Implementar los servicios de Omnissa Access y de infraestructura

El procedimiento que se describe a continuación permite implementar los servicios de Omnissa Access y de infraestructura.

Actualizar el archivo access-profile.yml

Este archivo contiene:

• Nodos del clúster
• FQDN
• Certificados
• Configuración del inquilino

Procedimiento:

1. Abra el archivo access-profile.yml. Por ejemplo:

   vi /opt/wss/<cluster_name>/access/access-profile.yml
   

2. Siga las instrucciones que aparecen a continuación para actualizar el archivo access-profile.yml.

   Nota: El marcador de posición <LOAD_BALANCER_IP> utilizado en las siguientes instrucciones debe corresponder a la dirección IP del equilibrador de carga o proxy inverso que implementó en Usar un equilibrador de carga o proxy inverso para habilitar el acceso externo a Omnissa Access.

   
   fqdn:
     # Domain Name i.e: if you are going to access your tenant as tenant1.example.com, your FQDN.name should be example.com
     name: example.com
     # Port associated with FQDN
     port: 443
     # IP associated with FQDN
     # tenant_name.fqdn.name should resolve to this IP, i.e: if tenant_name=tenant1 and fqdn.name=example.com, tenant1.example.com should resolve to this IP
     ip: <LOAD_BALANCER_IP>
   
   server_certificate:
     # If you need to use self-signed FQDN/LB certificate, set is_self_signed: true, else provide path to your custom certificate and key.
     is_self_signed: false
     # [Required when is_self_signed is false] Custom cert file path.
     # Place your certificate at /opt/wss/<cluster_name>/access/certs/custom_cert.pem
     custom_cert_file: /opt/wss/<cluster_name>/access/certs/custom_cert.pem
     # [Required when is_self_signed is false] Custom key file path.
     # Place your key at /opt/wss/<cluster_name>/access/certs/custom_cert_key.pem
     custom_cert_keyfile: /opt/wss/<cluster_name>/access/certs/custom_cert_key.pem
   
   first_tenant:
     # tenant_name is mandatory for all on-premises customers. All other fields are mandatory.
     tenant_name: <YOUR_TENANT_NAME>
     admin_user_name: <TENANT_ADMIN_NAME>
     admin_email: <TENANT_ADMIN_EMAIL>
     admin_first_name: <TENANT_ADMIN_FIRST_NAME>
     admin_last_name: <TENANT_ADMIN_LAST_NAME>
   
   cert_proxy:
     enabled: true
     # certificate type - FQDN_CERT or CUSTOM_CERT
     ssl_certificate_type: CUSTOM_CERT
     # [Optional] ssl_certificate_path and ssl_certificate_key mandatory if ssl_certificate_type is CUSTOM_CERT
     # SSL certificate and key must be placed at /opt/wss/<cluster_name>/access/certs/ and referenced with the full path i.e: /opt/wss/<cluster_name>/access/certs/custom_cert_proxy_cert.pem
     ssl_certificate_path: /opt/wss/<cluster_name>/access/certs/custom_cert_proxy_cert.pem
     ssl_certificate_key: /opt/wss/<cluster_name>/access/certs/custom_cert_proxy_key.pem
   
   # All IPs between client and access instances, including cluster node IPs (excluding bootstrap), need to be added to this list
   # There should be minimum of 1 IP(LB) in case load balanced access setup, if there are proxies in between your client and access LB, all proxies need to be added to this list
   # Example: ["10.0.0.x", "10.0.0.x", "10.0.0.x"]
   ip_ignore_list_for_xff_header: ["<LOAD_BALANCER_IP>", "<PROXY_IP>", "<ACCESS_NODES>"]
   
   smtp:
     enabled: true
     # [Required when enabled is true]
     host: smtp.example.com
     port: 587
     user: smtp-user@example.com
     # [Required when enabled is true] Supported value -> STARTTLS or SSL_TLS
     security_type: STARTTLS
   

3. Después de actualizar el archivo access-profile.yml, ejecute el arranque. Por ejemplo:

   cd /opt/wss/<cluster_name>
   wso access bootstrap
   
   # Output
   creating secret engine
   creating secret engine
   creating secret engine
   Successfully synced all KV's to consul
   Successfully synced all secrets
   

   Resultado: Este paso carga la configuración en Vault y Consul.

4. Antes de realizar la implementación, cree una instantánea de cada máquina virtual del clúster.

   Se recomienda crear las instantáneas en este momento para poder volver a ellas si se produce un error durante la implementación.

5. Ejecute los siguientes comandos para implementar los servicios en segundo plano y supervise la implementación desde otra ventana de terminal. Opcionalmente, agregue -v al comando de implementación para obtener resultados más detallados.

   Nota: La implementación continuará aunque se cierre la terminal o la sesión SSH y tardará aproximadamente 40 minutos.

   nohup wso services deploy --type full &
   
   # OUTPUT
   [1] XXXX 
   nohup: ignoring input and appending output to 'nohup.out'
   
   # Optionally, use this alternative command instead for more verbose output:
   # nohup wso services deploy --type full -v &
   
   # Press Enter, then from a different terminal window on the same machine, monitor the deployment with the following commands: 
   
   cd /opt/wss/<cluster_name>
   tail -f nohup.out
   
   # OUTPUT
   Cleaning up
   Cleans up the docker subsystem on nodes (unused images)
   Generating environment file with cluster details and secret tokens
   Verify that CA is present in trust bundle on all nodes
   <timestamp> Using additional env vars /opt/wss/<cluster_name>/additional_env_vars.env
   Deploying service control-plane-logging
   Deployment of service control-plane-logging complete
   Deploying service telegraf-statsd
   Deployment of service telegraf-statsd complete
   Deploying service telegraf-asset-server
   Deployment of service telegraf-asset-server complete
   Deploying service ingress
   Deployment of service ingress complete
   Deploying service ingress-gateway-route-reloader
   Deployment of service ingress-gateway-route-reloader complete
   Deploying service control-plane-backup
   Deployment of service control-plane-backup complete
   Deploying service client-side-load-balancer
   Deployment of service client-side-load-balancer complete
   Deploying service telegraf-uptime
   Deployment of service telegraf-uptime complete
   Deploying service cp-ops-dispatch
   Deployment of service cp-ops-dispatch complete
   Deploying service cp-ops-output-processor
   Deployment of service cp-ops-output-processor complete
   Deploying service kafka
   Deployment of service kafka complete
   Deploying service kafka-monitoring
   Deployment of service kafka-monitoring complete
   Deploying service postgres
   Deployment of service postgres complete
   Deploying service postgres-monitoring
   Deployment of service postgres-monitoring complete
   Deploying service pgbouncer
   Deployment of service pgbouncer complete
   Deploying service postgres-backup
   Deployment of service postgres-backup complete
   Deploying service postgres-diff-backup
   Deployment of service postgres-diff-backup complete
   Deploying service postgres-operations
   Deployment of service postgres-operations complete
   Deploying service postgres-operations-vacuum
   Deployment of service postgres-operations-vacuum complete
   Deploying service redis
   Deployment of service redis complete
   Deploying service redis-monitoring
   Deployment of service redis-monitoring complete
   Deploying service opensearch
   Deployment of service opensearch complete
   Deploying service coredns
   Deployment of service coredns complete
   Deploying service nginx-http
   Deployment of service nginx-http complete
   Deploying service acs
   Deployment of service acs complete
   Deploying service crypto
   Deployment of service crypto complete
   Deploying service cds
   Deployment of service cds complete
   Deploying service token
   Deployment of service token complete
   Deploying service analytics
   Deployment of service analytics complete
   Deploying service saas
   Deployment of service saas complete
   Deploying service federation
   Deployment of service federation complete
   Deploying service authcontrol
   Deployment of service authcontrol complete
   Deploying service greenbox
   Deployment of service greenbox complete
   Deploying service ws1notifications
   Deployment of service ws1notifications complete
   Deploying service ws1ntfmanager
   Deployment of service ws1ntfmanager complete
   Deploying service skycap
   Deployment of service skycap complete
   Deploying service cas
   Deployment of service cas complete
   Deploying service certproxy
   Deployment of service certproxy complete
   Deploying service commchannel
   Deployment of service commchannel complete
   Deploying service launcher
   Deployment of service launcher complete
   Deploying service ws1admin
   Deployment of service ws1admin complete
   Deploying service hubconsole
   Deployment of service hubconsole complete
   Deploying service mpsso
   Deployment of service mpsso complete
   Deploying service usergroup
   Deployment of service usergroup complete
   Deploying service nginx-stream
   Deployment of service nginx-stream complete
   All services deployed successfully
   

6. Ejecute el siguiente comando para comprobar si el servicio está listo.

   wso access check-service-readiness
   
   # OUTPUT
   {
     "cds": "READY",
     "acs": "READY",
     "saas": "READY",
     "crypto": "READY",
     "token": "READY",
     "ws1notifications": "READY",
     "ws1ntfmanager": "READY",
     "federation": "READY",
     "analytics": "READY",
     "authcontrol": "READY",
     "skycap": "READY",
     "greenbox": "READY",
     "cas": "READY",
     "certproxy": "READY",
     "commchannel": "READY",
     "ws1admin": "READY",
     "mpsso": "READY",
     "hubconsole": "READY",
     "usergroup": "READY",
     "launcher": "READY"
   }
   

7. Asegúrese de que el estado de cada servicio sea READY.

   Si algún servicio se encuentra en estado NOT_READY, no podrá pasar a la siguiente fase. Solucione los problemas y rectifique.

   Puede consultar los pasos a seguir para solucionar problemas en Un servicio se encuentra en estado No listo.