Implementar los servicios de Omnissa Access y de infraestructura

El procedimiento que se describe a continuación permite implementar los servicios de Omnissa Access y de infraestructura.

Actualizar el archivo access-profile.yml

Este archivo contiene:

Nodos del clúster
FQDN
Certificados
Configuración del inquilino

Procedimiento:

Abra el archivo access-profile.yml. Por ejemplo:

vi /root/<cluster_name>/access/access-profile.yml

Siga las instrucciones que aparecen a continuación para actualizar el archivo access-profile.yml.


fqdn:
  # Domain Name i.e: if you are going to access your tenant as tenant1.example.com, your FQDN.name should be example.com
  name: example.com
  # Port associated with FQDN
  port: 443
  # IP associated with FQDN
  # tenant_name.fqdn.name should resolve to this IP, i.e: if tenant_name=tenant1 and fqdn.name=example.com, tenant1.example.com should resolve to this IP
  ip: <LOAD_BALANCER_IP>

server_certificate:
  # If you need to use self-signed FQDN/LB certificate, set is_self_signed: true, else provide path to your custom certificate and key.
  is_self_signed: false
  # [Required when is_self_signed is false] Custom cert file path.
  # Place your certificate at /root/<cluster-name>/access/certs/custom_cert.pem
  custom_cert_file: /root/<cluster-name>/access/certs/custom_cert.pem
  # [Required when is_self_signed is false] Custom key file path.
  # Place your key at /root/<cluster-name>/access/certs/custom_cert_key.pem
  custom_cert_keyfile: /root/<cluster-name>/access/certs/custom_cert_key.pem

first_tenant:
  # tenant_name is mandatory for all Onprem customers. All other fields are mandatory.
  tenant_name: <YOUR_TENANT_NAME>
  admin_user_name: <TENANT_ADMIN_NAME>
  admin_email: <TENANT_ADMIN_EMAIL>
  admin_first_name: <TENANT_ADMIN_FIRST_NAME>
  admin_last_name: <TENANT_ADMIN_LAST_NAME>

cert_proxy:
  enabled: true
  # certificate type - FQDN_CERT or CUSTOM_CERT
  ssl_certificate_type: CUSTOM_CERT
  # [Optional] ssl_certificate_path and ssl_certificate_key mandatory if ssl_certificate_type is CUSTOM_CERT
  # SSL certificate and key must be placed at /root/<cluster-name>/access/certs/ and referenced with the full path i.e: /root/<cluster-name>/access/certs/custom_cert_proxy_cert.pem
  ssl_certificate_path: /root/<cluster-name>/access/certs/custom_cert_proxy_cert.pem
  ssl_certificate_key: /root/<cluster-name>/access/certs/custom_cert_proxy_key.pem

# All IPs between client and access instances, including cluster node IPs (excluding bootstrap), need to be added to this list
# There should be minimum of 1 IP(LB) in case load balanced access setup, if there are proxies in between your client and access LB, all proxies need to be added to this list
# Example: ["10.0.0.x", "10.0.0.x", "10.0.0.x"]
ip_ignore_list_for_xff_header: ["<LOAD_BALANCER_IP>", "<PROXY_IP>", "<ACCESS_NODES>"]

smtp:
  enabled: true
  # [Required when enabled is true]
  host: smtp.example.com
  port: 587
  user: smtp-user@example.com
  # [Required when enabled is true] Supported value -> STARTTLS or SSL_TLS
  security_type: STARTTLS

Después de actualizar el archivo access-profile.yml, ejecute el arranque. Por ejemplo:

cd /root/<cluster_name>
wso access bootstrap

# Output
creating secret engine
creating secret engine
creating secret engine
Successfully synced all KV's to consul
Successfully synced all secrets

Resultado: Este paso carga la configuración en Vault y Consul.

Ejecute el comando correspondiente para implementar los servicios, dependiendo de si desea ejecutar la implementación en segundo plano o en primer plano. Por ejemplo:
- Ejecuta la implementación en segundo plano y continúa aunque se cierre el terminal o la sesión SSH. Recomendado para implementaciones de larga duración.
```
nohup wso services deploy --type full &
## This will take time to deploy around 40 min

# OUTPUT
[1] 108485
nohup: ignoring input and appending output to 'nohup.out'
```
- Ejecuta la implementación en primer plano con el registro detallado activado, mostrando información detallada sobre el progreso y la depuración en el terminal. Recomendado para supervisar y solucionar problemas de las implementaciones en tiempo real.
```
wso services deploy --type full -v
## This will take time to deploy around 40 min

# OUTPUT
[1] 108485
nohup: ignoring input and appending output to 'nohup.out'
```

Siga las instrucciones que aparecen a continuación para supervisar la implementación.

# log in to the same machine from a different terminal window to check logs

cd /root/<cluster_name>
tail -f nohup.out

# OUTPUT
Cleaning up
Cleans up the docker subsystem on nodes (unused images)
Generating environment file with cluster details and secret tokens
Verify that CA is present in trust bundle on all nodes
<timestamp> Using additional env vars /root/<cluster_name>/additional_env_vars.env
Deploying service control-plane-logging
Deployment of service control-plane-logging complete
Deploying service telegraf-statsd
Deployment of service telegraf-statsd complete
Deploying service telegraf-asset-server
Deployment of service telegraf-asset-server complete
Deploying service ingress
Deployment of service ingress complete
Deploying service ingress-gateway-route-reloader
Deployment of service ingress-gateway-route-reloader complete
Deploying service control-plane-backup
Deployment of service control-plane-backup complete
Deploying service client-side-load-balancer
Deployment of service client-side-load-balancer complete
Deploying service telegraf-uptime
Deployment of service telegraf-uptime complete
Deploying service cp-ops-dispatch
Deployment of service cp-ops-dispatch complete
Deploying service cp-ops-output-processor
Deployment of service cp-ops-output-processor complete
Deploying service kafka
Deployment of service kafka complete
Deploying service kafka-monitoring
Deployment of service kafka-monitoring complete
Deploying service postgres
Deployment of service postgres complete
Deploying service postgres-monitoring
Deployment of service postgres-monitoring complete
Deploying service pgbouncer
Deployment of service pgbouncer complete
Deploying service postgres-backup
Deployment of service postgres-backup complete
Deploying service postgres-diff-backup
Deployment of service postgres-diff-backup complete
Deploying service postgres-operations
Deployment of service postgres-operations complete
Deploying service postgres-operations-vacuum
Deployment of service postgres-operations-vacuum complete
Deploying service redis
Deployment of service redis complete
Deploying service redis-monitoring
Deployment of service redis-monitoring complete
Deploying service opensearch
Deployment of service opensearch complete
Deploying service coredns
Deployment of service coredns complete
Deploying service nginx-http
Deployment of service nginx-http complete
Deploying service acs
Deployment of service acs complete
Deploying service crypto
Deployment of service crypto complete
Deploying service cds
Deployment of service cds complete
Deploying service token
Deployment of service token complete
Deploying service analytics
Deployment of service analytics complete
Deploying service saas
Deployment of service saas complete
Deploying service federation
Deployment of service federation complete
Deploying service authcontrol
Deployment of service authcontrol complete
Deploying service greenbox
Deployment of service greenbox complete
Deploying service ws1notifications
Deployment of service ws1notifications complete
Deploying service ws1ntfmanager
Deployment of service ws1ntfmanager complete
Deploying service skycap
Deployment of service skycap complete
Deploying service cas
Deployment of service cas complete
Deploying service certproxy
Deployment of service certproxy complete
Deploying service commchannel
Deployment of service commchannel complete
Deploying service launcher
Deployment of service launcher complete
Deploying service ws1admin
Deployment of service ws1admin complete
Deploying service hubconsole
Deployment of service hubconsole complete
Deploying service mpsso
Deployment of service mpsso complete
Deploying service usergroup
Deployment of service usergroup complete
Deploying service nginx-stream
Deployment of service nginx-stream complete

Ejecute el siguiente comando para comprobar si el servicio está listo.

wso access check-service-readiness

# OUTPUT
{
  "cds": "READY",
  "acs": "READY",
  "saas": "READY",
  "crypto": "READY",
  "token": "READY",
  "ws1notifications": "READY",
  "ws1ntfmanager": "READY",
  "federation": "READY",
  "analytics": "READY",
  "authcontrol": "READY",
  "skycap": "READY",
  "greenbox": "READY",
  "cas": "READY",
  "certproxy": "READY",
  "commchannel": "READY",
  "ws1admin": "READY",
  "mpsso": "READY",
  "hubconsole": "READY",
  "usergroup": "READY",
  "launcher": "READY"
}

Asegúrese de que el estado de cada servicio sea READY. Si algún servicio se encuentra en estado NOT_READY, no podrá pasar a la siguiente fase. Solucione los problemas y rectifique.

¿Le resultó útil esta página?

Implementar los servicios de Omnissa Access y de infraestructura

Actualizar el archivo access-profile.yml

Enviar comentarios sobre este tema

Escriba su reseña