Implantar os serviços de Infraestrutura e do Omnissa Access

O procedimento a seguir implanta os serviços de infraestrutura e do Omnissa Access.

Atualizar o arquivo access-profile.yml

Este arquivo contém:

• Nós do cluster
• FQDN
• Certificados
• Configuração do locatário

Procedimento:

1. Abra o arquivo access-profile.yml. Por exemplo:

   vi /opt/wss/<cluster_name>/access/access-profile.yml
   

2. Siga as instruções abaixo para atualizar o arquivo access-profile.yml.

   Nota: o espaço reservado <LOAD_BALANCER_IP> usado nas instruções a seguir deve ser o endereço IP do balanceador de carga ou do proxy reverso que você implantou em Usar um balanceador de carga ou proxy reverso para ativar o acesso externo ao Omnissa Access.

   
   fqdn:
     # Domain Name i.e: if you are going to access your tenant as tenant1.example.com, your FQDN.name should be example.com
     name: example.com
     # Port associated with FQDN
     port: 443
     # IP associated with FQDN
     # tenant_name.fqdn.name should resolve to this IP, i.e: if tenant_name=tenant1 and fqdn.name=example.com, tenant1.example.com should resolve to this IP
     ip: <LOAD_BALANCER_IP>
   
   server_certificate:
     # If you need to use self-signed FQDN/LB certificate, set is_self_signed: true, else provide path to your custom certificate and key.
     is_self_signed: false
     # [Required when is_self_signed is false] Custom cert file path.
     # Place your certificate at /opt/wss/<cluster_name>/access/certs/custom_cert.pem
     custom_cert_file: /opt/wss/<cluster_name>/access/certs/custom_cert.pem
     # [Required when is_self_signed is false] Custom key file path.
     # Place your key at /opt/wss/<cluster_name>/access/certs/custom_cert_key.pem
     custom_cert_keyfile: /opt/wss/<cluster_name>/access/certs/custom_cert_key.pem
   
   first_tenant:
     # tenant_name is mandatory for all on-premises customers. All other fields are mandatory.
     tenant_name: <YOUR_TENANT_NAME>
     admin_user_name: <TENANT_ADMIN_NAME>
     admin_email: <TENANT_ADMIN_EMAIL>
     admin_first_name: <TENANT_ADMIN_FIRST_NAME>
     admin_last_name: <TENANT_ADMIN_LAST_NAME>
   
   cert_proxy:
     enabled: true
     # certificate type - FQDN_CERT or CUSTOM_CERT
     ssl_certificate_type: CUSTOM_CERT
     # [Optional] ssl_certificate_path and ssl_certificate_key mandatory if ssl_certificate_type is CUSTOM_CERT
     # SSL certificate and key must be placed at /opt/wss/<cluster_name>/access/certs/ and referenced with the full path i.e: /opt/wss/<cluster_name>/access/certs/custom_cert_proxy_cert.pem
     ssl_certificate_path: /opt/wss/<cluster_name>/access/certs/custom_cert_proxy_cert.pem
     ssl_certificate_key: /opt/wss/<cluster_name>/access/certs/custom_cert_proxy_key.pem
   
   # All IPs between client and access instances, including cluster node IPs (excluding bootstrap), need to be added to this list
   # There should be minimum of 1 IP(LB) in case load balanced access setup, if there are proxies in between your client and access LB, all proxies need to be added to this list
   # Example: ["10.0.0.x", "10.0.0.x", "10.0.0.x"]
   ip_ignore_list_for_xff_header: ["<LOAD_BALANCER_IP>", "<PROXY_IP>", "<ACCESS_NODES>"]
   
   smtp:
     enabled: true
     # [Required when enabled is true]
     host: smtp.example.com
     port: 587
     user: smtp-user@example.com
     # [Required when enabled is true] Supported value -> STARTTLS or SSL_TLS
     security_type: STARTTLS
   

3. Depois de atualizar o arquivo access-profile.yml, execute o bootstrap. Por exemplo:

   cd /opt/wss/<cluster_name>
   wso access bootstrap
   
   # Output
   creating secret engine
   creating secret engine
   creating secret engine
   Successfully synced all KV's to consul
   Successfully synced all secrets
   

   Resultado: esta etapa carrega a configuração no Vault e no Consul.

4. Antes de implantar, tire um snapshot de todas as máquinas virtuais no cluster.

   É recomendável tirar snapshots nesse ponto para que você possa reverter para os snapshots se a implantação falhar.

5. Execute os seguintes comandos para implantar os serviços em segundo plano, monitorar a implantação de uma janela de terminal diferente e, opcionalmente, adicionar -v ao comando deploy para uma saída mais detalhada.

   Nota: a implantação continua mesmo que o terminal ou a sessão SSH seja encerrada e leva aproximadamente 40 minutos.

   nohup wso services deploy --type full &
   
   # OUTPUT
   [1] XXXX 
   nohup: ignoring input and appending output to 'nohup.out'
   
   # Optionally, use this alternative command instead for more verbose output:
   # nohup wso services deploy --type full -v &
   
   # Press Enter, then from a different terminal window on the same machine, monitor the deployment with the following commands: 
   
   cd /opt/wss/<cluster_name>
   tail -f nohup.out
   
   # OUTPUT
   Cleaning up
   Cleans up the docker subsystem on nodes (unused images)
   Generating environment file with cluster details and secret tokens
   Verify that CA is present in trust bundle on all nodes
   <timestamp> Using additional env vars /opt/wss/<cluster_name>/additional_env_vars.env
   Deploying service control-plane-logging
   Deployment of service control-plane-logging complete
   Deploying service telegraf-statsd
   Deployment of service telegraf-statsd complete
   Deploying service telegraf-asset-server
   Deployment of service telegraf-asset-server complete
   Deploying service ingress
   Deployment of service ingress complete
   Deploying service ingress-gateway-route-reloader
   Deployment of service ingress-gateway-route-reloader complete
   Deploying service control-plane-backup
   Deployment of service control-plane-backup complete
   Deploying service client-side-load-balancer
   Deployment of service client-side-load-balancer complete
   Deploying service telegraf-uptime
   Deployment of service telegraf-uptime complete
   Deploying service cp-ops-dispatch
   Deployment of service cp-ops-dispatch complete
   Deploying service cp-ops-output-processor
   Deployment of service cp-ops-output-processor complete
   Deploying service kafka
   Deployment of service kafka complete
   Deploying service kafka-monitoring
   Deployment of service kafka-monitoring complete
   Deploying service postgres
   Deployment of service postgres complete
   Deploying service postgres-monitoring
   Deployment of service postgres-monitoring complete
   Deploying service pgbouncer
   Deployment of service pgbouncer complete
   Deploying service postgres-backup
   Deployment of service postgres-backup complete
   Deploying service postgres-diff-backup
   Deployment of service postgres-diff-backup complete
   Deploying service postgres-operations
   Deployment of service postgres-operations complete
   Deploying service postgres-operations-vacuum
   Deployment of service postgres-operations-vacuum complete
   Deploying service redis
   Deployment of service redis complete
   Deploying service redis-monitoring
   Deployment of service redis-monitoring complete
   Deploying service opensearch
   Deployment of service opensearch complete
   Deploying service coredns
   Deployment of service coredns complete
   Deploying service nginx-http
   Deployment of service nginx-http complete
   Deploying service acs
   Deployment of service acs complete
   Deploying service crypto
   Deployment of service crypto complete
   Deploying service cds
   Deployment of service cds complete
   Deploying service token
   Deployment of service token complete
   Deploying service analytics
   Deployment of service analytics complete
   Deploying service saas
   Deployment of service saas complete
   Deploying service federation
   Deployment of service federation complete
   Deploying service authcontrol
   Deployment of service authcontrol complete
   Deploying service greenbox
   Deployment of service greenbox complete
   Deploying service ws1notifications
   Deployment of service ws1notifications complete
   Deploying service ws1ntfmanager
   Deployment of service ws1ntfmanager complete
   Deploying service skycap
   Deployment of service skycap complete
   Deploying service cas
   Deployment of service cas complete
   Deploying service certproxy
   Deployment of service certproxy complete
   Deploying service commchannel
   Deployment of service commchannel complete
   Deploying service launcher
   Deployment of service launcher complete
   Deploying service ws1admin
   Deployment of service ws1admin complete
   Deploying service hubconsole
   Deployment of service hubconsole complete
   Deploying service mpsso
   Deployment of service mpsso complete
   Deploying service usergroup
   Deployment of service usergroup complete
   Deploying service nginx-stream
   Deployment of service nginx-stream complete
   All services deployed successfully
   

6. Execute o seguinte comando para verificar a prontidão do serviço.

   wso access check-service-readiness
   
   # OUTPUT
   {
     "cds": "READY",
     "acs": "READY",
     "saas": "READY",
     "crypto": "READY",
     "token": "READY",
     "ws1notifications": "READY",
     "ws1ntfmanager": "READY",
     "federation": "READY",
     "analytics": "READY",
     "authcontrol": "READY",
     "skycap": "READY",
     "greenbox": "READY",
     "cas": "READY",
     "certproxy": "READY",
     "commchannel": "READY",
     "ws1admin": "READY",
     "mpsso": "READY",
     "hubconsole": "READY",
     "usergroup": "READY",
     "launcher": "READY"
   }
   

7. Certifique-se de que o status de cada serviço esteja em um estado de READY.

   Se qualquer serviço estiver em um estado de NOT_READY, você não poderá prosseguir para a próxima fase. Solucione os problemas e corrija-os.

   Para ver as etapas de solução de problemas, consulte Um serviço está em um estado não pronto.