BluValt VDC Admin Guide 2.1
BluValt VDC Admin Guide 2.1
Bluvalt Brand
Version: 2.2
Date: 12/7/2017
Bluvalt Brand - Bluvalt JIDDAH VDC Administrator Manual
Cloud Services - Procedure/Process
Table of Contents
2.9.1. ALLOWING INBOUND AND OUTBOUND TRAFFIC BETWEEN VMS ON THE SAME NETWORK .............. 28
3. V OLUMES ................................................................................................................. 35
4. I MAGES .................................................................................................................... 41
5. N ETWORKING .......................................................................................................... 44
Confidentiality Agreement
The information contained in this document is the property of STC and may not be copied
or communicated to a third party or used for any purpose other than that for which it is supplied,
without the express written consent of STC. bluvalt is a registered trademark of STC.
Acronyms
Preface
This guide enables administrators to utilize bluvalt to its full potential, as per their
rights & roles in managing the platform on the cloud.
1. Dashboard Overview
You can apply any adjustments on your account using Settings option, or check
the interface Help through the provided drop-down list.
o Images: View images created by project users, along with any image
that is publicly available. This menu item will enable users to create,
edit, and delete images. Hence, they can launch new instances from
these images.
o Security Groups: View, create, edit, and delete Security Groups and
Security Group Rules.
o Key Pairs: View, create, edit, and import SSH key pairs, or delete key
pairs.
The Overview menu item demonstrates a simple graphical recap for the VMs’ usage
limit dimensions, like the number of VCPUs, disks, RAM, and uptime for all of these instances.
This page also provides a summary of how the project is doing in relation to the project
quotas under the ‘Limit Summary’ section. On the other hand, the ‘Usage Summary’ section
displays the overall consumed quota of the currently running instances/active Instances -
within a specified period of time – along with detailed information on usage per VM at the
‘Usage’ section.
A user can simply enter the desired From - To dates in (YYYY-mm-dd) format, and click
Submit. Then, you can preview all usage details, or export the grid content to a CSV file via
Download CSV Summary.
Instances are virtual machines (VMs) that run in the cloud. To launch a new instance,
please apply the following steps:
On the Instances page, click the Launch Instance button at the top right
corner. Then, the Launch Instance dialog will appear:
Field Description
Instance Boot Boot from a predefined image with an Operating system or boot
Source from an existing volume with an operating system.
Access & Security This tab controls connectivity to an instance via SSH key pairs,
security groups, and other mechanisms.
Device Size The size of the root volume (C: drive in Windows) of the
instance.
Device Name The mount point for the volume on a LINUX instance (this option
has no effect on Windows instances).
In the Launch Instance ‘Access & Security’ tab, select the needed security
groups that you want to apply on the VM. In addition, you can select the Key
pair that will be used to connect to the instance via SSH (this does not apply to
Windows instances).
In the Launch Instance ‘Networking’ tab, select the networks that will be
connected to the instance. The instance will get a network interface for each
selected network.
Afterwards, press the Launch button and pay attention to how the Status, Task
and Power State fields change for the new VM.
Once the instance is in the Active status, then the Instance creation is
completed and it is ready to be used.
Users can perform various management tasks on the created instance, as shown
below. Click the More button per instance record, to expand the drop down list of
actions available for this instance.
Action Description
Each instance has a private fixed IP address and can also have a public (floating) IP
address. Private IP Addresses are used for communications between instances that are
connected to same virtual router (vRouter). Public (floating) IP Addresses are used for
communication between instances that are connected to a different virtual router or that are
located outside of bluvalt.
The project quota defines the maximum number of floating IP addresses that you can
allocate to the project. After allocating a floating IP address to a project, an admin user can:
Associate the floating IP address with an instance of the project. Only one floating
IP address can be allocated to a Virtual Network Interface instance any given time.
Release a floating IP from the project, which automatically deletes this IP’s
associations.
Note:
1. Follow the above path to reach the Instances page, and click the Instance Name.
The Instance Details page shows the ‘Overview’ tab, associated with more detailed
information, as shown below.
2. Then, click the ‘Console’ tab, in order to open the VNC console window on the
Instance Console page.
3. Log in to the VM using your Username and Password. If you cannot type at the
prompt, click in the grey area first, and then type at the prompt. If you see a command
prompt, then you are successfully connected to the instance using VNC console.
Important Note:
LINUX VMs cannot be accessed through the Console by default. You must use
KeyPairs to access the LINUX instance for the first time. If needed, you can set a
password for the instance after accessing it through SSH, and then use it with the
username to access the LINUX instance through the Console window.
A more secure way to connect to your LINUX VMs is by using Key Pairs. Each key pair
has two parts, the public key and the private key. The public key is what is injected into your
LINUX instances under the authorized_key file. The private key is what you save in a .pem file
on your local machine. You can use your private key to SSH into your LINUX instances.
These keys are injected into your LINUX instances to make password-less SSH access to the
instance possible.
To use a key pair, you should first create one, and then assign it to an instance during
the VM creation process.
Navigate to this path; Project → Compute → Access & Security → Key Pairs.
Then, click the + Create Key Pair button, as shown below.
Enter the Key Pair Name at the provided field, and then click Create Key Pair
button.
Hence, the key .pem file will be downloaded to your browser, and you will be able to
use it to connect remotely to your server through SSH.
Important Note:
Please save your key pair private key and don’t lose it, for security reasons re-
downloading the key pair private key again is not possible. In case you lost the Key
pair private key, you can take a snapshot of the VM and launch a new instance
from the snapshot and assign a new key pair to it.
Launch a new instance and assign the key pair through the ‘Access and
Security’ tab.
Make sure that port 22 (SSH) is allowed through the Security Group used by
the instance. For more elaborations, check heading ‘2.9. Working with Security
Groups’.
Notes:
Upon creating & configuring an instance, it will be accessible to users through SSH
from their workstations.
LINUX and UNIX based VMs default username can be found in the information of
the image that is used to create the VM. For more information, please check
section ‘4. Images’.
With the native OpenSSH client on a LINUX workstation, you can use this .pem-file
directly. If you are using a Windows workstation, you will need to use a third party
SSH app, as Windows does not include an SSH client.
The most popular Windows SSH Clients are “Xshell” and “Putty”. “Xshell” works
by importing the .pem-file directly, while “PuTTY” does not work with .pem-files.
Thus, you have to convert your key first, by completing the following steps:
b) Start PuTTYgen.
c) Click Load.
d) Browse to the location of the private key file that you want to convert
(Note: PuTTYgen displays only files with extension .ppk by default.
Therefore, you will need to change that to display files of all types, in
order to see your .pem key file).
f) When you click OK, PuTTYgen will display a dialog box with information
about the loaded key, such as the Public Key and the Fingerprint.
g) Optional step: Enter and confirm a key Passphrase. Note that, if you
use a passphrase, you will have to enter this passphrase whenever you
authenticate with your key.
Now you can use the converted private key in Putty by following these steps:
Open Putty.
Click on the Browse button under Private key file for authentication.
Enter in the Host Name (or IP address) field, the username and floating IP
address of the instance.
Optional step: Enter a name for the session in the Saved Sessions field and
click Save. This saves all the settings, including the private key for this session.
When you connect for the first time, you will be asked if you trust this
computer. Normally you can click Yes.
If you haven’t entered the username with the IP/hostname in the Host Name
field, you will be prompted to enter it within instance login.
2. On the Instance page, click the Instance Name. Then, the Instance Details page
appears with ‘Overview’ tab displayed by default.
3. Click the ‘Console’ tab. You should see the VNC console window on the Instance
Console page.
5. Assign a Floating IP to the instance. For more elaborations, check ‘5.4 External
Network Connectivity to VM (Floating IP)’ below.
Make sure that port 3389 (RDP) is allowed through the Security Group used by
the instance. For more elaborations, check heading ‘2.9: Working with Security
Groups’.
Make Sure RDP is enabled in the Windows VM and allowed through its firewall.
A Security Group is a collection of network access rules that are used to limit the types
of traffic that have access to instances. Hence, Security Groups are applied to instances ports
directly.
When you launch an instance, you can assign one or more security groups to it.
If you launch an instance and did not assign a security group to it, it will
The associated rules in each security group control the traffic to instances in the
group.
You cannot add rules that deny traffic; any inbound and outbound traffic that is
not matched by a rule is denied access by default.
The ‘Default’ Security group is available by default and it cannot be deleted or changed.
It includes the following rules:
Important Notes:
All external remote access (SSH, RDP or HTTP) attempts to any VM are not allowed
by default. Thus, an appointed admin user should configure access rules first to
allow it.
When creating a new security group, it will contain a rule by default to allow all
outgoing traffic. You can delete this rule, if required.
To create a New Rule that allows access through a protocol and port in a Security
Group, apply the following steps:
2. Click on the ‘Security Groups’ tab to show the security groups that are available for
this project.
Enter the required rule data at the Add Rule dialog box, as follows:
Field Description
Rule Choose the type of rule you want to create. Note that, there
are pre-defined rules, yet a user is eligible to create his own
TCP/UDP/ICMP custom rule.
Port Range In case of choosing a custom rule, enter your port range.
5. Finally, click Add button to save the record. Once you made a change to the security
group rules and saved the record, the change will be effective immediately for all
instances using that security group.
Here we will need to configure the security group to allow Ingress and Egress traffic
between VMs in the security groups:
Add a rule in the used Security Group for the source VM to allow outgoing traffic
from the Source VM:
o Direction: Egress.
o Remote: Enter the Security Group name. (you can use CIDR instead by
entering the source IP address/range)
Add a rule in the used Security Group for the destination VM to allow incoming
traffic to the Destination VM:
o Direction: Ingress.
o Remote: Enter the Security Group name. (you can use CIDR instead by
entering the destination IP address/range)
Example
Allowing ping (ICMP) traffic (inbound and outbound) between 2 instances in the same
network and associated with different Security Groups SG1 and SG2 prospectively
To accomplish this, you will need to add 2 rules in each Security Group, one to allow
outbound ICMP from the VMs assigned to it and the other to allow inbound ICMP to the VMs
assigned it:
o Direction: Egress
o Direction: Ingress
o Direction: Egress
o Direction: Ingress
Add a rule in the used Security Group for the source VM to allow outgoing traffic
to the Destination IP(s) from the Source IP(s):
o Direction: Egress.
Add a rule in the used Security Group for the Destination VM to allow incoming
traffic to the Destination VM from the Source IP(s):
o Direction: Ingress.
Example
Open incoming SSH traffic from the IP address 192.168.100.100 (outside the cloud) to
instances in the Security Group “SG1”.
o Direction: Ingress
o Port Range: 22
o Remote: CIDR
o CIDR: 192.168.100.100/32
o Rule: SSH
o Remote: CIDR
o CIDR: 192.168.100.100/32
If two networks are connected to the same router the VMs inside them can
communicate using their private IP addresses, therefore we can use the VMs private IPs in
the Security Groups rules. However, if the two networks are connected to different routers,
the traffic will pass through the public network to reach the other router and then to the
destination network. This means that the appointed user will need to allow traffic in the
Security Groups using the Public (floating) IP addresses of the VMs. The difference is
explained in the below figures:
NOTE:
For further explanation on how networking works, please check section ‘5.
Networking’.
Here is how to configure the Security Groups to control the network access in the above
scenario:
Add a rule in the used Security Group for the Source VM, to allow outgoing traffic
from the Source VM to the Destination VM:
o Direction: Egress.
Add a rule in the used Security Group for the Destination VM, to allow incoming
traffic to the Destination VM from the Source VM:
o Direction: Ingress.
Example
Allowing inbound communications on port 3306 (MySQL) from the instances “VM1” in
the network “My Net1” which is connected to the router “My Router 1”, the VM is associated
with Security Group “SG1”, to the MySQL instance “MySQLVM” in the network “My Net2” which
is connected to the router “My Router 2”, the VM is associated with the Security Group “SG2”.
Source Destination
Since the source and destination are on different networks that are connected to
different routers, then they will not be able to communicate through their private IP
addresses. They can only communicate through their public (floating) IP addresses.
Therefore, we will need to configure two rules, one to allow outbound traffic from “SG1” to
the destination public IP address, and another rule in “SG2” to allow inbound traffic from the
source public IP address.
“SG1” Configurations:
o Direction: Egress
o Remote: CIDR
o CIDR: 192.168.200.12/32
“SG2” Configurations:
o Direction: Ingress
o Remote: CIDR
o CIDR: 192.168.100.11/32
3. Volumes
bluvalt Volumes are provided as a block storage service.
When you create a new instance in bluvalt, it gets stored on a new
volume. You can create a custom volume and attach it to a running
instance or detach a volume and attach it to another instance at
any time. You can also create a snapshot from /or delete a volume.
Block volumes storage is persistent, so the data is not affected by
attaching/detaching it to other instances, the data will be lost only
when you delete the volume.
To create a volume in the Block Storage service and attach it to a VM, apply the
following steps:
3. Enter/select the following values at the dialog box listed fields, as follows:
4. After entering the required data, click Create Volume. The new volume will be created
and is ready to be assigned to an instance.
After creating one or more volumes, a user can attach them to instances. You can
attach a volume to one instance at a time, as follows:
2. Select the required volume to add to an instance, and click Manage Attachments.
3. In the Manage Volume Attachments dialog box, select the required Instance.
4. It is optional to choose to enter the name of the device from which the volume is
accessible by the instance (this is valid only for LINUX VMs only)
Notes:
The dashboard shows the Instance to which the volume is now attached and the
Device Name.
It is worth mentioning; a user can view the status of a volume in the Volumes tab
at the dashboard. The volume is either Available or In-Use.
To use the attached volume, you will need to log in to the instance, mount and
format it. You can also detach the volume from the VM and attach it to another
VM, as required.
Important Note:
You will need to unmount the device from your instance prior to detaching it, to
avoid any data corruption in the volume.
Detaching a volume before unmounting it from the OS may also cause the VM to
hang.
A volume size can only be extended and not reduced. To extend a volume size:
In the Extend Volume dialog box, enter the new size of the volume.
In the Actions column of the volume you want to take a snapshot of, click
Create Snapshot (In some cases, creating a snapshot from an attached volume
can result in a corrupted snapshot).
In the Create Volume Snapshot dialog box, enter the snapshot Name.
You will find the snapshot in the ‘Volume Snapshots’ tab, as shown below.
You can then create a new volume from the snapshot and attach it to an
instance.
Snapshots for an instance volume are taken as a recovery point. You can use this to
recover your VM in case of an OS corruption. To launch a new instance from a created
instance volume snapshot, apply the following steps:
1. Navigate to the Volume Snapshots and locate the instance volume snapshot and create
a new volume from it.
3. On the Action menu of the volume, click on Edit Volume and make sure that it is bootable.
7. Under Volume, you will find the volume that you created from the snapshot.
8. Complete the launch instance process and the new VM instance will be created with
everything retained to the VM snapshot point.
4. Images
A Virtual Machine Image, referred to in this document simply as
an image, is a single file that contains a virtual disk, which has a bootable
operating system installed. Images are used to create virtual machine
instances within the cloud.
Important Note:
LINUX and UNIX based VMs information also include the default username that is
used to access the instance through SSH.
If the list of available images does not include the required image, bluvalt enables
you to upload an OS image of your choice and launch a new instance from the image you
uploaded.
Bluvalt only accepts images in QCOW2 format, so in order for your image to work it
must be converted to the QCOW2 format first. To do that you will need to use an image
converting tool. If you are on a Linux system, you can download the qemu-img package and
use it for the conversion. If you are on a Windows system, you can download the QEMU
disk image utility (quemu-img.exe) and use it for the conversion
1. if the Linux VM is hosted in a hypervisor, Export the Linux VM from the hypervisor,
or you can take a snapshot of the VM and locate the snapshot image location
2. Use the qemu image converter tool to convert the image to the QCOW2 format.
For example:
1. Please follow the documented guide located in our support pages on how to
convert a Windows VM and install all the required drivers on the VM:
https://support.bluvalt.com
3. Use the qemu image converter tool to convert the image to the QCOW2 format.
For example:
After converting the VM image to the compatible format, you will be ready to upload
the image, you will need to contact our support team; they will instruct you on how
to upload your image.
Important Note:
Microsoft product use rights do not allow the use of License Mobility for Windows
licenses. Therefore, to upload a Windows image you must provide us with the admin
password so we can change the license key.
Once the image have been uploaded you will find it in the images list under the
Projects tab
5. Networking
bluvalt provides networking services such as L3, IP Address Management (IPAM),
routing between IP subnets and to the outside world, and more.
When creating a new instance, Virtual Network Interfaces (VIFs) are created for it.
For network communication between VMs to function properly, VIFs of different VMs need
to be wired together using virtual switches. For communications between different virtual
switches, they need to be wired to a virtual router.
Navigate to this path; Project → Network → Network Topology, in order to check the
network topology.
In the above image, you can see the communications between the virtual devices in
the project. You can notice that each network is highlighted in a different color. The Icons
represents the VMs and network elements in the project, you can also choose to view the
devices labels by pressing the Toggle Labels button:
Icon Description
Virtual
Network
The Network Topology diagram is interactive, allowing you to quickly check the
details of elements, perform basic actions, and navigate to most common screens for
elements.
For example, you can click on the Network icon and check the quick overview.
You can click on the View Details link to go to the Network Details page.
1. Navigate to this path; Project → Network → Networks, in order to check the current
networks at the list.
3. In the Create Network wizard, on the ‘Network’ tab specify the Network Name and
Admin State (If set to down, the network will be set as down and does not forward
any packets), and then press Next. (select Create Subnet to create a subnet now or
4. On the ‘Subnet’ tab, choose a Subnet Name and a Network Address (CIDR) for your
subnet. You can provide a gateway IP address value or leave it empty, and it will be
set automatically to the first IP of the network.
5. On the ‘Subnet Detail’ tab, you can optionally enter the starting and ending IP
addresses you want for your DHCP allocation pool in the Allocation Pools field. Also
you can optionally change the DNS Name Servers field and enter the DNS IP addresses
of your choice to be assigned automatically to the VMs in the subnet. You can also
optionally enter the Destination CIDR and Next Hop for your subnet in the Host Routes
field to create host routes.
6. Click on Create button to keep the record. Hence, the created network will appear in
the networks grid. Also you can test the new network by launching two VMs, and
verify if those VMs have network connectivity among each other.
1. Navigate to this path; Project → Network → Routers, in order to check the current
Routers at the list.
3. In the Create Router dialog box, specify a name for the router and the Admin State (If
set to down, the router will be set as down and does not forward any packets), if you
need to connect the router to the public internet select the External Network from
the dropdown list and click Create Router.
The new router is now displayed in the ‘Routers’ tab. If you did not choose to connect
the router to the public Internet, you can apply the following steps:
1. On the Routers List, click the new router’s Set Gateway button.
2. In the External Network field, specify the network to which the router will connect,
and then click Set Gateway.
3. To confirm that your router is setup properly, you can click on the Network
Topology option and ensure that the router is connected to the external network.
To connect a network to the newly created router, apply the following steps:
2. On the Router Details page, click the ‘Interfaces’ tab, and then click Add Interface.
o Optional Step: In the Add Interface dialog box, set an IP Address for
the router interface for the selected subnet. However, to avoid any
conflict, it is recommended to leave it empty.
o If you choose not to set the IP Address value, then by default the first
host IP address in the subnet will be used.
5. To confirm that your network is setup properly, you can click on the Network
Topology and ensure that the network is connected to the router.
bluvalt allows you to optionally add a public IP addresses to running instances. This
public IP address is called ‘Floating IP’. bluvalt Networking uses Network Address Translation
(NAT) to assign floating IPs to virtual instances.
Important Note:
To assign a floating IP address to a VM, first we will need to allocate a floating IP to the
project:
1. Navigate to this path; Project → Compute → Access & Security, in order to check the
‘Floating IPs’ tab.
Now that we have allocated a floating IP, we can associate it with a VM:
2. In the Manage Floating /IP Association dialog box, the floating IP will be selected by
default. Select the VM with which the floating IP will be associated in the Port to be
associated list.
Notes:
You can also associate a floating IP with a VM by choosing the Associate Floating
IP from the instance actions menu.
You can check the Floating IPs page to verify that it is updated with the floating IP
associated with the VM.
When a network is created, a subnet can be assigned upon creation. However, you
can add a new subnet to a network at any time.
1. Navigate to; Project → Network → Networks, and select the network to which you
want to add a subnet.
3. On the ‘Subnet’ tab, choose a Subnet Name and a Network Address (CIDR) for your
subnet. You can provide a gateway IP address value or leave it empty, and it will be
set automatically on the first IP of the network.
4. On the ‘Subnet Detail’ tab, you can optionally enter the starting and ending IP
addresses you want for your DHCP allocation pool in the Allocation Pools field.
In addition, you can optionally change the DNS Name Servers field and enter the DNS
IP addresses of your choice to be assigned automatically to the VMs in the subnet.
Moreover, you can optionally enter the Destination CIDR and Next Hop for your
subnet in the Host Routes field to create host routes.
5. Click on Create button, the new subnet will be available with the Subnets section of
the network
First, you will have to delete any interface between the network and any router:
2. Examine the network that will be deleted, and check the routers connected to it.
4. In the routers list, click the name of the router that is connected to the switch.
5. Navigate to the Router Interfaces page, and delete the interface that is connected to
the switch.
6. Apply the same steps for the rest of the routers that are connected to the switch, if
any.
Now you will need to detach all network interfaces between the instances and the
switch
In the action menu for the instance that is connected to the network select Detach Interface
and select the port that is connected to the network.
9. Select the network that will be deleted, and click the Delete Network button.
To delete a router, it should be free of all ports to networks. Also you should have no
associated floating IP that is assigned to an instance that rely on the router for outside
connectivity.
2. Examine the router that will be deleted, and check the networks and their connected
instances.
3. Check if the instances have any associated floating IPs and disassociate them.
6. On the Router Details page, delete the interfaces that are connected to the switches.
8. Select the router that you want to delete, and click Delete Router button.
6. Object Storage
Object Storage (also known as object-based storage) is a storage architecture that
manages data as objects. As opposed to other storage architectures like file systems which
manage data as a file hierarchy and block storage which manages data as blocks within
sectors and tracks, object storage systems store files in a flat organization of containers and
use unique IDs to retrieve them. Object Storage is not directly accessed by the operating
system; it is not seen as a local or remote filesystem. Instead, interaction occurs at the
application level via an API
A Container is a storage compartment for your data which provides a way for you to
organize your data. You can think of a container as a folder in Windows ® or a directory in
UNIX ®. The primary difference between a container and these other file system concepts is
that containers cannot be nested. You can, however, create an unlimited number of
containers within your account. Data should be stored in a container, so you should have at
least one container defined in your account prior to uploading data.
3. In the Create Container dialog box, enter a significant Name for the container. Choose
to make the container either Private or Public. (A Public Container will allow anyone
with the Public URL to gain access to your objects in the container).
The Upload Object to Container: <name> dialog box appears. ``<name>`` is the name
of the container to which you are uploading the object.
To copy an object from one container to another, apply the following steps:
1. Navigate to this path; Project → Object Store tab → Containers Category, in order to
select the container in which you want to store your object.
3. In the Copy Object launch dialog box, enter the following values:
o Path: Specify a path in which the new copy should be stored inside the
selected container.
o Destination Object Name: Enter a name for the object in the new
container.
You can create a new object in container without an available file and can upload the
file later when it is ready. This temporary object acts as a place-holder for a new object, and
enables the user to share object metadata and URL info in advance.
1. Navigate to this path; Project → Object Store tab → Containers Category, in order to
select the container in which you want to store your object.
Pseudo-folders are similar to folders in your desktop operating system. They are
virtual collections defined by a common prefix on the object’s name.
1. Navigate to this path; Project → Object Store tab → Containers Category, in order to
select the container in which you want to store your object.
A slash (/) character is used as the delimiter for pseudo-folders in Object Storage.
4. Click Create.
Although the object storage is designed to store files on the cloud and be mainly
interacted with through web APIs, you can still directly share a link of an uploaded object to
be downloaded from the object storage system.
1. Make sure the container is set to Public, you can do that by selecting the Make Public
option from the container action menu
2. From the containers action menu, click on View Details and then copy the containers
Public URL
3. In the action menu of the Object select View Details and then copy the name of the
object
4. Append the copied object name to the public URL of the container, and then paste
the complete string in the browser URL field.
5. If the object is viewable by a browser it will open the object in the browser page,
otherwise the browser will download the object as a file