以下过程将部署 Omnissa Access 和基础架构服务。
更新 access-profile.yml 文件
此文件包含：
- 集群节点
- FQDN
- 证书
- 租户配置
过程：
-
打开
access-profile.yml文件。例如：vi /root/<cluster_name>/access/access-profile.yml -
按照以下内嵌说明，更新
access-profile.yml文件。fqdn: # Domain Name i.e: if you are going to access your tenant as tenant1.example.com, your FQDN.name should be example.com name: example.com # Port associated with FQDN port: 443 # IP associated with FQDN # tenant_name.fqdn.name should resolve to this IP, i.e: if tenant_name=tenant1 and fqdn.name=example.com, tenant1.example.com should resolve to this IP ip: <LOAD_BALANCER_IP> server_certificate: # If you need to use self-signed FQDN/LB certificate, set is_self_signed: true, else provide path to your custom certificate and key. is_self_signed: false # [Required when is_self_signed is false] Custom cert file path. # Place your certificate at /root/<cluster-name>/access/certs/custom_cert.pem custom_cert_file: /root/<cluster-name>/access/certs/custom_cert.pem # [Required when is_self_signed is false] Custom key file path. # Place your key at /root/<cluster-name>/access/certs/custom_cert_key.pem custom_cert_keyfile: /root/<cluster-name>/access/certs/custom_cert_key.pem first_tenant: # tenant_name is mandatory for all Onprem customers. All other fields are mandatory. tenant_name: <YOUR_TENANT_NAME> admin_user_name: <TENANT_ADMIN_NAME> admin_email: <TENANT_ADMIN_EMAIL> admin_first_name: <TENANT_ADMIN_FIRST_NAME> admin_last_name: <TENANT_ADMIN_LAST_NAME> cert_proxy: enabled: true # certificate type - FQDN_CERT or CUSTOM_CERT ssl_certificate_type: CUSTOM_CERT # [Optional] ssl_certificate_path and ssl_certificate_key mandatory if ssl_certificate_type is CUSTOM_CERT # SSL certificate and key must be placed at /root/<cluster-name>/access/certs/ and referenced with the full path i.e: /root/<cluster-name>/access/certs/custom_cert_proxy_cert.pem ssl_certificate_path: /root/<cluster-name>/access/certs/custom_cert_proxy_cert.pem ssl_certificate_key: /root/<cluster-name>/access/certs/custom_cert_proxy_key.pem # All IPs between client and access instances, including cluster node IPs (excluding bootstrap), need to be added to this list # There should be minimum of 1 IP(LB) in case load balanced access setup, if there are proxies in between your client and access LB, all proxies need to be added to this list # Example: ["10.0.0.x", "10.0.0.x", "10.0.0.x"] ip_ignore_list_for_xff_header: ["<LOAD_BALANCER_IP>", "<PROXY_IP>", "<ACCESS_NODES>"] smtp: enabled: true # [Required when enabled is true] host: smtp.example.com port: 587 user: smtp-user@example.com # [Required when enabled is true] Supported value -> STARTTLS or SSL_TLS security_type: STARTTLS -
更新
access-profile.yml文件后，运行引导程序。例如：cd /root/<cluster_name> wso access bootstrap # Output creating secret engine creating secret engine creating secret engine Successfully synced all KV's to consul Successfully synced all secrets**结果：**此步骤会将配置加载到 Vault 和 Consul 中。
-
根据要在后台还是前台运行部署，运行相应的命令以部署服务。例如：
-
在后台运行部署，即使终端或 SSH 会话关闭也会继续。建议用于长时间运行的部署。
nohup wso services deploy --type full & ## This will take time to deploy around 40 min # OUTPUT [1] 108485 nohup: ignoring input and appending output to 'nohup.out' -
在前台运行部署并启用详细日志记录，从而在终端中显示详细进度和调试信息。建议用于实时监控部署并进行故障排除。
wso services deploy --type full -v ## This will take time to deploy around 40 min # OUTPUT [1] 108485 nohup: ignoring input and appending output to 'nohup.out'
-
-
按照以下内嵌说明，监控部署。
# log in to the same machine from a different terminal window to check logs cd /root/<cluster_name> tail -f nohup.out # OUTPUT Cleaning up Cleans up the docker subsystem on nodes (unused images) Generating environment file with cluster details and secret tokens Verify that CA is present in trust bundle on all nodes <timestamp> Using additional env vars /root/<cluster_name>/additional_env_vars.env Deploying service control-plane-logging Deployment of service control-plane-logging complete Deploying service telegraf-statsd Deployment of service telegraf-statsd complete Deploying service telegraf-asset-server Deployment of service telegraf-asset-server complete Deploying service ingress Deployment of service ingress complete Deploying service ingress-gateway-route-reloader Deployment of service ingress-gateway-route-reloader complete Deploying service control-plane-backup Deployment of service control-plane-backup complete Deploying service client-side-load-balancer Deployment of service client-side-load-balancer complete Deploying service telegraf-uptime Deployment of service telegraf-uptime complete Deploying service cp-ops-dispatch Deployment of service cp-ops-dispatch complete Deploying service cp-ops-output-processor Deployment of service cp-ops-output-processor complete Deploying service kafka Deployment of service kafka complete Deploying service kafka-monitoring Deployment of service kafka-monitoring complete Deploying service postgres Deployment of service postgres complete Deploying service postgres-monitoring Deployment of service postgres-monitoring complete Deploying service pgbouncer Deployment of service pgbouncer complete Deploying service postgres-backup Deployment of service postgres-backup complete Deploying service postgres-diff-backup Deployment of service postgres-diff-backup complete Deploying service postgres-operations Deployment of service postgres-operations complete Deploying service postgres-operations-vacuum Deployment of service postgres-operations-vacuum complete Deploying service redis Deployment of service redis complete Deploying service redis-monitoring Deployment of service redis-monitoring complete Deploying service opensearch Deployment of service opensearch complete Deploying service coredns Deployment of service coredns complete Deploying service nginx-http Deployment of service nginx-http complete Deploying service acs Deployment of service acs complete Deploying service crypto Deployment of service crypto complete Deploying service cds Deployment of service cds complete Deploying service token Deployment of service token complete Deploying service analytics Deployment of service analytics complete Deploying service saas Deployment of service saas complete Deploying service federation Deployment of service federation complete Deploying service authcontrol Deployment of service authcontrol complete Deploying service greenbox Deployment of service greenbox complete Deploying service ws1notifications Deployment of service ws1notifications complete Deploying service ws1ntfmanager Deployment of service ws1ntfmanager complete Deploying service skycap Deployment of service skycap complete Deploying service cas Deployment of service cas complete Deploying service certproxy Deployment of service certproxy complete Deploying service commchannel Deployment of service commchannel complete Deploying service launcher Deployment of service launcher complete Deploying service ws1admin Deployment of service ws1admin complete Deploying service hubconsole Deployment of service hubconsole complete Deploying service mpsso Deployment of service mpsso complete Deploying service usergroup Deployment of service usergroup complete Deploying service nginx-stream Deployment of service nginx-stream complete -
运行以下命令以检查服务的就绪状态。
wso access check-service-readiness # OUTPUT { "cds": "READY", "acs": "READY", "saas": "READY", "crypto": "READY", "token": "READY", "ws1notifications": "READY", "ws1ntfmanager": "READY", "federation": "READY", "analytics": "READY", "authcontrol": "READY", "skycap": "READY", "greenbox": "READY", "cas": "READY", "certproxy": "READY", "commchannel": "READY", "ws1admin": "READY", "mpsso": "READY", "hubconsole": "READY", "usergroup": "READY", "launcher": "READY" } -
确保每项服务都处于
READY状态。如果任何服务处于NOT_READY状态，则无法继续下一阶段。应进行故障排除和纠正。
此页面对您有帮助吗?