Die folgende Vorgehensweise stellt Omnissa Access und die Infrastrukturdienste bereit.
Aktualisieren der access-profile.yml-Datei
Diese Datei enthält:
- Clusterknoten
- FQDN
- Zertifikate
- Mandatenkonfiguration
Vorgehensweise:
-
Öffnen Sie die
access-profile.yml-Datei. Beispiel:vi /root/<cluster_name>/access/access-profile.yml -
Befolgen Sie die unten stehenden Inline-Anweisungen, um die
access-profile.yml-Datei zu aktualisieren.fqdn: # Domain Name i.e: if you are going to access your tenant as tenant1.example.com, your FQDN.name should be example.com name: example.com # Port associated with FQDN port: 443 # IP associated with FQDN # tenant_name.fqdn.name should resolve to this IP, i.e: if tenant_name=tenant1 and fqdn.name=example.com, tenant1.example.com should resolve to this IP ip: <LOAD_BALANCER_IP> server_certificate: # If you need to use self-signed FQDN/LB certificate, set is_self_signed: true, else provide path to your custom certificate and key. is_self_signed: false # [Required when is_self_signed is false] Custom cert file path. # Place your certificate at /root/<cluster-name>/access/certs/custom_cert.pem custom_cert_file: /root/<cluster-name>/access/certs/custom_cert.pem # [Required when is_self_signed is false] Custom key file path. # Place your key at /root/<cluster-name>/access/certs/custom_cert_key.pem custom_cert_keyfile: /root/<cluster-name>/access/certs/custom_cert_key.pem first_tenant: # tenant_name is mandatory for all Onprem customers. All other fields are mandatory. tenant_name: <YOUR_TENANT_NAME> admin_user_name: <TENANT_ADMIN_NAME> admin_email: <TENANT_ADMIN_EMAIL> admin_first_name: <TENANT_ADMIN_FIRST_NAME> admin_last_name: <TENANT_ADMIN_LAST_NAME> cert_proxy: enabled: true # certificate type - FQDN_CERT or CUSTOM_CERT ssl_certificate_type: CUSTOM_CERT # [Optional] ssl_certificate_path and ssl_certificate_key mandatory if ssl_certificate_type is CUSTOM_CERT # SSL certificate and key must be placed at /root/<cluster-name>/access/certs/ and referenced with the full path i.e: /root/<cluster-name>/access/certs/custom_cert_proxy_cert.pem ssl_certificate_path: /root/<cluster-name>/access/certs/custom_cert_proxy_cert.pem ssl_certificate_key: /root/<cluster-name>/access/certs/custom_cert_proxy_key.pem # All IPs between client and access instances, including cluster node IPs (excluding bootstrap), need to be added to this list # There should be minimum of 1 IP(LB) in case load balanced access setup, if there are proxies in between your client and access LB, all proxies need to be added to this list # Example: ["10.0.0.x", "10.0.0.x", "10.0.0.x"] ip_ignore_list_for_xff_header: ["<LOAD_BALANCER_IP>", "<PROXY_IP>", "<ACCESS_NODES>"] smtp: enabled: true # [Required when enabled is true] host: smtp.example.com port: 587 user: smtp-user@example.com # [Required when enabled is true] Supported value -> STARTTLS or SSL_TLS security_type: STARTTLS -
Führen Sie nach dem Aktualisieren der
access-profile.yml-Datei das Bootstrap aus. Beispiel:cd /root/<cluster_name> wso access bootstrap # Output creating secret engine creating secret engine creating secret engine Successfully synced all KV's to consul Successfully synced all secretsErgebnis: Bei diesem Schritt wird die Konfiguration in Vault und Consul geladen.
-
Führen Sie den entsprechenden Befehl zum Bereitstellen von Diensten aus, je nachdem, ob Sie die Bereitstellung im Hintergrund oder im Vordergrund ausführen möchten. Beispiel:
-
Führt die Bereitstellung im Hintergrund aus und wird auch dann fortgesetzt, wenn das Terminal oder die SSH-Sitzung geschlossen wird. Empfohlen für Bereitstellungen mit langer Ausführungsdauer.
nohup wso services deploy --type full & ## This will take time to deploy around 40 min # OUTPUT [1] 108485 nohup: ignoring input and appending output to 'nohup.out' -
Führt die Bereitstellung im Vordergrund mit aktivierter ausführlicher Protokollierung durch und zeigt detaillierte Fortschritts- und Debugging-Informationen im Terminal an. Empfohlen für die Überwachung und Fehlerbehebung bei Bereitstellungen in Echtzeit.
wso services deploy --type full -v ## This will take time to deploy around 40 min # OUTPUT [1] 108485 nohup: ignoring input and appending output to 'nohup.out'
-
-
Befolgen Sie zur Überwachung der Bereitstellung die nachstehenden Inline-Anweisungen.
# log in to the same machine from a different terminal window to check logs cd /root/<cluster_name> tail -f nohup.out # OUTPUT Cleaning up Cleans up the docker subsystem on nodes (unused images) Generating environment file with cluster details and secret tokens Verify that CA is present in trust bundle on all nodes <timestamp> Using additional env vars /root/<cluster_name>/additional_env_vars.env Deploying service control-plane-logging Deployment of service control-plane-logging complete Deploying service telegraf-statsd Deployment of service telegraf-statsd complete Deploying service telegraf-asset-server Deployment of service telegraf-asset-server complete Deploying service ingress Deployment of service ingress complete Deploying service ingress-gateway-route-reloader Deployment of service ingress-gateway-route-reloader complete Deploying service control-plane-backup Deployment of service control-plane-backup complete Deploying service client-side-load-balancer Deployment of service client-side-load-balancer complete Deploying service telegraf-uptime Deployment of service telegraf-uptime complete Deploying service cp-ops-dispatch Deployment of service cp-ops-dispatch complete Deploying service cp-ops-output-processor Deployment of service cp-ops-output-processor complete Deploying service kafka Deployment of service kafka complete Deploying service kafka-monitoring Deployment of service kafka-monitoring complete Deploying service postgres Deployment of service postgres complete Deploying service postgres-monitoring Deployment of service postgres-monitoring complete Deploying service pgbouncer Deployment of service pgbouncer complete Deploying service postgres-backup Deployment of service postgres-backup complete Deploying service postgres-diff-backup Deployment of service postgres-diff-backup complete Deploying service postgres-operations Deployment of service postgres-operations complete Deploying service postgres-operations-vacuum Deployment of service postgres-operations-vacuum complete Deploying service redis Deployment of service redis complete Deploying service redis-monitoring Deployment of service redis-monitoring complete Deploying service opensearch Deployment of service opensearch complete Deploying service coredns Deployment of service coredns complete Deploying service nginx-http Deployment of service nginx-http complete Deploying service acs Deployment of service acs complete Deploying service crypto Deployment of service crypto complete Deploying service cds Deployment of service cds complete Deploying service token Deployment of service token complete Deploying service analytics Deployment of service analytics complete Deploying service saas Deployment of service saas complete Deploying service federation Deployment of service federation complete Deploying service authcontrol Deployment of service authcontrol complete Deploying service greenbox Deployment of service greenbox complete Deploying service ws1notifications Deployment of service ws1notifications complete Deploying service ws1ntfmanager Deployment of service ws1ntfmanager complete Deploying service skycap Deployment of service skycap complete Deploying service cas Deployment of service cas complete Deploying service certproxy Deployment of service certproxy complete Deploying service commchannel Deployment of service commchannel complete Deploying service launcher Deployment of service launcher complete Deploying service ws1admin Deployment of service ws1admin complete Deploying service hubconsole Deployment of service hubconsole complete Deploying service mpsso Deployment of service mpsso complete Deploying service usergroup Deployment of service usergroup complete Deploying service nginx-stream Deployment of service nginx-stream complete -
Führen Sie den folgenden Befehl aus, um die Betriebsbereitschaft des Diensts zu überprüfen.
wso access check-service-readiness # OUTPUT { "cds": "READY", "acs": "READY", "saas": "READY", "crypto": "READY", "token": "READY", "ws1notifications": "READY", "ws1ntfmanager": "READY", "federation": "READY", "analytics": "READY", "authcontrol": "READY", "skycap": "READY", "greenbox": "READY", "cas": "READY", "certproxy": "READY", "commchannel": "READY", "ws1admin": "READY", "mpsso": "READY", "hubconsole": "READY", "usergroup": "READY", "launcher": "READY" } -
Stellen Sie sicher, dass sich der Status jedes Dienstes im Zustand
READYbefindet. Wenn sich ein Dienst in einem ZustandNOT_READYbefindet, können Sie nicht mit der nächsten Phase fortfahren. Führen Sie eine Fehlerbehebung durch und korrigieren Sie etwaige Probleme.
War diese Seite hilfreich?