Apollo Config on Ubuntu 24.04 LTS

Apollo is an open source distributed configuration management centre. Applications fetch typed, versioned configuration at runtime and pick up changes without a redeploy, while operators get per environment and per cluster namespaces, release and rollback history, grey scale releases for staged rollouts, and a complete audit trail of every change. A web portal manages all of it, so configuration stops living in scattered property files and becomes a governed, reviewable resource. This image delivers Apollo fully installed and running, with its database, both schemas and all three Apollo services already wired together, so a working configuration portal is operational within minutes of launch.

Secure by default

Apollo's published sample data seeds the portal with a well known administrator login that is documented in the project's own quick start. An image that shipped it would give every customer the same publicly known credential. This image never ships in that state. The seeded account is locked during the build, so the captured image contains no usable portal login at all, and on each virtual machine's first boot a unique portal administrator password, a unique database password and a unique database root password are generated, hashed where appropriate, and written to a root only file. The documented default login is rejected on every deployment, and no two deployments share a credential.

Locked down by default

• Only the web portal is reachable from the network. The configuration service, the administration service and the database are bound to the loopback interface.
• This matters because Apollo's configuration service is unauthenticated by default, meaning any caller that knows an application id could otherwise read that application's configuration, and the administration service is a privileged management API intended only for the portal.
• The deployment guide explains how to deliberately expose the configuration service to your own application subnet, after enabling Apollo access keys, when you are ready to onboard client applications.
• Every image build runs a listener audit that fails the build if any unexpected port is reachable from the network.

Hardened and ready on first boot

• Installed from the official release distribution, verified against the checksums the project publishes for each artifact.
• All three services run as a dedicated unprivileged system user under systemd, for automatic restarts and clean logging.
• Backed by an on box MySQL with both Apollo schemas created, and a system managed OpenJDK runtime that keeps receiving security updates.
• The database credentials shared by the three services are written as a single file with an atomic replace, so a partially written file can never leave the stack in a broken state.

Why cloudimg

cloudimg delivers Apollo fully patched on a hardened Ubuntu 24.04 LTS base, serving on first boot, with no shared credentials and no manual configuration to work through. Every image passes an automated fifteen point verification gate and is backed by 24/7 support with a guaranteed 24 hour response SLA. A step by step deployment guide is provided.

Licensing

Apollo is open source software distributed under the Apache License 2.0, and is free. The cloudimg charge covers packaging, hardening, security patching, image maintenance and 24/7 support.

This is a repackaged open source software product with additional charges for cloudimg support services. Apollo is a trademark of its respective owner. All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.