This manual is a basic guide to how to Administer and Use Public Cloud in Abiquo

The following basic roles are described in this manual: cloud administrator, enterprise administrator, and user.

Cloud administrator tasks

This section describes the cloud administrator tasks in public cloud.

Configure your user account

All users should configure their user accounts before starting work with the cloud platform.

Create public cloud regions

Control tenant resources

You can control the resources that an enterprise may consume. This will help prevent resource over allocation, enterprises using resources from other enterprises, and even DoS attacks. Allocation limits will also help system administrators to anticipate user needs and forecast resource demand. Hard and soft limits are used by the resource scheduler to decide if a user can deploy a virtual appliance or not.

• Hard Limit: the maximum amount of resources (CPU, RAM, Hard Disk, etc.) that an enterprise may consume.
• Soft Limit: triggers a warning for users that they nearing the hard limits for their enterprise.

Enterprise allocation limits are checked during configuration or deploy, or before operations as shown in the above table.

Allow the tenant to access regions

To set the datacenters and public cloud regions that an enterprise is allowed to access, edit the Enterprise and click the Datacenters tab.

Select one or more datacenters or public cloud regions in the left pane and drag and drop them into the "Allowed Datacenters" right pane.

Access to at least one datacenter or public cloud region is required in order to deploy VMs. The left pane contains datacenters, which are "Prohibited Datacenters" by default.

Note that Allowed datacenters are working datacenters where users can deploy. This is different to an admin user having administration Scope to administer the infrastructure of datacenter. 

Limit tenant resources in the region

You can set resource allocation limits for this enterprise in each allowed datacenter or public cloud region. To set allocation limits, select one of the Allowed Datacenters in the right pane and click the edit button. Set these limit values in the pop-up that opens.

Limit resources for an enterprise in a public cloud region

Validation of resource limits in a location

As for overall enterprise limits, resource limits in a datacenter or public cloud region are validated as described in the following table. 

Tenants obtain cloud provider credentials

If the tenant does not have cloud provider credentials, they should follow their cloud provider's instructions on how to obtain access to the provider's API.

Abiquo provides basic guides to obtaining credentials, but the tenant should always consult the cloud provider for the most up-to-date information.

• Obtain Azure Credentials
• Obtain AWS credentials
• Obtain GCE credentials
• Obtain Rackspace credentials

Add tenant credentials for each provider

Before you enter public cloud credentials, there must be an existing public cloud region for the provider.

To add credentials for a public cloud provider

1. Check in Infrastructure view or with your Administrator, that the public cloud region is already created
2. Edit the enterprise and select the Credentials tab
3. From the Provider pull down list, select the public cloud provider
4. Enter your Access key ID, which may be a Username, a specific API access key ID or other account identifier
5. Enter your Secret access key, which may be an API key or other API credential
6. Click Validate account
7. After the account has been validated, click Save

Prepare foundation template library

In the Abiquo Apps Library you can compile a selection of certified public cloud templates for your users to deploy by self-service.

Abiquo will store the details of these templates but not their disks.

Tenant administrator tasks

This section describes tasks that will generally be performed by a tenant administrator.

Obtain credentials for public cloud

Abiquo provides basic guides to obtaining credentials, but the you should always consult the cloud provider for the most up-to-date information. 

• Obtain Azure Credentials
• Obtain AWS credentials
• Obtain GCE credentials
• Obtain Rackspace credentials

Prepare enterprise templates

Depending on their user privileges, the tenant administrator may be able to do the following tasks

• Search the Apps library for templates
• Add templates to the Apps library
• Modify templates
• Share templates with their customers

Onboard from public cloud

Onboard virtual datacenters from public cloud

Abiquo automatically onboards from public cloud regions

If you public cloud provider does not support virtual datacenter entities, Abiquo will automatically onboard when you select the public cloud region.

Restrict user access to virtual datacenters

By default, all users have access to all virtual datacenters. However, you can select a list of virtual datacenters for each user and they will only be able to access these virtual datacenters.

To restrict VDC access, open Users view and create or edit a user who is not an administrator or who does not have the No VDC restriction privilege.

On the create or edit dialog, select the Restrict access to VDC checkbox to open the list of available virtual datacenters. If none are selected, the user will have access to all VDCs. Select the VDCs where this user will be able to deploy VMs. You can only restrict the VDC access of users without the No VDC restriction privilege.

Manage Networks

This section describes how to manage networks in private datacenters and public cloud providers. 

Display virtual datacenter networks

Create a private network

Private networks are only available within a virtual datacenter. However, your cloud provider may configure an external gateway for your virtual datacenter.

To create a private network:

1. Go to Virtual datacenters → select virtual datacenter → Network → Private
2. Click the + add button  and complete the dialog

You can configure static routes when you create or edit a network. However, you should check with your systems administrator about when your VM will receive changes to static routes.

Create IP addresses in private networks

To create new IP addresses in a private network do these steps.

1. Go to Virtual datacenters → optionally select a virtual datacenter
2. Go to Networks → Private → select a private network
3. On the Private IPs page, click the add + button and enter details

Or you can add an IP directly to a VM. To do this:

1. Go to Virtual datacenters → Edit VM → Network
2. Click the add + button and enter details (or drag the Auto-generated IP label into the Network pane)

Enter the Number of IPs to create and the From IP address (the first in the range). The From IP address must be a new address that does not already exist in the network. After creating the first IP address, the platform will try to create the other IPs and it will skip any existing IP addresses. 


For example, if you have IP addresses in network 30.30.30.30, which are 30, 33, and 34 and then you request 3 new IPs from 30.30.30.31. The new IPs created should be as follows: 31, 32, 35. 

IP Addresses
30.30.30.30
30.30.30.31
30.30.30.32
30.30.30.33
30.30.30.34
30.30.30.35

When you add IPv6 addresses on strict networks, you don't need to set the starting address. On non-strict IPv6 networks, Abiquo recommends that you create an automatic IP address, or you can enter a From IP address manually.

Edit a private network

Delete a private network

Display onboarded external networks

Delete an onboarded external network

If an onboarded network has been deleted in the provider, its name will display in light gray text. If a VM is using an IP from this network, then you cannot deploy the VM.

If there are no VMs using the IPs of an external network that was already deleted in the provider, to delete the network in the platform, select it and click the delete button.

Set default virtual datacenter networks

Obtain IP addresses from public networks

Manage firewalls

Introduction to Firewalls

Synchronize firewall policies with the cloud provider

Create a firewall policy

The platform can create firewall policies in virtual datacenters in the provider, or in the platform only, for later use in providers, depending on provider support.

To create a new firewall, do these steps:

1. Go to Virtual datacenters → Network → Firewalls
2. Click the Add button
3. Enter the firewall details
   

   

   Field	Description
   Name	Name of the firewall policy.
   Location	Public cloud region
   Virtual datacenter	Virtual datacenter: The platform will create your firewall in the cloud provider. It will add a provider-ID that will display on the main Firewalls page. The platform will synchronize rules with the provider No virtual datacenter: If allowed by the provider. The platform will create the firewall in the platform only, for your enterprise in the public cloud region. The platform will not synchronize rules with the provider. The platform will create the firewall in the provider when you select a virtual datacenter.
   Default	Optional. Select to make the firewall the default for the virtual datacenter
   Description	Description of the firewall policy

4. Click Save to create the firewall
5. Add Firewall rules as described below

If you entered a virtual datacenter, the platform created your firewall in the provider. The platform will display a Provider-ID and a Virtual datacenter ID for the firewall. 

If you selected No virtual datacenter, the firewall will be created in the platform in the public cloud region for your enterprise. The synchronize process will not update this firewall. The platform will not create it in the provider until you select a virtual datacenter.

Set a firewall policy as the default for a virtual datacenter

Edit a firewall policy

Edit firewall policy rules

Delete firewall policy rules

To delete firewall rules, do these steps.

1. Go to Virtual datacenters → select a virtual datacenter or select All → Network → Firewalls
2. Edit the firewall
3. Select the Inbound or Outbound tab
4. On the left-hand side of each rule you wish to delete, click the trash/garbage Delete button
5. Click Save

Display firewall policies

Assign a firewall policy to a VM

See Assign a firewall policy to a VM

Move a firewall policy to another VDC

To move a firewall to another virtual datacenter:

• In Neutron, edit the firewall in Abiquo and change the VDC

• In Azure ARM, edit the firewall and change or remove the virtual datacenter
• In AWS, delete the firewall directly in the provider, then synchronize so the provider ID will be removed from the firewall in Abiquo. Now you can edit the firewall and change the virtual datacenter. This is because you are not allowed to edit firewalls or move them from one VPC to another in AWS but you can do this in Abiquo. The following screenshot shows a firewall after the AWS security group was deleted. The firewall rules are preserved for you to edit or apply to another virtual datacenter. 

Reuse a firewall after deleting a virtual datacenter

Delete a firewall policy

To delete a firewall policy:

1. Edit each VM that is using the firewall policy to remove the firewall policy
2. Select the firewall policy
3. Click the Delete button

Troubleshoot firewall policies

Manage firewalls with the API

Manage load balancers

Introduction to load balancers

See Provider support for load balancers tables

Display load balancers

Create a load balancer

Manage load balancers with the API

Edit load balancers

The cloud provider determines which elements of a load balancer that you can modify. Due to different provider support for load balancer features, it may be possible to make modifications in the platform that will later be rejected by the cloud provider, triggering an error. Check your cloud provider documentation for supported modifications.

Edit VMs to assign or unassign to load balancers

Onboard and synchronize load balancers from public cloud

Delete or release load balancers

Cloud user tasks

This section describes the tasks performed by the cloud user. Depending on user privileges, some of these functions may be performed by the tenant administrator.

Add public key to user account

Click on your user name in the top right-hand corner of the screen.

Edit your user account and update your details. Add a public key for SSH access to VMs deployed in public cloud.

Create virtual appliances

To create a new virtual appliance, open the Virtual datacenters view. Then select the virtual datacenter where the virtual appliance will be deployed, click the   add button, and complete the form.

Work with VMs

The basic process for working with VMs is the same throughout the whole Abiquo cloud platform, regardless of the underlying technology, which may be hypervisors, public clouds or Docker. The following screenshots show a private cloud environment, but they would be very similar for a public cloud or even a Docker environment.

Configure VMs

Configuring VMs in public cloud is similar to private cloud.

Edit VM general information in public cloud

Edit Public Cloud Network Configuration

You can edit the network configuration of an AWS machine if it is:

• Saved but not deployed
• Deployed and powered off

Click on the Network tab to edit the network configuration.

Add an Elastic IP as a Floating Public IP

To add a floating public IP to your VM:

• First obtain the floating public IP for your virtual datacenter from the public cloud provider
  
  • See Manage Networks
• Edit the VM configuration
• Select the Network tab
• Select the Public page
  
  • you will see the IPs that are already allocated to your enterprise in the virtual datacenter. You can select from these IPs.
• Drag and drop the IP address into the network interfaces list

A floating public IP should be displayed as shown in the following screenshot.  The floating IP is not part of any Abiquo VLAN.

Remove a Floating IP

To remove a floating IP from your VM, power off or undeploy the VM and click the X button near the IP address.

To ensure that your public cloud provider does not charge you for the floating public IP, remove it from your virtual datacenter. The floating public IP will be released and you cannot add it to another machine. When you add another floating IP to your virtual datacenter and VM, there is no guarantee that it will have the same IP address.

Bootstrap Scripts

Assign Firewalls to VMs

If firewalls are offered in your datacenter and firewalls have been created in your virtual datacenter, then you can assign firewalls to your VMs.

To assign a firewall from the virtual datacenter to a VM, edit the VM and open the Firewalls tab. Mark the firewall with a tick in the Firewall policies checklist. You can add as many firewall policies as necessary, up the public cloud provider's limit. See http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_SecurityGroups.html#VPCSecurityGroups

Click Save.

Remove a firewall from a VM

To remove a firewall from a VM, edit the VM and open the Firewalls tab. Remove the tick beside the firewall in the Firewall policies checklist. Click Save. 

Configure Chef Recipes and Roles

Chef is an infrastructure automation product that uses configuration recipes. You can use Abiquo Chef Integration to deploy a VM that will then configure itself using Chef recipes and roles. 

The Chef tab is enabled if the enterprise is Chef-enabled and the VM template is Chef-enabled. Before the VM is deployed, you can select from the available roles and recipes. These will be added to the machine's runlist. When the machine is deployed it will download the roles and recipes, and run them in order. Click the Chef tab. By default on this tab you can select roles. Mark the "Select individual components" checkbox to select individual recipes too. The selected recipes will be added to the Virtual Appliance's runlist in order of selection.

To change the order of the runlist, click on the pencil button beside a role or recipe, then edit the order number, then click OK.

Change the Order of Roles and Recipes After Deployment

To change the runlist order after deployment click on the pencil button, then edit the order number, then click OK. The Abiquo Chef Agent will connect to the Chef Server and update the runlist.

See also Configuring and Using Abiquo Chef Integration in the Abiquo HOWTOs and Troubleshooting Abiquo Chef Integration in the Administrator's Guide.

Configure Monitoring and Metrics

If you have the privilege to Manage VM monitoring and it is configured in your virtual datacenter, you can enable the option to fetch metrics from the hypervisor or public cloud region.

To enable VM monitoring and metrics, work with a VM that is powered off or undeployed.

Edit the VM and go to the Monitoring tab.

Mark the fetch metrics checkbox.

Select from the available options, f or example, for AWS, you can select detailed or basic monitoring.

The functionality and list of available metrics depend on the underlying virtualization technology.

Select the individual metrics you would like to retrieve for your VM.

Display Metrics for a VM

On the VM icon, click the Monitoring symbol to display the metrics. 

The metrics panel will open.

Select the refresh button to update the display of a metric.

Select the filter button to configure the display of the metric.

Set the

• Granularity, which is how often the metric is sampled
• Statistic, which determines how the raw values will be processed over time
• "Last" period, which is how long the display will look behind at the processed data.

Click Accept to save the values.

To view the exact metric values in a call-out box, mouse over the monitoring graph line.

To create a highlight point, click on the metric graph line.

To simultaneously view the data for more than one VM, use the virtual appliance monitoring view.