maarten
/
incus-contrib
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
incus-contrib/notes/aether-guide.md

8.7 KiB
Raw Blame History

Aether — Management Platform for Incus + OVN

Aether is a web-based management application that connects to Incus clusters and Operations Center instances. It provides VM/container deployment via blueprints, OVN network management, NSX firewall rule translation to OVN ACLs, HAProxy load balancer management, Ansible automation, and RBAC.

Deployment

Requirements

  • Image: Ubuntu Noble (24.04) golden image (~6.6 GiB compressed, 200 GiB virtual disk)
  • Resources: 8 GiB RAM minimum
  • Networking: needs direct LAN/VLAN access (macvlan recommended)
  • Services: PostgreSQL (bundled), FFSDN Go application on port 8443

Deployment on Incus cluster

# Import image
incus image import sources/aether-golden-image-v6.tar.gz \
    --alias aether-golden-image-v6 <remote>:

# Create VM (200 GiB disk required — qcow2 virtual size)
incus init <remote>:aether-golden-image-v6 <remote>:aether --vm \
    --target <node> --config limits.memory=8GiB -d root,size=200GiB

# Configure macvlan networking for direct VLAN access
incus config device remove <remote>:aether eth0 2>/dev/null
incus config device add <remote>:aether eth0 nic nictype=macvlan parent=mgmt

# Start and wait ~30s for boot
incus start <remote>:aether

# Run post-deploy (configures static IP, regenerates SSH keys, sets up DB)
incus exec <remote>:aether -- /home/ffsdn/post_deploy.sh <IP/PREFIX> <GATEWAY> <DNS>

Disk size considerations

The golden image is a qcow2 with 200 GiB virtual size but only ~11 GiB actual data. The target node must have at least 200 GiB of allocatable storage (even if thin-provisioned). On a fresh IncusOS node with a 64 GiB disk, only ~29 GiB is free after the OS. Nodes with 50 GiB disks (~8.5 GiB free) cannot host Aether. Target the node with the most available storage.

Lab deployment details

Setting Value
VM name aether
Location oc-node-01
IP 192.168.102.160/22 (VLAN 69)
Gateway 192.168.100.1
DNS 192.168.100.1
Port 8443 (HTTPS)
RAM 8 GiB
Disk 200 GiB (virtual), ~11 GiB actual

Web UI

Access at https://<IP>:8443. Default credentials: admin / (set during setup).

Post-deploy script

/home/ffsdn/post_deploy.sh performs 7 steps:

  1. Configure network (netplan)
  2. Apply network configuration
  3. Regenerate SSH host keys
  4. Wait for FFSDN to create PostgreSQL user
  5. Transfer database ownership
  6. Transfer table and sequence ownership
  7. Restart FFSDN service

The script deletes itself after successful execution.

Navigation

The sidebar provides access to all features:

Menu Item URL Path Description
Home /home Dashboard, welcome page
Manage Global FW rules /global-acls Global firewall / ACL management
Manage Cluster FW rules (submenu) Per-cluster firewall rules
Manage RBAC (submenu) Role-based access control
Manage VMs/Containers /infra View and manage instances
Deploy VM/Container/Blueprint /deploy Launch new workloads
Deployed Blueprints /deployedblueprints Track blueprint deployments
Blueprint Design /blueprintdesign Create deployment templates
Ansible Automation /awx-endpoints Ansible playbook management
Manage INCUS Clusters /incus-infra Connect and manage Incus clusters
Operations Center /operationcenter Connect to OC instances
HAProxy Load Balancers /haproxy Load balancer configuration
Trace Network Flow /traceflow Network flow analysis (NSX → OVN ACL translation?)
View Live GO Log /logs/live Real-time application logs
AETHER Ledger /logs Audit/activity ledger
View Sync Logs /synclogs Synchronization logs
AETHER Health /health System health checks
Change Password /change-password Change admin password
Licensing /licensing License management
Settings /settings Application settings

Initial Setup

Step 1: Connect Incus Cluster

Navigate to Manage INCUS Clusters (/incus-infra) → click Add/Edit/Delete INCUS clusters from/to AETHER.

The form requires:

  • Cluster Name: label for this cluster (e.g., oc-lab-cluster)
  • URL: Incus API endpoint (e.g., https://192.168.102.141:8443)
  • Trust Token: generated on the cluster

Generate a trust token on the Incus cluster:

incus config trust add <remote>:AETHER

Paste the token into the form and click Add Cluster. The cluster appears in the "Current INCUS Clusters" table with its TLS certificate fingerprint and expiry date.

After adding, select the cluster from the Select Cluster dropdown on the INCUS Infrastructure Management page. This loads the cluster dashboard with tabs:

Tab Description
Clustering: Members Cluster nodes with status, memory, load, roles
Clustering: Cluster Groups Logical groupings of nodes
Storage: Pools Storage pool configuration
Storage: Volumes Storage volume management
Profiles Instance profiles with devices and config
Operations Running and completed operations
Warnings Cluster warnings
Settings Cluster configuration
Images Cached images across the cluster
Configuration Cluster-level config keys
Instances All instances with actions (Start/Stop/Migrate/Console/etc.)
Networking Networks (bridge, OVN, physical) with View/Edit
ACLs Network ACL management
Address Sets Address set management for ACLs
OS IncusOS node management

The Instances tab provides per-instance action buttons: Start, Restart, Freeze, Unfreeze, Stop, Migrate, Snapshot, Console, Logs, Delete. Instances can be filtered by type (VM/Container) and status. Each row shows name, type, status, IPv4, memory usage, image, snapshots, and location (cluster member).

The Cluster Members view shows real-time memory and load bars per node, OVN roles, and an Evacuate action button.

Step 2: Connect Operations Center

Navigate to Operations Center (/operationcenter) → click + Add Operations Center.

The form requires:

  • Name: label for this OC (e.g., oc-lab)
  • URL: OC API endpoint (e.g., https://192.168.102.120:8443)
  • Certificate (PEM): client TLS certificate (PEM format)
  • Private Key (PEM): matching private key (PEM format)

Unlike Incus (which uses trust tokens), OC uses mutual TLS — Aether connects with a client certificate that must already be in the OC trust store. Use the same client.crt and client.key that were injected into the OC seed during deployment (typically at ~/.config/incus/client.crt and ~/.config/incus/client.key).

Click Test Connection to verify — a successful test shows: Connected! API: 1.0 (devel).

Click Save to add the OC. The OC appears in the "Configured Operations Centers" table with status, fingerprint, last connected timestamp, and Edit/Test/Delete actions. A green Manage badge indicates an active connection.

Connection comparison

Incus Cluster Operations Center
Auth method Trust token Mutual TLS (client cert + key)
Token/cert source incus config trust add Existing client cert from ~/.config/incus/
API version Incus REST API OC API 1.0
Port 8443 8443

Lab State After Setup

Connected infrastructure

Connection Name URL Status
Incus Cluster oc-lab-cluster https://192.168.102.141:8443 Connected
Operations Center oc-lab https://192.168.102.120:8443 Connected

Cluster members (as seen in Aether)

Node URL Status Memory Load Roles
oc-node-01 https://192.168.102.140:8443 Online 35% (5.5/16.0 GB) 19% ovn-chassis, database
oc-node-02 https://192.168.102.141:8443 Online 92% (14.7/16.0 GB) 28% ovn-chassis, database-leader
oc-node-03 https://192.168.102.142:8443 Online 54% (8.7/16.0 GB) 25% ovn-chassis, database

Instances visible in Aether

Name Type Status IPv4 Image Location
aether VM Running 192.168.102.160 ubuntu noble oc-node-01
ovn-central Container Running 10.207.217.23 Debian bookworm oc-node-02
ha-web-02 Container Stopped 10.10.10.3 Debian bookworm oc-node-02
ha-web-03 Container Stopped 10.10.10.4 Debian bookworm oc-node-03

Networks visible in Aether

Name Type IPv4 Uplink NAT Used By
UPLINK physical 192.168.100.1/22 - - 1
incusbr0 bridge 10.207.217.1/24 - IPv4, IPv6 2
meshbr0 bridge none - IPv6 1
net-prod ovn 10.10.10.1/24 UPLINK IPv4, IPv6 2