Apache Ozone

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region. Standard_B4ms (4 vCPU / 16 GiB RAM) is a good starting point, because Ozone runs five JVMs and is memory-hungry.

In the network security group (NSG), allow inbound 22/tcp from your management network and 80/tcp from the users who reach the Recon UI. For public exposure, front port 80 with TLS (see Enabling HTTPS).

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure portal, choose Create a resource, search the Marketplace for Apache Ozone by SecureAnyCloud, and choose Create. On the Basics tab, choose your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

On the Disks tab, review the dedicated 50 GiB data disk. Then choose Review + create, followed by Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:apache-ozone-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name ozone \
  --image sac1647283583153:apache-ozone-ubuntu-24-04:default:latest \
  --size Standard_B4ms \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name ozone --port 80 --priority 1010

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

systemctl is-active ozone-scm.service ozone-om.service ozone-datanode.service ozone-recon.service ozone-s3g.service nginx.service

All six services report active.

Step 5 - Confirm the gateway answers

The nginx reverse proxy serves an unauthenticated /health endpoint for liveness checks. It also fronts the Ozone Recon management UI behind HTTP Basic auth:

curl -s -o /dev/null -w 'health endpoint -> HTTP %{http_code}\n' http://127.0.0.1/health
curl -s -o /dev/null -w 'Recon UI (no auth) -> HTTP %{http_code}\n' http://127.0.0.1/

The /health endpoint returns HTTP 200. The Recon UI returns HTTP 401 until you supply the per-VM credentials.

Step 6 - Retrieve your admin password and S3 credentials

The first boot of your VM generates a unique administrator password and a per-VM S3 access key and secret. It writes them to a root-only file:

sudo grep -E '^OZONE_(ADMIN|S3)_' /root/ozone-credentials.txt

OZONE_ADMIN_USER is admin and OZONE_ADMIN_PASSWORD is the password that protects the Recon management UI. OZONE_S3_ACCESS_KEY and OZONE_S3_SECRET_KEY are the credentials for the loopback S3 gateway.

Step 7 - Open the Recon management UI

The Recon UI sits behind nginx HTTP Basic auth. Confirm that a wrong password is rejected and the real one returns the UI. Substitute your own password in the request. For example, to fetch the UI with the credentials from Step 6:

curl -s -o /dev/null -w '%{http_code}\n' -u admin:<OZONE_ADMIN_PASSWORD> http://127.0.0.1/

A wrong password returns HTTP 401, and the correct one returns HTTP 200 (the Recon overview page). In a browser, open http://<vm-public-ip>/ and sign in as admin with the password from Step 6.

Step 8 - Create a volume, bucket and key with the ozone shell

Ozone organizes objects as volume / bucket / key. The ozone sh command line creates them and puts and gets keys. Run it as the ozone service user:

echo "hello ozone" | sudo -u ozone tee /tmp/demo.txt
sudo -u ozone /opt/ozone/bin/ozone sh volume create /demovol
sudo -u ozone /opt/ozone/bin/ozone sh bucket create /demovol/demobucket
sudo -u ozone /opt/ozone/bin/ozone sh key put /demovol/demobucket/demokey /tmp/demo.txt
sudo -u ozone /opt/ozone/bin/ozone sh key list /demovol/demobucket
sudo -u ozone /opt/ozone/bin/ozone sh key get /demovol/demobucket/demokey /tmp/demo-out.txt

key list shows demokey, and key get writes the object back to /tmp/demo-out.txt. This confirms that the data plane round-trips end to end.

Step 9 - Use the S3 gateway

Ozone exposes the same namespace over an S3-compatible API on the gateway (loopback 127.0.0.1:9878). From your workstation, open an SSH tunnel to the gateway and point the AWS CLI at it with the per-VM S3 credentials from Step 6:

ssh -L 9878:127.0.0.1:9878 azureuser@<vm-public-ip>

In another terminal on your workstation, export OZONE_S3_ACCESS_KEY and OZONE_S3_SECRET_KEY as AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY, then run:

aws --endpoint http://localhost:9878 s3 ls

The S3 gateway lists the buckets that back your Ozone volumes, so existing S3 tooling works unchanged against Ozone.

Step 10 - Review datanodes, pipelines and keys in Recon

The Recon UI (Step 7) is the management console for the cluster. These views are the most useful:

• The Datanodes view lists the in-VM datanode, its capacity and the containers it holds.
• The Pipelines view shows the single write pipeline (factor ONE for a single datanode).
• The Buckets / keys views list every volume, bucket and object with its size and replication.

Confirm the Ozone version

/opt/ozone/bin/ozone version 2>/dev/null | head -3

Enabling HTTPS

For production, terminate TLS at nginx with a real domain that points at the VM's public IP. Install certbot and request a certificate, replacing the domain with your own:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d your-domain.example.com

Backup and maintenance

All Ozone data (the OM and SCM metadata, the HDDS datanode containers and the Recon database) lives on the dedicated data disk at /var/lib/ozone. Snapshot that disk in Azure to back up your store. Keep the OS patched with sudo apt update && sudo apt upgrade.

Ozone restarts cleanly with sudo systemctl restart ozone-scm ozone-om ozone-datanode ozone-recon ozone-s3g nginx. For larger datasets, resize the data disk in the Azure portal and grow the filesystem.

Support

SecureAnyCloud provides 24/7 support for this image. Contact us by email or chat for help with volume and bucket design, the ozone shell, the S3 gateway, replication tuning, scaling, TLS and backups.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

Deploy on Azure

Launch Apache Ozone on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Prerequisites

You need an active AWS account with permission to launch EC2 instances, create security groups and subscribe to AWS Marketplace products, and an EC2 key pair in the target region. m5.large (2 vCPU / 8 GiB RAM) is the recommended instance type, because Ozone runs five JVMs and is memory-hungry.

In the security group, allow inbound 22/tcp from your management network and 80/tcp from the users who reach the Recon console. For public exposure, front port 80 with TLS (see Enabling HTTPS). You reach the S3 Gateway over an SSH tunnel, so it needs no inbound port.

Connecting to your instance

Connect over SSH as the default login user for your AMI's operating system. The password and S3 credentials referenced throughout this guide live in a root-only file on the instance.

OS variant SSH login user Example

Ubuntu 24.04 LTS ubuntu ssh ubuntu@<instance-public-ip>

Step 1 - Deploy from the AWS Marketplace

Sign in to AWS Marketplace and search for Apache Ozone by SecureAnyCloud. Choose Continue to Subscribe, accept the terms, then choose Continue to Configuration and Continue to Launch. Choose the m5.large instance type and your key pair. In the security group, allow SSH (22) from your management network and HTTP (80) from the users who reach the Recon console. Review the dedicated 50 GiB data volume, then launch.

Step 2 - Deploy from the AWS CLI

aws ec2 run-instances \
  --image-id <ami-id-from-the-listing> \
  --instance-type m5.large \
  --key-name <your-key-pair> \
  --security-group-ids <your-sg> \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=ozone}]'

Step 3 - Connect to your instance

ssh ubuntu@<instance-public-ip>

Step 4 - Confirm the services are running

systemctl is-active ozone-scm.service ozone-om.service ozone-datanode.service ozone-recon.service ozone-s3g.service nginx.service

All six services report active.

Step 5 - Confirm the gateway answers

The nginx reverse proxy serves an unauthenticated /health endpoint for liveness checks. It also fronts the Ozone Recon management console behind HTTP Basic auth:

curl -s -o /dev/null -w 'health endpoint -> HTTP %{http_code}\n' http://127.0.0.1/health
curl -s -o /dev/null -w 'Recon UI (no auth) -> HTTP %{http_code}\n' http://127.0.0.1/

The /health endpoint returns HTTP 200. The Recon console returns HTTP 401 until you supply the per-instance credentials.

Step 6 - Retrieve your admin password and S3 credentials

The first boot of your instance generates a unique administrator password and a per-instance S3 access key and secret. It writes them to a root-only file:

sudo grep -E '^OZONE_(ADMIN|S3)_' /root/ozone-credentials.txt

OZONE_ADMIN_USER is admin and OZONE_ADMIN_PASSWORD is the password that protects the Recon management console. OZONE_S3_ACCESS_KEY and OZONE_S3_SECRET_KEY are the credentials for the loopback S3 gateway.

Step 7 - Open the Recon management console

The Recon console sits behind nginx HTTP Basic auth. Confirm that a wrong password is rejected and the real one returns the console. Substitute your own password in the request. For example, to fetch the console with the credentials from Step 6:

curl -s -o /dev/null -w '%{http_code}\n' -u admin:<OZONE_ADMIN_PASSWORD> http://127.0.0.1/

A wrong password returns HTTP 401, and the correct one returns HTTP 200 (the Recon overview page). In a browser, open http://<instance-public-ip>/ and sign in as admin with the password from Step 6. The overview shows datanode health, pipelines and the cluster storage capacity backed by the dedicated data volume.

Step 8 - Create a volume, bucket and key with the ozone shell

Ozone organizes objects as volume / bucket / key. The ozone sh command line creates them and puts and gets keys. Run it as the ozone service user:

echo "hello ozone" | sudo -u ozone tee /tmp/demo.txt
sudo -u ozone /opt/ozone/bin/ozone sh volume create /demovol
sudo -u ozone /opt/ozone/bin/ozone sh bucket create /demovol/demobucket
sudo -u ozone /opt/ozone/bin/ozone sh key put /demovol/demobucket/demokey /tmp/demo.txt
sudo -u ozone /opt/ozone/bin/ozone sh key list /demovol/demobucket
sudo -u ozone /opt/ozone/bin/ozone sh key get /demovol/demobucket/demokey /tmp/demo-out.txt

key list shows demokey, and key get writes the object back to /tmp/demo-out.txt. This confirms that the data plane round-trips end to end.

Step 9 - Use the S3 gateway

Ozone exposes the same namespace over an S3-compatible API on the gateway (loopback 127.0.0.1:9878). From your workstation, open an SSH tunnel to the gateway and point the AWS CLI at it with the per-instance S3 credentials from Step 6:

ssh -L 9878:127.0.0.1:9878 ubuntu@<instance-public-ip>

In another terminal on your workstation, export OZONE_S3_ACCESS_KEY and OZONE_S3_SECRET_KEY as AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY, then run:

aws --endpoint-url http://localhost:9878 s3api create-bucket --bucket demo echo "hello s3" > hello.txt
aws --endpoint-url http://localhost:9878 s3 cp hello.txt s3://demo/hello.txt
aws --endpoint-url http://localhost:9878 s3 ls s3://demo/

The S3 gateway accepts and lists your objects, so existing S3 tooling and SDKs work unchanged against Ozone.

Step 10 - Review datanodes and pipelines in Recon

The Recon console is the management console for the cluster. These views are the most useful:

• The Datanodes view lists the datanode, its state and capacity.
• The Pipelines view shows the single write pipeline (RATIS factor ONE for a single datanode).
• The Buckets / keys views list every volume, bucket and object with its size and replication.

Confirm the Ozone version

/opt/ozone/bin/ozone version 2>/dev/null | head -3

Enabling HTTPS

For production, terminate TLS at nginx with a real domain that points at the instance's public IP. Install certbot and request a certificate, replacing the domain with your own:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d your-domain.example.com

Backup and maintenance

All Ozone data (the OM and SCM metadata, the HDDS datanode containers and the Recon database) lives on the dedicated EBS data volume at /var/lib/ozone. Take an EBS snapshot of that volume to back up your store. Keep the OS patched with sudo apt update && sudo apt upgrade.

Ozone restarts cleanly with sudo systemctl restart ozone-scm ozone-om ozone-datanode ozone-recon ozone-s3g nginx. For larger datasets, resize the EBS volume in the AWS console and grow the filesystem.

Support

SecureAnyCloud provides 24/7 support for this image. Contact us by email or chat for help with volume and bucket design, the ozone shell, the S3 gateway, replication tuning, scaling, TLS and backups.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

Deploy on AWS

Launch Apache Ozone on AWS with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com