次の手順では、Omnissa Access とインフラストラクチャ サービスを展開します。
access-profile.yml ファイルの更新
このファイルには次のものが含まれます。
- クラスタ ノード
- FQDN
- 証明書
- テナント構成
手順：
-
access-profile.ymlファイルを開きます。例：vi /root/<cluster_name>/access/access-profile.yml -
以下のインラインの指示に従って、
access-profile.ymlファイルを更新します。fqdn: # Domain Name i.e: if you are going to access your tenant as tenant1.example.com, your FQDN.name should be example.com name: example.com # Port associated with FQDN port: 443 # IP associated with FQDN # tenant_name.fqdn.name should resolve to this IP, i.e: if tenant_name=tenant1 and fqdn.name=example.com, tenant1.example.com should resolve to this IP ip: <LOAD_BALANCER_IP> server_certificate: # If you need to use self-signed FQDN/LB certificate, set is_self_signed: true, else provide path to your custom certificate and key. is_self_signed: false # [Required when is_self_signed is false] Custom cert file path. # Place your certificate at /root/<cluster-name>/access/certs/custom_cert.pem custom_cert_file: /root/<cluster-name>/access/certs/custom_cert.pem # [Required when is_self_signed is false] Custom key file path. # Place your key at /root/<cluster-name>/access/certs/custom_cert_key.pem custom_cert_keyfile: /root/<cluster-name>/access/certs/custom_cert_key.pem first_tenant: # tenant_name is mandatory for all Onprem customers. All other fields are mandatory. tenant_name: <YOUR_TENANT_NAME> admin_user_name: <TENANT_ADMIN_NAME> admin_email: <TENANT_ADMIN_EMAIL> admin_first_name: <TENANT_ADMIN_FIRST_NAME> admin_last_name: <TENANT_ADMIN_LAST_NAME> cert_proxy: enabled: true # certificate type - FQDN_CERT or CUSTOM_CERT ssl_certificate_type: CUSTOM_CERT # [Optional] ssl_certificate_path and ssl_certificate_key mandatory if ssl_certificate_type is CUSTOM_CERT # SSL certificate and key must be placed at /root/<cluster-name>/access/certs/ and referenced with the full path i.e: /root/<cluster-name>/access/certs/custom_cert_proxy_cert.pem ssl_certificate_path: /root/<cluster-name>/access/certs/custom_cert_proxy_cert.pem ssl_certificate_key: /root/<cluster-name>/access/certs/custom_cert_proxy_key.pem # All IPs between client and access instances, including cluster node IPs (excluding bootstrap), need to be added to this list # There should be minimum of 1 IP(LB) in case load balanced access setup, if there are proxies in between your client and access LB, all proxies need to be added to this list # Example: ["10.0.0.x", "10.0.0.x", "10.0.0.x"] ip_ignore_list_for_xff_header: ["<LOAD_BALANCER_IP>", "<PROXY_IP>", "<ACCESS_NODES>"] smtp: enabled: true # [Required when enabled is true] host: smtp.example.com port: 587 user: smtp-user@example.com # [Required when enabled is true] Supported value -> STARTTLS or SSL_TLS security_type: STARTTLS -
access-profile.ymlファイルを更新したら、ブートストラップを実行します。例：cd /root/<cluster_name> wso access bootstrap # Output creating secret engine creating secret engine creating secret engine Successfully synced all KV's to consul Successfully synced all secrets**結果：**この手順は構成を Vault と Consul にロードします。
-
展開をバックグラウンドで実行するか、フォアグラウンドで実行するかに応じて、適切なコマンドを実行してサービスを展開します。例：
-
バックグラウンドで展開を実行し、ターミナルまたは SSH セッションが終了しても続行します。長期実行の展開に推奨されます。
nohup wso services deploy --type full & ## This will take time to deploy around 40 min # OUTPUT [1] 108485 nohup: ignoring input and appending output to 'nohup.out' -
詳細ログを有効にして展開をフォアグラウンドで実行し、詳細な進行状況とデバッグ情報をターミナルに表示します。展開のリアルタイムでの監視とトラブルシューティングに推奨されます。
wso services deploy --type full -v ## This will take time to deploy around 40 min # OUTPUT [1] 108485 nohup: ignoring input and appending output to 'nohup.out'
-
-
以下のインラインの指示に従って、展開を監視します。
# log in to the same machine from a different terminal window to check logs cd /root/<cluster_name> tail -f nohup.out # OUTPUT Cleaning up Cleans up the docker subsystem on nodes (unused images) Generating environment file with cluster details and secret tokens Verify that CA is present in trust bundle on all nodes <timestamp> Using additional env vars /root/<cluster_name>/additional_env_vars.env Deploying service control-plane-logging Deployment of service control-plane-logging complete Deploying service telegraf-statsd Deployment of service telegraf-statsd complete Deploying service telegraf-asset-server Deployment of service telegraf-asset-server complete Deploying service ingress Deployment of service ingress complete Deploying service ingress-gateway-route-reloader Deployment of service ingress-gateway-route-reloader complete Deploying service control-plane-backup Deployment of service control-plane-backup complete Deploying service client-side-load-balancer Deployment of service client-side-load-balancer complete Deploying service telegraf-uptime Deployment of service telegraf-uptime complete Deploying service cp-ops-dispatch Deployment of service cp-ops-dispatch complete Deploying service cp-ops-output-processor Deployment of service cp-ops-output-processor complete Deploying service kafka Deployment of service kafka complete Deploying service kafka-monitoring Deployment of service kafka-monitoring complete Deploying service postgres Deployment of service postgres complete Deploying service postgres-monitoring Deployment of service postgres-monitoring complete Deploying service pgbouncer Deployment of service pgbouncer complete Deploying service postgres-backup Deployment of service postgres-backup complete Deploying service postgres-diff-backup Deployment of service postgres-diff-backup complete Deploying service postgres-operations Deployment of service postgres-operations complete Deploying service postgres-operations-vacuum Deployment of service postgres-operations-vacuum complete Deploying service redis Deployment of service redis complete Deploying service redis-monitoring Deployment of service redis-monitoring complete Deploying service opensearch Deployment of service opensearch complete Deploying service coredns Deployment of service coredns complete Deploying service nginx-http Deployment of service nginx-http complete Deploying service acs Deployment of service acs complete Deploying service crypto Deployment of service crypto complete Deploying service cds Deployment of service cds complete Deploying service token Deployment of service token complete Deploying service analytics Deployment of service analytics complete Deploying service saas Deployment of service saas complete Deploying service federation Deployment of service federation complete Deploying service authcontrol Deployment of service authcontrol complete Deploying service greenbox Deployment of service greenbox complete Deploying service ws1notifications Deployment of service ws1notifications complete Deploying service ws1ntfmanager Deployment of service ws1ntfmanager complete Deploying service skycap Deployment of service skycap complete Deploying service cas Deployment of service cas complete Deploying service certproxy Deployment of service certproxy complete Deploying service commchannel Deployment of service commchannel complete Deploying service launcher Deployment of service launcher complete Deploying service ws1admin Deployment of service ws1admin complete Deploying service hubconsole Deployment of service hubconsole complete Deploying service mpsso Deployment of service mpsso complete Deploying service usergroup Deployment of service usergroup complete Deploying service nginx-stream Deployment of service nginx-stream complete -
次のコマンドを実行して、サービスの準備状況を確認します。
wso access check-service-readiness # OUTPUT { "cds": "READY", "acs": "READY", "saas": "READY", "crypto": "READY", "token": "READY", "ws1notifications": "READY", "ws1ntfmanager": "READY", "federation": "READY", "analytics": "READY", "authcontrol": "READY", "skycap": "READY", "greenbox": "READY", "cas": "READY", "certproxy": "READY", "commchannel": "READY", "ws1admin": "READY", "mpsso": "READY", "hubconsole": "READY", "usergroup": "READY", "launcher": "READY" } -
各サービスのステータスが
READY状態であることを確認します。NOT_READY状態のサービスがある場合は、次のフェーズに進むことはできません。トラブルシューティングして修正します。
このページは役に立ちましたか?