Jakson Tate

Posted on Aug 20 Originally published at servermo.com

Deploy Apache CloudStack on Ubuntu 24.04: Build a Private AWS

#devops #ubuntu #cloud #kvm

The ultimate VMware Escape Plan. Master cloud repatriation, secure KVM hypervisors, and slash enterprise IT costs natively on ServerMO Bare Metal.

The Era of Cloud Repatriation

Organizations face two massive shifts: hyper-inflated public cloud bills (AWS/Azure) and exorbitant VMware license renewals post-Broadcom acquisition.

Enterprises are executing aggressive cloud repatriation strategies. When comparing CloudStack vs OpenStack vs OpenNebula, CTOs quickly realize that OpenStack requires a dedicated DevOps team to maintain its modular dependency hell. Conversely, Apache CloudStack is a monolithic, turnkey platform that gives you a "Private AWS" out-of-the-box.

Phase 1: Network Bridge Configuration (Netplan)

To provide VPC routing, isolated guest networks, and floating IPs, CloudStack requires total control over a Linux Bridge. You must strip the IP address from your physical Network Interface Card (NIC) and assign it to a bridge.

⚠️ SRE ARCHITECTURE WARNING: Physical NIC DHCP

You MUST disable DHCP on your physical ethernet interface (e.g., eth0). If the physical NIC and the bridge both try to claim an IP address, your server will experience a catastrophic routing loop and disconnect from the network.

Edit /etc/netplan/01-netcfg.yaml:

network:
  version: 2
  renderer: networkd
  ethernets:
    eth0:
      dhcp4: false
      dhcp6: false
  bridges:
    cloudbr0:
      addresses: [192.168.1.10/24] # Your Bare Metal Server IP
      routes:
        - to: default
          via: 192.168.1.1
      nameservers:
        addresses: [8.8.8.8, 1.1.1.1]
      interfaces: [eth0]
      parameters:
        stp: false
        forward-delay: 0

Apply the configuration safely:

sudo netplan try
sudo netplan apply

Phase 2: Hardening the KVM Hypervisor

CloudStack uses KVM as its primary open-source hypervisor. Installing KVM on Ubuntu 24.04 introduces systemic challenges, specifically regarding libvirtd socket activation and AppArmor blocking API calls.

🚨 CRITICAL SRE ALERT: The Ubuntu 24.04 Libvirt Trap

Ubuntu 24.04 uses socket-based activation for libvirt. CloudStack requires legacy TCP listening. If you do not mask these sockets and disable AppArmor for libvirt, your Virtual Machines will silently fail to start during deployment.

# Install KVM & CloudStack Agent
sudo apt update && sudo apt install -y qemu-kvm cloudstack-agent

# Mask socket listeners to force legacy mode
sudo systemctl mask libvirtd.socket libvirtd-ro.socket libvirtd-admin.socket libvirtd-tls.socket libvirtd-tcp.socket

# Ensure disable directory exists and disable AppArmor for Libvirt
sudo mkdir -p /etc/apparmor.d/disable/
sudo ln -s /etc/apparmor.d/usr.sbin.libvirtd /etc/apparmor.d/disable/
sudo apparmor_parser -R /etc/apparmor.d/usr.sbin.libvirtd

# Configure Libvirt TCP Listening
echo 'listen_tls=0' | sudo tee -a /etc/libvirt/libvirtd.conf
echo 'listen_tcp=1' | sudo tee -a /etc/libvirt/libvirtd.conf
echo 'tcp_port="16509"' | sudo tee -a /etc/libvirt/libvirtd.conf
echo 'auth_tcp="none"' | sudo tee -a /etc/libvirt/libvirtd.conf

# Restart the hypervisor engine
sudo systemctl restart libvirtd

Phase 3: Secure Storage & Database Setup

CloudStack relies on MySQL for state management and NFS for Primary (VM Disks) and Secondary (ISOs/Snapshots) storage.

🚨 SECURITY ALERT: Defeating NFS Vulnerabilities

Never expose an NFS share with full chmod 777 permissions. Restrict your /etc/exports strictly to your Management VLAN subnet, and use UFW to drop external port 2049 requests.

# 1. Install MySQL & NFS
sudo apt install -y mysql-server nfs-kernel-server

# 2. Secure NFS Exports (Replace 192.168.1.0/24 with your subnet)
sudo mkdir -p /export/primary /export/secondary
echo "/export/primary 192.168.1.0/24(rw,async,no_root_squash,no_subtree_check)" | sudo tee -a /etc/exports
echo "/export/secondary 192.168.1.0/24(rw,async,no_root_squash,no_subtree_check)" | sudo tee -a /etc/exports
sudo exportfs -ra

# 3. Optimize MySQL for CloudStack
cat <<'EOF' | sudo tee /etc/mysql/mysql.conf.d/cloudstack.cnf
[mysqld]
server-id=1
innodb_rollback_on_timeout=1
innodb_lock_wait_timeout=600
max_connections=1000
log-bin=mysql-bin
binlog-format = 'ROW'
EOF

sudo systemctl restart mysql nfs-kernel-server

Phase 4: Deploying the Management Server

The Management Server serves the UI, orchestrates KVM hosts, and provisions SystemVMs (Virtual Routers and Console Proxies).

# Add the official ShapeBlue CloudStack Repository
sudo mkdir -p /etc/apt/keyrings
wget -O- [http://packages.shapeblue.com/release.asc](http://packages.shapeblue.com/release.asc) | gpg --dearmor | sudo tee /etc/apt/keyrings/cloudstack.gpg > /dev/null
echo "deb [signed-by=/etc/apt/keyrings/cloudstack.gpg] [http://packages.shapeblue.com/cloudstack/upstream/debian/4.20](http://packages.shapeblue.com/cloudstack/upstream/debian/4.20) /" | sudo tee /etc/apt/sources.list.d/cloudstack.list

sudo apt update
sudo apt install -y cloudstack-management bzip2

# Initialize the Database Schema
sudo cloudstack-setup-databases cloud:P@ssw0rd123@localhost --deploy-as=root:YourMySQLRootPass

# Launch the Management Server
sudo cloudstack-setup-management

# Seed the KVM SystemVM Template to Secondary Storage
wget [http://download.cloudstack.org/systemvm/4.20/systemvmtemplate-4.20.1-x86_64-kvm.qcow2.bz2](http://download.cloudstack.org/systemvm/4.20/systemvmtemplate-4.20.1-x86_64-kvm.qcow2.bz2)
bzip2 -d systemvmtemplate-4.20.1-x86_64-kvm.qcow2.bz2

sudo /usr/share/cloudstack-common/scripts/storage/secondary/cloud-install-sys-tmplt \
-m /export/secondary \
-f systemvmtemplate-4.20.1-x86_64-kvm.qcow2 \
-h kvm -F

Access your Private Cloud Dashboard at http://YOUR_SERVER_IP:8080/client (Default login: admin / password).

Phase 5: The VMware Escape Plan

CloudStack includes native virt-v2v migration integration to move existing virtual machines off VMware ESXi without third-party licenses:

# Install virt-v2v and nbdkit on KVM hosts for native VMware migration
sudo apt install -y virt-v2v nbdkit

You can map your vCenter credentials inside CloudStack to automatically convert VMDK disk formats to QCOW2 and inject KVM virtio drivers on the fly. Pairing this with ServerMO Bare Metal Servers slashes hypervisor licensing costs to zero.

💬 Apache CloudStack & Private Cloud FAQ

Why is Apache CloudStack the best VMware alternative post-Broadcom?

CloudStack is a turnkey IaaS platform providing a VMware-like UI, VPC networking, and native migration tools (virt-v2v) to move workloads to open-source KVM seamlessly without vendor lock-in.

CloudStack vs OpenStack vs OpenNebula: Which is better?

OpenStack requires a dedicated DevOps team to maintain modular complexity. OpenNebula lacks deep enterprise features. Apache CloudStack deploys out-of-the-box like a monolithic AWS clone with low operational overhead.

Why does my CloudStack SystemVM stay in the "Starting" state?

This is typically an NFS export permission or routing issue. Verify that Secondary NFS storage includes no_root_squash and that your cloudbr0 bridge has internet access.

Read the full guide on ServerMO:

Deploy Apache CloudStack on Ubuntu 24.04: Build a Private AWS | ServerMO

DEV Community