Creating an Image

Scenarios

Create an image using the ISO file uploaded through Uploading to an OBS Bucket.

Procedure

1. Log in to the management console.
2. In the left navigation pane, choose Images. The Images page is displayed.
3. On the Private Image tab page, click Create Image. The Create Image page is displayed.
4. During image creation, Workspace needs to be authorized to access user resources. The system will create the following agencies and grant the required permissions to them, as shown in Table 1.
   

   During image creation, the agency created by the user cannot be deleted. Otherwise, the image will fail to be created.

   Table 1 Agency description

   Agency Name	Permission Name	Description
   workspace_trust_for_image_creation	Workspace ImageCreationAgencyPolicy	Used to authorize Workspace to access and manage the image creation server and network resources during image creation.
   workspace_trust_for_image_server	Workspace ImageServerAgencyPolicy	Used to authorize the image creation server to access Workspace during image creation.

5. Configure basic settings.

   Table 2 Basic configuration description

   Basic Settings	Parameter Description	Example
   Name	Custom image name. Only letters, digits, spaces, hyphens (-), underscores (_), and periods (.) are supported. It cannot start or end with a space.	Workspace_Image
   Description (Optional)	Enter a description.	-
   Used for	Desktop: image used to provision cloud desktops. Cloud application: image used to provision cloud applications. Multi-session image Single-session image	Desktop
   Encapsulation	No: Images that are not encapsulated can be provisioned more rapidly. Yes: In AD scenarios, you can encapsulate images if there are application requirements. However, the provisioning duration is longer than that in non-encapsulation scenarios.	No

6. Select an image file.

   Select the image file uploaded in Uploading to an OBS Bucket.

7. Configure the OS.
   

   Automatic identification based on the selected image file is supported. If the system identifies that the architecture in the image file is different from what you select here, the identified architecture will be used instead. If the system fails to identify an architecture, the architecture you select here will be used.

8. Select a boot mode.
   • Windows 10 and Windows Server: Select BIOS or UEFI as required.
   • Windows 11: Select UEFI.

9. (Optional) Configure a secure boot certificate.
   

   The system provides a default certificate. This parameter is displayed only when Windows 11 is selected.

10. Set the disk capacity.

    Enter the required disk capacity based on service requirements.

    

    Ensure that the entered size is not smaller than the system disk size of the image file.

11. (Optional) Configure image encryption.
    1. Select image encryption. The image encryption page is displayed.
    2. Select the Select existing key option.
       1. Select the required key from the Key Name drop-down list.
       2. Click OK.
    3. Select Enter key ID.
       1. Enter a key ID in the text box.

          You can view the key ID in the key list.

       2. Click OK.

    A KMS key can be custom, default, or shared.

    • Shared keys: You can use Data Encryption Workshop (DEW) to create grants that allow other accounts to use your keys. For details, see Creating a Grant.
    • Custom keys: You can select an existing key or create a key. For details about how to create a custom key, see Creating a Custom Key.
    • Key sharing via resources: You can use Resource Access Manager (RAM) to share your keys with other accounts via resource sharing. For details, see Sharing Your Resources.
      

      • When you use Key Management Service (KMS) to encrypt images, the system automatically grants the key to the Workspace service account for creating and using encrypted images for Workspace.
      • You are advised not to remove the related authorization (grant_to_workspace_xxx). Otherwise, the desktop functions encrypted by the key will be affected. For example, if the authorization is removed, the desktop cannot be started properly.

12. Configure the image creation server.
    • Select the required specifications based on service requirements.
    • Set the retention period of the image creation service. The value ranges from 60 to 2880 minutes.
      

      • The image creation server is used as a temporary VM. Do not attach disks to or detach disks from the server. Otherwise, the image creation may be affected.
      • After an image is created, the system automatically deletes the image if the retention period expires. You can also manually delete the image as required after the image is created.

13. Configure enterprise projects and tags.
    1. Select the required enterprise project from the drop-down list based on service requirements.
    2. Click Add.
    3. Enter the tag key and value and click Add. Table 3 describes the naming rules.
       

       You can add up to 10 tags to an image.

       Table 3 Tag naming rules

       Parameter	Rule
       Tag key	The value cannot be empty. The value can contain up to 36 characters. A tag key can contain letters, digits, spaces, and special characters (_.:=+-@), but it cannot start or end with a space or start with _sys_. Each tag key must be unique on the same desktop.
       Tag value	The value can contain up to 43 characters. A tag value can contain letters, digits, spaces, and special characters (_.:/=+-@).

14. Select I have read and agree to Commitment Statement of Image Creation and Image Disclaimer and click OK.
    A message is displayed, indicating that the image server is being prepared.

    

    The time required for registering an image file as a private image varies depending on the image file size. Wait until it is complete.