmM4/4wD5I1+dfMSe85rSEzzUCDcCMEg67sBKdO2CFK1GoH21ttrz1CV+xt8Pn9a488kgsp2ZyU+yixS59CrM7onEzt1R4miXWAJAtydNHAmmbgKrTxqf67fEXFcrlFAHexi6vvINZWZPD6+J+q6xg==</X509Certificate>
+      </X509Data>
+    </KeyInfo>
+  </Signature>
+  <SPSSODescriptor WantAssertionsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
+    <KeyDescriptor use="signing">
+      <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
+        <X509Data>
+          <X509Certificate>MIIC/TCCAeWgAwIBAgIQF9xAVqfHt7dNSOnsMKYLDjANBgkqhkiG9w0BAQsFADApMScwJQYDVQQDEx5MaXZlIElEIFNUUyBTaWduaW5nIFB1YmxpYyBLZXkwHhcNMTkwNjE4MDAwMDAwWhcNMjEwNjE4MDAwMDAwWjApMScwJQYDVQQDEx5MaXZlIElEIFNUUyBTaWduaW5nIFB1YmxpYyBLZXkwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDLwL+mOk+zhgjHPFiZuDaU7coCOMkYyJyWS2B2KWYx7BMmy+SBSlFvvDHIiMXeLnv9DiUnQXtjClZXNqEo2amM/KdXfnCUlwdnqGa89TbB8kM6aBQKCh5Up7vejD+KRpPcOK7DqxWnm037zNKH+6liwRMUD/+lkBODoG1/ThuBVM0Kr1Oowfnkb4JYeF5xZk+2+ThR2dcQzdsz8dBW1GpGopdoM5G1amVhoRPBeNlYUqf0JUPE36Dx0iCmeXX00HTR2gd+/DJFVe34l/VxL4cqufmRcqWHy7axonbpt8svjAervGgueF5W/BVGcO4eVwFzFfnAz7bSaH/zbsNnQkFtAgMBAAGjITAfMB0GA1UdDgQWBBQlxmu/Hj1qB2A306p0Sz9up711AjANBgkqhkiG9w0BAQsFAAOCAQEAEhb+i+J69DvzCTfmC0Mn+uSGzBaW0ksMZNjM8/p/RFueytNo8/DY6TUb9W8l/HSVON782iGG7hIsG68RUIZ5q+/WAB9iBvKkKv5aGZ0bK/eD5boHwBwMa3udTjU68Vkai0A7naISEh22h+lQPvKiftCEzK1x9j2FoAXEMhACnpTwRrrj3SsJXCsMaOKcVw7sCmM4/4wD5I1+dfMSe85rSEzzUCDcCMEg67sBKdO2CFK1GoH21ttrz1CV+xt8Pn9a488kgsp2ZyU+yixS59CrM7onEzt1R4miXWAJAtydNHAmmbgKrTxqf67fEXFcrlFAHexi6vvINZWZPD6+J+q6xg==</X509Certificate>
+        </X509Data>
+      </KeyInfo>
+    </KeyDescriptor>
+    <KeyDescriptor use="signing">
+      <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
+        <X509Data>
+          <X509Certificate>MIIC/TCCAeWgAwIBAgIQbgDHfi3t1JNGVqwD5/7lmjANBgkqhkiG9w0BAQsFADApMScwJQYDVQQDEx5MaXZlIElEIFNUUyBTaWduaW5nIFB1YmxpYyBLZXkwHhcNMjAxMjIxMDAwMDAwWhcNMjUxMjIxMDAwMDAwWjApMScwJQYDVQQDEx5MaXZlIElEIFNUUyBTaWduaW5nIFB1YmxpYyBLZXkwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDFT0/0/2qQurnYa0LbJHF9YYozhEH6r9mCxVDBYbewSG4tGgrWpsewQ/96pcczGMQctMvU+h2eX38Hx/f9JAIDbuRQzQlsPhQS7DDZ6WlTXU+t8d/g2C7fpSoLs4KVdJih4xyjLUWj+BK/ijsRjBt4Riw9VbJH/DdWKyoSMbECEiE+s1RtLP/eYoMmNfxyQGqWirCNqVNBTlqzYQp4dgF0foYy4ktoxwmQOVoTcIMFYp1I4pFPI7CxuMLkfK0X7aTbM7YGphvMfJxJkjrQdyI7G5d1t4DNi3zkEbBT7FGAr6qPt3Kn9ralpqJKHdpEBA9N0vNwQo5XTYIhUbPQ16IRAgMBAAGjITAfMB0GA1UdDgQWBBRs7tPmfkksSr67KtElHjYZbeaCTjANBgkqhkiG9w0BAQsFAAOCAQEAJqwMZSjQJ36x+1sty6EeLKQLQewQwPaEC47Zut+8bXed6Q8jMZ0bfa/MM7XquEcabaMZLQuKLft44YXwXXQOfQrI2qjQr3eToJFlDT9hR0rfp9wQqttDxd6Aa6RWwDTgo5oKUQCTKLHhEy8uWzScK0eGt2d7TWTaDXjRSwNq6tM7fRhZs07tKBV3xfi9EQy/mlavAMFRBVm86NSo7AsOG1IOMq03U3ooCWAXh9PdvvHNfHhH19futAnC/HeOjwRF1Qc527aBMphYFQLdiThfmfmiE/AhQqCwZ2oE7uCJhBtR+Kb1ZGhjI35pHfsSqGiFa7Kr+5ave822PDcke89Mvg==</X509Certificate>
+        </X509Data>
+      </KeyInfo>
+    </KeyDescriptor>
+    <KeyDescriptor use="signing">
+      <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
+        <X509Data>
+          <X509Certificate>MIIC/TCCAeWgAwIBAgIQbgDHfi3t1JNGVqwD5/7lmjANBgkqhkiG9w0BAQsFADApMScwJQYDVQQDEx5MaXZlIElEIFNUUyBTaWduaW5nIFB1YmxpYyBLZXkwHhcNMjAxMjIxMDAwMDAwWhcNMjUxMjIxMDAwMDAwWjApMScwJQYDVQQDEx5MaXZlIElEIFNUUyBTaWduaW5nIFB1YmxpYyBLZXkwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDFT0/0/2qQurnYa0LbJHF9YYozhEH6r9mCxVDBYbewSG4tGgrWpsewQ/96pcczGMQctMvU+h2eX38Hx/f9JAIDbuRQzQlsPhQS7DDZ6WlTXU+t8d/g2C7fpSoLs4KVdJih4xyjLUWj+BK/ijsRjBt4Riw9VbJH/DdWKyoSMbECEiE+s1RtLP/eYoMmNfxyQGqWirCNqVNBTlqzYQp4dgF0foYy4ktoxwmQOVoTcIMFYp1I4pFPI7CxuMLkfK0X7aTbM7YGphvMfJxJkjrQdyI7G5d1t4DNi3zkEbBT7FGAr6qPt3Kn9ralpqJKHdpEBA9N0vNwQo5XTYIhUbPQ16IRAgMBAAGjITAfMB0GA1UdDgQWBBRs7tPmfkksSr67KtElHjYZbeaCTjANBgkqhkiG9w0BAQsFAAOCAQEAJqwMZSjQJ36x+1sty6EeLKQLQewQwPaEC47Zut+8bXed6Q8jMZ0bfa/MM7XquEcabaMZLQuKLft44YXwXXQOfQrI2qjQr3eToJFlDT9hR0rfp9wQqttDxd6Aa6RWwDTgo5oKUQCTKLHhEy8uWzScK0eGt2d7TWTaDXjRSwNq6tM7fRhZs07tKBV3xfi9EQy/mlavAMFRBVm86NSo7AsOG1IOMq03U3ooCWAXh9PdvvHNfHhH19futAnC/HeOjwRF1Qc527aBMphYFQLdiThfmfmiE/AhQqCwZ2oE7uCJhBtR+Kb1ZGhjI35pHfsSqGiFa7Kr+5ave822PDcke89Mvg==</X509Certificate>
+        </X509Data>
+      </KeyInfo>
+    </KeyDescriptor>
+    <SingleLogoutService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://login.microsoftonline.com/login.srf"/>
+    <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</NameIDFormat>
+    <NameIDFormat>urn:mace:shibboleth:1.0:nameIdentifier</NameIDFormat>
+    <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</NameIDFormat>
+    <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</NameIDFormat>
+    <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</NameIDFormat>
+    <AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://login.microsoftonline.com/login.srf" index="0" isDefault="true"/>
+    <AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST-SimpleSign" Location="https://login.microsoftonline.com/login.srf" index="1"/>
+    <AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:PAOS" Location="https://login.microsoftonline.com/login.srf" index="2"/>
+  </SPSSODescriptor>
+  <Extensions>
+    <alg:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
+    <alg:SigningMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
+  </Extensions>
+</EntityDescriptor>

backend/build/cloudid/root/opt/yunion/share/saml/sp-metadata/gcp.xml

@@ -0,0 +1,25 @@
+<?xml version="1.0"?>
+<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" entityID="google.com" validUntil="2021-06-02T00:00:00Z">
+  <SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol" WantAssertionsSigned="true">
+    <KeyDescriptor use="signing">
+      <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+        <ds:X509Data>
+          <ds:X509Certificate>
+          </ds:X509Certificate>
+        </ds:X509Data>
+      </ds:KeyInfo>
+    </KeyDescriptor>
+    <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</NameIDFormat>
+    <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</NameIDFormat>
+    <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</NameIDFormat>
+    <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</NameIDFormat>
+    <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName</NameIDFormat>
+    <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:WindowsDomainQualifiedName</NameIDFormat>
+    <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:kerberos</NameIDFormat>
+    <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:entity</NameIDFormat>
+    <AssertionConsumerService index="1" isDefault="true" Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://www.google.com/a/yunion-hk.com/acs"/>
+    <AttributeConsumingService index="1">
+      <RequestedAttribute isRequired="false" Name="user.email" FriendlyName="user.email"/>
+    </AttributeConsumingService>
+  </SPSSODescriptor>
+</EntityDescriptor>

backend/build/cloudid/root/opt/yunion/share/saml/sp-metadata/gcp_domain.xml

@@ -0,0 +1,25 @@
+<?xml version="1.0"?>
+<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" entityID="google.com/a/yunion-hk.com" validUntil="2021-06-02T00:00:00Z">
+  <SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol" WantAssertionsSigned="true">
+    <KeyDescriptor use="signing">
+      <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+        <ds:X509Data>
+          <ds:X509Certificate>
+          </ds:X509Certificate>
+        </ds:X509Data>
+      </ds:KeyInfo>
+    </KeyDescriptor>
+    <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</NameIDFormat>
+    <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</NameIDFormat>
+    <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</NameIDFormat>
+    <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</NameIDFormat>
+    <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName</NameIDFormat>
+    <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:WindowsDomainQualifiedName</NameIDFormat>
+    <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:kerberos</NameIDFormat>
+    <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:entity</NameIDFormat>
+    <AssertionConsumerService index="1" isDefault="true" Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://www.google.com/a/yunion-hk.com/acs"/>
+    <AttributeConsumingService index="1">
+      <RequestedAttribute isRequired="false" Name="user.email" FriendlyName="user.email"/>
+    </AttributeConsumingService>
+  </SPSSODescriptor>
+</EntityDescriptor>

backend/build/cloudid/root/opt/yunion/share/saml/sp-metadata/qcloud.xml

@@ -0,0 +1,28 @@
+<?xml version="1.0" encoding="utf-8"?>
+<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" xmlns:saml="urn:oasis:names:tc:SAML:2.0:AssertionConsumerService" entityID="cloud.tencent.com" validUntil="2059-08-15T06:24:31Z">
+  <SPSSODescriptor WantAssertionsSigned="true" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
+    <KeyDescriptor use="signing">
+      <ds:KeyInfo>
+        <ds:X509Data>
+          <ds:X509Certificate>MIIEWzCCA0OgAwIBAgIJAP2Wa/iz6Zn+MA0GCSqGSIb3DQEBBQUAMIHDMQswCQYDVQQGEwJDTjESMBAGA1UECAwJZ3Vhbmdkb25nMREwDwYDVQQHDAhzaGVuemhlbjE2MDQGA1UECgwtVGVuY2VudCBUZWNobm9sb2d5IChTaGVuemhlbikgQ29tcGFueSBMaW1pdGVkMRYwFAYDVQQLDA1UZW5jZW50IENsb3VkMRowGAYDVQQDDBFjbG91ZC50ZW5jZW50LmNvbTEhMB8GCSqGSIb3DQEJARYScWNsb3VkQHRlbmNlbnQuY29tMB4XDTE4MDgxNTA2MjQzMVoXDTE5MDgxNTA2MjQzMVowgcMxCzAJBgNVBAYTAkNOMRIwEAYDVQQIDAlndWFuZ2RvbmcxETAPBgNVBAcMCHNoZW56aGVuMTYwNAYDVQQKDC1UZW5jZW50IFRlY2hub2xvZ3kgKFNoZW56aGVuKSBDb21wYW55IExpbWl0ZWQxFjAUBgNVBAsMDVRlbmNlbnQgQ2xvdWQxGjAYBgNVBAMMEWNsb3VkLnRlbmNlbnQuY29tMSEwHwYJKoZIhvcNAQkBFhJxY2xvdWRAdGVuY2VudC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC7z2KMtR6GS4IzwfFYLSULCrKrr6iUVRlxUhn0y/CjpWXGg31nwvXYmJZaCwjUlorTd3pYDmStmd4xoL3xrGFnqX0xqKw7S+vbB9wo5tSHww15vkiYPanjsgeaiXihBBB6jvsV8+4iuVk8JA3x990/0wic/ZuKIhCI4mLCaQYLXbsYopUPQ5p+dwkCY9pYxP+zjOQathA0cjzKyzp9io2pcH2vtj7RzM+j4sLTsTC+OGfh7k9LQO5/fswQTQKr1B4tmtI8Cq7pUP0Fud1YLjMpod/NRVv1/xIF6cJFP8QARfmC45FPjHToORiXVUV8hii8l4EkXw2bAQO+wqodXJaZAgMBAAGjUDBOMB0GA1UdDgQWBBQ6e8nFUT7oKF+LbOYFH200WR5I0zAfBgNVHSMEGDAWgBQ6e8nFUT7oKF+LbOYFH200WR5I0zAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBBQUAA4IBAQBAIaZDjgCLkWq6fFpp/ViwdEBtLbKNNx2K28z91kTZNE+lepYagqWQIPpTGo69GmO9Qdf/mkspY3Y80Q3MpUO09V3gsiqXQBHD5ZfyRHwmqDjDudLA1SGzMjMT+48XuMq4fdonO1o5fyDh/My9w1LuRZzWw5ZE0JEpKgXq1ynQYz0uEip7KrUVUNoAS2n9jT8APfs16M4p5VRpIYlugnBwR9P2bZba+9fR/SPTa7FX4S8sU649wGPR+49uvic2kwc8FP6AXGurJZhd7mZ44j58q0M/LXm/6wiyUslZ/I0uGhxmRav0cTQz4T1dXKdh2pJZBwz8yMv2P6fuxcFlUeR6</ds:X509Certificate>
+        </ds:X509Data>
+      </ds:KeyInfo>
+    </KeyDescriptor>
+    <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</NameIDFormat>
+    <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:entity</NameIDFormat>
+    <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</NameIDFormat>
+    <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</NameIDFormat>
+    <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:WindowsDomainQualifiedName</NameIDFormat>
+    <AssertionConsumerService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://cloud.tencent.com/login/saml" index="1" isDefault="true"/>
+    <AttributeConsumingService index="1">
+      <ServiceName xml:lang="en"/>
+      <RequestedAttribute FriendlyName="RoleEntitlement" Name="https://cloud.tencent.com/SAML/Attributes/Role" isRequired="true"/>
+      <RequestedAttribute FriendlyName="RoleSessionName" Name="https://cloud.tencent.com/SAML/Attributes/RoleSessionName" isRequired="true"/>
+    </AttributeConsumingService>
+  </SPSSODescriptor>
+  <Organization>
+    <OrganizationName xml:lang="en">Tencent Cloud Services, Inc.</OrganizationName>
+    <OrganizationDisplayName xml:lang="en">Tencent Cloud</OrganizationDisplayName>
+    <OrganizationURL xml:lang="en">https://cloud.tencent.com</OrganizationURL>
+  </Organization>
+</EntityDescriptor>

backend/build/cloudid/root/opt/yunion/share/saml/sp-metadata/volcengine.xml

@@ -0,0 +1,35 @@
+<?xml version="1.0"?>
+<EntityDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata"
+    xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
+    xmlns:ds="http://www.w3.org/2000/09/xmldsig#" entityID="https://www.volcengine.com/">
+    <SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol" WantAssertionsSigned="true">
+        <KeyDescriptor use="signing">
+            <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+                <ds:X509Data>
+                    <ds:X509Certificate>MIIDJjCCAg6gAwIBAgIUF3lH8/cdlQeyPBqt066RFnt3cI4wDQYJKoZIhvcNAQELBQAwJTEjMCEGA1UEAxMadXJuOnZvbGNlbmdpbmU6d2Vic2VydmljZXMwHhcNMjMwODA4MDIzNzI4WhcNMzMwODIxMTYwMDAwWjAlMSMwIQYDVQQDExp1cm46dm9sY2VuZ2luZTp3ZWJzZXJ2aWNlczCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAPZ+nhODpFTe+A8PbuZYA5XDQ04WckV1A5U90tKaaUX5uKLUYfDtFA1TwMO/qG87LU/0Pxs4FhgZJkUOeBHkyYzzXZQvtfsJ9frcKkcTjX/WF4XJyitXCULSjhcclMS3gOqeI/Mo3P90KutfhNli/mAHQJaRsuPFG4ZwBusbUo8i5sqBqt/Sg8JapH7DjEU2mN1165o59gavPGSByPeEuu28EkivVFcI7Jox5ztwgMrOYY+pYP9GeSurzpyLq3CfvvahTsAJjuHDHTTnYNcq/I3VOap/y4cOU6vgxcQvBmgb+CBvGldjn0em3BIn5meQwuB6jfQ7kqBaO1PRD1nhDTMCAwEAAaNOMEwwSgYIKwYBBQUHAQEEPjA8MDoGCCsGAQUFBzABhi5odHRwOi8vbmV4dXMtcHJvZHVjdGlvbi5ieXRlZGFuY2UubmV0L3BjYS9vY3NwMA0GCSqGSIb3DQEBCwUAA4IBAQBxySDr9TPJxRN+otrFDaV8HSeFKUUSO3+r8bEVAXmS+xUsdUOZbaf2r/g+eKrW58dpn+iBWTAAKug9Jwe5KVGqB7G5r2r6k/eI5dvv5r/Fr5T7NppRCXKQTQiAhrrVlqttsagPztJ6LmVAcm4sh4Ckx99FgibQCbT/zui+c6IUyEQcVIwtmoPANl3K2Yn85t+G+Cu9xxXY0JPlZcUHntHg0R0PUWc3LuzLXnff7JWEzPyhMUBLpQk5BltxuD5cTGCA6WafJuBTAqkt48VN0MFTP5c5m3PJFz8Ro1GLY8hw1uhUEx28DKBkQSGpkZNx0oJXETIDpSBfD0dHWBvZQPd0</ds:X509Certificate>
+                </ds:X509Data>
+            </ds:KeyInfo>
+        </KeyDescriptor>
+        <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</NameIDFormat>
+        <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</NameIDFormat>
+        <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</NameIDFormat>
+        <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</NameIDFormat>
+        <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName</NameIDFormat>
+        <NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:WindowsDomainQualifiedName</NameIDFormat>
+        <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:kerberos</NameIDFormat>
+        <NameIDFormat>urn:oasis:names:tc:SAML:2.0:nameid-format:entity</NameIDFormat>
+        <AssertionConsumerService index="1" isDefault="true" Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://signin.volcengine.com/saml/sso"/>
+        <AttributeConsumingService index="1">
+            <ServiceName xml:lang="en">Volcengine Single Sign-On</ServiceName>
+            <RequestedAttribute isRequired="true" Name="https://www.volcengine.com/SAML/Attributes/Identity" FriendlyName="Identity"/>
+            <RequestedAttribute isRequired="true" Name="https://www.volcengine.com/SAML/Attributes/SessionName" FriendlyName="SessionName"/>
+            <RequestedAttribute isRequired="false" Name="https://www.volcengine.com/SAML/Attributes/SessionDuration" FriendlyName="SessionDuration"/>
+
+        </AttributeConsumingService>
+    </SPSSODescriptor>
+    <Organization>
+        <OrganizationName xml:lang="en">Volcengine, Inc.</OrganizationName>
+        <OrganizationDisplayName xml:lang="en">Volcengine</OrganizationDisplayName>
+        <OrganizationURL xml:lang="en">https://www.volcengine.com</OrganizationURL>
+    </Organization>
+</EntityDescriptor>

backend/build/cloudid/vars

@@ -0,0 +1 @@
+DESCRIPTION="Yunion CloudId"

backend/build/cloudnet/root/etc/yunion/cloudnet.conf.sample

@@ -0,0 +1,10 @@
+region = 'Yunion'
+address = '10.168.222.136'
+port = 8891
+auth_uri = 'http://10.168.222.136:35357/v3'
+admin_user = 'cloudnetadmin'
+admin_password = 'xxxxxxxxxxxxxxxx'
+admin_tenant_name = 'system'
+sql_connection = 'mysql+pymysql://yunionansible:9YuQL9KEZn1mppaK@localhost:3306/yunionansible?charset=utf8'
+
+auto_sync_table = True

backend/build/cloudnet/vars

@@ -0,0 +1 @@
+DESCRIPTION="Yunion Cloudnet"

backend/build/convert_rpm2deb.sh

@@ -0,0 +1,23 @@
+#!/bin/bash
+
+set -e
+
+if [ -z "$ROOT_DIR" ]; then
+    ROOT_DIR=$(dirname $(dirname $(readlink -f "$BASH_SOURCE")))
+fi
+
+RPMS_DIR=$ROOT_DIR/_output/rpms
+DEBS_DIR=$ROOT_DIR/_output/debs
+
+case $(uname -m) in
+    x86_64)
+        CURRENT_ARCH=amd64
+        ;;
+    aarch64)
+        CURRENT_ARCH=arm64
+        ;;
+esac
+
+mkdir -p $DEBS_DIR && cd $DEBS_DIR
+
+find $RPMS_DIR -type f -name *.rpm -exec alien --target=$CURRENT_ARCH {} \;

backend/build/devtool/vars

@@ -0,0 +1 @@
+DESCRIPTION="Yunion DevTools Server"

backend/build/dhcprelay/root/etc/sysconfig/yunion_dhcprelay

@@ -0,0 +1,3 @@
+INTERFACE=""
+INTERFACE_IP=""
+RELAY=""

backend/build/dhcprelay/root/usr/lib/systemd/system/yunion-dhcprelay.service

@@ -0,0 +1,22 @@
+[Unit]
+Description=Yunion Cloud DHCP Relay Agent
+Documentation=https://docs.yunion.cn
+After=network-online.target
+Wants=network-online.target
+After=network.target
+
+[Service]
+Type=simple
+EnvironmentFile=-/etc/sysconfig/yunion_dhcprelay
+User=root
+Group=root
+ExecStart=/opt/yunion/bin/dhcprelay --interface "$INTERFACE" --ip "$IP" --relay "$RELAY"
+WorkingDirectory=/opt/yunion/bin
+KillMode=process
+Restart=always
+RestartSec=30
+LimitNOFILE=500000
+LimitNPROC=500000
+
+[Install]
+WantedBy=multi-user.target

backend/build/dhcprelay/vars

@@ -0,0 +1,2 @@
+DESCRIPTION="Yunion Tiny DHCP Relay Server"
+SERVICE="yes"

backend/build/docker/Dockerfile.ansibleserver

@@ -0,0 +1,8 @@
+FROM registry.cn-beijing.aliyuncs.com/yunionio/ansibleserver-base:3.22.2-0
+
+# https://github.com/yunionio/telegraf/blob/yn-release-1.36/Makefile.yn#L28
+# install playbook and telegraf install pkg
+COPY --from=registry.cn-beijing.aliyuncs.com/yunionio/file-repo:v0.5.3 /opt/yunion/playbook /opt/yunion/playbook
+COPY --from=registry.cn-beijing.aliyuncs.com/yunionio/file-repo:v0.5.3 /opt/yunion/ansible-install-pkg /opt/yunion/ansible-install-pkg
+
+ADD ./_output/alpine-build/bin/ansibleserver /opt/yunion/bin/ansibleserver

backend/build/docker/Dockerfile.ansibleserver-base

@@ -0,0 +1,31 @@
+FROM registry.cn-beijing.aliyuncs.com/yunionio/onecloud-base:v3.22.2-0
+
+LABEL maintainer="Yousong Zhou <zhouyousong@yunionyun.com>"
+
+ENV TZ="UTC"
+
+RUN sed -i 's!https://dl-cdn.alpinelinux.org/!https://mirrors.ustc.edu.cn/!g' /etc/apk/repositories
+
+# openssh-client, for ansible ssh connection
+# git, ca-certificates, for fetching ansible roles
+RUN set -x \
+  && apk update \
+  && apk add openssh-client \
+  && apk add sshpass \
+  && apk add py3-pip \
+  && apk add py3-paramiko \
+  && apk add tzdata git ca-certificates
+
+RUN apk add --no-cache openssh openssl curl rsync pv mariadb-client
+RUN apk add --no-cache --virtual .build-dependencies \
+  libffi-dev openssl-dev python3-dev build-base py-setuptools rust cargo mariadb-dev
+
+# ansible should be installed
+# after setuptools and wheel
+RUN rm /usr/lib/python3.*/EXTERNALLY-MANAGED
+RUN pip3 install -U pip setuptools wheel \
+  && pip3 install mysqlclient pywinrm \
+  && pip3 install 'ansible<=9.0.0' \
+  && apk del --no-network .build-dependencies \
+  && rm -rf /root/.cache /root/.cargo /var/cache/apk/*
+

backend/build/docker/Dockerfile.apigateway

@@ -0,0 +1,3 @@
+FROM registry.cn-beijing.aliyuncs.com/yunionio/onecloud-base:v3.22.2-0
+
+ADD ./_output/alpine-build/bin/apigateway /opt/yunion/bin/apigateway

backend/build/docker/Dockerfile.apimap

@@ -0,0 +1,3 @@
+FROM registry.cn-beijing.aliyuncs.com/yunionio/onecloud-base:v3.22.2-0
+
+ADD ./_output/alpine-build/bin/apimap /opt/yunion/bin/apimap

backend/build/docker/Dockerfile.baremetal-agent

@@ -0,0 +1,8 @@
+FROM registry.cn-beijing.aliyuncs.com/yunionio/baremetal-base:v0.3.9-20251215.0
+
+LABEL maintainer="Zexi Li <lizexi@yunionyun.com>"
+
+RUN mkdir -p /opt/yunion/bin
+
+ENV TZ="UTC"
+ADD ./_output/alpine-build/bin/baremetal-agent /opt/yunion/bin/baremetal-agent

backend/build/docker/Dockerfile.baremetal-base

@@ -0,0 +1,89 @@
+#RUN yum install -y https://iso.yunion.cn/vm-images/baremetal-pxerom-1.1.0-21092209.x86_64.rpm
+#RUN yum install -y http://192.168.23.50:8083/baremetal-pxerom-1.1.0-21092209.x86_64.rpm
+FROM registry.cn-beijing.aliyuncs.com/yunionio/yunionos:v4.0.0-20251201.0 as yunionos
+
+FROM centos:8 as grub-stage
+
+RUN sed -i 's/mirrorlist/#mirrorlist/g' /etc/yum.repos.d/CentOS-*
+RUN sed -i 's|#baseurl=http://mirror.centos.org|baseurl=http://vault.centos.org|g' /etc/yum.repos.d/CentOS-*
+RUN dnf install -y grub2*
+
+# make grub_booti386 firmware
+RUN grub2-mkimage -d /usr/lib/grub/i386-pc/ -O i386-pc-pxe -o /root/grub_booti386 -p '/grub' pxe tftp boot linux ext2 xfs ntfs fat part_msdos part_gpt normal biosdisk
+# make grub_bootx64 firmware
+RUN grub2-mkimage -d /usr/lib/grub/x86_64-efi/ -O x86_64-efi -o /root/grub_bootx64.efi -p '/grub' efinet tftp boot linux ext2 xfs ntfs fat part_msdos part_gpt normal efi_gop
+# make grub_arm64 firmware
+RUN grub2-mkimage -d /usr/lib/grub/arm64-efi/ -O arm64-efi -o /root/grub_arm64.efi -p '/grub' efinet tftp boot linux ext2 xfs ntfs fat part_msdos part_gpt normal efi_gop
+
+RUN mkdir -p /tftp/grub
+
+RUN cp /root/grub_booti386 /tftp
+RUN cp -rf /usr/lib/grub/i386-pc /tftp/grub
+
+RUN cp /root/grub_bootx64.efi /tftp
+RUN cp -rf /usr/lib/grub/x86_64-efi /tftp/grub
+
+RUN cp /root/grub_arm64.efi /tftp
+RUN cp -rf /usr/lib/grub/arm64-efi /tftp/grub
+
+
+FROM registry.cn-beijing.aliyuncs.com/yunionio/onecloud-base:v3.22.2-0
+
+LABEL maintainer="Zexi Li <zexi.li@icloud.com>"
+
+RUN mkdir -p /opt/yunion/bin
+
+RUN apk update && \
+    apk add --no-cache ipmitool ethtool tzdata ca-certificates cdrkit coreutils librados librbd && \
+    rm -rf /var/cache/apk/*
+
+RUN mkdir -p /opt/cloud/yunion/baremetal
+
+# udpate latest pci.ids
+RUN wget -O /opt/cloud/yunion/baremetal/pci.ids http://pci-ids.ucw.cz/v2.2/pci.ids
+
+# download baremetal-pxerom-*.x86_64.rpm and unpack rpm in current directory
+#COPY --from=build /opt/cloud/yunion/baremetal/bootia32.efi /opt/cloud/yunion/baremetal
+#COPY --from=build /opt/cloud/yunion/baremetal/bootx64.efi /opt/cloud/yunion/baremetal
+#COPY --from=build /opt/cloud/yunion/baremetal/chain.c32 /opt/cloud/yunion/baremetal
+#COPY --from=build ./opt/cloud/yunion/baremetal/initramfs /opt/cloud/yunion/baremetal
+#COPY --from=build ./opt/cloud/yunion/baremetal/isolinux.bin /opt/cloud/yunion/baremetal
+#COPY --from=build ./opt/cloud/yunion/baremetal/kernel /opt/cloud/yunion/baremetal
+#COPY --from=build ./opt/cloud/yunion/baremetal/ldlinux.c32 /opt/cloud/yunion/baremetal
+#COPY --from=build ./opt/cloud/yunion/baremetal/ldlinux.e32 /opt/cloud/yunion/baremetal
+#COPY --from=build ./opt/cloud/yunion/baremetal/ldlinux.e64 /opt/cloud/yunion/baremetal
+#COPY --from=build ./opt/cloud/yunion/baremetal/libcom32.c32 /opt/cloud/yunion/baremetal
+#COPY --from=build ./opt/cloud/yunion/baremetal/libutil.c32 /opt/cloud/yunion/baremetal
+#COPY --from=build ./opt/cloud/yunion/baremetal/lpxelinux.0 /opt/cloud/yunion/baremetal
+#COPY --from=build ./opt/cloud/yunion/baremetal/menu.c32 /opt/cloud/yunion/baremetal
+#COPY --from=build ./opt/cloud/yunion/baremetal/pxelinux.0 /opt/cloud/yunion/baremetal
+
+# copy grub file
+COPY --from=grub-stage /tftp/grub_booti386 /opt/cloud/yunion/baremetal
+COPY --from=grub-stage /tftp/grub_bootx64.efi /opt/cloud/yunion/baremetal
+COPY --from=grub-stage /tftp/grub_arm64.efi /opt/cloud/yunion/baremetal
+COPY --from=grub-stage /tftp/grub /opt/cloud/yunion/baremetal/grub
+
+# copy boot files from yunionos
+COPY --from=yunionos /yunionos/x86_64/kernel /opt/cloud/yunion/baremetal
+COPY --from=yunionos /yunionos/x86_64/initramfs /opt/cloud/yunion/baremetal
+COPY --from=yunionos /yunionos/aarch64/kernel /opt/cloud/yunion/baremetal/kernel_aarch64
+COPY --from=yunionos /yunionos/aarch64/initramfs /opt/cloud/yunion/baremetal/initramfs_aarch64
+COPY --from=yunionos /yunionos/riscv64/kernel /opt/cloud/yunion/baremetal/kernel_riscv64
+COPY --from=yunionos /yunionos/riscv64/initramfs /opt/cloud/yunion/baremetal/initramfs_riscv64
+
+# TODO: syslinux firmwares should removed in future
+COPY --from=yunionos /yunionos/x86_64/isolinux.bin /opt/cloud/yunion/baremetal
+COPY --from=yunionos /yunionos/x86_64/bootia32.efi /opt/cloud/yunion/baremetal
+COPY --from=yunionos /yunionos/x86_64/bootx64.efi /opt/cloud/yunion/baremetal
+COPY --from=yunionos /yunionos/x86_64/chain.c32 /opt/cloud/yunion/baremetal
+COPY --from=yunionos /yunionos/x86_64/initramfs /opt/cloud/yunion/baremetal
+COPY --from=yunionos /yunionos/x86_64/kernel /opt/cloud/yunion/baremetal
+COPY --from=yunionos /yunionos/x86_64/ldlinux.c32 /opt/cloud/yunion/baremetal
+COPY --from=yunionos /yunionos/x86_64/ldlinux.e32 /opt/cloud/yunion/baremetal
+COPY --from=yunionos /yunionos/x86_64/ldlinux.e64 /opt/cloud/yunion/baremetal
+COPY --from=yunionos /yunionos/x86_64/libcom32.c32 /opt/cloud/yunion/baremetal
+COPY --from=yunionos /yunionos/x86_64/libutil.c32 /opt/cloud/yunion/baremetal
+COPY --from=yunionos /yunionos/x86_64/lpxelinux.0 /opt/cloud/yunion/baremetal
+COPY --from=yunionos /yunionos/x86_64/menu.c32 /opt/cloud/yunion/baremetal
+COPY --from=yunionos /yunionos/x86_64/pxelinux.0 /opt/cloud/yunion/baremetal

backend/build/docker/Dockerfile.climc

@@ -0,0 +1,7 @@
+FROM registry.cn-beijing.aliyuncs.com/yunionio/climc-base:3.22.2-2
+
+ADD ./build/climc/root/opt /opt
+
+RUN cp /opt/yunion/scripts/motd/climc.sh /etc/profile.d/climc.sh && ln -sf /etc/profile.d/climc.sh /root/.bashrc
+
+ADD ./_output/alpine-build/bin/climc ./_output/alpine-build/bin/*cli /opt/yunion/bin/

backend/build/docker/Dockerfile.climc-base

@@ -0,0 +1,24 @@
+FROM registry.cn-beijing.aliyuncs.com/yunionio/onecloud-base:v0.3.5
+
+ARG TARGETPLATFORM
+ARG BUILDPLATFORM
+ARG TARGETARCH
+
+LABEL maintainer="Zexi Li <lizexi@yunionyun.com>"
+
+ENV TZ="Asia/Shanghai"
+
+RUN mkdir -p /opt/yunion/bin
+
+RUN echo http://dl-cdn.alpinelinux.org/alpine/edge/testing >>/etc/apk/repositories
+
+RUN apk add --no-cache bash bash-completion tzdata ca-certificates vim ipmitool ceph-common dropbear shadow && \
+    rm -rf /var/cache/apk/*
+
+RUN usermod --shell /bin/bash root
+
+RUN curl https://iso.yunion.cn/binaries/kubernetes-release/release/v1.22.9/bin/linux/${TARGETARCH}/kubectl -o /usr/bin/kubectl && chmod a+x /usr/bin/kubectl
+
+RUN cp /usr/share/zoneinfo/Asia/Shanghai /etc/localtime
+
+RUN mkdir -p /opt/yunion/bin

backend/build/docker/Dockerfile.climc-base-3-22-2

@@ -0,0 +1,24 @@
+FROM registry.cn-beijing.aliyuncs.com/yunionio/onecloud-base:v3.22.2-0
+
+ARG TARGETPLATFORM
+ARG BUILDPLATFORM
+ARG TARGETARCH
+
+LABEL maintainer="Zexi Li <lizexi@yunionyun.com>"
+
+ENV TZ="Asia/Shanghai"
+
+RUN mkdir -p /opt/yunion/bin
+
+RUN echo http://dl-cdn.alpinelinux.org/alpine/edge/testing >>/etc/apk/repositories
+
+RUN apk add --no-cache bash bash-completion tzdata ca-certificates vim ipmitool ceph-common dropbear shadow && \
+    rm -rf /var/cache/apk/*
+
+RUN usermod --shell /bin/bash root
+
+RUN curl -L https://iso.yunion.cn/binaries/kubernetes-release/release/v1.22.9/bin/linux/${TARGETARCH}/kubectl -o /usr/bin/kubectl && chmod a+x /usr/bin/kubectl
+
+RUN cp /usr/share/zoneinfo/Asia/Shanghai /etc/localtime
+
+RUN mkdir -p /opt/yunion/bin

backend/build/docker/Dockerfile.cloudevent

@@ -0,0 +1,3 @@
+FROM registry.cn-beijing.aliyuncs.com/yunionio/onecloud-base:v3.22.2-0
+
+ADD ./_output/alpine-build/bin/cloudevent /opt/yunion/bin/cloudevent

backend/build/docker/Dockerfile.cloudid

@@ -0,0 +1,4 @@
+FROM registry.cn-beijing.aliyuncs.com/yunionio/onecloud-base:v3.22.2-0
+
+COPY ./build/cloudid/root/opt/ /opt/
+ADD ./_output/alpine-build/bin/cloudid /opt/yunion/bin/cloudid

backend/build/docker/Dockerfile.cloudmon

@@ -0,0 +1,8 @@
+FROM registry.cn-beijing.aliyuncs.com/yunionio/onecloud-base:v3.22.2-0
+
+LABEL maintainer="Zexi Li <lizexi@yunionyun.com>"
+
+RUN mkdir -p /etc/yunion/data/
+
+ADD   ./_output/alpine-build/bin/cloudmon \
+      /opt/yunion/bin/

backend/build/docker/Dockerfile.cloudnet

@@ -0,0 +1,3 @@
+FROM registry.cn-beijing.aliyuncs.com/yunionio/onecloud-base:v3.22.2-0
+
+ADD ./_output/alpine-build/bin/cloudnet /opt/yunion/bin/cloudnet