Your cloud

Your own cloud

Turn hardware you operate into a deliberate service for virtual machines, networks and projects—without pretending the infrastructure underneath has stopped being real.

What you will learn

A single server can run a virtual machine with QEMU, KVM or libvirt. That is useful, but it does not by itself provide a catalogue of images, self-service networks, projects, an API, a scheduler, or a clear record of who owns what. A cloud is the control system that makes those resources repeatable and manageable across one or more physical machines.

OpenStack is that control system. It does not replace Linux, switches, disks, backups or the hypervisor. It coordinates them. The Saphira role packages assemble a controller, compute and storage preparation role so that an operator does not have to begin with unrelated upstream guides and distribution-specific integration work.

Current Saphira status

The controller, compute, storage and documentation packages are now published. A published package is not proof that every optional OpenStack feature is complete: controller setup stops if noVNC web assets are absent, and Cinder storage still needs its first deployed create/attach/read-back/delete proof even though the iSCSI target chain is now published. Those gates are explained rather than hidden in the role guides.

Cloud infrastructure is more than a virtual machine

QEMU emulates hardware. KVM is the Linux kernel interface that lets QEMU use compatible processor virtualisation instructions. Libvirt is the management layer that asks QEMU/KVM to create, stop and inspect guests. Together they are the execution layer: they make a virtual machine run on one host.

OpenStack sits above that layer. Nova records and schedules instances; Neutron creates and connects virtual ports; Glance supplies images; Keystone checks identity and permissions; Placement reports usable resource inventory. Its APIs and Horizon dashboard let several users request resources without each person manually signing in to a hypervisor.

Infrastructure means controllers, compute hosts, network switches and storage. A guest operating system lives inside an instance. Its website, database, family service, test environment or business application lives inside the guest. OpenStack manages the infrastructure boundary; it does not automatically patch, secure or back up an application simply because the application runs in a VM.

Architecture: who talks to whom

The roles configured by the Saphira packages. This is a service map, not a high-availability promise.

User and dashboard

Browser → Horizon → Keystone authentication → OpenStack APIs. Horizon is a web client of the cloud, not the cloud by itself.

Controller node

Keystone, Glance, Placement, Nova API/conductor/scheduler, Neutron API/RPC, Horizon, MariaDB, RabbitMQ and memcached.

Compute node

Nova Compute, libvirt, QEMU/KVM, Open vSwitch, Neutron OVS and DHCP agents, then the running guest VM.

Network path

Neutron records a network and port. The OVS agent binds that port to the configured provider bridge; the bridge reaches the selected physical NIC and physical network. DHCP can serve the subnet only when the Neutron DHCP agent, RPC path and network configuration all work.

Storage: dependencies published, proof pending

Cinder, LVM and the iSCSI target chain are published. Persistent Cinder export and attachment are not yet a completed role: the deployed volume lifecycle has not been proven end to end.

Component	Why it exists	How it communicates
Keystone	Identity, tokens, projects, users, roles and service catalogue.	Every API request presents a token; services also use service credentials and tokens to call each other.
Nova and Placement	Instance API, scheduling and resource inventory.	Nova uses Keystone, Glance, Neutron, Placement and RabbitMQ to choose and direct a compute host.
Neutron	Networks, subnets, ports, DHCP and virtual-network agents.	HTTP API plus RabbitMQ RPC to OVS and DHCP agents; the API answering alone is not enough.
Glance	Image catalogue and delivery.	Nova asks for the boot image selected for an instance.
Horizon	Web dashboard.	Uses Keystone and the service APIs; it needs collected static files to render and operate correctly.
Cinder	Persistent block volumes.	Coordinates a volume service, LVM backend and iSCSI target. The packages are published; the Saphira deployment and volume lifecycle proof are still outstanding.
MariaDB, RabbitMQ, memcached	Durable service data, asynchronous RPC and token/cache support.	They are supporting infrastructure on which the APIs and agents depend.

From Launch Instance to a booted guest

The user signs in to Horizon. Horizon gets a Keystone token scoped to the user’s project and sends API requests on the user’s behalf.
The user chooses an image, flavor and network. Nova validates the request and consults Keystone, Glance, Neutron and Placement.
Placement and Nova scheduling find a compute host reporting suitable capacity. The host must already have been discovered into Nova’s cell.
Nova sends work through RabbitMQ to Nova Compute. Neutron’s control services and agents prepare the virtual port and its bridge binding.
Nova Compute asks libvirt to start QEMU. With /dev/kvm, the guest uses hardware virtualisation; without it, QEMU emulates the CPU in software and is much slower.
The guest boots from the selected image. ACTIVE means Nova considers the build successful; it does not independently prove that the guest received DHCP, finished booting, has a route, or accepts your connection.

Terms you will use

Hypervisor: The host software that starts and supervises virtual machines. Saphira compute nodes use libvirt to control QEMU, with KVM acceleration when the host exposes /dev/kvm.
Virtual machine / instance: A guest operating system running on virtual hardware. OpenStack calls its managed record an instance; the guest still needs its own users, updates, backup plan and applications.
Image: A reusable boot-disk template, such as a cloud-ready Linux QCOW2 image. Glance stores and supplies images.
Flavor: A named requested size: virtual CPU, RAM and disk. A flavor is not a reservation; a suitable compute host must still have capacity.
Project: An ownership and permission boundary for users, networks, instances and volumes. Projects are useful for teams, customers, labs or separate private services.
Network: A virtual Layer-2 network. Neutron records it, and agents on the compute host bind its ports to the configured virtual and physical network path.
Volume: A persistent block disk managed by Cinder and attached to an instance. It is different from local compute storage and the instance's ephemeral disk.

Useful shapes for a private cloud

Testing and learning

Create isolated instances and networks for upgrades, experiments and training without repurposing the host that runs a live service.

Separate projects

Give different teams, customers or household services distinct projects, credentials and resource ownership.

Private services

Run a website, development tool or internal application in a guest while keeping host and guest administration separate.

Business infrastructure

Standardise how machines and networks are created. Capacity planning, patching, backups and recovery drills still belong to the operator.

Plan before installing

Choose stable controller and compute addresses, decide which physical network and NIC carry provider traffic, record the controller’s public console hostname, and keep service credentials separate from the administrator password. A dedicated provider NIC is less disruptive than bridging the only interface carrying SSH.

The recipes do not establish a supported minimum CPU, RAM or disk specification, and they do not validate a combined controller-and-compute machine. Size from your measured workload and treat single-host roles as unverified until you have tested them yourself.

# Read-only planning and inventory tool: it does not deploy services.
apk add saphira-openstack
saphira-openstack init
saphira-openstack inventory --file /etc/saphira-openstack/inventory.ini --check

The wizard may inspect local interfaces, bridges, routes and storage read-only, then writes an inventory only after confirmation. Use it to record intent; use the role guides to configure roles.

Continue with a role

Controller node: install and operate the control plane →Compute node: join a hypervisor and launch a guest →Storage node: follow the published-chain, proof-pending Cinder path →Pitfalls book: diagnose a failing layer →

For concepts beyond Saphira packaging, use the official OpenStack documentation for Keystone, Nova, Neutron, Glance, and Cinder. Upstream capability is not evidence that a Saphira role currently configures it.