从此版本开始，access-wizard 会通过单个引导式命令，自动执行引导节点设置、控制平面初始化、控制平面部署、Access 服务和基础架构服务部署以及租户创建步骤。向导会提出一组简短的问题，为您编写配置文件，然后按顺序运行各部署阶段。如果您希望单独执行这些步骤，请参阅手动部署 Omnissa Access。
**注意：**Access Wizard 26.07 支持 Omnissa Access 26.07.0.0 的绿场部署。更新现有部署和部署更高版本不在此版本的支持范围内。
如果您已准备好所需的 IP 地址、证书和其他信息，则回答问卷只需要几分钟时间。随后的自动化部署大约需要 1.5 到 2 个小时。
准备工作
在开始之前，请确认以下几项：
- 阶段 1 - 准备虚拟机以安装 Omnissa Access 和阶段 2 - 部署虚拟机以安装 Omnissa Access 中的引导虚拟机、基础架构虚拟机和 Omnissa Access 虚拟机已部署并打开电源。
- 已按照使用负载均衡器或反向代理启用对 Omnissa Access 的外部访问中所述配置了负载均衡器，且启用了 X-Forwarded-For 标头并侦听端口 443。
- 租户 FQDN（例如
tenant.example.com）的 DNS 解析为负载均衡器 IP 地址。 - 您具有在 OVA 部署期间在每个节点上设置的
configuser密码。如果该密码已过期或需要重置，请参阅管理 Omnissa Access Control Plane 集群节点。 - 您已准备好 TLS 证书，可以是自签名证书（向导可以为您生成一个证书），也可以是来自您自己的 CA 的完整链 PEM 证书和匹配的未加密私钥。
注意：
- 向导会验证引导节点上的磁盘空间和 Docker 存储，并检查与其他每个节点的 SSH 连接和身份验证。它不会单独验证远程节点的 CPU、RAM 或磁盘大小；在开始之前，请根据阶段 1 - 准备虚拟机以安装 Omnissa Access 中的大小调整表进行确认。
- Access Wizard RPM 已进行数字签名。验证签名（请参阅下面的信任签名密钥和验证 RPM）是一项独立的检查，与下一部分中的 SHA-256 校验和验证不同 — 校验和只确认下载文件没有损坏，而不能确认它确实来自 Omnissa。
下载并验证 Access Wizard
过程：
-
登录到 Omnissa Customer Connect 并下载：
- Omnissa Access 资产包（包含控制平面清单和容器映像的 ZIP 文件）。
- Access Wizard RPM 包 — 包含以下三项的 ZIP 文件：RPM (
access-wizard-26.07.noarch.rpm)、其.sha256校验和文件以及 Omnissa RPM 签名公钥 (omnissa-linux-rpm-gpg-key.pub)。
-
在本地计算机上解压缩 RPM 包（或在将其复制到引导节点后进行解压缩 — 请参阅下一部分）：
unzip <wizard-bundle>.zip -
根据 RPM 包中包含的
.sha256文件验证 RPM，并根据已发布的校验和验证资产包：sha256sum -c access-wizard-26.07.noarch.rpm.sha256 sha256sum <asset-bundle>.zip如果任一值不匹配，请不要继续操作。
将文件上载到引导节点
过程：
-
将两个 zip 文件复制到引导节点：
scp <wizard-bundle>.zip <asset-bundle>.zip \ configuser@<bootstrap-ip>:/home/configuser/ -
以
configuser身份连接到引导节点，然后解压缩 RPM 包：ssh configuser@<bootstrap-ip> unzip <wizard-bundle>.zip在此过程的其余部分，请保持以
configuser身份登录。所有后续命令均显式使用sudo。
信任签名密钥并验证 RPM
过程：
-
导入 Omnissa RPM 签名公钥（从解压缩 RPM 包的目录运行）：
sudo rpm --import omnissa-linux-rpm-gpg-key.pub -
验证 RPM 签名和完整性：
sudo rpm -K access-wizard-26.07.noarch.rpm输出必须指示有效的摘要和签名。如果验证失败，请不要安装 RPM。
安装 RPM
过程：
sudo dnf install -y access-wizard-26.07.noarch.rpm
安装的软件包标识为 access-wizard-26.07-1.noarch。
确认安装
过程：
sudo access-wizard --version
预期输出：
access-wizard 26.07
启动引导式部署
过程：
sudo access-wizard deploy --asset-bundle /<path>/<asset-bundle>.zip
向导会显示一个欢迎屏幕，其中列出了六个问卷部分（“基本信息”、“租户”、“基础架构节点”、“Access 节点”、“证书”、“可选服务”），然后会提示您按 Enter 以开始。
● OMNISSA ACCESS — Deployment Wizard
Official documentation
• Release Notes
- https://docs.omnissa.com/bundle/workspace-one-access-release-notesV26.07/page/workspace-one-access-release-notes.html
• Install Omnissa Access
- https://docs.omnissa.com/bundle/workspace-one-access-installation-guideV26.07/page/InstallingOmnissaAccess.html
• Deploy Access & Infrastructure
- https://docs.omnissa.com/bundle/workspace-one-access-installation-guideV26.07/page/DeploytheOmnissaAccessandInfrastructureServices.html
View or copy all official documentation URLs: sudo access-wizard docs
-------------------------------------------------------------
Omnissa Access - guided deployment
-------------------------------------------------------------
This wizard asks what it needs, writes your config files, and runs
the deployment in the right order. If a step doesn't validate, it
stops and tells you what to look at rather than pressing on.
There are 6 sections of questions.
The deployment itself takes about two hours. If your connection
drops during it, reconnect and run:
sudo access-wizard resume
It continues from the last completed deployment stage without asking the
questionnaire again.
1. Basic information
2. Tenant
3. Infrastructure nodes
4. Access nodes
5. Certificates
6. Optional services
Press Enter to begin.
第 1 部分：基本信息
-
查看位于
https://www.omnissa.com/general-terms/的 EULA，然后接受相应条款。============================================================= Section 1 of 6: Basic information ============================================================= ------------------------------------------------------------- License agreement ------------------------------------------------------------- Before anything else, please read and accept the end user license agreement. Review it at https://www.omnissa.com/general-terms/ Do you agree to these terms? [Y/n]: EULA accepted <acceptance-timestamp> -
确认向导自动找到的资产包。向导会根据已发布的校验和验证其完整性。
------------------------------------------------------------- Asset bundle verification ------------------------------------------------------------- ✓ Asset integrity <verification-detail> -
选择集群名称。这会确定工作目录路径
/opt/wss/<cluster_name>。------------------------------------------------------------- Cluster ------------------------------------------------------------- Choose a short name for this deployment. The wizard creates /opt/wss/<cluster_name>. This becomes the working directory for future WSO administration and maintenance commands. What would you like to call this cluster?: <cluster_name> Working directory will be /opt/wss/<cluster_name> Your answers are saved to /opt/wss/<cluster_name>/wizard.ini -
选择部署规模 — 小型、中型或大型。向导会显示每个选项的节点拓扑。
What size deployment is this? Every deployment uses 3 Infrastructure nodes. The number of Access nodes and supported scale depend on the deployment size. 1) Small 2 Access nodes 300,000 users 3,000 groups 50 apps 2) Medium 2 Access nodes 1,000,000 users 10,000 groups 150 apps 3) Large 3 Access nodes 1,000,000 users 20,000 groups 500 apps Choose 1-3: 1 ✓ Deployment size Small Topology: 3 Infrastructure + 2 Access nodes -
确认检测到的引导节点 IP 地址。
------------------------------------------------------------- This node ------------------------------------------------------------- This looks like the Bootstrap node, with IP address <bootstrap-ip>. Is that right? [Y/n]: Y -
输入共享的
configuser密码。向导会立即在引导节点上验证该密码。如果需要重置该密码，请参阅管理 Omnissa Access Control Plane 集群节点。------------------------------------------------------------- Credentials ------------------------------------------------------------- The credentials the cluster uses to reach every node. This is the configuser password you already set when you deployed the OVA. Not a new one. It must be the same on every node. Enter the configuser password:******** Enter it again to confirm:******** Validating configuser authentication on Bootstrap (<bootstrap-ip>)... configuser password validated against Bootstrap. -
选择集群在其他节点上进行身份验证的方式：使用您刚刚输入的密码，或使用生成的 SSH 密钥对。
-
密码
How should the cluster authenticate to the Infrastructure and Access nodes? 1) password use the password you just entered 2) ssh_key generate a key and copy it to every node Choose 1-2: 1 -
ssh_key
How should the cluster authenticate to the Infrastructure and Access nodes? 1) password use the password you just entered 2) ssh_key generate a key and copy it to every node Choose 1-2: 2
-
-
输入负载均衡器 IP 地址，以及 X-Forwarded-For IP 地址（如果适用于您的部署）。向导会检查端口 443 连接。
------------------------------------------------------------- Load balancer ------------------------------------------------------------- The load balancer sits in front of your Access nodes. It should already be configured with X-Forwarded-For headers enabled. You'll add the Access nodes as upstreams once they're deployed. What is the load balancer IP address: <load-balancer-ip> Checking... Load balancer <load-balancer-ip> port 443 reachable ------------------------------------------------------------- X-Forwarded-For trusted proxies ------------------------------------------------------------- The load balancer and Access node IPs are included automatically. Enter only additional trusted proxy, WAF, CDN, or other forwarding-hop IPs. Do you need to add any additional IPs for X-Forwarded-For? [y/N]: y Additional trusted IP: <trusted-proxy-ip> Added <trusted-proxy-ip> Add another trusted IP? [y/N]: n Section 1 complete.
第 2 部分：租户
输入租户前缀和基本域 — 用户通过 https://<tenant-name>.<base-domain> 访问部署。向导会检查 FQDN 是否解析为负载均衡器 IP，然后要求提供租户管理员的用户名（默认为 admin）、名字、姓氏和电子邮件地址。
=============================================================
Section 2 of 6: Tenant
=============================================================
Now configure the tenant your users will sign in to.
Load Balancer URL: https://tenant.acme.example.com
Tenant: tenant
Base domain: acme.example.com
What should the tenant be called: <tenant-name>
What is the base domain: <base-domain>
Users will reach this deployment at:
https://<tenant-name>.<base-domain>
Checking DNS...
<tenant-name>.<base-domain> resolves to <load-balancer-ip>
Matches the load balancer.
-------------------------------------------------------------
Tenant administrator
-------------------------------------------------------------
The first administrator account for this tenant.
What should the administrator's username be? [admin]: admin
Administrator's first name: <first-name>
Administrator's last name: <last-name>
Administrator's email address: <administrator-email>
Section 2 complete.
第 3 部分：基础架构节点
输入 3 个基础架构节点中每个节点的 IP 地址。在您输入每个节点时，向导会检查 SSH 可访问性，并在节点上进行身份验证。重复的地址会被拒绝。
=============================================================
Section 3 of 6: Infrastructure nodes
=============================================================
Every deployment uses 3 Infrastructure/Platform nodes, regardless
of size.
These run the platform services (Vault, Consul, Nomad) and the
shared infrastructure: PostgreSQL, Redis, Kafka, and OpenSearch.
What is the IP address of Infrastructure node 1: <infra-ip-1>
What is the IP address of Infrastructure node 2: <infra-ip-2>
What is the IP address of Infrastructure node 3: <infra-ip-3>
Checking SSH reachability and authentication on each Infrastructure node...
✓ Infrastructure node 1 <infra-ip-1> reachable and authenticated
✓ Infrastructure node 2 <infra-ip-2> reachable and authenticated
✓ Infrastructure node 3 <infra-ip-3> reachable and authenticated
All 3 Infrastructure nodes are reachable and authenticated.
Section 3 complete.
第 4 部分：Access 节点
输入每个 Access 节点的 IP 地址（小型或中型部署为 2 个节点，大型部署为 3 个节点）。向导会检查每个节点的可访问性并进行身份验证。
=============================================================
Section 4 of 6: Access nodes
=============================================================
Your small deployment uses 2 Omnissa Access nodes.
These run the Access application services and sit behind your load
balancer. Platform services also run here.
What is the IP address of Access node 1: <access-ip-1>
What is the IP address of Access node 2: <access-ip-2>
Checking SSH reachability and authentication on each Access node...
✓ Access node 1 <access-ip-1> reachable and authenticated
✓ Access node 2 <access-ip-2> reachable and authenticated
All 2 Access nodes are reachable and authenticated.
Section 4 complete.
第 5 部分：证书
选择 Access 用于租户 FQDN 的 TLS 证书：
- 自签名 — 在部署期间自动生成。
- 自定义 — 将您自己的 PEM 证书和私钥上载到引导节点。向导会验证证书链、密钥匹配和租户 FQDN 覆盖范围。
-
自签名
============================================================= Section 5 of 6: Certificates ============================================================= Access needs a TLS certificate for <tenant-name>.<base-domain>. What certificate should Access use? 1) self-signed generated for you during deployment 2) custom your own certificate from a CA Choose 1-2: 1 Section 5 complete. -
自定义
============================================================= Section 5 of 6: Certificates ============================================================= Access needs a TLS certificate for <tenant-name>.<base-domain>. What certificate should Access use? 1) self-signed generated for you during deployment 2) custom your own certificate from a CA Choose 1-2: 2 ------------------------------------------------------------- What you need ------------------------------------------------------------- Two files, both PEM format: Certificate complete chain, with the server certificate first, followed by any intermediate CA certificates; the file starts with -----BEGIN CERTIFICATE----- Private key text file starting with -----BEGIN PRIVATE KEY----- or -----BEGIN RSA PRIVATE KEY----- It must not be encrypted or password protected. The certificate must cover <tenant-name>.<base-domain>, as the Common Name or a Subject Alternative Name. A wildcard (*.<base-domain>) also works. Upload both to this node. From your workstation: scp mycert.pem mykey.pem configuser@<bootstrap-ip>:/home/configuser/omnissa-upload/ I've created /home/configuser/omnissa-upload for you. Where are your certificate files? 1) Already uploaded to this node 2) Not yet, I'll upload now - wait for me 3) Actually, use a self-signed certificate instead Choose 1-3: 1 Checking /home/configuser/omnissa-upload... <mycert>.pem <size> KB certificate <mykey>.pem <size> KB private key Found a certificate and key. Use these? [Y/n]: Y Checking the certificate... Format PEM certificate Covers <tenant-name>.<base-domain> (via wildcard *.<base-domain>) Issued by <Issuer> Valid until <date> (<> days from now) Key match yes Certificate accepted. Both files will be copied into place when deployment starts. Section 5 complete.
第 6 部分：可选服务
四个可选项目：SMTP、NTP、NFS 共享存储，以及适用于 Android 的移动 SSO 的证书代理。在出现任何 [y/N] 提示时回答 n 以推迟配置相应项目。使用 access-wizard configure 完成部署后，可以重新访问所有四个项目。
**注意：**引导节点会验证您输入的 NTP 服务器的 DNS 名称解析。
=============================================================
Section 6 of 6: Optional services
=============================================================
Four optional items. All can be configured later if you'd rather
get the deployment running first.
-------------------------------------------------------------
Email (SMTP)
-------------------------------------------------------------
Access sends email for password resets, notifications, and new
user invitations. Without it, the administrator can still sign in
using the reset link created at the end of this deployment, but no
other user will receive email.
Configure SMTP now? [y/N]: n
-------------------------------------------------------------
Time synchronization (NTP)
-------------------------------------------------------------
Cluster nodes need their clocks in sync. Certificate validation and
token expiry both depend on it, so drift causes authentication
failures that are hard to trace.
Do you have an NTP server? [y/N]: n
-------------------------------------------------------------
Shared storage (NFS)
-------------------------------------------------------------
Optional shared storage for the cluster.
Do you have NFS storage to configure? [y/N]: n
-------------------------------------------------------------
Cert-Proxy (Mobile SSO for Android)
-------------------------------------------------------------
Cert-Proxy enables Mobile SSO for Android devices.
It can be configured later if you skip it now.
Configure Cert-Proxy (Mobile SSO for Android)? [y/N]: y
Which certificate should Cert-Proxy use?
1) Reuse the Load Balancer certificate selected above (recommended)
2) Use a different certificate and private key
Choose 1-2: 1
Section 6 complete.
查看并确认
在所有六个部分之后，向导会显示您的回答的完整摘要。
=============================================================
Ready to deploy
=============================================================
CLUSTER
Name <cluster_name>
Working directory /opt/wss/<cluster_name>
Size small
Bootstrap <bootstrap-ip>
Load balancer <load-balancer-ip>
Credentials configuser (password set)
Authentication SSH key
password used for initial key distribution
Asset bundle <asset-bundle>.zip
EULA <verification-detail>
TENANT
URL https://<tenant-name>.<base-domain>
Username <username>
Administrator <first-name> <last-name>
Email <administrator-email>
INFRASTRUCTURE NODES
Node 1 <infra-ip-1>
Node 2 <infra-ip-2>
Node 3 <infra-ip-3>
ACCESS NODES
Node 1 <access-ip-1>
Node 2 <access-ip-2>
X-FORWARDED-FOR TRUSTED HOPS
Load balancer <load-balancer-ip>
Access nodes <access-ip-1>, <access-ip-2>
Additional trusted IPs <trusted-proxy-ip>
Final trusted list <load-balancer-ip>, <access-ip-1>, <access-ip-2>, <trusted-proxy-ip>
CERTIFICATE
Type custom
Covers <tenant-name>.<base-domain> (via wildcard *.<base-domain>)
Expires <date>
OPTIONAL
Cert-Proxy enabled (FQDN_CERT)
SMTP not configured
NTP not configured
NFS not configured
-------------------------------------------------------------
This takes roughly 1.5 to 2 hours:
Loading images 5 minutes
Control plane deploy 30-60 minutes
Services deploy 40 minutes
Tenant creation 5-10 minutes
You don't need to stay at the terminal. Progress is shown here
and written to /opt/wss/.omnissa-wizard/logs/
At the end you'll get a password reset link for the
administrator account. It expires in 24 hours, so be ready to
copy it.
Everything above has been saved to /opt/wss/<cluster_name>/wizard.ini
If you stop now, nothing has been changed on any node.
-------------------------------------------------------------
Is everything above correct?
1) Yes, continue to validation
2) No, let me change something
3) Exit without deploying
Choose 1-3:
选择 1 可继续进行验证，选择 2 可更改某些内容，或选择 3 可退出而不部署。
Is everything above correct?
1) Yes, continue to validation
2) No, let me change something
3) Exit without deploying
Choose 1-3: 1
然后，向导会显示最终就绪状态摘要，并提示您启动部署。
-------------------------------------------------------------
Deploying
-------------------------------------------------------------
✓ Workflow continuation protected from SSH disconnects
-------------------------------------------------------------
Stage 1 of 7 - Validate prerequisites
-------------------------------------------------------------
Checking this Bootstrap node before making deployment changes.
✓ Root privileges running as root
✓ Required commands all available
✓ Node authentication 6 nodes verified (password)
✓ Bootstrap <bootstrap-ip> AlmaLinux 9.6
✓ Infrastructure 1 <infra-ip-1> AlmaLinux 9.6
✓ Infrastructure 2 <infra-ip-2> AlmaLinux 9.6
✓ Infrastructure 3 <infra-ip-3> AlmaLinux 9.6
✓ Access 1 <access-ip-1> AlmaLinux 9.6
✓ Access 2 <access-ip-2> AlmaLinux 9.6
✓ Node OS validation 6 nodes running AlmaLinux 9.6
✓ Asset bundle located access-26.07-assets.zip
✓ Asset bundle structure manifest and Linux CLI found
✓ Working-directory disk space 132 GB available
✓ Docker storage 44 GB available at /var/lib/docker
✓ Disconnect protection systemd transient services
✓ Cluster node connectivity 5/5 answering on SSH
✓ Load balancer port 443 <load-balancer-ip> reachable
✓ Tenant certificate files certificate and key available
Pre-deployment readiness
✓ Bootstrap authenticated · <boostrap-ip>
✓ Infrastructure nodes 3/3 authenticated
✓ Access nodes 2/2 authenticated
✓ Node addresses unique and validated
✓ Configuration ready for deployment
1) Start deployment
2) Review or change configuration
3) Re-enter the shared configuser password
4) Exit safely
Choose 1-4:
部署阶段
向导会自动运行以下七个阶段。使终端会话保持打开状态以监控进度。
| 阶段 | 名称 | 执行的操作 |
|---|---|---|
| 1 | 验证必备条件 | root 特权、所需命令、节点身份验证、操作系统验证、资产包完整性、磁盘空间、负载均衡器检查 |
| 2 | 准备部署资产 | 工作目录、资产包转储和提取、CLI 安装、容器映像加载 |
| 3 | 初始化集群 | 集群配置、SSH 密钥分发（如果选择）、集群清单、控制平面配置文件 |
| 4 | 验证集群 | 配置预检查、清单验证 |
| 5 | 部署控制平面 | Vault、Consul、Nomad 和平台服务；平台运行状况验证 |
| 6 | 部署 Access 服务 | Access 配置文件、配置同步、所有 Access 应用程序服务、服务就绪网关 |
| 7 | 创建租户 | 租户创建、重置链接切换、SMTP 配置（如果选择） |
-------------------------------------------------------------
Stage 1 of 7 - Validate prerequisites
-------------------------------------------------------------
✓ Root privileges running as root
✓ Required commands all available
✓ Node authentication 6 nodes verified (password)
✓ Node OS validation 6 nodes running <supported-os>
✓ Asset bundle located <asset-bundle>.zip
✓ Asset bundle structure manifest and Linux CLI found
✓ Working-directory disk space <nn> GB available
✓ Docker storage <nn> GB available at <docker-root>
✓ Disconnect protection systemd transient services
✓ Cluster node connectivity 5/5 answering on SSH
✓ Load balancer port 443 <load-balancer-ip> is listening
✓ Tenant certificate self-signed selected
OK All prerequisites passed
-------------------------------------------------------------
Stage 2 of 7 - Prepare deployment assets
-------------------------------------------------------------
✓ Working directory /opt/wss/<cluster_name>
✓ Asset bundle staged ...
✓ Asset bundle extracted ...
✓ WSO CLI installed /usr/bin/wso
✓ EULA acceptance recorded by the CLI
▓ Loading images <elapsed>
✓ Container images loaded and verified
-------------------------------------------------------------
Stage 3 of 7 - Initialize the cluster
-------------------------------------------------------------
✓ Cluster initialization cp-cluster / <size>
✓ Cluster inventory 5 nodes across 12 groups
✓ Control Plane profile generated defaults retained
-------------------------------------------------------------
Stage 4 of 7 - Validate the cluster
-------------------------------------------------------------
• Optional Control Plane precheck skipped
✓ Cluster inventory validated
-------------------------------------------------------------
Stage 5 of 7 - Deploy the Control Plane
-------------------------------------------------------------
▓ Control Plane deployment <elapsed>
✓ Control Plane deployed
✓ Platform health Vault, Consul, and Nomad healthy
-------------------------------------------------------------
Stage 6 of 7 - Deploy Access services
-------------------------------------------------------------
✓ Access profile written
✓ Access configuration synced to Vault and Consul
✓ <service-1> deployed
✓ <service-2> deployed
...
✓ <service-47> deployed
✓ Access services 47/47 · 100%
✓ Service readiness all services READY
-------------------------------------------------------------
Stage 7 of 7 - Create the tenant
-------------------------------------------------------------
▓ Tenant creation <elapsed>
✓ Tenant created successfully
如果连接断开或中断向导
resume 命令会从上次完成的部署阶段继续运行。将跳过已完成且保持有效的工作，并且不会再次请求先前已保存的问卷回答。
- **在问卷中：**按 Ctrl+C，然后运行
resume将还原已保存的回答。 - **监控受保护的部署阶段时：**按 Ctrl+C 将断开终端连接，但不会停止部署。即使 SSH 会话断开连接，受保护的阶段也会继续运行。
要在任一情况下检查进度或继续，请重新连接并运行：
sudo access-wizard status
sudo access-wizard resume
租户创建和完成
在阶段 7 即将结束时，屏幕上会显示一个一次性密码重置链接。**立即复制该链接 — 该链接会在 24 小时后过期，并且不会写入任何日志文件。**保存该链接后键入 CONTINUE。
=============================================================
COPY THIS NOW - the link expires in 24 hours
=============================================================
Login URL https://<tenant-name>.<base-domain>
Username admin
Reset your password at:
<one-time-reset-link>
如果在问卷中配置了 SMTP，Omnissa CLI 此时会安全地提示输入 SMTP 服务帐户密码。
SMTP uses a secure password prompt from the Omnissa CLI.
Enter SMTP Password: ********
✓ SMTP configured
部署完成时，向导会显示完成摘要，其中包含总部署时间、租户 URL、管理员用户名、集群名称和节点计数。如果在问卷中跳过了任何可选项目，则“仍未完成 (Still outstanding)”行将列出稍后要配置的项目。
---------------------------------------------------------------
Deployment complete
---------------------------------------------------------------
✔ All done - total time: <elapsed>
Tenant URL https://<tenant-name>.<base-domain>
Administrator admin
Cluster <cluster_name>
Nodes 3 Infrastructure, 2 Access
Still outstanding:
SMTP is not configured. Run: sudo access-wizard configure
PLATFORM ACCESS
From /opt/wss/<cluster_name>/cp-cluster/cp-cluster.env
Nomad https://<nomad-ip>:4646
Consul https://<consul-ip>:8501
Vault https://<vault-ip>:8202
Administrative tokens are stored in the protected environment file:
/opt/wss/<cluster_name>/cp-cluster/cp-cluster.env (root-only, mode 600)
To display tokens securely:
sudo access-wizard show-tokens
Logs from this run are in: /opt/wss/.omnissa-wizard/logs/
要进行故障排除，可以直接从节点读取相同的值，而不是通过 show-tokens 读取：
sudo cat /opt/wss/<cluster_name>/cp-cluster/cp-cluster.env
部署后
检查状态：
sudo access-wizard status
---------------------------------------------------------------
Progress
---------------------------------------------------------------
Cluster <cluster_name>
Tenant <tenant-name>.<base-domain>
done Prerequisite validation
done Working directory preparation
done Deployment asset preparation
done Workspace ONE configuration
done Cluster initialization
skipped SSH key configuration
done Cluster configuration
done Control Plane profile
skipped Control Plane precheck
done Cluster inventory validation
done Control Plane deployment
done Platform health validation
done Access profile preparation
done Access configuration synchronization
done Access services deployment
done Service readiness
done Tenant creation
done SMTP configuration
All phases complete.
显示平台令牌（部署后不会自动显示 Nomad、Consul、Vault）：
sudo access-wizard show-tokens
需要交互式终端。出现提示时键入 REVEAL。
配置 SMTP、NTP、NFS 或证书代理。access-wizard configure 命令只有在部署完成后才会运行。该命令会一次性遍历所有四个项目，并对每个项目提示 [y/N]。回答 n 以保留设置不变：
[root@ng-bootstrap wss]# access-wizard configure
Full session log: /opt/wss/.omnissa-wizard/logs/session-20260807-220226-configure.log
-------------------------------------------------------------
Optional configuration
-------------------------------------------------------------
Configure the optional settings you need. Answer no to leave a
setting unchanged and continue to the next one.
Configure SMTP? [y/N]: n
Configure NTP? [y/N]: n
Configure NFS? [y/N]: n
Configure Cert-Proxy (Mobile SSO for Android)? [y/N]: n
-------------------------------------------------------------
Configuration complete
-------------------------------------------------------------
SMTP unchanged
NTP unchanged
NFS unchanged
Cert-Proxy unchanged
如果 Omnissa 要求您发送诊断信息，请收集支持包：
sudo access-wizard support-bundle
这会将日志、配置和环境详细信息的已编辑存档写入 /opt/wss/.omnissa-wizard/。在发送之前，请先对其进行检查。
其他命令：access-wizard 还提供 credentials、verify-control-plane、docs 和 deploy --dry-run 选项。运行 access-wizard --help 可了解完整的用法。
如果在部署期间服务失败
如果阶段 6（部署 Access 服务）报告某项服务不正常，请在不重新启动整个部署的情况下恢复该服务：
-
检查哪个阶段或哪项服务停滞：
sudo access-wizard status -
根据显示的状态确定如何继续操作：
-
如果控制平面部署为
running，请不要尝试恢复。应向 Omnissa 技术支持团队提交支持请求单，并附上支持包：sudo access-wizard support-bundle -
如果控制平面部署为
done，并且没有任何具体项目被标记为失败，请使用以下命令恢复：sudo WIZ_CP_REDEPLOY=yes access-wizard resume该命令会从运行状况验证开始，然后处理 Access 配置文件，最后处理 Access 服务。
-
如果控制平面部署为
done，并且状态输出指向特定的失败 Access 服务（报告为 X/47），请先解决该服务：-
打开 Nomad UI，找到失败的作业，然后将其清除（停止并移除，而不仅仅是重新启动）。
-
从引导节点的集群工作目录中仅重新部署那一项服务：
cd /opt/wss/<cluster_name> wso services deploy -s <service-name>**注意：**仅部署在执行自动化流程期间失败的服务。
-
成功重新部署该服务后，恢复向导：
sudo access-wizard resume
按顺序部署的服务列表：
control-plane-logging host-logging telegraf-statsd telegraf-asset-server ingress ingress-gateway-route-reloader control-plane-backup client-side-load-balancer telegraf-uptime cp-ops-dispatch cp-ops-output-processor kafka kafka-monitoring postgres postgres-monitoring pgbouncer postgres-backup postgres-diff-backup postgres-operations postgres-operations-vacuum redis redis-monitoring opensearch coredns eecache nginx-http acs crypto cds token analytics saas federation authcontrol greenbox ws1notifications ws1ntfmanager skycap cas certproxy commchannel launcher ws1admin hubconsole mpsso nginx-stream usergroup -
-
这适用于服务进入错误状态的任何情况，而不仅仅是在初始部署期间。相同的恢复流程在完成部署之后或升级期间同样适用。
此页面对您有帮助吗?