Abiquo 6.0
This document walks through the features that support resellers on the Abiquo multicloud platform and describes the easy steps to set up a reseller hierarchy in the platform.
This section describes the features of the Abiquo multicloud platform that support resellers and their customers in both private cloud and public cloud (Azure CSP and Amazon resellers in the APN).
Customers may have further levels, for example, departments. So an example of a full reseller hierarchy could be:
Diagram: an example of a reseller hierarchy.
Abiquo resellers can work with all supported private and public cloud providers, and there are several features specifically designed for Amazon and Azure partners.
The Abiquo UI is HTML5 and you can easily brand it with CSS themes. There are two main branding elements: the login pages and the tenant themes.
You can brand the login page to replace the logo and background image.
For each tenant, you can add a logo, main menu icons, a custom color scheme, and more.
And for the browser tabs, you can brand the favicon.
For more details, see Abiquo branding guide
So for example, you can give users full access to resources in private cloud and read-only access to resources in public cloud. By default users have full access to all of their virtual datacenters. A VDC role replaces the user’s role within one or more virtual datacenters.
The administrator can set a default virtual datacenter role for a tenant in a provider, or a region, and they can update specific virtual datacenters with custom roles. For example, AWS virtual datacenters could always be read only, if the administrator sets a VIEWER role to replace a USER role.
The role restriction applies to cloud users only, not administrators, and it is also possible to create exceptions for specific users.
See also:
Outsource cloud services with restricted VApps
Abiquo supports provider services at the VM configuration level with restricted virtual appliances (VApps). Abiquo VApps contain groups of VMs that can be related. You can perform actions on all the VMs in a VApp, for example, you can deploy them together. Any user with the privilege to Restrict a VM can move a VM to a restricted VApp, even if they cannot manage or view the restricted VApp. This feature works with the Move VM functionality.
A cloud user could simply mark a checkbox to outsource a VM. Whereas the administrator can select or create a new restricted VApp.
A restricted VApp is invisible to the cloud user but it is still part of the VDC with access to VDC resources, the administrator can manage it as usual, and it is accounted in the platform as part of the tenant's resources.
The dashboard widgets import billing data from public cloud, for Amazon, Azure and Google, and it also supports the addition of custom billing data via API. It displays the latest bills and the estimated bills. The administrator can configure the dashboard to display data for reseller and partner accounts and their customers, as well as for customers who wish to use accounts that were obtained directly from the provider. The platform controls the display of the hybrid billing dashboard with privileges. This feature requires the reseller or tenant to configure programmatic billing in the provider.
Screenshot: Details of the latest bills
Screenshot: Estimated bill
Administrators can request an update of public cloud billing on demand if they have the privilege to Generate billing. The administrator edits an enterprise and goes to the Credentials tab, and then clicks the play arrow Generate billing button beside the Create account button.
On the Generate billing dialog, the administrator can enter the dates to generate bills for, and select the enterprises, including enterprises in their reseller hierarchy.
To enable you to easily manage public cloud pricing, the platform can retrieve price lists from public cloud providers (such as Amazon and Azure). These prices are for Linux VMs without any applications installed. You can later manually edit these prices or use the default to update them every 24 hours. This feature synchronizes price lists for customers of resellers (with markup) and standard customers.
Administrators will need to add pricing credentials with access to pricing for public cloud accounts for either resellers or standard customers.
See Synchronize public cloud price lists.
The platform makes it easy to administer a hierarchy because usually an administrator will only manage their own tenant's users and those in their direct scope. And they will manage templates and blueprints for their own tenant. The administrator can then delegate administration to scopes beneath their scope. And share VM templates and configuration blueprints with them. So, for example, a resellers' customers could manage their own users, local VM templates, and so on. And these customers can even have their own hierarchies and delegate administration to their departments.
Administrators can store metadata for each tenant, for example, an account ID, as well as values of provider pricing markups, currencies, and so on. To store metadata, administrators create enterprise properties, which have a key and a value. Cloud administrators can create hidden, read-only, read-write properties
Tenant administrators can usually display read-only properties and create and update read-write properties.
In Abiquo administrators create an organization hierarchy using Scopes. First of all, the cloud administrator should define the tenants (enterprises) that a user will administer (users, templates, etc), and create an access list, which is the User scope. Then they should define the related enterprises, for which they will delegate administration. These access lists will also be scopes, but below the user's scope in the hierarchy, as child scopes of the parent scope. The cloud administrator can create a tree structure with as many levels as necessary.
For billing and reporting, the cloud administrator can define the "top of the branch" enterprises, which could be the customer headquarters or similar.
An Abiquo scope is an access list that you can assign to tenants and you can define the scope hierarchy by selecting a Parent scope of the scope.
First we create a scope for the reseller, which is below the Global scope.
We will select the locations that an administrator with this scope can manage.
Then we will create a scope for a customer tenant of the reseller. The customer scope has the reseller scope as its parent scope. Select the cloud providers and datacenters and later add the enterprise to its own scope.
In this case, we create the scopes first and select the locations that the administrators can manage. Later we will add the enterprises to their scopes. This means that the administrators in these enterprises can manage the users, templates, and so on.
To create a reseller enterprise, you should mark the enterprise with the Reseller flag. You will also need to enter pricing credentials, the provider discount, and create a base pricing model. Remember that you can only have one reseller per scope (enterprise default scope). When you configure the billing dashboard, enter the reseller's credentials. The platform will then identify the reseller's customers using their compute credentials, for example, the AWS access ID.
See Create a reseller enterprise
Create reseller pricing models
The platform provides a pricing estimate for deploying a virtual appliance when the user clicks the pricing button, usually marked with a currency symbol.
An administrator can assign the same pricing model to multiple enterprises and clone pricing models to create new ones. Administrators can set resource prices per location in multiple currencies. Administrators can use cost codes to set prices for templates and hardware profiles. The platform combines pricing models with usage data to generate billing data that is output in CSV files.
For resellers, the platform can import prices for hardware profiles from public cloud. The pricing model from a reseller is the base for a pricing model for the customers created by the reseller. The reseller can set markup for customers, on top of the base pricing model. Customers can only display their own prices.
Create a reseller pricing model and assign it to your resellers. For more details, see Create a new pricing model and Create reseller pricing models.
To create a reseller administrator, you will first need to define their role, with the privileges they will have to perform actions on the platform.
A reseller role with minimum restrictions could grant the administrator the following privileges:
The cloud administrator can create reseller customer enterprises centrally or delegate this work to the reseller, in which case the reseller administrator will require the Manage enterprises privilege. Note that this will mean that reseller administrator can also edit their own enterprise if it is in their scope.
Screenshot: Create the user and assign the reseller administrator role.
To ensure that the appropriate base pricing model is available, the reseller administrator with pricing privileges should log in to create the customer pricing model.
You can create a customer with one or more tenant enterprises. The main customer enterprise is the "key node" of each customer organization, for example, it would represent the headquarters of an organization.
When you create the main customer enterprise, mark the Key node flag. If this enterprise is the customer of a public cloud reseller, then you do not need to enter pricing credentials. You should create tenant properties for markup, and a customer ID. The platform will automatically propagate pricing models and price lists to this tenant, with markup. Remember that you can only have one key node per scope (Enterprise default scope). In scopes below the key node enterprise, you should then create any other enterprises to represent other parts of the customer organization, for example, departments of a business, stores in a retail chain.
As an AWS or Azure partner with a reseller hierarchy in Abiquo, you can now enter partner customer credentials as "only for billing" to display their public cloud billing data on their Abiquo dashboards. This functionality was previously available in Abiquo for Azure, and it is now available for AWS too.
In AWS in version 6.0 this functionality only supports accounts that are customers of an AWS partner account.
If your customer has their own AWS account, please see Add a customer AWS account to Abiquo for billing only
In 6.0.0, in the AWS billing dashboard configuration for resellers and standard accounts, you must enter the new amazon_bucket_region enterprise property
To use this functionality, you must have a reseller enterprise with pricing credentials in the same scope or a parent scope.
You can enter the following public cloud credentials:
For both types of accounts, for the Secret access key, enter a random password.
When you enter the credentials, mark the Only for billing checkbox. For customers with these credentials, there will be no compute access using Abiquo.
If users will not use the compute feature, you do not need to create an IAM user or an application, as for compute accounts.
To create accounts for a reseller customer:
Abiquo will automatically create the account in the cloud provider and add the credentials to the reseller customer's enterprise.
To display the prices for your tenant: