Setting Up a KVM Hypervisor Host in Apache CloudStack

Table of contents +

Introduction

KVM Compute Host

A compute host is a physical server running the Kernel-based Virtual Machine (KVM) hypervisor. Apache CloudStack uses these hosts to provide the CPU, memory, networking and virtualization resources required to run virtual machines.

The CloudStack Management Server controls the compute hosts and handles operations such as virtual machine deployment, lifecycle management, networking, storage integration and monitoring.

Version

Apache CloudStack 4.19

This tutorial was created using Apache CloudStack 4.19.

Before you begin

✓You should have root access to the KVM host.
✓ Confirm the correct network interfaces before modifying Netplan.
✓ Verify the static IP address, subnet and gateway before applying network changes.

CloudStack Agent

Add the Apache CloudStack repository

Add the CloudStack package repository and install the CloudStack agent together with the networking and SSH utilities required by the compute host.

Root privileges required

The commands in this section modify APT repositories and install system packages.

Terminal bash

mkdir -p /etc/apt/keyrings
wget -O- http://packages.shapeblue.com/release.asc | gpg --dearmor | sudo tee /etc/apt/keyrings/cloudstack.gpg > /dev/null
echo deb [signed-by=/etc/apt/keyrings/cloudstack.gpg] http://packages.shapeblue.com/cloudstack/upstream/debian/4.19 / > /etc/apt/sources.list.d/cloudstack.list
apt update -y
apt install cloudstack-agent openssh-server bridge-utils net-tools -y

Networking

Configure network bridges and a static IP

CloudStack KVM hosts commonly use Linux bridges to connect virtual machines to the physical network. In this example,cloudbr0andcloudbr1are configured using Netplan.

Network

Check your interfaces first

Your interfaces may not be named enp0s3 and enp0s8 . Confirm the interface names, gateway and static IP addresses for your own network.

Netplan configuration yaml

network:
version: 2
renderer: NetworkManager
ethernets:
    enp0s3: {}
    enp0s8: {}
bridges:
    cloudbr0:
        addresses: [192.168.1.101/24]
        dhcp4: false
        routes:
            - to: default
            via: 192.168.1.1
        nameservers:
            addresses: [8.8.8.8, 8.8.4.4]
            search: []
        interfaces: [enp0s3]
        parameters:
            stp: true
    cloudbr1:
        dhcp4: false
        interfaces: [enp0s8]
        parameters:
            stp: true

After saving the Netplan configuration, apply it:

Terminal bash

netplan apply

Console Access

Enable VNC for the Console Proxy

Configure QEMU so that VNC listens on all interfaces. This allows the CloudStack Console Proxy to establish console connections to virtual machines hosted on the KVM server.

Terminal bash

sed -i -e 's/#vnc_listen.*$/vnc_listen = "0.0.0.0"/g' /etc/libvirt/qemu.conf

libvirt

Enable libvirtd listen mode

Configure the libvirt daemon to start in listen mode so CloudStack can communicate with the virtualization service.

Terminal bash

echo LIBVIRTD_ARGS="--listen" >> /etc/default/libvirtd

systemd

Mask socket-based libvirt services

Disable the socket-activated libvirt units so the daemon can use the listen configuration defined for the CloudStack host.

Terminal bash

systemctl mask libvirtd.socket libvirtd-ro.socket libvirtd-admin.socket libvirtd-tls.socket libvirtd-tcp.socket

libvirt

Configure the libvirt daemon

Add the required libvirt daemon configuration used by the KVM host.

/etc/libvirt/libvirtd.conf config

echo 'listen_tls=0' >> /etc/libvirt/libvirtd.conf
echo 'listen_tcp=0' >> /etc/libvirt/libvirtd.conf
echo 'tls_port = "16514"' >> /etc/libvirt/libvirtd.conf
echo 'tcp_port = "16509"' >> /etc/libvirt/libvirtd.conf
echo 'mdns_adv = 0' >> /etc/libvirt/libvirtd.conf
echo 'auth_tcp = "none"' >> /etc/libvirt/libvirtd.conf

Service

Restart libvirtd

Restart the virtualization daemon so the changes made in the previous steps take effect.

Terminal bash

systemctl restart libvirtd

AppArmor

Disable AppArmor for libvirt

Disable the relevant AppArmor profiles for libvirt and the virtualization helper.

Terminal bash

ln -s /etc/apparmor.d/usr.sbin.libvirtd /etc/apparmor.d/disable/
ln -s /etc/apparmor.d/usr.lib.libvirt.virt-aa-helper /etc/apparmor.d/disable/
apparmor_parser -R /etc/apparmor.d/usr.sbin.libvirtd
apparmor_parser -R /etc/apparmor.d/usr.lib.libvirt.virt-aa-helper

SSH

Configure the SSH authorized key

The CloudStack Management Server requires SSH access to the compute host. Display the public key generated by your Management Server:

Management Server bash

cat /var/lib/cloudstack/management/.ssh/id_rsa.pub

On the KVM compute host, open the authorized keys file:

KVM Host bash

nano ~/.ssh/authorized_keys

Copy the public key from the Management Server and paste it into theauthorized_keysfile on the compute host.

Use your own CloudStack SSH key

Every CloudStack installation generates its own SSH key. Do not copy an example public key from another installation.

✓

KVM Host complete

Your KVM host is ready for CloudStack.

The compute host now has the CloudStack agent, Linux bridges, libvirt configuration, console access and SSH authentication required for integration with the Management Server.