Cloudstack management server, nfs server, kvm host configuration steps

[arpanbht]

Hey guys, I just want to to if I am following proper steps to configure management server , nfs server and kvm host.

Here I have attached the steps which I follow to configure these. Please guide me if I need to make any changes or the current configuration is okay.

I have made two bash scripts for kvm host and nfs server and I manually install the management server

Here is the management server steps

apt install chrony -y

sudo nano /etc/apt/sources.list.d/cloudstack.list
deb https://download.cloudstack.org/ubuntu jammy 4.22

wget -O - https://download.cloudstack.org/release.asc |sudo tee /etc/apt/trusted.gpg.d/cloudstack.asc

sudo apt update

sudo apt install cloudstack-management -y

sudo apt install openjdk-11-jdk -y

sudo update-alternatives --config java

sudo apt install mysql-server -y

sudo nano /etc/mysql/my.cnf

[mysqld]
server_id=source-01
innodb_rollback_on_timeout=1
innodb_lock_wait_timeout=600
max_connections=350
log_bin=mysql-bin
binlog_format=ROW

sudo systemctl restart mysql

sudo mysql

ALTER USER 'root'@'localhost' IDENTIFIED WITH mysql_native_password BY '<password>';
FLUSH PRIVILEGES;
EXIT;

sudo cloudstack-setup-databases cloud:<password>@localhost --deploy-as=root:<password> -e file -m <mgmt_key> -k <db_key> -i <mgmt_ip>

nano /etc/sudoers

Defaults:cloud !requiretty

cloudstack-setup-management

ufw allow mysql

ufw allow 8080/tcp
ufw allow 8250/tcp
ufw allow 8443/tcp
ufw allow 9090/tcp
ufw enable
ufw reload

sudo systemctl start cloudstack-management
sudo systemctl enable cloudstack-management

Here is the bashscript file for nfs server

#!/usr/bin/env bash
# --------------------------------------------
# Script: setup-nfs-server.sh
# Purpose: Setup NFS server with primary & secondary exports
# OS: Ubuntu / Debian based systems
# --------------------------------------------

set -e

echo "🚀 Starting NFS Server Setup..."

# Ensure script is run as root
if [[ "$EUID" -ne 0 ]]; then
  echo "❌ Please run this script as root (use sudo)"
  exit 1
fi

# Update system and install required packages
echo "📦 Updating system and installing NFS packages..."
apt update -y
apt install -y nfs-kernel-server rpcbind

# Create export directories
echo "📁 Creating export directories..."
mkdir -p /export/primary
mkdir -p /export/secondary

# Set permissions (CloudStack-friendly)
echo "🔐 Setting permissions..."
chown -R nobody:nogroup /export
chmod -R 777 /export

# Backup existing exports file
echo "🗂️ Backing up /etc/exports..."
cp /etc/exports /etc/exports.bak.$(date +%F-%T)

# Configure NFS exports
echo "✍️ Configuring /etc/exports..."
cat <<EOF >> /etc/exports

# CloudStack NFS Storage
/export/primary   *(rw,async,no_root_squash,no_subtree_check)
/export/secondary *(rw,async,no_root_squash,no_subtree_check)
EOF

# Apply NFS export rules
echo "🔄 Applying NFS exports..."
exportfs -ra

# Restart services
echo "🔁 Restarting NFS services..."
systemctl enable rpcbind --now
systemctl enable nfs-kernel-server --now
systemctl restart rpcbind
systemctl restart nfs-kernel-server

# Verify exports
echo "✅ Verifying NFS exports..."
showmount -e localhost

echo "🎉 NFS Server setup completed successfully!"

Here is the bashscript file for kvm host

#!/bin/bash

set -e

### -------------------------
###  Parse Arguments
### -------------------------
while [[ "$#" -gt 0 ]]; do
    case $1 in
        --host-ip) HOST_IP="$2"; shift ;;
        --mgmt-ip) MGMT_IP="$2"; shift ;;
        --iface) IFACE="$2"; shift ;;
        --root-pass) ROOT_PASS="$2"; shift ;;
        --ubuntu-version) UBUNTU_VERSION="$2"; shift ;;
        --cloud-version) CLOUD_VERSION="$2"; shift ;;
        *) echo "Unknown parameter: $1"; exit 1 ;;
    esac
    shift
done

### -------------------------
###  Validate required args
### -------------------------
if [[ -z "$HOST_IP" || -z "$MGMT_IP" || -z "$IFACE" || -z "$ROOT_PASS" || -z "$UBUNTU_VERSION" || -z "$CLOUD_VERSION" ]]; then
    echo "❌ Missing required arguments."
    echo "Usage:"
    echo "sudo bash cloudstack-agent-setup.sh --host-ip X.X.X.X --mgmt-ip X.X.X.X --iface enp3s0 --root-pass 'pass' --ubuntu-version 24.04 --cloud-version 4.22"
    exit 1
fi

### Installing essential packages
echo "▶ Installing essential packages..."
apt update -y
apt install -y iputils-ping net-tools nano neofetch curl openvswitch-switch ufw

### Hardcoded gateway
GATEWAY="192.168.1.1"

echo "===== Starting CloudStack Agent Setup ====="
sleep 2

### -------------------------
### Enable SSH root login
### -------------------------
echo "▶ Enabling SSH root login..."
apt update -y
apt install -y openssh-server

sed -i 's/^#\?PasswordAuthentication.*/PasswordAuthentication yes/' /etc/ssh/sshd_config
sed -i 's/^#\?PermitRootLogin.*/PermitRootLogin yes/' /etc/ssh/sshd_config

echo "root:$ROOT_PASS" | chpasswd
systemctl restart ssh

### -------------------------
### Install Required Packages
### -------------------------
echo "▶ Installing Java 11..."
apt install -y openjdk-11-jre-headless
update-alternatives --set java /usr/lib/jvm/java-11-openjdk-amd64/bin/java

### -------------------------
### Configure Netplan Bridge
### -------------------------
echo "▶ Configuring cloudbr0 bridge..."

# Find the first .yaml file in /etc/netplan
NETPLAN_FILE=$(ls /etc/netplan/*.yaml | head -n 1)
if [ -z "$NETPLAN_FILE" ]; then
    echo "❌ No netplan YAML file found in /etc/netplan."
    exit 1
fi

echo "Editing netplan file: $NETPLAN_FILE"

# Backup the original netplan file
cp "$NETPLAN_FILE" "$NETPLAN_FILE.bak"

# Overwrite the netplan file with bridge config
cat > "$NETPLAN_FILE" <<EOF
network:
  version: 2
  renderer: networkd

  ethernets:
    $IFACE:
      dhcp4: false
      dhcp6: false

  bridges:
    cloudbr0:
      interfaces: [$IFACE]
      addresses:
        - $HOST_IP/24
      routes:
        - to: default
          via: $GATEWAY
      nameservers:
        addresses: [8.8.8.8, 1.1.1.1]
      mtu: 1500
      dhcp4: false
      dhcp6: false
      parameters:
        stp: false
        forward-delay: 0
EOF

netplan generate
netplan apply

### -------------------------
### Install KVM + Libvirt
### -------------------------
echo "▶ Installing KVM..."
apt install -y qemu-kvm libvirt-daemon-system libvirt-clients bridge-utils virtinst ovmf dnsmasq qemu-utils

echo "▶ Configuring libvirtd..."

cat > /etc/libvirt/libvirtd.conf <<EOF
listen_tls = 0
listen_tcp = 1
tcp_port = "16509"
tls_port = "16514"
auth_tcp = "none"
mdns_adv = 0
EOF

echo 'LIBVIRTD_ARGS="--listen"' > /etc/default/libvirtd

systemctl mask libvirtd.socket libvirtd-ro.socket libvirtd-admin.socket libvirtd-tls.socket libvirtd-tcp.socket || true
systemctl daemon-reload
systemctl restart libvirtd

### -------------------------
### UFW Firewall Rules
### -------------------------
echo "▶ Configuring firewall..."
ufw allow 22/tcp
ufw allow 1798/tcp
ufw allow 8250/tcp
ufw allow 16509/tcp
ufw allow 16514/tcp
ufw allow 5900:6100/tcp
ufw allow 49152:49216/tcp
ufw --force enable

### -----------------------------
### Allow Bridge traffic in UFW
### -----------------------------
echo "▶ Allowing bridge traffic in UFW..."
sudo sed -i 's/^DEFAULT_FORWARD_POLICY=.*/DEFAULT_FORWARD_POLICY="ACCEPT"/' /etc/default/ufw
ufw reload
ufw allow in on cloudVirBr0
ufw allow out on cloudVirBr0
ufw reload
ufw enable

grep DEFAULT_FORWARD_POLICY /etc/default/ufw

### -------------------------
### Add CloudStack Repo
### -------------------------
echo "▶ Adding CloudStack $CLOUD_VERSION repo for Ubuntu $UBUNTU_VERSION..."

echo "deb https://download.cloudstack.org/ubuntu noble $CLOUD_VERSION" > /etc/apt/sources.list.d/cloudstack.list
wget -O - https://download.cloudstack.org/release.asc | tee /etc/apt/trusted.gpg.d/cloudstack.asc >/dev/null
apt update

### -------------------------
### Install CloudStack Agent
### -------------------------
echo "▶ Installing CloudStack Agent..."
apt install -y cloudstack-agent
systemctl stop cloudstack-agent

### -------------------------
### Configure Agent Properties
### -------------------------
echo "▶ Configuring CloudStack Agent..."

GUID=$(uuidgen)

cat > /etc/cloudstack/agent/agent.properties <<EOF
guid=$GUID
host=$MGMT_IP
port=8250
hypervisor.type=kvm
resource=com.cloud.hypervisor.kvm.resource.LibvirtComputingResource
libvirt.uri=qemu:///system

use.secure.connection=false
sec.ssl.enabled=false
ca.plugin.cert.service.enabled=false

private.network.device=cloudbr0
public.network.device=cloudbr0
guest.network.device=cloudbr0

cluster=2
pod=2
zone=2

local.server.ip=$HOST_IP
workers=5
vm.migrate.wait=3600
EOF

### -------------------------
### Configure Environment Overrides
### -------------------------
mkdir -p /etc/systemd/system/cloudstack-agent.service.d

cat > /etc/systemd/system/cloudstack-agent.service.d/envfix.conf <<EOF
[Service]
Environment="JAVA_OPTS=-Djava.io.tmpdir=/usr/share/cloudstack-agent/tmp -Xms256m -Xmx2048m"
Environment="CLASSPATH=/usr/share/cloudstack-agent/lib/*:/usr/share/cloudstack-agent/plugins/*:/etc/cloudstack/agent:/usr/share/cloudstack-common/scripts"
Environment="JAVA_CLASS=com.cloud.agent.AgentShell"
EOF

systemctl daemon-reload
systemctl restart cloudstack-agent

echo "===================================="
echo " CloudStack Agent Setup Completed!"
echo "===================================="
systemctl status cloudstack-agent --no-pager



: <<'COMMENT'

sudo bash cloudstack.sh \
  --host-ip 192.168.1.195 \
  --mgmt-ip 192.168.1.201 \
  --iface enp4s0 \
  --root-pass 'user@1234' \
  --ubuntu-version 22.04 \
  --cloud-version 4.22


systemctl status cloudstack-agent --no-pager

COMMENT

Please let me know if you guys need some other details. I will follow up 🙌.

[DaanHoogland]

@arpanbht , I asked copilot what to think of this and then it occured to me that a lot of this work is done in the installer (cc @sudo87 ) Here is the analysis CoPilot gave me:

Here's a comparison of the discussion's manual scripts vs. the official cloudstack-installer:

---

Side-by-Side Comparison

Aspect	Discussion Scripts	apache/cloudstack-installer
Invocation	3 separate scripts, run manually in order	Single one-liner: curl -sSfL https://get.cloudstack.cloud/install.sh | sudo bash
Components covered	Management, NFS, KVM (separate)	All-in-One or Custom — management, KVM, NFS, MySQL, Usage Server
Zone deployment	Manual (not scripted)	Built-in guided Zone Deployment Wizard
OS support	Ubuntu only (hardcoded jammy/noble)	Ubuntu 20.04/22.04/24.04, Oracle/Rocky/Alma 8 & 9, EL10 (experimental)
Idempotency	None — re-running risks breakage	✅ Tracker file prevents duplicate steps
Error handling	Basic set -e	Full logging to installer.log + progress tracking
Hardcoded values	Gateway 192.168.1.1, zone/pod/cluster IDs, Java path	Parameterized, auto-detected
Java management	Installs Java 11 manually (likely wrong version)	Handles correct version automatically, warns against pre-installing Java
Network bridge	cloudbr0 via Netplan (hardcoded gateway)	Auto-configures bridge, detects interface
NFS exports	Wildcard * (any host)	Configured for local all-in-one use
Interactive UI	None	dialog-based menu with 4 options
Multi-machine	Designed for it (separate scripts per role)	Supported via "Custom Installation" mode

---

Key Takeaways

1. For a quick lab/PoC, the official installer is far superior — it handles all the rough edges the discussion scripts get wrong (Java version, codename mapping, hardcoded IPs).

2. For multi-machine deployments (separate management, NFS, and KVM hosts like in the discussion), the official installer's Custom Installation mode covers this too — you'd run it on each machine and select only the relevant components.

3. The discussion scripts would benefit from adopting the installer's approach to:

   • Deriving Ubuntu codenames from version numbers
   • Making the gateway a CLI argument
   • Adding an idempotency/tracker mechanism

4. The installer's own README explicitly warns: "Avoid pre-installing Java before running this script" — which is exactly the issue in the management server steps in the discussion (Java installed after cloudstack-management).

Recommendation for the OP: Point them to curl -sSfL https://get.cloudstack.cloud/install.sh | sudo bash — it solves most of the issues identified in the previous review out of the box.

[arpanbht]

@DaanHoogland Thank you man for you time, I will look into this.