apache · rajujith · Feb 27, 2024 · Apr 8, 2024 · Apr 11, 2024 · Apr 11, 2024
diff --git a/README.rst b/README.rst
@@ -90,7 +90,7 @@ On your computer, follow these steps to setup a local repository for working on
 .. code:: bash
 
    $ git clone https://github.com/YOUR_ACCOUNT/cloudstack-documentation.git
-   $ cd cloudstack-docs-install
+   $ cd cloudstack-documentation
    $ git remote add upstream https://github.com/apache/cloudstack-documentation.git
    $ git checkout main
    $ git fetch upstream

diff --git a/requirements.txt b/requirements.txt
@@ -2,4 +2,4 @@ docutils==0.20.1
 Sphinx==7.2.6
 sphinx-rtd-theme==2.0.0
 readthedocs-sphinx-ext==2.2.5
-Jinja2==3.1.3
+Jinja2==3.1.5
diff --git a/source/_global.rst b/source/_global.rst
@@ -25,19 +25,19 @@
 
 .. Latest version systemvm template name
 
-.. |sysvm64-version|     replace:: 4.19.1
-.. |sysvm64-name-xen|    replace:: systemvm-xenserver-4.19.1
-.. |sysvm64-name-kvm|    replace:: systemvm-kvm-4.19.1
-.. |sysvm64-name-vmware| replace:: systemvm-vmware-4.19.1
-.. |sysvm64-name-hyperv| replace:: systemvm-hyperv-4.19.1
-.. |sysvm64-name-ovm|    replace:: systemvm-ovm-4.19.1
+.. |sysvm64-version|     replace:: 4.20.0
+.. |sysvm64-name-xen|    replace:: systemvm-xenserver-4.20.0-x86_64
+.. |sysvm64-name-kvm|    replace:: systemvm-kvm-4.20.0-x86_64
+.. |sysvm64-name-vmware| replace:: systemvm-vmware-4.20.0-x86_64
+.. |sysvm64-name-hyperv| replace:: systemvm-hyperv-4.20.0-x86_64
+.. |sysvm64-name-ovm|    replace:: systemvm-ovm-4.20.0-x86_64
 
 .. Latest version systemvm template URL
-.. |sysvm64-url-xen|    replace:: http://download.cloudstack.org/systemvm/4.19/systemvmtemplate-4.19.1-xen.vhd.bz2
-.. |sysvm64-url-kvm|    replace:: http://download.cloudstack.org/systemvm/4.19/systemvmtemplate-4.19.1-kvm.qcow2.bz2
-.. |sysvm64-url-vmware| replace:: http://download.cloudstack.org/systemvm/4.19/systemvmtemplate-4.19.1-vmware.ova
-.. |sysvm64-url-hyperv| replace:: http://download.cloudstack.org/systemvm/4.19/systemvmtemplate-4.19.1-hyperv.vhd.zip
-.. |sysvm64-url-ovm|    replace:: http://download.cloudstack.org/systemvm/4.19/systemvmtemplate-4.19.1-ovm.raw.bz2
+.. |sysvm64-url-xen|    replace:: http://download.cloudstack.org/systemvm/4.20/systemvmtemplate-4.20.0.0-x86_64-xen.vhd.bz2
+.. |sysvm64-url-kvm|    replace:: http://download.cloudstack.org/systemvm/4.20/systemvmtemplate-4.20.0.0-x86_64-kvm.qcow2.bz2
+.. |sysvm64-url-vmware| replace:: http://download.cloudstack.org/systemvm/4.20/systemvmtemplate-4.20.0.0-x86_64-vmware.ova
+.. |sysvm64-url-hyperv| replace:: http://download.cloudstack.org/systemvm/4.20/systemvmtemplate-4.20.0.0-x86_64-hyperv.vhd.zip
+.. |sysvm64-url-ovm|    replace:: http://download.cloudstack.org/systemvm/4.20/systemvmtemplate-4.20.0.0-x86_64-ovm.raw.bz2
 
 .. Images
 

diff --git a/source/_static/images/B&R-Backup-Respository.png b/source/_static/images/B&R-Backup-Respository.png
diff --git a/source/_static/images/account-limits.png b/source/_static/images/account-limits.png
diff --git a/source/_static/images/add-remove-sharedfs-network.png b/source/_static/images/add-remove-sharedfs-network.png
diff --git a/source/_static/images/cks-acquire-publicip.png b/source/_static/images/cks-acquire-publicip.png
diff --git a/source/_static/images/cks-addfirewall.png b/source/_static/images/cks-addfirewall.png
diff --git a/source/_static/images/cks-addloadbalancer.png b/source/_static/images/cks-addloadbalancer.png
diff --git a/source/_static/images/cks-addnode.png b/source/_static/images/cks-addnode.png
diff --git a/source/_static/images/create-sharedfs-admin.png b/source/_static/images/create-sharedfs-admin.png
diff --git a/source/_static/images/create-sharedfs.png b/source/_static/images/create-sharedfs.png
diff --git a/source/_static/images/create-webhook.png b/source/_static/images/create-webhook.png
diff --git a/source/_static/images/default-login.png b/source/_static/images/default-login.png
diff --git a/source/_static/images/deploy-vm-arch-types.png b/source/_static/images/deploy-vm-arch-types.png
diff --git a/source/_static/images/dynamic-routing-as-number-ranges.png b/source/_static/images/dynamic-routing-as-number-ranges.png
diff --git a/source/_static/images/dynamic-routing-as-numbers.png b/source/_static/images/dynamic-routing-as-numbers.png
diff --git a/source/_static/images/dynamic-routing-bgp-peers.png b/source/_static/images/dynamic-routing-bgp-peers.png
diff --git a/source/_static/images/dynamic-routing-change-network-bgp-peers.png b/source/_static/images/dynamic-routing-change-network-bgp-peers.png
diff --git a/source/_static/images/dynamic-routing-change-vpc-bgp-peers.png b/source/_static/images/dynamic-routing-change-vpc-bgp-peers.png
diff --git a/source/_static/images/edit-user-api-key-access.png b/source/_static/images/edit-user-api-key-access.png
diff --git a/source/_static/images/filter-user-api-key-access.png b/source/_static/images/filter-user-api-key-access.png
diff --git a/source/_static/images/forgot-password.png b/source/_static/images/forgot-password.png
diff --git a/source/_static/images/manage-ipv4-subnets-for-networks.png b/source/_static/images/manage-ipv4-subnets-for-networks.png
diff --git a/source/_static/images/manage-ipv4-subnets-for-zone.png b/source/_static/images/manage-ipv4-subnets-for-zone.png
diff --git a/source/_static/images/management-server-peers.png b/source/_static/images/management-server-peers.png
diff --git a/source/_static/images/management-server-statistics.png b/source/_static/images/management-server-statistics.png
diff --git a/source/_static/images/management-servers-list.png b/source/_static/images/management-servers-list.png
diff --git a/source/_static/images/nsx-phy-networks.png b/source/_static/images/nsx-phy-networks.png
diff --git a/source/_static/images/nsx-provider.png b/source/_static/images/nsx-provider.png
diff --git a/source/_static/images/nsx-public-traffic.png b/source/_static/images/nsx-public-traffic.png
diff --git a/source/_static/images/reset-password.png b/source/_static/images/reset-password.png
diff --git a/source/_static/images/restart-sharedfs.png b/source/_static/images/restart-sharedfs.png
diff --git a/source/_static/images/routed-add-network-cidrsize.png b/source/_static/images/routed-add-network-cidrsize.png
diff --git a/source/_static/images/routed-add-network-offering.png b/source/_static/images/routed-add-network-offering.png
diff --git a/source/_static/images/routed-add-vpc-offering.png b/source/_static/images/routed-add-vpc-offering.png
diff --git a/source/_static/images/routed-ipv4-routes.png b/source/_static/images/routed-ipv4-routes.png
diff --git a/source/_static/images/routed-ipv4-routing-firewall.png b/source/_static/images/routed-ipv4-routing-firewall.png
diff --git a/source/_static/images/sharedfs-access-tab.png b/source/_static/images/sharedfs-access-tab.png
diff --git a/source/_static/images/template-upload-from-local.png b/source/_static/images/template-upload-from-local.png
diff --git a/source/_static/images/webhook-deliveries.png b/source/_static/images/webhook-deliveries.png
diff --git a/source/_static/images/webhooks.png b/source/_static/images/webhooks.png
diff --git a/source/_static/images/zone-capacities.png b/source/_static/images/zone-capacities.png
diff --git a/source/adminguide/accounts.rst b/source/adminguide/accounts.rst
@@ -632,7 +632,7 @@ Using OAuth2 Authentication For Users
 
 OAuth2, the industry-standard authorization or authentication framework, simplifies the process of
 granting access to resources. CloudStack supports OAuth2 authentication wherein users can login into
-CloudStack without using username and password. CloudStack currently supports Google and Github providers.
+CloudStack without using username and password. CloudStack currently supports Google and GitHub providers.
 Other OAuth2 providers can be easily integrated with CloudStack using its plugin framework.
 
 For admins, the following are the settings available at global level to configure OAuth2.
@@ -671,12 +671,12 @@ To register the OAuth provider client ID, redirect URI, secret key have to provi
 OAuth 2.0 has to be first configured in the corresponding provider to obtain the client ID, redirect URI, secret Key.
 
 For Google, please follow the instructions mentioned here `"Setting up OAuth 2.0 in Google" <https://support.google.com/cloud/answer/6158849?hl=en>`_.
-For Github, please follow the instructions mentioned here `"Setting up OAuth 2.0 in Github" <https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/creating-an-oauth-app>`_.
+For GitHub, please follow the instructions mentioned here `"Setting up OAuth 2.0 in GitHub" <https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/creating-an-oauth-app>`_.
 
 In any OAuth 2.0 configuration admin has to use the redirect URI "http://<management server IP>:<port>/#/verifyOauth"
 
 .. Note:: [Google OAuth 2.0 redirect URI] :
-          Google OAuth 2.0 configuration wont accept '#' in the URI, please use "http://<management server Domain>:<port>/?verifyOauth"
+          Google OAuth 2.0 configuration won't accept '#' in the URI, please use "http://<management server Domain>:<port>/?verifyOauth"
           Google does not accept direct IP address in the redirect URI, it must be a domain. As a workaround one can add the management
           server IP to host table in the local system and assign a domain, something like "management.cloud". In that redirect URI looks like
           "http://management.cloud:8080/?verifyOauth"
@@ -807,4 +807,153 @@ The admin can also disable 2FA for a User using the action button as shown below
           If the admin themself loses the authenticator application or forgets the static PIN, then the admin
           will have to either use apikey to disable 2FA using the API setupUserTwoFactorAuthentication with
           enable flag to false or to do the database changes in 'user' table by clearing the columns
-          'is_user_2fa_enabled', 'key_for_2fa', 'user_2fa_provider' for the specific entry.
+          'is_user_2fa_enabled', 'key_for_2fa', 'user_2fa_provider' for the specific entry.
+
+Password Recovery for Users (Forgot Password)
+---------------------------------------------
+
+CloudStack supports password recovery using email. To enable this feature,
+set global setting `user.password.reset.enabled` to `true`. The following
+global settings are available to configure SMTP for password recovery.
+
+
+.. list-table:: Password Recovery Global Settings
+   :header-rows: 1
+
+   * - Global setting
+     - Default
+     - Description
+   * - ``user.password.reset.enabled``
+     - `false`
+     - Determines whether password recovery via email is enabled or not.
+   * - ``user.password.reset.ttl``
+     - `30`
+     - TTL in minutes for the token generated to reset the ACS user's password.
+   * - ``user.password.reset.email.sender``
+     - `null`
+     - Sender for emails sent to the user to reset ACS user's password
+   * - ``user.password.reset.smtp.host``
+     - `null`
+     - Host for SMTP server
+   * - ``user.password.reset.smtp.port``
+     - `25`
+     - Port for SMTP server
+   * - ``user.password.reset.smtp.useAuth``
+     - `false`
+     - Use auth in the SMTP server
+   * - ``user.password.reset.smtp.username``
+     - `null`
+     - Username for SMTP server
+   * - ``user.password.reset.smtp.password``
+     - `null`
+     - Password for SMTP Server
+   * - ``user.password.reset.mail.template``
+     - `Hello {{username}}!`
+
+       `You have requested to reset your password. Please click the following link to reset your password:``
+
+       `http://{{{resetLink}}}`
+
+       `If you did not request a password reset, please ignore this email.`
+
+
+       `Regards,`
+
+       `The CloudStack Team`
+     - Template of mail sent to the user to reset ACS user's password. This uses
+       mustache template engine. Available variables are: `username`, 
+       `firstName`, `lastName`, `resetLink`, `token`.
+
+
+Once the global settings are configured, follow the below steps to reset the
+password for a user:
+
+#. Open the "Forgot Password" link on the login page.
+
+   .. figure:: /_static/images/default-login.png
+      :align:   center
+
+#. Enter your username and domain name and click on "Submit".
+
+   .. figure:: /_static/images/forgot-password.png
+      :align:   center
+
+#. An email will be sent to the User with a link to reset the password.
+
+#. Open the link in the email and set the new password.
+
+   .. figure:: /_static/images/reset-password.png
+      :align:   center
+
+Using API Key and Secret Key based Authentication
+-------------------------------------------------
+Users can generate API key and Secret key to directly access CloudStack APIs.
+This authenctication method is used for programatically calling CloudStack APIs and thus helps in automation.
+The API key uniquely identifies the Account, while the Secret key is used to generate a secure singnature.
+When making an API call, the API key and signature are included along with the command and other parameters,
+and sent to the CloudStack API endpoint. For detailed information, refer to the CloudStack's Programmer Guide.
+
+Disabling Api Key and Secret Key based Access
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+Root Administrators may choose to Disable Api key based access for certain Users, Accounts or Domains.
+Or the Administrator may choose to Disable Api Key based access globally and allow only for certain users.
+This could be particularly useful in cases where external authorization mechanisms like LDAP, SAML or OAuth2 are used,
+as then Api key based authorization is the only means for automation.
+This gives control to the Admin over who is allowed to run automation.
+
+Api key based access is enabled by default but it can be disabled (or enabled) at different granularities:
+
+1. Users
+
+Setting for a User can be changed through the Api Key Access field in the Edit User form, visible only to the Root Administrator.
+Three values are possible: Disable, Enable and Inherit. Inherit means that the User will inherit whatever value is set for the Account.
+
+    .. figure:: /_static/images/edit-user-api-key-access.png
+       :align:  center
+
+Admins can also search for Users having the required Api key access value using the User list view search filter.
+
+    .. figure:: /_static/images/filter-user-api-key-access.png
+       :align:  center
+
+2. Accounts
+
+Similar to Users, Api Key Access field is present in the Edit Account Form and the Account list view search filter, only for the Root Administrator. 
+If the value is set to Inherit, it means that Account will inherit whatever value is set for the Domain.
+
+3. Domains
+
+Api Key Access at Domain level is controlled by the Domain level setting "api.key.access". If the Domain level
+configuration is not set, then similar to other configurations it will consult the global value.
+
+4. Global
+
+The global value of the configuration setting "api.key.access" is set to 'True' by default. So Api Key Access at
+all levels is enabled by default. If the global value is changed to 'False' without setting any of the lower levels,
+then Api Key Access will be disabled for all Users.
+
+Order of Precedence
+^^^^^^^^^^^^^^^^^^^
+The local value always takes precedence over the global value. So if Api key access is disabled for a User but
+enabled for an Account, the User authorisation will still fail. Only if the User's Api key access is set to
+'Inherit', the Account's Api Key Access value is considered.
+Similarly if Account's Api Key Access is set to 'Inherit', only then the Domain level setting is considered,
+And only if the Domain level configuration is not set, the Global configuration is considered.
+
+Examples
+^^^^^^^^
+
+#. Disallow Api key access for all Accounts and Users in a Domain.
+
+    #. Leave all User and Account level Api Key Access values to the default 'Inherit'.
+    #. Set the Domain level setting "api.key.access" to False only for the required domain.
+
+#. Disallow Api key access for some Users, but allowed globally.
+
+    #. Set the User level permission to ‘Disabled’ only for the required Users.
+    #. All upper level permissions should either be Inherit or Enabled.
+
+#. Allow Api key access to some Users, but disallowed globally.
+
+    #. Set User level permission to ‘Enabled’ only for the required Users.
+    #. All upper level permissions should either be Inherit or Disabled.
diff --git a/source/adminguide/api.rst b/source/adminguide/api.rst
@@ -64,12 +64,16 @@ the user data:
 #. Run the following command to find the virtual router.
 
    .. code:: bash
+
       # cat /var/lib/dhclient/dhclient-eth0.leases | grep dhcp-server-identifier | tail -1
+
 #. Access user data by running the following command using the result of
    the above command
 
    .. code:: bash
+
       # curl http://10.1.1.1/latest/user-data
+
 Meta Data can be accessed similarly, using a URL of the form
 http://10.1.1.1/latest/meta-data/{metadata type}. (For backwards
 compatibility, the previous URL http://10.1.1.1/latest/{metadata type}
@@ -169,7 +173,7 @@ VMdata - a list of String arrays representing [“directory”, “filename”,
 
     - meta_data.json
 
-    - Network_data.json
+    - network_data.json
 
   - label, which is configurable in global settings:
 

diff --git a/source/adminguide/arch_types.rst b/source/adminguide/arch_types.rst
@@ -0,0 +1,30 @@
+.. Licensed to the Apache Software Foundation (ASF) under one
+   or more contributor license agreements.  See the NOTICE file
+   distributed with this work for additional information#
+   regarding copyright ownership.  The ASF licenses this file
+   to you under the Apache License, Version 2.0 (the
+   "License"); you may not use this file except in compliance
+   with the License.  You may obtain a copy of the License at
+   http://www.apache.org/licenses/LICENSE-2.0
+   Unless required by applicable law or agreed to in writing,
+   software distributed under the License is distributed on an
+   "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+   KIND, either express or implied.  See the License for the
+   specific language governing permissions and limitations
+   under the License.
+
+
+Hosts/Cluster Arch Types Allocation
+===================================
+
+Since CloudStack 4.20.0, it is possible to add AMD 64 bits and ARM 64 bits clusters (and hosts). A single zone can contain clusters (and hosts) of different arch types (multi-arch zones). 
+
+When a multi-arch zone is selected for VM deployment, CloudStack allows the users to filter the templates/ISOs by their arch type.
+
+|deploy-vm-arch-types.png|
+
+Once a template/ISO is selected, only the clusters (and hosts) matching the arch type will be considered for the VM allocation
+
+.. |deploy-vm-arch-types.png| image:: /_static/images/deploy-vm-arch-types.png
+   :alt: Filtering templates and ISOs by arch types
+
diff --git a/source/adminguide/autoscale_with_virtual_router.rst b/source/adminguide/autoscale_with_virtual_router.rst
@@ -14,7 +14,7 @@
    under the License.
 
 
-Configuring AutoScale with using CloudStack Virtual Router
+Configuring AutoScale with the CloudStack Virtual Router
 =============================================
 
 

diff --git a/source/adminguide/backup_and_recovery.rst b/source/adminguide/backup_and_recovery.rst
@@ -28,13 +28,17 @@ The following providers are currently supported:
 
 - VMware with Veeam Backup and Recovery
 - KVM with DELL EMC Networker
+- KVM with NAS B&R Plugin (4.20 onwards)
 
 See the Veeam Backup and Recovery plugin documentation for plugin specific information.
-:ref:`Veeam Backup and Recovery Plugin`
+:ref:`Veeam Backup and Replication Plugin`
 
 See the DELL EMC Networker Backup and Recovery plugin documentation for plugin specific information.
 :ref:`DELL EMC Networker Backup and Recovery Plugin`
 
+See the NAS Backup and Recovery plugin documentation for plugin specific information.
+:ref:`NAS Backup and Recovery Plugin`
+
 
 Backup and Recovery Concepts
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
@@ -73,7 +77,7 @@ the Global Settings area of the CloudStack UI.
 Configuration                     Description
 ================================= ========================
 backup.framework.enabled          Setting to enable or disable the feature. Default: false.
-backup.framework.provider.plugin  The backup provider (plugin) name. For example: 'dummy', 'veeam' and 'networker'. This is a zone specific setting. Default: dummy.
+backup.framework.provider.plugin  The backup provider (plugin) name. For example: 'dummy', 'veeam', 'networker' and 'nas'. This is a zone specific setting. Default: dummy.
 backup.framework.sync.interval    Background sync task internal in seconds that performs metrics/usage stats collection, backup reconciliation and backup scheduling. Default: 300.
 ================================= ========================
 
@@ -88,7 +92,7 @@ Backup Offerings
 ------------------
 
 Admins can import an external provider's backup offerings using UI or API for a
-particular zone, as well as manage a backup offering's lifecyle. Admins can also
+particular zone, as well as manage a backup offering's lifecycle. Admins can also
 specify if a backup offering allows user-defined backup schedules and ad-hoc
 backups. Users can list and consume the imported backup offerings, only root admins can import or
 delete offerings.