Skip to main content

OpenStack clouds

Many public clouds run on OpenStack: OVHcloud Public Cloud, Infomaniak Public Cloud and others. On any of them you upload the qcow2 to the cloud's image service once, then launch instances from it with your key pair, as from any other image. No seed ISO is needed: the instance reads your key from the cloud.

Before you start​

  • A project at an OpenStack cloud, with the right to upload private images. Most providers allow it; a few offer their own images only.
  • The openstack command-line client, with your project's credentials loaded (the openrc file or clouds.yaml your provider gives you). Everything here can also be done in the Horizon dashboard, where the provider offers it.
  • A flavor with 2 vCPU, 4 GB of memory and a 40 GB disk or more, as Hardware describes.
  • A key pair in the project, or your SSH public key to create one with.
  • The file: the qcow2, antelao-ohm-<version>-amd64.qcow2.

Download​

Download the qcow2 from the table on the overview page, then check it before you upload it. Run this in the folder you downloaded it to:

curl -fsSLO https://packages.antelao.io/raw/cosign.pub
sha256sum cosign.pub
curl -fsSLO https://images.antelao.io/ohm/stable/0.23.0/SHA256SUMS
curl -fsSLO https://images.antelao.io/ohm/stable/0.23.0/SHA256SUMS.sig
cosign verify-blob --key cosign.pub --signature SHA256SUMS.sig \
  --insecure-ignore-tlog=true SHA256SUMS
sha256sum --check --ignore-missing SHA256SUMS

Verify the download says what must come out right, and how to check on Windows or a Mac.

Import​

Upload the qcow2 to the image service:

openstack image create antelao-ohm-<version> \
  --disk-format qcow2 --container-format bare \
  --min-disk 40 --min-ram 4096 \
  --property os_distro=debian --property os_version=13 \
  --property hw_qemu_guest_agent=yes \
  --private \
  --file antelao-ohm-<version>-amd64.qcow2

The upload takes a while; the image is ready when openstack image show antelao-ohm-<version> says active.

  • Firmware. The disk boots both BIOS and UEFI, and an instance boots BIOS unless the image says otherwise, so there is nothing to set. To boot UEFI anyway, add --property hw_firmware_type=uefi where your provider supports it.

  • Raw images. Some providers whose storage runs on Ceph ask for raw images rather than qcow2. Convert first if yours does, and upload with --disk-format raw:

    qemu-img convert -f qcow2 -O raw antelao-ohm-<version>-amd64.qcow2 antelao-ohm-<version>-amd64.raw

In Horizon the same upload is Project > Compute > Images > Create Image: give it a name, choose the file, and set Format to QCOW2 - QEMU Emulator, Minimum Disk to 40 and Minimum RAM to 4096.

Give it your SSH key​

The instance takes your key from the project's key pair, through the cloud's metadata service or a config drive, and the first boot gives it to the user debian.

Create the key pair from your public key, if the project does not have it yet:

openstack keypair create --public-key ~/.ssh/id_ed25519.pub my-key

Then a security group that lets SSH and the web in, and nothing else:

openstack security group create antelao-ohm
openstack security group rule create --protocol tcp --dst-port 22 antelao-ohm
openstack security group rule create --protocol tcp --dst-port 80 antelao-ohm
openstack security group rule create --protocol tcp --dst-port 443 antelao-ohm

Leave the console's port 5322 and the other management ports out: you reach the console through an SSH tunnel. To allow SSH from your own address only, add --remote-ip 203.0.113.10/32 to the first rule.

User data, optionally. An instance also takes a cloud-config as user data, the same one a seed ISO carries. Use it, for example, to write the bootstrap document to /etc/antelao/bootstrap.json. The seed ISO builder writes one you can start from: build a seed, open What is on the disc, and copy its user-data.

Start it and wait for the first boot​

Launch the instance:

openstack server create odoo-1 \
  --image antelao-ohm-<version> \
  --flavor <flavor> \
  --network <network> \
  --key-name my-key \
  --security-group antelao-ohm

Add --user-data user-data to pass a cloud-config, and --config-drive true on a cloud without a metadata service. Where the network is private, attach a floating IP afterwards with openstack floating ip create and openstack server add floating ip.

In Horizon this is Project > Compute > Instances > Launch Instance: the image under Source, the flavor under Flavor, the network under Networks, the group under Security Groups, the key pair under Key Pair, and the user data under Configuration as Customization Script.

openstack console log show odoo-1 shows the boot messages, and openstack server show odoo-1 shows the instance's address. The first boot installs the server in the background, which takes about 10 minutes. Sign in over SSH meanwhile and the login message says how far it is.

Reach the console​

Sign in over SSH as debian with your key:

ssh debian@203.0.113.10

Once the first boot is done, the login message shows the console's address. Read the administrator's first password:

sudo cat /root/antelao-ohm-handoff.json

Then open the console through an SSH tunnel from your own computer:

ssh -N -L 5322:127.0.0.1:5322 debian@203.0.113.10

Browse to https://localhost:5322/ and accept the self-signed certificate once. Point your DNS name at the instance's public address, then carry on with the installation page:

  1. Check the server
  2. Reach the console
  3. Sign in and finish the setup
  4. Create your first instance

Platform notes and troubleshooting​

  • The user is debian. Not root and not ubuntu, whatever the provider's own images use.
  • The upload is refused or stalls. Check the project's image quota and that the provider takes qcow2; convert to raw where it does not. Upload from a machine close to the cloud if your own connection is slow: the file is several gigabytes.
  • The instance does not boot. Remove hw_firmware_type from the image, or set it the other way, with openstack image set or openstack image unset.
  • SSH times out. Check that the security group is on the instance and allows port 22, and that the address you use is the floating or public one.
  • SSH refuses the key. The key pair is given to the instance when it is created. Check --key-name, and that you sign in as debian.
  • A volume-backed instance. Clouds that boot from volumes create one from the image; make it 40 GB or more. A bigger flavor disk or volume is used by the first boot.
  • The first boot failed. The login message says FAILED with the reason. See What the first boot does for how to run it again.
Last updated on