Apache CloudStack Documentation

repository·main·Indexed 25 days ago

https://github.com/apache/cloudstack

An open-source Infrastructure as a Service (IaaS) platform for deploying and managing large-scale virtual machine networks. This documentation covers compute orchestration, networking, and user management via Web UI, CLI, and API, with detailed guides on implementing and deploying Network Orchestrator extensions using scripts (Bash, Python, Go) to manage custom network devices, firewall rules, and VPCs.

Tokens
51.7K
Snippets
55
Records
354
Agent score
85%

What's inside Apache CloudStack

  1. Overview of the CloudStack Angular UI (ngui)

    main
    The ngui tool provides a user interface for Apache CloudStack built using Angular.js. It includes a Flask wrapper that sits on top of the CloudStack API to simplify client-side interactions and facilitate easier communication with the CloudStack backend.
  2. Overview of Apache CloudStack

    main

    Apache CloudStack is an open-source Infrastructure as a Service (IaaS) platform designed to deploy and manage large networks of virtual machines. It provides compute orchestration, Network-as-a-Service, user and account management, a native API, resource accounting, and a User Interface (UI).

    Supported hypervisors include:

    • VMware vSphere
    • KVM
    • XenServer
    • XenProject
    • Hyper-V
    • OVM
    • LXC containers
  3. Overview of Apache CloudStack architecture

    main

    Apache CloudStack is an open-source Infrastructure-as-a-Service (IaaS) orchestration platform. It manages virtual machines across various hypervisors (KVM, VMware, XenServer/XCP-ng, Hyper-V, baremetal-bridge, OVM) and various storage types (NFS, Ceph/RBD, iSCSI, SMB, primary-storage plugins, S3-compatible secondary storage).

    Key components include:

    • Management Server: A Java/Tomcat-style servlet server backed by MariaDB/MySQL that exposes a signed REST/JSON API.
    • Agents: Software running on each hypervisor host to orchestrate resources.
    • System VMs: Specialized VMs including the Secondary Storage VM, Console Proxy VM, and virtual routers.
    • Authorization: Uses RBAC (Role-Based Access Control) combined with a multi-tenant domain/account/project hierarchy.
  4. Understand the CloudStack Deployment Shape

    main

    Apache CloudStack is a distributed IaaS control plane, not a single-binary appliance or a hosted SaaS. A typical deployment consists of:

    • Management Servers: One or more instances. Smaller clouds use a single instance; larger deployments use a cluster behind a load balancer.
    • Database: A MariaDB or MySQL instance.
    • Usage Server: One instance.
    • System VMs: An optional set of VMs including SecondaryStorageVM, ConsoleProxyVM, and VirtualRouter.
    • Agents/Bridges: A cloudstack-agent running on each hypervisor host (for KVM/baremetal) or out-of-process resource bridges (for VMware, XenServer, XCP-ng, or Hyper-V).

    The operator is responsible for managing the surrounding networks (management, public, guest, and storage networks) and the physical hosts.

  5. Understand the CloudStack UI style architecture

    main

    The CloudStack UI uses Less for styling. The main entry point is src/styles/index.less, which imports Ant Design Vue styles along with custom variables and rules.

    Key entry points for Less files include:

    • dist/antd.less: Imports everything via index.less and components.less.
    • lib/style/index.less:
      • themes/default.less: Contains color/colors and default theme @variables.
      • core/index.less: Includes base styles, motion rules, and iconfont.
  6. Understand the CloudStack Security Threat Model scope

    main

    CloudStack's security model defines specific boundaries for what is considered a vulnerability. It is not a defender against:

    • The Operator: Users with root access to management or hypervisor hosts, raw MariaDB credentials, or the JCEKS keystore/Root CA private key are considered to have unbounded power.
    • Malicious External Services: Hostile LDAP, SAML, OAuth, S3, or storage providers (e.g., Ceph) are treated as trusted control-plane peers.
    • The Hypervisor: Vulnerabilities in KVM, VMware, Xen, or Hyper-V (e.g., guest escapes or libvirt privilege escalations) are upstream issues.
    • Authorized Admin Actions: A root administrator performing actions they are already authorized to do (e.g., changing global config or uploading templates) is not a vulnerability.
    • Guest VM Isolation: CloudStack manages the orchestration of guest placement but is not responsible for hypervisor-level isolation (e.g., side-channel attacks or resource limit enforcement).
    • Template/ISO Sandboxing: CloudStack does not parse or sanitize the semantics of cloud-init, user-data, or metadata passed to guests.
    • Unsupported Components: Tools like marvin, cloud-cli, or devcloud are out of scope. Additionally, vulnerabilities in vendored upstream libraries (e.g., Bouncy Castle, Spring, log4j) should be reported upstream.
  7. Configure VirtualBox network adapters for DevCloud4

    main

    To use the DevCloud4 environment, you must manually configure three Host-Only network adapters in VirtualBox settings. Navigate to the Network tab and then the Host-only Networks tab, and configure the adapters as follows:

    AdapterIPv4 IP AddressSubnetDHCP Server
    vboxnet0192.168.22.1255.255.255.0Disabled
    vboxnet1192.168.23.1255.255.255.0Disabled
    vboxnet2192.168.24.1255.255.255.0Disabled
  8. Manage Images, Templates, and ISOs

    main

    Handle deployment images in the UI:

    Templates:

    • Register or upload local templates
    • Edit, copy, or delete templates
    • Update template permissions
    • Download templates

    ISOs:

    • Register or upload local ISOs
    • Edit, copy, or delete ISOs
    • Download ISOs

    Kubernetes ISOs:

    • Enable/disable Kubernetes ISOs
    • Add specific Kubernetes versions
  9. Deploy a Network Extension Script

    main

    After creating an extension, you must deploy your executable to the management server. CloudStack resolves the executable in this order:

    1. <extensionPath>/<extensionName>.sh (Preferred)
    2. <extensionPath> (if it is a regular executable file)

    The <extensionPath> is typically /usr/share/cloudstack-management/extensions/<extensionName>/. If you have multiple management servers, the script must be deployed to every one.

    SCRIPT_PATH=$(cmk listExtensions name=my-sdn | jq -r '.[0].path')
    # e.g. /usr/share/cloudstack-management/extensions/my-sdn/
    mkdir -p "${SCRIPT_PATH}"
    cp my-sdn.sh "${SCRIPT_PATH}/my-sdn.sh"
    chmod 755    "${SCRIPT_PATH}/my-sdn.sh"
  10. Implement a CloudStack Adaptive Volume Storage Provider

    main
    To create a custom volume storage provider for CloudStack using the Adaptive Plugin Base, you must implement a decoupled interface that manages volumes (e.g., via FiberChannel) through an external storage API. This process involves three main steps: implementing the provider interface, extending the primary datastore provider plugin, and providing the necessary configuration for CloudStack to load the module.