初始化 Omnissa Access Control Plane 集群

请按照以下过程从引导节点初始化 Omnissa Access Control Plane 集群。所有命令都必须从引导节点运行。

初始化控制平面集群

过程：

• 按照以下内嵌说明，初始化控制平面集群。

  **注意：**请运行以下命令，并根据您部署的 OVA 大小，将 <size_of_your_deployment> 替换为 small、medium 或 large：

  cd /opt/wss/<cluster_name>
  wso access init -n cp-cluster -s <size_of_your_deployment>
  

  运行此命令时，提供的输出会与以下内容类似：

  cd /opt/wss/<cluster_name>
  wso access init -n cp-cluster -s small
  
  # Output
  <timestamp> Control Plane name: cp-cluster
  <timestamp> Created a sample profile.yml file
  <timestamp> Sample Control Plane inventory file created
  <timestamp> Created a sample telemetry config file: /opt/wss/<cluster_name>/telegraf_plugin/prometheus_remote_write.conf.example
  <timestamp> Successfully initialized
  

结果：

此命令会创建以下文件：

• 集群清单文件：/opt/wss/<cluster_name>/cp-cluster/cp-cluster.ini
• 部署配置文件：/opt/wss/<cluster_name>/profile.yml

配置集群清单

cp-cluster.ini 文件定义了以下各项：

• 基础架构/平台节点
• Omnissa Access 节点

生成 SSH 私钥文件：

如果您计划使用 ansible_ssh_private_key_file 连接到集群节点（而不是使用 ansible_password），请在填充 cp-cluster.ini 文件之前生成以下密钥文件。

# On bootstrap node follow below steps
# change to configuser
su configuser

# Generate Public and private keys
ssh-keygen -t <cipher>

# Copy public Key to all other machines (Access+Infra+platform)
ssh-copy-id configuser@10.0.0.X 
# Repeat this for all cluster VMs from bootstrap VM

# Test login work with other machines without password
ssh configuser@10.0.0.X
# You should be able to login to 10.0.0.X from bootstrap without credentials

# Exit from 10.0.0.X by using exit command, so that you are in bootstrap machine. 
exit 
# Exit as configuser; run again to return to root

# create a directory in bootstrap machine
mkdir -p /opt/wss/<cluster_name>/cp-cluster/private-key

# Copy the private key to PATH
cp /home/configuser/.ssh/id_<cipher> /opt/wss/<cluster_name>/cp-cluster/private-key

# change the permission of file
chmod 400 /opt/wss/<cluster_name>/cp-cluster/private-key/id_<cipher>

自动填充 cp-cluster.ini 文件的过程：

执行以下命令：

update-cluster-ini INI_FILE=/opt/wss/<cluster_name>/cp-cluster/cp-cluster.ini

# Output

[root@bootstrap configuser]# update-cluster-ini INI_FILE=/opt/wss/<cluster_name>/cp-cluster/cp-cluster.ini
Enter User (this is the user created at OVA deployment): configuser
Use (1) password or (2) ssh_private_key_file?
Enter 1 or 2: 1
Enter password:
Deployment size: (1) small  (2) medium  (3) large
Enter 1, 2, or 3: 1
Enter Omnissa Access Node IPs (2 IPs required, comma or space separated): 10.0.0.x 10.0.0.x
Enter infra and platform node IPs (3 IPs required, comma or space separated): 10.0.0.x 10.0.0.x 10.0.0.x 
Moved existing /opt/wss/<cluster_name>/cp-cluster/cp-cluster.ini to /opt/wss/<cluster_name>/cp-cluster/cp-cluster.ini.bkp.20260714_052152
Written /opt/wss/<cluster_name>/cp-cluster/cp-cluster.ini (small): access=2, infra=3, asset=2.

**注意：**当系统提示输入密码时，请输入在 OVA 部署时用于 configuser 帐户的相同密码。该密码在集群中的所有引导节点、Omnissa Access 节点和基础架构/平台节点上必须相同。

更新 cp-cluster.ini 文件的手动过程：

1. 打开 cp-cluster.ini 文件。例如：

   vi /opt/wss/<cluster_name>/cp-cluster/cp-cluster.ini
   

2. 按照以下内嵌说明，更新该文件。

   注意：ansible_user 必须始终设置为 configuser。

   然后，选择一种身份验证方法：

   • ansible_password — 确认该字段设置为 configuser 密码。
   • ansible_ssh_private_key_file — 为 configuser 生成的 SSH 私钥（请参阅前面的生成 SSH 私钥文件）。

   使用其中一种方法，而不要同时使用这两种方法。

   [linux:children]
   asset_server_linux
   consul_server_linux
   general_compute_linux
   kafka_controller_linux
   kafka_server_linux
   nomad_server_linux
   opensearch_leader_linux
   opensearch_data_linux
   postgres_linux
   vault_server_linux
   general_compute_nginx_http
   general_compute_access_linux
   
   # This template includes sample IPs. Please update these to match your specific environment settings.
   
   # Provide IPs to asset server nodes
   [asset_server_linux]
   10.0.0.1
   10.0.0.2
   
   # Provide IPs to all Infrastructure/Platform and Omnissa Access nodes
   [consul_server_linux]
   10.0.0.1
   10.0.0.2
   10.0.0.3
   10.0.0.4
   10.0.0.5
   
   # Provide IPs to all Infrastructure/Platform and Omnissa Access nodes
   [vault_server_linux]
   10.0.0.1
   10.0.0.2
   10.0.0.3
   10.0.0.4
   10.0.0.5
   
   # Provide IPs to all Infrastructure/Platform and Omnissa Access nodes
   [nomad_server_linux]
   10.0.0.1
   10.0.0.2
   10.0.0.3
   10.0.0.4
   10.0.0.5
   
   # Provide IPs to kafka controller nodes
   [kafka_controller_linux]
   10.0.0.1
   10.0.0.2
   10.0.0.3
   
   # Provide IPs to kafka server nodes
   [kafka_server_linux]
   10.0.0.1
   10.0.0.2
   10.0.0.3
   
   # Provide IPs to postgres server nodes
   [postgres_linux]
   10.0.0.1
   10.0.0.2
   10.0.0.3
   
   # Provide IPs to Opensearch leader nodes
   [opensearch_leader_linux]
   10.0.0.1
   10.0.0.2
   10.0.0.3
   
   # Provide IPs to Opensearch data nodes
   [opensearch_data_linux]
   10.0.0.1
   10.0.0.2
   10.0.0.3
   
   # Provide IPs to General compute nodes
   [general_compute_linux]
   10.0.0.1
   10.0.0.2
   10.0.0.3
   
   # Provide IPs to access compute nodes
   [general_compute_access_linux]
   10.0.0.4
   10.0.0.5
   
   # Provide IPs to Nginx HTTP server nodes
   [general_compute_nginx_http]
   10.0.0.4
   10.0.0.5
   
   [linux:vars]
   # Uncomment ansible_user, ansible_password or ansible_ssh_private_key_file below to provide common credentials to connect to each of the specified nodes
   # Only one of password or ssh private key can be provided
   #ansible_user=
   #ansible_password=
   #ansible_ssh_private_key_file=
   

更新 profile.yml 文件

此过程可确保最初仅部署核心基础架构服务。

profile.yml 文件 (/opt/wss/<cluster_name>/profile.yml) 包含集群环境的部署级别配置设置。它主要用于配置：

• 时间同步 (NTP)

• 共享存储 (NFS)

• 集中式日志记录集成

  日志记录部分允许集群服务将日志转发到集中式日志记录平台，例如：

  • Loki
  • OpenSearch
  • Syslog

  示例结构：

  # logging:
  # loki_server:
  #    url:
  #    username:
  #    password:
  # opensearch:
  #    url: https://10.0.0.x:<port>
  #    username: host-logging-writer
  #    password: *******
  #    index_prefix: access_logs
  # syslog_servers:
  #    host:
  #    protocol: udp
  #    port: 514
  #    syslog_cert_passphrase:   # only if your syslog client key in the logging directory is passphrase-protected  
  

重要说明

• 部署后对日志记录配置所做的更改可能需要重新部署或升级才能生效。
• 仅取消注释并配置所需的部分。
• 确保所有外部服务（NTP、NFS、日志记录服务器）均可从集群节点进行访问。
• 这不是强制性过程，但如果贵组织具有 NTP 服务器，则可以启用 NTP 服务器配置并使用服务器地址对其进行更新。

过程：

1. 打开 profile.yml 文件。例如：

   vi /opt/wss/<cluster_name>/profile.yml
   

2. 取消注释用于为集群配置基于 NFS 的共享存储（如果需要）和 NTP 服务器（推荐）的设置，例如：

   # Uncomment and provide NTP server to configure for time synchronization on the cluster nodes
   # ntp_server:
   
   # Uncomment and provide NFS server to configure Network File Share on the cluster nodes
   # nfs_host: 10.0.0.x
   # nfs_path:
   # nfs_version: 4
   

3. 查看 profile.yml 文件的其余内容并更新其他必要部分，例如日志记录和衡量指标。

4. 保存 profile.yml 文件。

5. 运行以下命令以验证 profile.yml 文件。

   wso cp precheck
   
   # Output
   Cluster Size is (small)...
   The following errors were found in the cluster configuration:
   logging configuration is not set
   telemetry configuration is not set
   nfs backup server info is not set
   
   Please fix the above errors and validate the cluster configuration again.
   

   **注意：**如果 wso cp precheck 报告未设置日志记录、遥测或 NFS 备份服务器信息，而您尚未配置这些可选设置，则这些错误是预期行为。您可以放心地忽略这些设置并继续执行 wso access validate。

验证集群清单文件

• 更新清单文件 (.ini) 后，对其进行验证。例如：

  wso access validate
  
  # OUTPUT
  <timestamp> Inventory file validated successfully.
  

  **注意：**即使 wso cp precheck 之前报告了配置错误，wso access validate 也可能报告成功。这是预期行为 — 无论出现任何预检查警告，都会继续执行 wso access validate。