224 lines
8.7 KiB
Markdown
224 lines
8.7 KiB
Markdown
# Aether — Management Platform for Incus + OVN
|
|
|
|
Aether is a web-based management application that connects to Incus clusters
|
|
and Operations Center instances. It provides VM/container deployment via
|
|
blueprints, OVN network management, NSX firewall rule translation to OVN ACLs,
|
|
HAProxy load balancer management, Ansible automation, and RBAC.
|
|
|
|
## Deployment
|
|
|
|
### Requirements
|
|
|
|
- **Image**: Ubuntu Noble (24.04) golden image (~6.6 GiB compressed, 200 GiB
|
|
virtual disk)
|
|
- **Resources**: 8 GiB RAM minimum
|
|
- **Networking**: needs direct LAN/VLAN access (macvlan recommended)
|
|
- **Services**: PostgreSQL (bundled), FFSDN Go application on port 8443
|
|
|
|
### Deployment on Incus cluster
|
|
|
|
```bash
|
|
# Import image
|
|
incus image import sources/aether-golden-image-v6.tar.gz \
|
|
--alias aether-golden-image-v6 <remote>:
|
|
|
|
# Create VM (200 GiB disk required — qcow2 virtual size)
|
|
incus init <remote>:aether-golden-image-v6 <remote>:aether --vm \
|
|
--target <node> --config limits.memory=8GiB -d root,size=200GiB
|
|
|
|
# Configure macvlan networking for direct VLAN access
|
|
incus config device remove <remote>:aether eth0 2>/dev/null
|
|
incus config device add <remote>:aether eth0 nic nictype=macvlan parent=mgmt
|
|
|
|
# Start and wait ~30s for boot
|
|
incus start <remote>:aether
|
|
|
|
# Run post-deploy (configures static IP, regenerates SSH keys, sets up DB)
|
|
incus exec <remote>:aether -- /home/ffsdn/post_deploy.sh <IP/PREFIX> <GATEWAY> <DNS>
|
|
```
|
|
|
|
### Disk size considerations
|
|
|
|
The golden image is a qcow2 with 200 GiB virtual size but only ~11 GiB actual
|
|
data. The target node must have at least 200 GiB of allocatable storage (even
|
|
if thin-provisioned). On a fresh IncusOS node with a 64 GiB disk, only ~29 GiB
|
|
is free after the OS. Nodes with 50 GiB disks (~8.5 GiB free) cannot host
|
|
Aether. Target the node with the most available storage.
|
|
|
|
### Lab deployment details
|
|
|
|
| Setting | Value |
|
|
|---------|-------|
|
|
| VM name | `aether` |
|
|
| Location | oc-node-01 |
|
|
| IP | 192.168.102.160/22 (VLAN 69) |
|
|
| Gateway | 192.168.100.1 |
|
|
| DNS | 192.168.100.1 |
|
|
| Port | 8443 (HTTPS) |
|
|
| RAM | 8 GiB |
|
|
| Disk | 200 GiB (virtual), ~11 GiB actual |
|
|
|
|
### Web UI
|
|
|
|
Access at `https://<IP>:8443`. Default credentials: admin / (set during setup).
|
|
|
|
### Post-deploy script
|
|
|
|
`/home/ffsdn/post_deploy.sh` performs 7 steps:
|
|
1. Configure network (netplan)
|
|
2. Apply network configuration
|
|
3. Regenerate SSH host keys
|
|
4. Wait for FFSDN to create PostgreSQL user
|
|
5. Transfer database ownership
|
|
6. Transfer table and sequence ownership
|
|
7. Restart FFSDN service
|
|
|
|
The script **deletes itself** after successful execution.
|
|
|
|
## Navigation
|
|
|
|
The sidebar provides access to all features:
|
|
|
|
| Menu Item | URL Path | Description |
|
|
|-----------|----------|-------------|
|
|
| Home | `/home` | Dashboard, welcome page |
|
|
| Manage Global FW rules | `/global-acls` | Global firewall / ACL management |
|
|
| Manage Cluster FW rules | (submenu) | Per-cluster firewall rules |
|
|
| Manage RBAC | (submenu) | Role-based access control |
|
|
| Manage VMs/Containers | `/infra` | View and manage instances |
|
|
| Deploy VM/Container/Blueprint | `/deploy` | Launch new workloads |
|
|
| Deployed Blueprints | `/deployedblueprints` | Track blueprint deployments |
|
|
| Blueprint Design | `/blueprintdesign` | Create deployment templates |
|
|
| Ansible Automation | `/awx-endpoints` | Ansible playbook management |
|
|
| Manage INCUS Clusters | `/incus-infra` | Connect and manage Incus clusters |
|
|
| Operations Center | `/operationcenter` | Connect to OC instances |
|
|
| HAProxy Load Balancers | `/haproxy` | Load balancer configuration |
|
|
| Trace Network Flow | `/traceflow` | Network flow analysis (NSX → OVN ACL translation?) |
|
|
| View Live GO Log | `/logs/live` | Real-time application logs |
|
|
| AETHER Ledger | `/logs` | Audit/activity ledger |
|
|
| View Sync Logs | `/synclogs` | Synchronization logs |
|
|
| AETHER Health | `/health` | System health checks |
|
|
| Change Password | `/change-password` | Change admin password |
|
|
| Licensing | `/licensing` | License management |
|
|
| Settings | `/settings` | Application settings |
|
|
|
|
## Initial Setup
|
|
|
|
### Step 1: Connect Incus Cluster
|
|
|
|
Navigate to **Manage INCUS Clusters** (`/incus-infra`) → click
|
|
**Add/Edit/Delete INCUS clusters from/to AETHER**.
|
|
|
|
The form requires:
|
|
- **Cluster Name**: label for this cluster (e.g., `oc-lab-cluster`)
|
|
- **URL**: Incus API endpoint (e.g., `https://192.168.102.141:8443`)
|
|
- **Trust Token**: generated on the cluster
|
|
|
|
Generate a trust token on the Incus cluster:
|
|
```bash
|
|
incus config trust add <remote>:AETHER
|
|
```
|
|
|
|
Paste the token into the form and click **Add Cluster**. The cluster appears
|
|
in the "Current INCUS Clusters" table with its TLS certificate fingerprint
|
|
and expiry date.
|
|
|
|
After adding, select the cluster from the **Select Cluster** dropdown on
|
|
the INCUS Infrastructure Management page. This loads the cluster dashboard
|
|
with tabs:
|
|
|
|
| Tab | Description |
|
|
|-----|-------------|
|
|
| Clustering: Members | Cluster nodes with status, memory, load, roles |
|
|
| Clustering: Cluster Groups | Logical groupings of nodes |
|
|
| Storage: Pools | Storage pool configuration |
|
|
| Storage: Volumes | Storage volume management |
|
|
| Profiles | Instance profiles with devices and config |
|
|
| Operations | Running and completed operations |
|
|
| Warnings | Cluster warnings |
|
|
| Settings | Cluster configuration |
|
|
| Images | Cached images across the cluster |
|
|
| Configuration | Cluster-level config keys |
|
|
| Instances | All instances with actions (Start/Stop/Migrate/Console/etc.) |
|
|
| Networking | Networks (bridge, OVN, physical) with View/Edit |
|
|
| ACLs | Network ACL management |
|
|
| Address Sets | Address set management for ACLs |
|
|
| OS | IncusOS node management |
|
|
|
|
The **Instances** tab provides per-instance action buttons: Start, Restart,
|
|
Freeze, Unfreeze, Stop, Migrate, Snapshot, Console, Logs, Delete. Instances
|
|
can be filtered by type (VM/Container) and status. Each row shows name, type,
|
|
status, IPv4, memory usage, image, snapshots, and location (cluster member).
|
|
|
|
The **Cluster Members** view shows real-time memory and load bars per node,
|
|
OVN roles, and an Evacuate action button.
|
|
|
|
### Step 2: Connect Operations Center
|
|
|
|
Navigate to **Operations Center** (`/operationcenter`) → click
|
|
**+ Add Operations Center**.
|
|
|
|
The form requires:
|
|
- **Name**: label for this OC (e.g., `oc-lab`)
|
|
- **URL**: OC API endpoint (e.g., `https://192.168.102.120:8443`)
|
|
- **Certificate (PEM)**: client TLS certificate (PEM format)
|
|
- **Private Key (PEM)**: matching private key (PEM format)
|
|
|
|
Unlike Incus (which uses trust tokens), OC uses **mutual TLS** — Aether
|
|
connects with a client certificate that must already be in the OC trust store.
|
|
Use the same `client.crt` and `client.key` that were injected into the OC
|
|
seed during deployment (typically at `~/.config/incus/client.crt` and
|
|
`~/.config/incus/client.key`).
|
|
|
|
Click **Test Connection** to verify — a successful test shows:
|
|
`Connected! API: 1.0 (devel)`.
|
|
|
|
Click **Save** to add the OC. The OC appears in the "Configured Operations
|
|
Centers" table with status, fingerprint, last connected timestamp, and
|
|
Edit/Test/Delete actions. A green **Manage** badge indicates an active
|
|
connection.
|
|
|
|
### Connection comparison
|
|
|
|
| | Incus Cluster | Operations Center |
|
|
|---|---|---|
|
|
| Auth method | Trust token | Mutual TLS (client cert + key) |
|
|
| Token/cert source | `incus config trust add` | Existing client cert from `~/.config/incus/` |
|
|
| API version | Incus REST API | OC API 1.0 |
|
|
| Port | 8443 | 8443 |
|
|
|
|
## Lab State After Setup
|
|
|
|
### Connected infrastructure
|
|
|
|
| Connection | Name | URL | Status |
|
|
|------------|------|-----|--------|
|
|
| Incus Cluster | oc-lab-cluster | https://192.168.102.141:8443 | Connected |
|
|
| Operations Center | oc-lab | https://192.168.102.120:8443 | Connected |
|
|
|
|
### Cluster members (as seen in Aether)
|
|
|
|
| Node | URL | Status | Memory | Load | Roles |
|
|
|------|-----|--------|--------|------|-------|
|
|
| oc-node-01 | https://192.168.102.140:8443 | Online | 35% (5.5/16.0 GB) | 19% | ovn-chassis, database |
|
|
| oc-node-02 | https://192.168.102.141:8443 | Online | 92% (14.7/16.0 GB) | 28% | ovn-chassis, database-leader |
|
|
| oc-node-03 | https://192.168.102.142:8443 | Online | 54% (8.7/16.0 GB) | 25% | ovn-chassis, database |
|
|
|
|
### Instances visible in Aether
|
|
|
|
| Name | Type | Status | IPv4 | Image | Location |
|
|
|------|------|--------|------|-------|----------|
|
|
| aether | VM | Running | 192.168.102.160 | ubuntu noble | oc-node-01 |
|
|
| ovn-central | Container | Running | 10.207.217.23 | Debian bookworm | oc-node-02 |
|
|
| ha-web-02 | Container | Stopped | 10.10.10.3 | Debian bookworm | oc-node-02 |
|
|
| ha-web-03 | Container | Stopped | 10.10.10.4 | Debian bookworm | oc-node-03 |
|
|
|
|
### Networks visible in Aether
|
|
|
|
| Name | Type | IPv4 | Uplink | NAT | Used By |
|
|
|------|------|------|--------|-----|---------|
|
|
| UPLINK | physical | 192.168.100.1/22 | - | - | 1 |
|
|
| incusbr0 | bridge | 10.207.217.1/24 | - | IPv4, IPv6 | 2 |
|
|
| meshbr0 | bridge | none | - | IPv6 | 1 |
|
|
| net-prod | ovn | 10.10.10.1/24 | UPLINK | IPv4, IPv6 | 2 |
|