Apache Pulsar

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B4ms (4 vCPU / 16 GiB RAM) is a good starting point for the standalone JVM stack. Scale up for higher message throughput.

Configure the NSG to allow inbound 22/tcp from your management network and 80/tcp for the web console. Put TLS in front of the console before you expose it publicly (see Enabling HTTPS). Allow 6650/tcp (the Pulsar broker client port) only from the application networks that run Pulsar clients. The broker admin REST API (8080) and the Pulsar Manager backend (7750) are bound to loopback and are not exposed.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Apache Pulsar by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Review the dedicated data disk on the Disks tab. Then select Review + create, followed by Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:apache-pulsar-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name pulsar \
  --image sac1647283583153:apache-pulsar-ubuntu-24-04:default:latest \
  --size Standard_B4ms \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name pulsar --port 80 --priority 1010

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

systemctl is-active pulsar.service pulsar-manager.service nginx.service

All three services report active. On first boot, the standalone broker can take one to two minutes to start fully while the JVM warms up and BookKeeper initializes.

Step 5 - Retrieve your admin password

The image generates a unique admin password on the first boot of your VM and writes it to a root-only file:

sudo cat /root/pulsar-credentials.txt

The PULSAR_MANAGER_ADMIN_PASSWORD value is the password. Sign in to the Pulsar Manager web console as admin with it. The nginx layer also prompts for the same admin user and password as a second layer of HTTP Basic auth.

Step 6 - Verify the broker health

The broker exposes an admin REST API on loopback. Confirm that the standalone cluster is registered:

curl -sf http://127.0.0.1:8080/admin/v2/clusters; echo

The response is the JSON array ["standalone"]. You can also list the built-in tenants:

curl -sf http://127.0.0.1:8080/admin/v2/tenants; echo

Step 7 - Open the Pulsar Manager web console

Browse to http://<vm-public-ip>/. Answer the nginx HTTP Basic prompt as admin with the password from Step 5. Then sign in to Pulsar Manager itself as admin with the same password.

On first sign-in, add an Environment so that the console can reach your broker. Give it any name (for example standalone) and set the Service URL to http://127.0.0.1:8080. Pulsar Manager then lets you browse tenants, namespaces and topics, inspect subscriptions and backlog, and manage the cluster.

Step 8 - Produce and consume a test message

Pulsar ships a command-line client. On the VM, produce three messages to a topic, then consume them back:

sudo -u pulsar /opt/pulsar/current/bin/pulsar-client produce persistent://public/default/demo-topic --messages "hello-pulsar" --num-produce 3

sudo -u pulsar /opt/pulsar/current/bin/pulsar-client consume persistent://public/default/demo-topic --subscription-name demo-sub --num-messages 3 --subscription-position Earliest

The producer reports 3 messages successfully produced and the consumer prints the three hello-pulsar payloads followed by 3 messages successfully consumed. The topic and its messages persist in BookKeeper on the dedicated data disk.

Step 9 - Connect from your applications

Point your Pulsar client libraries (Java, Python, Go, C++, Node.js) at pulsar://<vm-public-ip>:6650. Open NSG port 6650/tcp from your application networks only. Add TLS and authentication before you expose the broker beyond a trusted network. The broker admin REST API on 8080 and the Pulsar Manager backend on 7750 stay on loopback by design.

Enabling HTTPS

For production, terminate TLS at nginx with a real domain that points at the VM's public IP. Install certbot and request a certificate, replacing the domain with your own:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d your-domain.example.com

For end-to-end broker security, also enable Pulsar's own TLS transport and authentication on port 6650 per the Apache Pulsar security documentation.

Backup and maintenance

The BookKeeper ledgers and journal, ZooKeeper metadata and the Pulsar Manager database live on the dedicated data disk at /var/lib/pulsar. Snapshot that disk in Azure to back up your topics and persisted messages. Keep the OS patched with sudo apt update && sudo apt upgrade.

The broker restarts cleanly with sudo systemctl restart pulsar, and the console restarts with sudo systemctl restart pulsar-manager. The image ships patched against the Ubuntu 24.04 security baseline at build time.

Support

This image is backed by 24/7 SecureAnyCloud support. Contact us by email or chat for help with broker configuration, tenants and namespaces, TLS, authentication, geo-replication, persistence and backups.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

Deploy on Azure

Launch Apache Pulsar on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com