Setting Up a Management Server in Apache CloudStack

Table of contents+

Introduction

Management Server

The Management Server is one of the central components in an Apache CloudStack environment. It acts as the cloud control plane and coordinates the resources that make up the infrastructure.

It is responsible for functions such as user authentication, resource provisioning, virtual machine lifecycle management, and infrastructure monitoring.

Version

Apache CloudStack 4.19

This tutorial was created using Apache CloudStack 4.19.

Installation

Add the repository for Apache CloudStack

The setup used in this tutorial installs Apache CloudStack 4.19 from the ShapeBlue package repository.

Root privileges required

The commands in this section are intended to be run from a root shell.

Terminal bash

mkdir -p /etc/apt/keyrings
wget -O- http://packages.shapeblue.com/release.asc | gpg --dearmor | sudo tee /etc/apt/keyrings/cloudstack.gpg > /dev/null
echo deb [signed-by=/etc/apt/keyrings/cloudstack.gpg] http://packages.shapeblue.com/cloudstack/upstream/debian/4.19 / > /etc/apt/sources.list.d/cloudstack.list
apt update -y
apt install cloudstack-management mysql-server net-tools -y

MySQL

Configure MySQL settings

Open the MySQL server configuration file:

Terminal bash

nano /etc/mysql/mysql.conf.d/mysqld.cnf

Under the[mysqld]section, add the following configuration:

/etc/mysql/mysql.conf.d/mysqld.cnf config

server_id=1
sql-mode="STRICT_TRANS_TABLES,NO_ENGINE_SUBSTITUTION,ERROR_FOR_DIVISION_BY_ZERO,NO_ZERO_DATE,NO_ZERO_IN_DATE,NO_ENGINE_SUBSTITUTION"
innodb_rollback_on_timeout=1
innodb_lock_wait_timeout=600
max_connections=1000
log-bin=mysql-bin
binlog-format='ROW'

MySQL Authentication

Login to MySQL

Open the MySQL client as the root database user.

Terminal bash

mysql -u root -p

Environment note

Password used in this setup

In the environment used for this tutorial, the default MySQL root password was blank, so Enter was pressed at the password prompt.

Inspect the current MySQL authentication settings, set a password for the root user, and change the root authentication plugin tomysql_native_password.

MySQL sql

SELECT user,authentication_string,plugin,host FROM mysql.user;
ALTER USER 'root'@'localhost' IDENTIFIED WITH mysql_native_password BY 'password';
use mysql;
UPDATE user SET plugin="mysql_native_password" WHERE User='root';
flush privileges;
\q

Change the example password

The valuepasswordis only the value used in the original example. Use an appropriate password for your own environment.

MySQL

Restart the MySQL service

Restart MySQL so the configuration changes are applied.

Terminal bash

systemctl restart mysql

Networking

Set up a static IP address using Netplan

The Management Server should use a stable IP address. The original tutorial uses192.168.1.100/24on interfaceenp0s3.

Network

Check your network first

Confirm that the gateway is correct for your network and verify that the IP address you plan to assign is not already in use.

Netplan configuration yaml

network:
version: 2
renderer: NetworkManager
ethernets:
    enp0s3:
        addresses: [192.168.1.100/24]
        nameservers:
            addresses: [8.8.8.8, 8.8.4.4]
        routes:
            - to: default
            via: 192.168.1.1

After saving the Netplan configuration, apply it:

Terminal bash

netplan apply

Hostname

Add the static IP address to /etc/hosts

Update the hosts file so the Management Server's hostname resolves to its static IP address.

Hostname

Comment out the old hostname entry

The tutorial comments out 127.0.1.1 ubuntu1 and maps ubuntu1 to the static address instead.

/etc/hosts config

127.0.0.1       localhost
#127.0.1.1      ubuntu1
192.168.1.100   ubuntu1

# The following lines are desirable for IPv6 capable hosts
::1     ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters

SSH

Get the CloudStack SSH authorized key

Display the public SSH key generated for the CloudStack Management Server:

Terminal bash

cat /var/lib/cloudstack/management/.ssh/id_rsa.pub

You will need the public key from your own Management Server when configuring the compute node.

Do not copy the sample key

Your CloudStack installation generates its own SSH key. The key below is only the sample output from the original tutorial.

Sample SSH public key public key

ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC7BhkJlLiglLzgeOjPE+0FBy6q6ICOTFWvRODfqGuKnS4YbOebo5j0IdIVFnDuItAiEcTuEZxatr0osvZLD/zrG0HGLcNZgsV+EA8+xdGQgwQOS7LQa3diloAfTu/RGS2V3ZKRSK/mLKhBYyhJfKWAuo59MxfYm9XETja/cuN/1eCb0bFs65md6NwT/wL9JSM9x5WBJufB67gPBLRa06+alN13rHaqm2hB5P0/yd4lCmJMQLTe0FgejqG+mwjQt2fQTMtmBF2AyBvrQu8d5pbuPGwP+OfzMD3hQhrbrZZj5M4ctxHUhB9s57CVzB6CDFllRM8ASy2JVJMoE1AEEAVdgp8Dq/dmnvA3988lEEdRA4l8Tm4taLByAwbmH/WHwVlWv/mmGGiQ6UETYBw5Vx1SmPLxMFffgVxLdHVYYDLY/t+0oEFSC+gipD3nhhEkSIIFyjVirVaWe+zzhQpqt662F9xHzAWN72ln5TkCSL3qKZ4/MOg9hCyL7V0r6knYzos= cloud@ubuntu1

CloudStack Database

Set up the Apache CloudStack database

Initialize the databases that CloudStack uses for configuration and operational data.

machinepassword

Your Ubuntu password

password

Your MySQL password

Terminal bash

cloudstack-setup-databases cloud:machinepassword@localhost --deploy-as=root:password

Management Server

Set up the Management Server

After the CloudStack database has been initialized, run the Management Server setup command.

Terminal bash

cloudstack-setup-management

Dashboard

Open the Apache CloudStack dashboard

Once the Management Server is running, open the CloudStack web interface in your browser.

Address

Use your own Management Server address

The IP address below is the address from the original example. Your Management Server may use a different address.

Browser url

http://192.168.1.100:8080/client

✓

Management Server complete

Your CloudStack control plane is now set up.

The next part of the CloudStack deployment is preparing a KVM hypervisor that can provide compute resources for virtual machines.

Firewall

Allow the required firewall ports

If UFW is enabled on the Management Server, allow the ports required by Apache CloudStack before continuing. These ports are used by the CloudStack web interface and internal management services.

Required ports

8080

CloudStack web interface and Management Server access.

8250

Used by CloudStack for communication with system components and agents.

8443

Used for secure CloudStack management communication.

NFS

Required when the Management Server needs to communicate with NFS-based primary or secondary storage.

Allow the CloudStack TCP ports with UFW:

Terminal bash

ufw allow 8080 
ufw allow 8250 
ufw allow 8443

If this server also needs access to NFS services, allow the appropriate NFS traffic for your environment.

Terminal bash

ufw allow nfs

Restrict firewall access when possible

For production environments, avoid exposing management ports to the entire Internet. Restrict access to trusted management networks, hosts, or internal interfaces whenever possible.

After adding the rules, verify the current UFW configuration:

Terminal bash

ufw status