Déployer les services d'infrastructure et d'Omnissa Access

La procédure suivante déploie les services d'infrastructure et d'Omnissa Access.

Mettre à jour le fichier access-profile.yml

Ce fichier contient les éléments suivants :

• Nœuds de clusters
• nom de domaine complet
• Certificats
• Configuration des locataires

Procédure :

1. Ouvrez le fichier access-profile.yml Par exemple :

   vi /root/<cluster_name>/access/access-profile.yml
   

2. Suivez les instructions en ligne ci-dessous pour mettre à jour le fichier access-profile.yml.

   
   fqdn:
     # Domain Name i.e: if you are going to access your tenant as tenant1.example.com, your FQDN.name should be example.com
     name: example.com
     # Port associated with FQDN
     port: 443
     # IP associated with FQDN
     # tenant_name.fqdn.name should resolve to this IP, i.e: if tenant_name=tenant1 and fqdn.name=example.com, tenant1.example.com should resolve to this IP
     ip: <LOAD_BALANCER_IP>
   
   server_certificate:
     # If you need to use self-signed FQDN/LB certificate, set is_self_signed: true, else provide path to your custom certificate and key.
     is_self_signed: false
     # [Required when is_self_signed is false] Custom cert file path.
     # Place your certificate at /root/<cluster-name>/access/certs/custom_cert.pem
     custom_cert_file: /root/<cluster-name>/access/certs/custom_cert.pem
     # [Required when is_self_signed is false] Custom key file path.
     # Place your key at /root/<cluster-name>/access/certs/custom_cert_key.pem
     custom_cert_keyfile: /root/<cluster-name>/access/certs/custom_cert_key.pem
   
   first_tenant:
     # tenant_name is mandatory for all Onprem customers. All other fields are mandatory.
     tenant_name: <YOUR_TENANT_NAME>
     admin_user_name: <TENANT_ADMIN_NAME>
     admin_email: <TENANT_ADMIN_EMAIL>
     admin_first_name: <TENANT_ADMIN_FIRST_NAME>
     admin_last_name: <TENANT_ADMIN_LAST_NAME>
   
   cert_proxy:
     enabled: true
     # certificate type - FQDN_CERT or CUSTOM_CERT
     ssl_certificate_type: CUSTOM_CERT
     # [Optional] ssl_certificate_path and ssl_certificate_key mandatory if ssl_certificate_type is CUSTOM_CERT
     # SSL certificate and key must be placed at /root/<cluster-name>/access/certs/ and referenced with the full path i.e: /root/<cluster-name>/access/certs/custom_cert_proxy_cert.pem
     ssl_certificate_path: /root/<cluster-name>/access/certs/custom_cert_proxy_cert.pem
     ssl_certificate_key: /root/<cluster-name>/access/certs/custom_cert_proxy_key.pem
   
   # All IPs between client and access instances, including cluster node IPs (excluding bootstrap), need to be added to this list
   # There should be minimum of 1 IP(LB) in case load balanced access setup, if there are proxies in between your client and access LB, all proxies need to be added to this list
   # Example: ["10.0.0.x", "10.0.0.x", "10.0.0.x"]
   ip_ignore_list_for_xff_header: ["<LOAD_BALANCER_IP>", "<PROXY_IP>", "<ACCESS_NODES>"]
   
   smtp:
     enabled: true
     # [Required when enabled is true]
     host: smtp.example.com
     port: 587
     user: smtp-user@example.com
     # [Required when enabled is true] Supported value -> STARTTLS or SSL_TLS
     security_type: STARTTLS
   
   

3. Après la mise à jour du fichier access-profile.yml, exécutez le démarrage. Par exemple :

   cd /root/<cluster_name>
   wso access bootstrap
   
   # Output
   creating secret engine
   creating secret engine
   creating secret engine
   Successfully synced all KV's to consul
   Successfully synced all secrets
   

   Résultat : cette étape charge la configuration dans Vault et Consul.

4. Exécutez la commande appropriée pour déployer les services, selon que vous souhaitez exécuter le déploiement en arrière-plan ou au premier plan. Par exemple :

   • Exécute le déploiement en arrière-plan et continue même si le terminal ou la session de protocole SSH est fermé. Recommandé pour les déploiements à long terme.

     nohup wso services deploy --type full &
     ## This will take time to deploy around 40 min
     
     # OUTPUT
     [1] 108485
     nohup: ignoring input and appending output to 'nohup.out'
     

   • Exécute le déploiement au premier plan avec la journalisation détaillée activée, affichant des informations détaillées sur la progression et le débogage dans le terminal. Recommandé pour la surveillance et le dépannage des déploiements en temps réel.

     wso services deploy --type full -v
     ## This will take time to deploy around 40 min
     
     # OUTPUT
     [1] 108485
     nohup: ignoring input and appending output to 'nohup.out'
     

5. Suivez les instructions en ligne ci-dessous pour surveiller le déploiement.

   # log in to the same machine from a different terminal window to check logs
   
   cd /root/<cluster_name>
   tail -f nohup.out
   
   # OUTPUT
   Cleaning up
   Cleans up the docker subsystem on nodes (unused images)
   Generating environment file with cluster details and secret tokens
   Verify that CA is present in trust bundle on all nodes
   <timestamp> Using additional env vars /root/<cluster_name>/additional_env_vars.env
   Deploying service control-plane-logging
   Deployment of service control-plane-logging complete
   Deploying service telegraf-statsd
   Deployment of service telegraf-statsd complete
   Deploying service telegraf-asset-server
   Deployment of service telegraf-asset-server complete
   Deploying service ingress
   Deployment of service ingress complete
   Deploying service ingress-gateway-route-reloader
   Deployment of service ingress-gateway-route-reloader complete
   Deploying service control-plane-backup
   Deployment of service control-plane-backup complete
   Deploying service client-side-load-balancer
   Deployment of service client-side-load-balancer complete
   Deploying service telegraf-uptime
   Deployment of service telegraf-uptime complete
   Deploying service cp-ops-dispatch
   Deployment of service cp-ops-dispatch complete
   Deploying service cp-ops-output-processor
   Deployment of service cp-ops-output-processor complete
   Deploying service kafka
   Deployment of service kafka complete
   Deploying service kafka-monitoring
   Deployment of service kafka-monitoring complete
   Deploying service postgres
   Deployment of service postgres complete
   Deploying service postgres-monitoring
   Deployment of service postgres-monitoring complete
   Deploying service pgbouncer
   Deployment of service pgbouncer complete
   Deploying service postgres-backup
   Deployment of service postgres-backup complete
   Deploying service postgres-diff-backup
   Deployment of service postgres-diff-backup complete
   Deploying service postgres-operations
   Deployment of service postgres-operations complete
   Deploying service postgres-operations-vacuum
   Deployment of service postgres-operations-vacuum complete
   Deploying service redis
   Deployment of service redis complete
   Deploying service redis-monitoring
   Deployment of service redis-monitoring complete
   Deploying service opensearch
   Deployment of service opensearch complete
   Deploying service coredns
   Deployment of service coredns complete
   Deploying service nginx-http
   Deployment of service nginx-http complete
   Deploying service acs
   Deployment of service acs complete
   Deploying service crypto
   Deployment of service crypto complete
   Deploying service cds
   Deployment of service cds complete
   Deploying service token
   Deployment of service token complete
   Deploying service analytics
   Deployment of service analytics complete
   Deploying service saas
   Deployment of service saas complete
   Deploying service federation
   Deployment of service federation complete
   Deploying service authcontrol
   Deployment of service authcontrol complete
   Deploying service greenbox
   Deployment of service greenbox complete
   Deploying service ws1notifications
   Deployment of service ws1notifications complete
   Deploying service ws1ntfmanager
   Deployment of service ws1ntfmanager complete
   Deploying service skycap
   Deployment of service skycap complete
   Deploying service cas
   Deployment of service cas complete
   Deploying service certproxy
   Deployment of service certproxy complete
   Deploying service commchannel
   Deployment of service commchannel complete
   Deploying service launcher
   Deployment of service launcher complete
   Deploying service ws1admin
   Deployment of service ws1admin complete
   Deploying service hubconsole
   Deployment of service hubconsole complete
   Deploying service mpsso
   Deployment of service mpsso complete
   Deploying service usergroup
   Deployment of service usergroup complete
   Deploying service nginx-stream
   Deployment of service nginx-stream complete
   

6. Exécutez la commande suivante pour vérifier la disponibilité du service.

   wso access check-service-readiness
   
   # OUTPUT
   {
     "cds": "READY",
     "acs": "READY",
     "saas": "READY",
     "crypto": "READY",
     "token": "READY",
     "ws1notifications": "READY",
     "ws1ntfmanager": "READY",
     "federation": "READY",
     "analytics": "READY",
     "authcontrol": "READY",
     "skycap": "READY",
     "greenbox": "READY",
     "cas": "READY",
     "certproxy": "READY",
     "commchannel": "READY",
     "ws1admin": "READY",
     "mpsso": "READY",
     "hubconsole": "READY",
     "usergroup": "READY",
     "launcher": "READY"
   }
   

7. Assurez-vous que chaque service est dans l'état READY. Si un service est dans l'état NOT_READY, vous ne pouvez pas passer à la phase suivante. Dépannez et rectifiez.