Deploying the Omnissa Access and Infrastructure Services

The procedure that follows deploys the Omnissa Access and infrastructure services.

Update the access-profile.yml File

This file contains:

• Cluster nodes
• FQDN
• Certificates
• Tenant configuration

Procedure:

1. Open the access-profile.yml file. For example:

   vi /opt/wss/<cluster_name>/access/access-profile.yml
   

2. Follow the inline instructions below to update the access-profile.yml file.

   Note: The <LOAD_BALANCER_IP> placeholder used in the instructions that follow must be the IP address of the load balancer or reverse proxy you deployed in Using a Load Balancer or Reverse Proxy to Enable External Access to Omnissa Access.

   fqdn:
     # Domain name. Tenant is reached at <tenant_name>.<fqdn.name>
     name: 'tenant.domain.tld'
     port: 443
     ip: '10.0.0.1'
   
   server_certificate:
     is_self_signed: true
   
   first_tenant:
     tenant_name: 'tenant1'
     admin_user_name: 'admin'
     admin_email: 'admin@domain.tld'
     admin_first_name: 'Admin'
     admin_last_name: 'User'
   
   cert_proxy:
     enabled: true
     ssl_certificate_type: FQDN_CERT
   
   # XFF trusted hops: LB, Access nodes, additional proxies. Bootstrap/Infra excluded.
   ip_ignore_list_for_xff_header: ["10.0.0.1", "10.0.0.2", "10.0.0.3"]
   
   smtp:
     enabled: false
   

3. After updating the access-profile.yml file, run the bootstrap. For example:

   cd /opt/wss/<cluster_name>
   wso access bootstrap
   
   # Output
   creating secret engine
   creating secret engine
   creating secret engine
   Successfully synced all KV's to consul
   Successfully synced all secrets
   

   Result: This step loads the configuration into Vault and Consul.

4. If you are using a proxy, the following steps are required for configuration. Otherwise, this step can be ignored.

   Parameters:

   • Required: --proxy_host and --proxy_port
   • Optional: --non_proxy_host
   • Authenticated also needs: --proxy_user and --proxy_password

   # Dry-run connectivity (nothing persisted)
   wso access proxy test unauthenticated
   wso access proxy test authenticated
   
   # Persist config (Consul KV + Vault for auth credentials)
   wso access proxy configure unauthenticated
   wso access proxy configure authenticated
   
   # Show what is stored
   wso access proxy get
   

5. Run the following commands to deploy the services in the background, monitor the deployment from a different terminal window, and, optionally, add -v to the deploy command for more verbose output.

   Note: The deployment continues even if the terminal or SSH session is closed, and takes around 40 minutes.

   nohup wso services deploy --type full &
   
   # OUTPUT
   [1] XXXX 
   nohup: ignoring input and appending output to 'nohup.out'
   
   # Optionally, use this alternative command instead for more verbose output:
   # nohup wso services deploy --type full -v &
   
   # Press Enter, then from a different terminal window on the same machine, monitor the deployment with the following commands: 
   
   cd /opt/wss/<cluster_name>
   tail -f nohup.out
   
   # OUTPUT
   Cleaning up
   Cleans up the docker subsystem on nodes (unused images)
   Generating environment file with cluster details and secret tokens
   Verify that CA is present in trust bundle on all nodes
   <timestamp> Using additional env vars /opt/wss/<cluster_name>/additional_env_vars.env
   Deploying service control-plane-logging
   Deployment of service control-plane-logging complete
   Deploying service telegraf-statsd
   Deployment of service telegraf-statsd complete
   Deploying service telegraf-asset-server
   Deployment of service telegraf-asset-server complete
   Deploying service ingress
   Deployment of service ingress complete
   Deploying service ingress-gateway-route-reloader
   Deployment of service ingress-gateway-route-reloader complete
   Deploying service control-plane-backup
   Deployment of service control-plane-backup complete
   Deploying service client-side-load-balancer
   Deployment of service client-side-load-balancer complete
   Deploying service telegraf-uptime
   Deployment of service telegraf-uptime complete
   Deploying service cp-ops-dispatch
   Deployment of service cp-ops-dispatch complete
   Deploying service cp-ops-output-processor
   Deployment of service cp-ops-output-processor complete
   Deploying service kafka
   Deployment of service kafka complete
   Deploying service kafka-monitoring
   Deployment of service kafka-monitoring complete
   Deploying service postgres
   Deployment of service postgres complete
   Deploying service postgres-monitoring
   Deployment of service postgres-monitoring complete
   Deploying service pgbouncer
   Deployment of service pgbouncer complete
   Deploying service postgres-backup
   Deployment of service postgres-backup complete
   Deploying service postgres-diff-backup
   Deployment of service postgres-diff-backup complete
   Deploying service postgres-operations
   Deployment of service postgres-operations complete
   Deploying service postgres-operations-vacuum
   Deployment of service postgres-operations-vacuum complete
   Deploying service redis
   Deployment of service redis complete
   Deploying service redis-monitoring
   Deployment of service redis-monitoring complete
   Deploying service opensearch
   Deployment of service opensearch complete
   Deploying service coredns
   Deployment of service coredns complete
   Deploying service nginx-http
   Deployment of service nginx-http complete
   Deploying service acs
   Deployment of service acs complete
   Deploying service crypto
   Deployment of service crypto complete
   Deploying service cds
   Deployment of service cds complete
   Deploying service token
   Deployment of service token complete
   Deploying service analytics
   Deployment of service analytics complete
   Deploying service saas
   Deployment of service saas complete
   Deploying service federation
   Deployment of service federation complete
   Deploying service authcontrol
   Deployment of service authcontrol complete
   Deploying service greenbox
   Deployment of service greenbox complete
   Deploying service ws1notifications
   Deployment of service ws1notifications complete
   Deploying service ws1ntfmanager
   Deployment of service ws1ntfmanager complete
   Deploying service skycap
   Deployment of service skycap complete
   Deploying service cas
   Deployment of service cas complete
   Deploying service certproxy
   Deployment of service certproxy complete
   Deploying service commchannel
   Deployment of service commchannel complete
   Deploying service launcher
   Deployment of service launcher complete
   Deploying service ws1admin
   Deployment of service ws1admin complete
   Deploying service hubconsole
   Deployment of service hubconsole complete
   Deploying service mpsso
   Deployment of service mpsso complete
   Deploying service usergroup
   Deployment of service usergroup complete
   Deploying service nginx-stream
   Deployment of service nginx-stream complete
   All services deployed successfully
   

6. Run the following command to check the readiness of the service.

   wso access check-service-readiness
   
   # OUTPUT
   {
     "cds": "READY",
     "acs": "READY",
     "saas": "READY",
     "crypto": "READY",
     "token": "READY",
     "ws1notifications": "READY",
     "ws1ntfmanager": "READY",
     "federation": "READY",
     "analytics": "READY",
     "authcontrol": "READY",
     "skycap": "READY",
     "greenbox": "READY",
     "cas": "READY",
     "certproxy": "READY",
     "commchannel": "READY",
     "ws1admin": "READY",
     "mpsso": "READY",
     "hubconsole": "READY",
     "usergroup": "READY",
     "launcher": "READY"
   }
   

7. Ensure that the status of each service is in a READY state.

   If any service is in a NOT_READY state, you cannot proceed to the next phase. Troubleshoot and rectify.

   For troubleshooting steps, see A Service is in a Not Ready State.