6.1 Cloud on z/VM components An enterprise cloud might be composed of various components, depending on its main  purpose. Implementing an Infrastructure as a Service (IaaS) cloud in z/VM demands the  integration of some important components. The following components play a role in the  integration of a cloud in z/VM: Note:  The CMA description in this publication that refers to CMA 6.4 (Newton) and the  support for the Cloud Manager Appliance (CMA) on z/VM v7.1 is a transitional offer until a  strategic long-term solution to replace the CMA is available. For more information, see IBM  Cloud Private documentation at this web page. The Cloud Manager Appliance 6.4 is available for z/VM v7.1 for the specific use case with  IBM Cloud Private only. For more information, contact your IBM representative. The xCAT MN and the ZHCP server now both run within the OPNCLOUD virtual machine. z/VM supports the following system roles, which control the set of services that are running  inside the OPNCLOUD virtual machine: Runs cloud controller services (such as glance image services) and all services that are  listed under the compute_mn role. z/VM also runs the xCAT MN and ZHCP services to  allow the controller to manage OpenStack z/VM hosts. Runs compute services (nova-compute service), networking services (neutron-zvm-agent  service), and telemetry services (ceilometer-polling) for the z/VM hypervisor. z/VM also  runs the ZHCP service to allow a remote xCAT MN service to manage hosts. GLYPH<SM590000> The z/VM Directory Manager (DirMaint) or a supported equivalent software provides a  command-driven interface to manage z/VM directory entries. GLYPH<SM590000> The z/VM Systems Management Application Programming Interface (SMAPI) provides  programmatic access for managing many virtual images that are running on a single z/VM  image by using a standard, platform-independent client interface, which reduces the  number of z/VM-specific programming skills that are required. GLYPH<SM590000> An External Security Manager (ESM) (such as IBM Resource Access Control Facility  [RACF]) provides more resource protection beyond DIRMAINT and SMAPI authorizations.  An ESM is optional, but implementing it might ensure that the company security policy is  met. For more information about how to implement RACF, see Chapter 4, “IBM Resource  Access Control Facility Security Server for IBM z/VM” on page 55. GLYPH<SM590000> A Virtual Switch (VSWITCH) provides network connectivity between the management  components to allow command-driven requests to come from the z/VM platform or other  network -connected locations. They also provide the networks on to which newly  provisioned instances are connected. GLYPH<SM590000> The z/VM Cloud Manager Appliance (CMA) that is available is version 6.4 and is based on  Newton. It provides an easy method to deploy z/VM OpenStack enablement. OpenStack  products and solutions can be constructed to use as many or as few of the services as  needed, whether that means that the CMA runs cloud controller services, compute node  services, or only services that are needed by OpenStack z/VM drivers running in other  virtual machines (VMs) or on other platforms. GLYPH<SM590000> CMA controller GLYPH<SM590000> CMA compute 158  Securing Your Cloud: IBM Security for LinuxONE