Core Concepts

Before you log in for the first time, it helps to understand a handful of concepts that the rest of the documentation refers to constantly. This page is a quick orientation — follow the links for the full detail.

OpenStack

OpenStack is the open-source cloud infrastructure platform that runs underneath everything. It manages your virtual machines, networks, storage, and identities. You interact with it either through the Cloud Services Portal (the higher-level management UI) or directly through OpenStack Horizon (the raw OpenStack web UI) and the OpenStack CLI.

OpenStack Documentation

The Cloud Services Portal

The Cloud Services Portal is the central web interface for managing your cloud resources. From here you manage projects, clients, users, S3 object storage, backups, quotas, and usage. Most day-to-day tasks happen here rather than in raw OpenStack.

Cloud Services Portal Quickstart

Clients and Projects

Two concepts structure how your resources are organised:

• Client — the top-level administrative unit. A client groups users and billing, and contains one or more projects.
• Project — the actual OpenStack project (tenant). Resources like VMs, networks, and storage live inside a project. When you create a VM, you create it in a project.

Users and Permissions

Users are managed in the Cloud Services Portal under Organisation Management. Permission profiles (e.g. User vs User-Adm) are configured under Dashboard Management. Permissions are not all in one place:

• Cloud Services Portal permissions (e.g. who can manage users) are set under Organisation Management and Dashboard Management.
• OpenStack / resource permissions are set within the respective panel sections, such as Quota, Usage, OpenStack, or S3 Storage Management.

The menu items you see depend heavily on your subscription (order) and your permissions, so your view may differ from a colleague's.

Quotas

A quota is a limit on how much of a resource (CPU, RAM, storage, number of VMs, etc.) a project can consume. Quotas prevent any single project from exhausting the shared infrastructure. You can request quota changes through the portal.

Quota Management

Regions and Availability Zones

The platform is deployed across two geographically separated regions in Switzerland, each containing three availability zones. Understanding the difference is essential for placing your workloads correctly.

Region

A region is a fully independent OpenStack deployment. The platform offers two:

Resources created in one region are not visible in the other. However, your project spans both regions — you can deploy VMs in Zurich and Geneva under the same project. Note that quotas apply per region and S3 buckets are region-specific, while EC2 credentials and users are region-independent.

Availability Zone

An availability zone (AZ) is a physically isolated section within a region. Each region contains three AZs:

When you deploy a VM, you choose an AZ. A VM cannot be moved to another AZ later. Routers and network services (DHCP, metadata) are deployed highly available across all AZs of a region by default.

Network relationship

The key difference between regions and AZs is at the network level:

• Region 1 (ch-zh1, Zurich) uses OVS (Open vSwitch) with VXLAN tunneling. Private Layer 2 networks stretch across all three AZs — a VM in ch-zh1-az1 and a VM in ch-zh1-az3 communicate on the same private subnet without any gateway or tunnel configuration.
• Region 2 (ch-ge1, Geneva) uses OVN (Open Virtual Network) with GENEVE tunneling. The effect is the same — private L2 across all AZs — but OVN is the newer, more flexible networking backend.
• Regions are not coupled. There is no stretched Layer 2 network between Zurich and Geneva. Cross-region communication requires floating IPs, a VPN, or a dedicated interconnect.

%%{init: {'themeVariables': {'textColor': '#333333', 'edgeLabelBackground': '#ffffff', 'clusterBkg': 'transparent', 'clusterBorder': '#999999'}}}%%
flowchart TD
    subgraph ZH ["Region ch-zh1 · Zurich · OVS/VXLAN"]
        AZ1["AZ1"] --- AZ2["AZ2"]
        AZ2 --- AZ3["AZ3"]
        AZ3 --- AZ1
    end
    subgraph GE ["Region ch-ge1 · Geneva · OVN/GENEVE"]
        GE1["AZ1"] --- GE2["AZ2"]
        GE2 --- GE3["AZ3"]
        GE3 --- GE1
    end
    ZH -.-|"No stretched L2<br>Floating IP / VPN"| GE

    classDef az fill:#e3f2fd,stroke:#1565c0,color:#0d47a1;
    class AZ1,AZ2,AZ3,GE1,GE2,GE3 az;
    linkStyle 0,1,2,3,4,5 stroke:#1565c0,stroke-width:2px;
    linkStyle 6 stroke:#e65100,stroke-width:3px,stroke-dasharray:10 5;

%%{init: {'themeVariables': {'textColor': '#e0e0e0', 'edgeLabelBackground': '#2a2a2a', 'clusterBkg': 'transparent', 'clusterBorder': '#666666'}}}%%
flowchart TD
    subgraph ZH ["Region ch-zh1 · Zurich · OVS/VXLAN"]
        AZ1["AZ1"] --- AZ2["AZ2"]
        AZ2 --- AZ3["AZ3"]
        AZ3 --- AZ1
    end
    subgraph GE ["Region ch-ge1 · Geneva · OVN/GENEVE"]
        GE1["AZ1"] --- GE2["AZ2"]
        GE2 --- GE3["AZ3"]
        GE3 --- GE1
    end
    ZH -.-|"No stretched L2<br>Floating IP / VPN"| GE

    classDef az fill:#1a3a5c,stroke:#64b5f6,color:#e3f2fd;
    class AZ1,AZ2,AZ3,GE1,GE2,GE3 az;
    linkStyle 0,1,2,3,4,5 stroke:#64b5f6,stroke-width:2px;
    linkStyle 6 stroke:#e65100,stroke-width:3px,stroke-dasharray:10 5;

Comparison

Next step

Now that you know the building blocks, learn how to log in for the first time.