다음 절차는 Omnissa Access 및 인프라 서비스를 배포합니다.
access-profile.yml 파일 업데이트
이 파일에는 다음이 포함됩니다.
- 클러스터 노드
- FQDN
- 인증서
- 테넌트 구성
절차:
-
access-profile.yml파일을 엽니다. 예:vi /root/<cluster_name>/access/access-profile.yml -
아래의 인라인 지침에 따라
access-profile.yml파일을 업데이트합니다.fqdn: # Domain Name i.e: if you are going to access your tenant as tenant1.example.com, your FQDN.name should be example.com name: example.com # Port associated with FQDN port: 443 # IP associated with FQDN # tenant_name.fqdn.name should resolve to this IP, i.e: if tenant_name=tenant1 and fqdn.name=example.com, tenant1.example.com should resolve to this IP ip: <LOAD_BALANCER_IP> server_certificate: # If you need to use self-signed FQDN/LB certificate, set is_self_signed: true, else provide path to your custom certificate and key. is_self_signed: false # [Required when is_self_signed is false] Custom cert file path. # Place your certificate at /root/<cluster-name>/access/certs/custom_cert.pem custom_cert_file: /root/<cluster-name>/access/certs/custom_cert.pem # [Required when is_self_signed is false] Custom key file path. # Place your key at /root/<cluster-name>/access/certs/custom_cert_key.pem custom_cert_keyfile: /root/<cluster-name>/access/certs/custom_cert_key.pem first_tenant: # tenant_name is mandatory for all Onprem customers. All other fields are mandatory. tenant_name: <YOUR_TENANT_NAME> admin_user_name: <TENANT_ADMIN_NAME> admin_email: <TENANT_ADMIN_EMAIL> admin_first_name: <TENANT_ADMIN_FIRST_NAME> admin_last_name: <TENANT_ADMIN_LAST_NAME> cert_proxy: enabled: true # certificate type - FQDN_CERT or CUSTOM_CERT ssl_certificate_type: CUSTOM_CERT # [Optional] ssl_certificate_path and ssl_certificate_key mandatory if ssl_certificate_type is CUSTOM_CERT # SSL certificate and key must be placed at /root/<cluster-name>/access/certs/ and referenced with the full path i.e: /root/<cluster-name>/access/certs/custom_cert_proxy_cert.pem ssl_certificate_path: /root/<cluster-name>/access/certs/custom_cert_proxy_cert.pem ssl_certificate_key: /root/<cluster-name>/access/certs/custom_cert_proxy_key.pem # All IPs between client and access instances, including cluster node IPs (excluding bootstrap), need to be added to this list # There should be minimum of 1 IP(LB) in case load balanced access setup, if there are proxies in between your client and access LB, all proxies need to be added to this list # Example: ["10.0.0.x", "10.0.0.x", "10.0.0.x"] ip_ignore_list_for_xff_header: ["<LOAD_BALANCER_IP>", "<PROXY_IP>", "<ACCESS_NODES>"] smtp: enabled: true # [Required when enabled is true] host: smtp.example.com port: 587 user: smtp-user@example.com # [Required when enabled is true] Supported value -> STARTTLS or SSL_TLS security_type: STARTTLS -
access-profile.yml파일을 업데이트한 후 부트스트랩을 실행합니다. 예:cd /root/<cluster_name> wso access bootstrap # Output creating secret engine creating secret engine creating secret engine Successfully synced all KV's to consul Successfully synced all secrets결과: 이 단계에서는 구성을 Vault 및 Consul에 로드합니다.
-
백그라운드 또는 포그라운드에서 배포를 실행할지 여부에 따라 적절한 명령을 실행하여 서비스를 배포합니다. 예:
-
터미널 또는 SSH 세션이 종료되어도 백그라운드에서 배포를 실행하고 계속 진행합니다. 장기 실행 배포에 권장됩니다.
nohup wso services deploy --type full & ## This will take time to deploy around 40 min # OUTPUT [1] 108485 nohup: ignoring input and appending output to 'nohup.out' -
세부 정보 로깅을 사용하도록 설정하여 포그라운드에서 배포를 실행하며, 터미널에 자세한 진행 상황 및 디버그 정보를 표시합니다. 실시간으로 배포 모니터링 및 문제 해결에 권장됩니다.
wso services deploy --type full -v ## This will take time to deploy around 40 min # OUTPUT [1] 108485 nohup: ignoring input and appending output to 'nohup.out'
-
-
아래의 인라인 지침에 따라 배포를 모니터링합니다.
# log in to the same machine from a different terminal window to check logs cd /root/<cluster_name> tail -f nohup.out # OUTPUT Cleaning up Cleans up the docker subsystem on nodes (unused images) Generating environment file with cluster details and secret tokens Verify that CA is present in trust bundle on all nodes <timestamp> Using additional env vars /root/<cluster_name>/additional_env_vars.env Deploying service control-plane-logging Deployment of service control-plane-logging complete Deploying service telegraf-statsd Deployment of service telegraf-statsd complete Deploying service telegraf-asset-server Deployment of service telegraf-asset-server complete Deploying service ingress Deployment of service ingress complete Deploying service ingress-gateway-route-reloader Deployment of service ingress-gateway-route-reloader complete Deploying service control-plane-backup Deployment of service control-plane-backup complete Deploying service client-side-load-balancer Deployment of service client-side-load-balancer complete Deploying service telegraf-uptime Deployment of service telegraf-uptime complete Deploying service cp-ops-dispatch Deployment of service cp-ops-dispatch complete Deploying service cp-ops-output-processor Deployment of service cp-ops-output-processor complete Deploying service kafka Deployment of service kafka complete Deploying service kafka-monitoring Deployment of service kafka-monitoring complete Deploying service postgres Deployment of service postgres complete Deploying service postgres-monitoring Deployment of service postgres-monitoring complete Deploying service pgbouncer Deployment of service pgbouncer complete Deploying service postgres-backup Deployment of service postgres-backup complete Deploying service postgres-diff-backup Deployment of service postgres-diff-backup complete Deploying service postgres-operations Deployment of service postgres-operations complete Deploying service postgres-operations-vacuum Deployment of service postgres-operations-vacuum complete Deploying service redis Deployment of service redis complete Deploying service redis-monitoring Deployment of service redis-monitoring complete Deploying service opensearch Deployment of service opensearch complete Deploying service coredns Deployment of service coredns complete Deploying service nginx-http Deployment of service nginx-http complete Deploying service acs Deployment of service acs complete Deploying service crypto Deployment of service crypto complete Deploying service cds Deployment of service cds complete Deploying service token Deployment of service token complete Deploying service analytics Deployment of service analytics complete Deploying service saas Deployment of service saas complete Deploying service federation Deployment of service federation complete Deploying service authcontrol Deployment of service authcontrol complete Deploying service greenbox Deployment of service greenbox complete Deploying service ws1notifications Deployment of service ws1notifications complete Deploying service ws1ntfmanager Deployment of service ws1ntfmanager complete Deploying service skycap Deployment of service skycap complete Deploying service cas Deployment of service cas complete Deploying service certproxy Deployment of service certproxy complete Deploying service commchannel Deployment of service commchannel complete Deploying service launcher Deployment of service launcher complete Deploying service ws1admin Deployment of service ws1admin complete Deploying service hubconsole Deployment of service hubconsole complete Deploying service mpsso Deployment of service mpsso complete Deploying service usergroup Deployment of service usergroup complete Deploying service nginx-stream Deployment of service nginx-stream complete -
다음 명령을 실행하여 서비스의 준비 상태를 확인합니다.
wso access check-service-readiness # OUTPUT { "cds": "READY", "acs": "READY", "saas": "READY", "crypto": "READY", "token": "READY", "ws1notifications": "READY", "ws1ntfmanager": "READY", "federation": "READY", "analytics": "READY", "authcontrol": "READY", "skycap": "READY", "greenbox": "READY", "cas": "READY", "certproxy": "READY", "commchannel": "READY", "ws1admin": "READY", "mpsso": "READY", "hubconsole": "READY", "usergroup": "READY", "launcher": "READY" } -
각 서비스의 상태가
READY상태인지 확인합니다. 서비스가NOT_READY상태인 경우 다음 단계로 진행할 수 없습니다. 문제를 해결하고 수정합니다.
이 페이지가 도움이 되었나요?