Add Aether management platform guide and extracted help texts
Aether deployed on oc-node-01, connected to Incus cluster (trust token) and Operations Center (mutual TLS). Extracted all 16 built-in help pages (426 KB) covering cluster management, storage, profiles, instances, HAProxy LB, firewall ACLs, blueprints, and health monitoring. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
parent
ccd8e87be6
commit
d2b49f5ef0
|
|
@ -34,3 +34,6 @@ env
|
|||
|
||||
# Observational deploy output (screenshots, logs)
|
||||
observe-runs/
|
||||
|
||||
# External software / golden images
|
||||
sources/
|
||||
|
|
|
|||
|
|
@ -0,0 +1,223 @@
|
|||
# Aether — Management Platform for Incus + OVN
|
||||
|
||||
Aether is a web-based management application that connects to Incus clusters
|
||||
and Operations Center instances. It provides VM/container deployment via
|
||||
blueprints, OVN network management, NSX firewall rule translation to OVN ACLs,
|
||||
HAProxy load balancer management, Ansible automation, and RBAC.
|
||||
|
||||
## Deployment
|
||||
|
||||
### Requirements
|
||||
|
||||
- **Image**: Ubuntu Noble (24.04) golden image (~6.6 GiB compressed, 200 GiB
|
||||
virtual disk)
|
||||
- **Resources**: 8 GiB RAM minimum
|
||||
- **Networking**: needs direct LAN/VLAN access (macvlan recommended)
|
||||
- **Services**: PostgreSQL (bundled), FFSDN Go application on port 8443
|
||||
|
||||
### Deployment on Incus cluster
|
||||
|
||||
```bash
|
||||
# Import image
|
||||
incus image import sources/aether-golden-image-v6.tar.gz \
|
||||
--alias aether-golden-image-v6 <remote>:
|
||||
|
||||
# Create VM (200 GiB disk required — qcow2 virtual size)
|
||||
incus init <remote>:aether-golden-image-v6 <remote>:aether --vm \
|
||||
--target <node> --config limits.memory=8GiB -d root,size=200GiB
|
||||
|
||||
# Configure macvlan networking for direct VLAN access
|
||||
incus config device remove <remote>:aether eth0 2>/dev/null
|
||||
incus config device add <remote>:aether eth0 nic nictype=macvlan parent=mgmt
|
||||
|
||||
# Start and wait ~30s for boot
|
||||
incus start <remote>:aether
|
||||
|
||||
# Run post-deploy (configures static IP, regenerates SSH keys, sets up DB)
|
||||
incus exec <remote>:aether -- /home/ffsdn/post_deploy.sh <IP/PREFIX> <GATEWAY> <DNS>
|
||||
```
|
||||
|
||||
### Disk size considerations
|
||||
|
||||
The golden image is a qcow2 with 200 GiB virtual size but only ~11 GiB actual
|
||||
data. The target node must have at least 200 GiB of allocatable storage (even
|
||||
if thin-provisioned). On a fresh IncusOS node with a 64 GiB disk, only ~29 GiB
|
||||
is free after the OS. Nodes with 50 GiB disks (~8.5 GiB free) cannot host
|
||||
Aether. Target the node with the most available storage.
|
||||
|
||||
### Lab deployment details
|
||||
|
||||
| Setting | Value |
|
||||
|---------|-------|
|
||||
| VM name | `aether` |
|
||||
| Location | oc-node-01 |
|
||||
| IP | 192.168.102.160/22 (VLAN 69) |
|
||||
| Gateway | 192.168.100.1 |
|
||||
| DNS | 192.168.100.1 |
|
||||
| Port | 8443 (HTTPS) |
|
||||
| RAM | 8 GiB |
|
||||
| Disk | 200 GiB (virtual), ~11 GiB actual |
|
||||
|
||||
### Web UI
|
||||
|
||||
Access at `https://<IP>:8443`. Default credentials: admin / (set during setup).
|
||||
|
||||
### Post-deploy script
|
||||
|
||||
`/home/ffsdn/post_deploy.sh` performs 7 steps:
|
||||
1. Configure network (netplan)
|
||||
2. Apply network configuration
|
||||
3. Regenerate SSH host keys
|
||||
4. Wait for FFSDN to create PostgreSQL user
|
||||
5. Transfer database ownership
|
||||
6. Transfer table and sequence ownership
|
||||
7. Restart FFSDN service
|
||||
|
||||
The script **deletes itself** after successful execution.
|
||||
|
||||
## Navigation
|
||||
|
||||
The sidebar provides access to all features:
|
||||
|
||||
| Menu Item | URL Path | Description |
|
||||
|-----------|----------|-------------|
|
||||
| Home | `/home` | Dashboard, welcome page |
|
||||
| Manage Global FW rules | `/global-acls` | Global firewall / ACL management |
|
||||
| Manage Cluster FW rules | (submenu) | Per-cluster firewall rules |
|
||||
| Manage RBAC | (submenu) | Role-based access control |
|
||||
| Manage VMs/Containers | `/infra` | View and manage instances |
|
||||
| Deploy VM/Container/Blueprint | `/deploy` | Launch new workloads |
|
||||
| Deployed Blueprints | `/deployedblueprints` | Track blueprint deployments |
|
||||
| Blueprint Design | `/blueprintdesign` | Create deployment templates |
|
||||
| Ansible Automation | `/awx-endpoints` | Ansible playbook management |
|
||||
| Manage INCUS Clusters | `/incus-infra` | Connect and manage Incus clusters |
|
||||
| Operations Center | `/operationcenter` | Connect to OC instances |
|
||||
| HAProxy Load Balancers | `/haproxy` | Load balancer configuration |
|
||||
| Trace Network Flow | `/traceflow` | Network flow analysis (NSX → OVN ACL translation?) |
|
||||
| View Live GO Log | `/logs/live` | Real-time application logs |
|
||||
| AETHER Ledger | `/logs` | Audit/activity ledger |
|
||||
| View Sync Logs | `/synclogs` | Synchronization logs |
|
||||
| AETHER Health | `/health` | System health checks |
|
||||
| Change Password | `/change-password` | Change admin password |
|
||||
| Licensing | `/licensing` | License management |
|
||||
| Settings | `/settings` | Application settings |
|
||||
|
||||
## Initial Setup
|
||||
|
||||
### Step 1: Connect Incus Cluster
|
||||
|
||||
Navigate to **Manage INCUS Clusters** (`/incus-infra`) → click
|
||||
**Add/Edit/Delete INCUS clusters from/to AETHER**.
|
||||
|
||||
The form requires:
|
||||
- **Cluster Name**: label for this cluster (e.g., `oc-lab-cluster`)
|
||||
- **URL**: Incus API endpoint (e.g., `https://192.168.102.141:8443`)
|
||||
- **Trust Token**: generated on the cluster
|
||||
|
||||
Generate a trust token on the Incus cluster:
|
||||
```bash
|
||||
incus config trust add <remote>:AETHER
|
||||
```
|
||||
|
||||
Paste the token into the form and click **Add Cluster**. The cluster appears
|
||||
in the "Current INCUS Clusters" table with its TLS certificate fingerprint
|
||||
and expiry date.
|
||||
|
||||
After adding, select the cluster from the **Select Cluster** dropdown on
|
||||
the INCUS Infrastructure Management page. This loads the cluster dashboard
|
||||
with tabs:
|
||||
|
||||
| Tab | Description |
|
||||
|-----|-------------|
|
||||
| Clustering: Members | Cluster nodes with status, memory, load, roles |
|
||||
| Clustering: Cluster Groups | Logical groupings of nodes |
|
||||
| Storage: Pools | Storage pool configuration |
|
||||
| Storage: Volumes | Storage volume management |
|
||||
| Profiles | Instance profiles with devices and config |
|
||||
| Operations | Running and completed operations |
|
||||
| Warnings | Cluster warnings |
|
||||
| Settings | Cluster configuration |
|
||||
| Images | Cached images across the cluster |
|
||||
| Configuration | Cluster-level config keys |
|
||||
| Instances | All instances with actions (Start/Stop/Migrate/Console/etc.) |
|
||||
| Networking | Networks (bridge, OVN, physical) with View/Edit |
|
||||
| ACLs | Network ACL management |
|
||||
| Address Sets | Address set management for ACLs |
|
||||
| OS | IncusOS node management |
|
||||
|
||||
The **Instances** tab provides per-instance action buttons: Start, Restart,
|
||||
Freeze, Unfreeze, Stop, Migrate, Snapshot, Console, Logs, Delete. Instances
|
||||
can be filtered by type (VM/Container) and status. Each row shows name, type,
|
||||
status, IPv4, memory usage, image, snapshots, and location (cluster member).
|
||||
|
||||
The **Cluster Members** view shows real-time memory and load bars per node,
|
||||
OVN roles, and an Evacuate action button.
|
||||
|
||||
### Step 2: Connect Operations Center
|
||||
|
||||
Navigate to **Operations Center** (`/operationcenter`) → click
|
||||
**+ Add Operations Center**.
|
||||
|
||||
The form requires:
|
||||
- **Name**: label for this OC (e.g., `oc-lab`)
|
||||
- **URL**: OC API endpoint (e.g., `https://192.168.102.120:8443`)
|
||||
- **Certificate (PEM)**: client TLS certificate (PEM format)
|
||||
- **Private Key (PEM)**: matching private key (PEM format)
|
||||
|
||||
Unlike Incus (which uses trust tokens), OC uses **mutual TLS** — Aether
|
||||
connects with a client certificate that must already be in the OC trust store.
|
||||
Use the same `client.crt` and `client.key` that were injected into the OC
|
||||
seed during deployment (typically at `~/.config/incus/client.crt` and
|
||||
`~/.config/incus/client.key`).
|
||||
|
||||
Click **Test Connection** to verify — a successful test shows:
|
||||
`Connected! API: 1.0 (devel)`.
|
||||
|
||||
Click **Save** to add the OC. The OC appears in the "Configured Operations
|
||||
Centers" table with status, fingerprint, last connected timestamp, and
|
||||
Edit/Test/Delete actions. A green **Manage** badge indicates an active
|
||||
connection.
|
||||
|
||||
### Connection comparison
|
||||
|
||||
| | Incus Cluster | Operations Center |
|
||||
|---|---|---|
|
||||
| Auth method | Trust token | Mutual TLS (client cert + key) |
|
||||
| Token/cert source | `incus config trust add` | Existing client cert from `~/.config/incus/` |
|
||||
| API version | Incus REST API | OC API 1.0 |
|
||||
| Port | 8443 | 8443 |
|
||||
|
||||
## Lab State After Setup
|
||||
|
||||
### Connected infrastructure
|
||||
|
||||
| Connection | Name | URL | Status |
|
||||
|------------|------|-----|--------|
|
||||
| Incus Cluster | oc-lab-cluster | https://192.168.102.141:8443 | Connected |
|
||||
| Operations Center | oc-lab | https://192.168.102.120:8443 | Connected |
|
||||
|
||||
### Cluster members (as seen in Aether)
|
||||
|
||||
| Node | URL | Status | Memory | Load | Roles |
|
||||
|------|-----|--------|--------|------|-------|
|
||||
| oc-node-01 | https://192.168.102.140:8443 | Online | 35% (5.5/16.0 GB) | 19% | ovn-chassis, database |
|
||||
| oc-node-02 | https://192.168.102.141:8443 | Online | 92% (14.7/16.0 GB) | 28% | ovn-chassis, database-leader |
|
||||
| oc-node-03 | https://192.168.102.142:8443 | Online | 54% (8.7/16.0 GB) | 25% | ovn-chassis, database |
|
||||
|
||||
### Instances visible in Aether
|
||||
|
||||
| Name | Type | Status | IPv4 | Image | Location |
|
||||
|------|------|--------|------|-------|----------|
|
||||
| aether | VM | Running | 192.168.102.160 | ubuntu noble | oc-node-01 |
|
||||
| ovn-central | Container | Running | 10.207.217.23 | Debian bookworm | oc-node-02 |
|
||||
| ha-web-02 | Container | Stopped | 10.10.10.3 | Debian bookworm | oc-node-02 |
|
||||
| ha-web-03 | Container | Stopped | 10.10.10.4 | Debian bookworm | oc-node-03 |
|
||||
|
||||
### Networks visible in Aether
|
||||
|
||||
| Name | Type | IPv4 | Uplink | NAT | Used By |
|
||||
|------|------|------|--------|-----|---------|
|
||||
| UPLINK | physical | 192.168.100.1/22 | - | - | 1 |
|
||||
| incusbr0 | bridge | 10.207.217.1/24 | - | IPv4, IPv6 | 2 |
|
||||
| meshbr0 | bridge | none | - | IPv6 | 1 |
|
||||
| net-prod | ovn | 10.10.10.1/24 | UPLINK | IPv4, IPv6 | 2 |
|
||||
File diff suppressed because it is too large
Load Diff
Loading…
Reference in New Issue