Deploy the Omnissa Access and Infrastructure Services

The procedure that follows deploys the Omnissa Access and infrastructure services.

Update the access-profile.yml File

This file contains:

• Cluster nodes
• FQDN
• Certificates
• Tenant configuration

Procedure:

1. Open the access-profile.yml file. For example:

   vi /opt/wss/<cluster_name>/access/access-profile.yml
   

2. Follow the inline instructions below to update the access-profile.yml file.

   Note: The <LOAD_BALANCER_IP> placeholder used in the instructions that follow must be the IP address of the load balancer or reverse proxy you deployed in Using a Load Balancer or Reverse Proxy to Enable External Access to Omnissa Access.

   
   fqdn:
     # Domain Name i.e: if you are going to access your tenant as tenant1.example.com, your FQDN.name should be example.com
     name: example.com
     # Port associated with FQDN
     port: 443
     # IP associated with FQDN
     # tenant_name.fqdn.name should resolve to this IP, i.e: if tenant_name=tenant1 and fqdn.name=example.com, tenant1.example.com should resolve to this IP
     ip: <LOAD_BALANCER_IP>
   
   server_certificate:
     # If you need to use self-signed FQDN/LB certificate, set is_self_signed: true, else provide path to your custom certificate and key.
     is_self_signed: false
     # [Required when is_self_signed is false] Custom cert file path.
     # Place your certificate at /opt/wss/<cluster_name>/access/certs/custom_cert.pem
     custom_cert_file: /opt/wss/<cluster_name>/access/certs/custom_cert.pem
     # [Required when is_self_signed is false] Custom key file path.
     # Place your key at /opt/wss/<cluster_name>/access/certs/custom_cert_key.pem
     custom_cert_keyfile: /opt/wss/<cluster_name>/access/certs/custom_cert_key.pem
   
   first_tenant:
     # tenant_name is mandatory for all on-premises customers. All other fields are mandatory.
     tenant_name: <YOUR_TENANT_NAME>
     admin_user_name: <TENANT_ADMIN_NAME>
     admin_email: <TENANT_ADMIN_EMAIL>
     admin_first_name: <TENANT_ADMIN_FIRST_NAME>
     admin_last_name: <TENANT_ADMIN_LAST_NAME>
   
   cert_proxy:
     enabled: true
     # certificate type - FQDN_CERT or CUSTOM_CERT
     ssl_certificate_type: CUSTOM_CERT
     # [Optional] ssl_certificate_path and ssl_certificate_key mandatory if ssl_certificate_type is CUSTOM_CERT
     # SSL certificate and key must be placed at /opt/wss/<cluster_name>/access/certs/ and referenced with the full path i.e: /opt/wss/<cluster_name>/access/certs/custom_cert_proxy_cert.pem
     ssl_certificate_path: /opt/wss/<cluster_name>/access/certs/custom_cert_proxy_cert.pem
     ssl_certificate_key: /opt/wss/<cluster_name>/access/certs/custom_cert_proxy_key.pem
   
   # All IPs between client and access instances, including cluster node IPs (excluding bootstrap), need to be added to this list
   # There should be minimum of 1 IP(LB) in case load balanced access setup, if there are proxies in between your client and access LB, all proxies need to be added to this list
   # Example: ["10.0.0.x", "10.0.0.x", "10.0.0.x"]
   ip_ignore_list_for_xff_header: ["<LOAD_BALANCER_IP>", "<PROXY_IP>", "<ACCESS_NODES>"]
   
   smtp:
     enabled: true
     # [Required when enabled is true]
     host: smtp.example.com
     port: 587
     user: smtp-user@example.com
     # [Required when enabled is true] Supported value -> STARTTLS or SSL_TLS
     security_type: STARTTLS
   

3. After updating the access-profile.yml file, run the bootstrap. For example:

   cd /opt/wss/<cluster_name>
   wso access bootstrap
   
   # Output
   creating secret engine
   creating secret engine
   creating secret engine
   Successfully synced all KV's to consul
   Successfully synced all secrets
   

   Result: This step loads the configuration into Vault and Consul.

4. Before deploying, take a snapshot of every virtual machine in the cluster.

   Taking snapshots at this point is recommended so you can revert to the snapshots if the deployment fails.

5. Run the following commands to deploy the services in the background, monitor the deployment from a different terminal window, and, optionally, add -v to the deploy command for more verbose output.

   Note: The deployment continues even if the terminal or SSH session is closed, and takes around 40 minutes.

   nohup wso services deploy --type full &
   
   # OUTPUT
   [1] XXXX 
   nohup: ignoring input and appending output to 'nohup.out'
   
   # Optionally, use this alternative command instead for more verbose output:
   # nohup wso services deploy --type full -v &
   
   # Press Enter, then from a different terminal window on the same machine, monitor the deployment with the following commands: 
   
   cd /opt/wss/<cluster_name>
   tail -f nohup.out
   
   # OUTPUT
   Cleaning up
   Cleans up the docker subsystem on nodes (unused images)
   Generating environment file with cluster details and secret tokens
   Verify that CA is present in trust bundle on all nodes
   <timestamp> Using additional env vars /opt/wss/<cluster_name>/additional_env_vars.env
   Deploying service control-plane-logging
   Deployment of service control-plane-logging complete
   Deploying service telegraf-statsd
   Deployment of service telegraf-statsd complete
   Deploying service telegraf-asset-server
   Deployment of service telegraf-asset-server complete
   Deploying service ingress
   Deployment of service ingress complete
   Deploying service ingress-gateway-route-reloader
   Deployment of service ingress-gateway-route-reloader complete
   Deploying service control-plane-backup
   Deployment of service control-plane-backup complete
   Deploying service client-side-load-balancer
   Deployment of service client-side-load-balancer complete
   Deploying service telegraf-uptime
   Deployment of service telegraf-uptime complete
   Deploying service cp-ops-dispatch
   Deployment of service cp-ops-dispatch complete
   Deploying service cp-ops-output-processor
   Deployment of service cp-ops-output-processor complete
   Deploying service kafka
   Deployment of service kafka complete
   Deploying service kafka-monitoring
   Deployment of service kafka-monitoring complete
   Deploying service postgres
   Deployment of service postgres complete
   Deploying service postgres-monitoring
   Deployment of service postgres-monitoring complete
   Deploying service pgbouncer
   Deployment of service pgbouncer complete
   Deploying service postgres-backup
   Deployment of service postgres-backup complete
   Deploying service postgres-diff-backup
   Deployment of service postgres-diff-backup complete
   Deploying service postgres-operations
   Deployment of service postgres-operations complete
   Deploying service postgres-operations-vacuum
   Deployment of service postgres-operations-vacuum complete
   Deploying service redis
   Deployment of service redis complete
   Deploying service redis-monitoring
   Deployment of service redis-monitoring complete
   Deploying service opensearch
   Deployment of service opensearch complete
   Deploying service coredns
   Deployment of service coredns complete
   Deploying service nginx-http
   Deployment of service nginx-http complete
   Deploying service acs
   Deployment of service acs complete
   Deploying service crypto
   Deployment of service crypto complete
   Deploying service cds
   Deployment of service cds complete
   Deploying service token
   Deployment of service token complete
   Deploying service analytics
   Deployment of service analytics complete
   Deploying service saas
   Deployment of service saas complete
   Deploying service federation
   Deployment of service federation complete
   Deploying service authcontrol
   Deployment of service authcontrol complete
   Deploying service greenbox
   Deployment of service greenbox complete
   Deploying service ws1notifications
   Deployment of service ws1notifications complete
   Deploying service ws1ntfmanager
   Deployment of service ws1ntfmanager complete
   Deploying service skycap
   Deployment of service skycap complete
   Deploying service cas
   Deployment of service cas complete
   Deploying service certproxy
   Deployment of service certproxy complete
   Deploying service commchannel
   Deployment of service commchannel complete
   Deploying service launcher
   Deployment of service launcher complete
   Deploying service ws1admin
   Deployment of service ws1admin complete
   Deploying service hubconsole
   Deployment of service hubconsole complete
   Deploying service mpsso
   Deployment of service mpsso complete
   Deploying service usergroup
   Deployment of service usergroup complete
   Deploying service nginx-stream
   Deployment of service nginx-stream complete
   All services deployed successfully
   

6. Run the following command to check the readiness of the service.

   wso access check-service-readiness
   
   # OUTPUT
   {
     "cds": "READY",
     "acs": "READY",
     "saas": "READY",
     "crypto": "READY",
     "token": "READY",
     "ws1notifications": "READY",
     "ws1ntfmanager": "READY",
     "federation": "READY",
     "analytics": "READY",
     "authcontrol": "READY",
     "skycap": "READY",
     "greenbox": "READY",
     "cas": "READY",
     "certproxy": "READY",
     "commchannel": "READY",
     "ws1admin": "READY",
     "mpsso": "READY",
     "hubconsole": "READY",
     "usergroup": "READY",
     "launcher": "READY"
   }
   

7. Ensure that the status of each service is in a READY state.

   If any service is in a NOT_READY state, you cannot proceed to the next phase. Troubleshoot and rectify.

   For troubleshooting steps, see A Service is in a Not Ready State.