This manual is a basic guide to how to Administer and Use Public Cloud in Abiquo
All users should configure their user accounts before starting work with the cloud platform.
You can control the resources that an enterprise may consume. This will help prevent resource over allocation, enterprises using resources from other enterprises, and even DoS attacks. Allocation limits will also help system administrators to anticipate user needs and forecast resource demand. Hard and soft limits are used by the resource scheduler to decide if a user can deploy a virtual appliance or not.
Enterprise allocation limits are checked during configuration or deploy, or before operations as described in the above table.
When creating allocation limits, you cannot have a hard limit only. And soft limits must always be less than or equal to hard limits. In addition, if the limits are equal to 0, then this means there is no limit to resource usage at this level. See Allocation limit rules.
To set the public cloud regions and datacenters that an enterprise is allowed to access, edit the Enterprise and click the Datacenters tab.
Drag and drop one or more public cloud regions or providers, or datacenters from the left pane into the "Allowed Datacenters" pane on the right.
An enterprise needs access to at least one public cloud region or datacenter so that its users can deploy VMs.
Note: when you create a public cloud region or a datacenter, the platform allows it for your own enterprise automatically. For all other enterprise, the platform adds it to the list in the left pane, which contains "Prohibited datacenters".
Allowed datacenters are working datacenters where users can deploy. This is different to an admin user having administration Scope to administer the infrastructure of datacenter.
You can set resource allocation limits for this enterprise in each allowed datacenter or public cloud region. To set allocation limits, select one of the Allowed Datacenters in the right pane and click the edit button. Set these limit values in the pop-up that opens.
Each tenant should have its own set of API credentials for each provider.
If the tenant does not have cloud provider credentials, they should follow their cloud provider's instructions on how to obtain access to the provider's API.
Abiquo provides basic guides to obtaining credentials, but the tenant should always consult the cloud provider for the most up-to-date information.
Before you enter public cloud credentials, there must be an existing public cloud region for the provider.
To add credentials for a public cloud provider
In the Abiquo Apps Library you can compile a selection of certified public cloud templates for your users to deploy by self-service.
Abiquo will store the details of these templates but not their disks.
Public cloud templates belong only to the region they were created in. Templates in one region usually cannot be accessed from another region and this rule also applies to the Abiquo Apps library. Public cloud templates that are effectively the same will usually have different IDs and names in each region.
The Apps library is a collection of VM templates that enables users to quickly and easily deploy VMs.
To display public cloud templates:
To display the details of a template, move the mouse over the template. A tooltip will display the template information.
The VM templates in the Apps library may be marked with the symbols described in the following table.
A template that may be used by all enterprises in the template's scope. See Modify a VM Template#ScopestabforsharingVMtemplates
|Deleted template||Also called an Unavailable template. The template has one or more disks missing in the Apps library filesystem.|
|Failed template||The template disk file was not properly created|
The public cloud template search and filter is used for all public clouds and private clouds that use their own registry, such as OpenStack and vCloud Director, and Docker
For example, ami-0354b96a
Search for this text in each template Name and Description. The search is not case sensitive
Any, Windows or Other
You can filter to find the templates you want to work with in the Apps library. To open the filter, click the funnel Filter button. Enter filter values, including wildcards, and click Accept.
To reset filter values to defaults, click Clear. This will display all local templates.
You can work with virtual machines, networks and storage in Virtual datacenters view
This section describes how to manage networks in private datacenters and public cloud providers.
In the Networks list, to view the pool and allocation of IPs:
You can then:
Private networks are only available within a virtual datacenter. However, your cloud provider may configure an external gateway for your virtual datacenter.
To create a private network:
Name of the network (VLAN). The name can contain up to 128 characters
|IPv6||Select checkbox for IPv6 network|
|Netmask||Network mask with an integer value of between 16 and 30|
Private address range of the network
Gateway of the VLAN. Must be an IP within the range of the network address and mask
The primary DNS
The secondary DNS
The DNS suffix
|Excluded from firewall||Select Excluded from firewall to define a network where VM firewalls will not apply|
Select Define to create static routes. See Configure Static Routes
Make this network the default network, replacing the existing default network.
You can configure static routes when you create or edit a network. However, you should check with your systems administrator about when your VM will receive changes to static routes.
Destination network mask
Destination network or host
Next hop (on your network)
Name of the VLAN. The name can contain up to 128 characters
|IPv6||Select checkbox for IPv6 network|
|Strict||IPv6 only. If you select Strict, Abiquo will automatically generate the network address (ULA) and also the IP addresses. If you do not select strict, you can enter the network address and IP addresses.|
|Netmask||Network mask of 48, 56 or 64.|
Private address range of the network. Only for non-strict networks
The primary DNS
The secondary DNS
The DNS suffix
Make this network the default network. In a datacenter, this will override the existing default network
In public cloud providers that support networks:
To create new IP addresses in a private network do these steps.
Or you can add an IP directly to a VM. To do this:
When you add IPv6 addresses on strict networks, you don't need to set the starting address.
On non-strict IPv6 networks, Abiquo recommends that you create an automatic IP address, or you can enter a From IP address manually as shown here.
The new settings will apply to all VMs deployed after you save the network.
To delete a private network:
To display onboarded external networks
If there are no VMs using the IPs of an external network that was already deleted in the provider, to delete the network in the platform, select it and click the Delete button.
To set a new or existing network as the default:
In private cloud, if you set a public network as the default, remember to obtain IP addresses for your VMs before you deploy!
This section describes firewall policies, which are similar to security groups. The platform supports firewall policies in private cloud with network managers (NSX, Neutron) and in public cloud (AWS, Azure). In Oracle Cloud, the platform enables users to onboard classic firewalls and assign them to VMs.
In vCloud Director, the platform supports classic firewalls, which are Edge firewalls at level of the public cloud region (orgVDC). The platform does not support security groups for VMs in vCloud Director. See Manage classic firewalls
To synchronize firewalls do these steps:
To synchronize a firewall before you add new firewall rules:
The platform can create firewall policies in virtual datacenters in the provider, or in the platform only, for later use in providers, depending on provider support.
To create a new firewall, do these steps:
Name of the firewall policy.
|Location||Public cloud region|
Description of the firewall policy
If you entered a virtual datacenter, the platform created your firewall in the provider. The platform will display a Provider-ID and a Virtual datacenter ID for the firewall.
If you selected No virtual datacenter, the firewall will be created in the platform in the public cloud region for your enterprise. The synchronize process will not update this firewall. The platform will not create it in the provider until you select a virtual datacenter.
To set or unset a default firewall for a virtual datacenter:
When the user creates a VM, the platform will assign the default firewall. The firewall rules apply to VMs, not individual NICs on the VMs. Changes to the firewall ruleset will apply to every VM in the virtual datacenter with the default firewall. If you do not set a default firewall but the provider requires one, for example, AWS, the platform will set the provider's default firewall. In AWS the default firewall is not marked.
To edit a firewall policy:
Name of the firewall policy
|Default||Select this option to set the firewall as the default. Note: The platform will not assign the default firewall to existing VMs.|
Description of the firewall policy
If the provider does not allow you to edit the policy, you may be able to delete the firewall in the provider, then reuse the configuration.
Amazon allows you to edit firewall rules and you can do this through the platform. First synchronize the firewall to update the rules because AWS will not allow you to create a rule that already exists in the security group. Remember that it may take some time for firewall rules to propagate throughout AWS. Until the rules have propagated, the platform will not be able to detect them. See http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/query-api-troubleshooting.html#eventual-consistency
To edit an AWS firewall in Abiquo, you can delete the firewall directly in the provider, then synchronize so the provider ID will be removed from the firewall in the platform. You can now edit the firewall and the firewall rules, and you can even assign the firewall to another virtual datacenter. The following screenshot shows the default firewall for several different VDCs. The "webDB" firewall currently exists in AWS. The other firewalls have been created in the platform but are not assigned to a virtual datacenter and do not currently exist in AWS.
To add a new firewall rule:
To delete firewall rules, do these steps.
To display firewalls that exist in a virtual datacenter in the provider:
To display all firewalls in a location (public cloud region or datacenter), including those that only exist in the platform and not in the provider:
To filter firewalls, enter text in the Search box to search by the Name, Description, and Provider ID in the Firewalls list.
To move a firewall to another virtual datacenter:
In Neutron, edit the firewall in Abiquo and change the VDC
To assign a firewall with no virtual datacenter to a virtual datacenter, do these steps
Go to Virtual datacenters → Network → Firewalls
Go to V. Datacenters All → Firewalls location
To delete a firewall policy:
A: In the Abiquo API, the firewall object contains a link to the virtual datacenter it belongs to.
Please refer to cloud provider documentation as the definitive guide to the load balancing features. And remember to check your cloud provider pricing before you begin.
To manage load balancers, go to Virtual datacenters → select a virtual datacenter → Network → Load balancers.
To display load balancers for a region, including those that are not assigned to a virtual datacenter in a provider
To display load balancers in virtual datacenters, select a virtual datacenter.
To create a load balancer:
Click the + Add button and complete the following dialogs according to your cloud provider's documentation
Screenshot: Creating a load balancer in AWS
Screenshot: Creating a load balancer in vCloud Director
The following screenshots are from AWS.
The name of the load balancer.
In providers that support subnets, the subnets that the load balancer is connected to.
See cloud provider documentation for more information
Select one of the common protocols to load presets
The incoming protocol to the load balancer. See cloud provider documentation for accepted values.
The incoming port to the load balancer. See cloud provider documentation for accepted values.
The outgoing protocol from the load balancer.
|Port out||The outgoing port from the load balancer|
|SSL Cerftificate||For secure connections (e.g. HTTPS), you can add an SSL certificate.|
|Add||Click Add to save a routing rule for the load balancer|
To delete a routing rule, click the Delete button beside the name of the routing rule in the list
Name of the certificate
The certificate contents
An intermediate certificate can be issued by a provider to support older browsers that may not have all of the trusted root certificates for that provider, so that users will not receive invalid SSL warnings. If you have an intermediate certificate, add it at the same time as the certificate to ensure that a trusted-chain certificate is configured.
The RSA private key for the certificate
Select one of the most common protocols to load presets
Name of the health check
The protocol with which the health check will be performed
The port to which the health check will be performed
|Path||The server path to ping (for supported protocols)|
|Interval (sec)||The interval in seconds between health checks|
|Timeout (sec)||The timeout in seconds after which an attempted health check will be considered unsuccessful|
|Attempts||The number of attempts before the health check will be considered unsuccessful|
|Add||Add the current health check to the load balancer|
If your provider supports firewalls, to add a firewall to your load balancer, select your firewall from the list of Firewalls that were created in your provider. Rackspace does not display a firewall selection list.
If a firewall is not on the list, it may not have been properly synchronized. In this case, you will need to click Cancel, synchronize firewalls and start again to create a new load balancer.
To assign your load balancer to VMs, drag and drop the VMs them from the Available Nodes list into the Attached Nodes list.
The following screenshot is from OpenStack Neutron.
The platform will display the Status of the load balancer nodes on the Nodes tab, if status information is available from the provider.
You can also check the status using the Abiquo API.
The cloud provider determines which elements of a load balancer that you can modify. Due to different provider support for load balancer features, it may be possible to make modifications in the platform that will later be rejected by the cloud provider, triggering an error. Check your cloud provider documentation for supported modifications.
To assign a virtual machine to a load balancer, select the load balancer from the list.
To access vCloud load balancers, and provider-only load balancers
To synchronize all load balancers in a VDC or region:
Load balancers that have been deleted directly in the provider are displayed in light gray text. You can edit these load balancers to recreate them in the provider, or delete them.
To delete a load balancer, select the load balancer and click the delete button.
If your enterprise does not have credentials in the provider, then the load balancer will be released (it will be deleted in the platform but it will remain in cloud provider).
This section describes the tasks that may be performed by the cloud user.
After you log in, you may need to edit your user account to update your details:
Add your public key that that the platform will use to launch VMs so that you can access them with SSH
Edit user general information
Edit user advanced
If you would like the platform to notify you when an alarm activates, create an Alert for it in Control view. Alerts are a group of one or more alarms. They are like a worker monitoring a group of alarms; when all the lights for the group are lit up, the alert is activated. Alerts can also trigger action plans to perform automated actions when their alarms activate. After you create an alert, create an action plan in Control view with the alert as a trigger.
You can create alarms for built-in VM metrics or scaling group metrics, as well as custom metrics created using the API for VMs, scaling groups, virtual appliances, and virtual datacenters.
You can push custom metrics for clone VMs but you cannot create alarms for cloned VMs that are part of a scaling group. This is because scaling groups have aggregate alarms that are associated with the base VM.
Virtual datacenters → Alarms
Before you begin:
To create an alarm:
|Entity type||Select an entity with metrics from the list on the left.|
|Entity name||The name of the entity|
|Entity label||The label of the entity, which for VMs is shown in the list on the left|
|Entity icon||The icon that the platform displays in the UI for VMs and virtual appliances|
Name of the alarm with up to 128 characters. Alarm names must be unique for each metric
|Description||Description of the alarm. Used together with the alarm name and VM name to identify the alarm, for example, when creating an alert|
|Metric||Select one of the metrics available for the VM|
|Metric unit||The unit of the metric. Read only|
|Metric description||The description of the metric. Read only|
|Dimension||When the metric has multiple dimensions, optionally select one or more dimensions. For example, if a VM has multiple hard disks, then the disk read bytes metric may have a dimension for each disk|
Last datapoints in period
The number of datapoints that the platform will evaluate the metric during the elapsed time.
If you request the evaluation of an alarm more frequently than metric data is collected by the platform or sent by the provider, then the alarm will not activate.
We recommend that you create alarms with longer evaluation periods, for example, an average of 10 points over the last hour, so the transmission and collection intervals will not affect the activation of the alarm.
Statistic that the platform will use for evaluating the alarm, which can be: average, maximum, minimum, sum, count, dev
Operator that the platform will use for evaluation of the alarm, for example, greater than. Values can be: notequal, greaterthan, greaterthanorequalto, lessthan, lessthanorequalto, trendup, trenddown
Value that the platform will evaluate the alarm against, if appropriate
The platform will create the alarm for the metric. If you would like the platform to notify you when an alarm is triggered, create an Alert.
Troubleshooting alarms that do not trigger
For a scaling group, an alarm on a metric of the VM in the base workload will receive input from the metrics of all VMs in the scaling group. This means the base workload and/or the clone VMs. So an alarm for a scaling group can activate, even if the base workload is not deployed.
For API documentation about alarms on an entity, see the API documentation for the entity's resource. For example, for VMs, see VirtualMachinesResource.
When you edit an alarm, there is an extra field, "Active", that shows if the alarm is activated or not.
After you save the alarm, the platform will start to evaluate it again with new data when it receives the next set of metrics datapoints.
You can also remove an alarm from an alert.
To delete an alarm:
To remove an alarm from an alert:
Go to Control → Alerts → edit alert
Select the alarm, click the delete button, and confirm
The platform will remove it from this alert, but it will remain in all other alerts that it is associated with
If you delete a VM, the platform will delete any alarms associated with its metrics.
To automate the configuration of your VM, edit the VM and on the Bootstrap tab, add a configuration or script that will run with cloud-init. Remember that your VM template must be compatible with cloud-init version 0.7.9 or above, and for Windows systems this will be a Cloudbase-Init template.
To add variables for use by cloud-init configurations or scripts, edit the VM and on the Variables tab, add the key and value for each variable that will be sent to the VM at deploy time. Remember that your VM template must be compatible with cloud-init version 0.7.9 or above, and for Windows system this will be a Cloudbase-Init template.
Chef is an infrastructure automation product that uses configuration recipes. You can use Abiquo Chef Integration to deploy a VM that will then configure itself using Chef recipes and roles on Linux VMs.
The Chef tab will display if your tenant has a Chef configuration and your VM template is compatible with cloud-init.
To add Chef roles and recipes for your VM:
To change the order of the runlist, click on the pencil button beside a role or recipe, then edit the order number, then click OK.
If you change the runlist after deploy, Abiquo will update the Chef server, and your Chef-client recipe can obtain these changes from the Chef server.