初始化 Omnissa Access Control Plane 叢集

依照下列程序，從啟動程序節點初始化 Omnissa Access Control Plane 叢集。所有命令都必須從啟動程序節點執行。

初始化控制平面叢集

操作程序：

• 依照下列內嵌指示初始化控制平面叢集。

  **附註：**請執行下列命令，並將 <size_of_your_deployment> 替換為 small、medium 或 large，以符合您所部署的 OVA 大小。

  cd /opt/wss/<cluster_name>
  wso access init -n cp-cluster -s <size_of_your_deployment>
  

  執行此命令時，輸出內容會類似如下：

  cd /opt/wss/<cluster_name>
  wso access init -n cp-cluster -s small
  
  # Output
  <timestamp> Control Plane name: cp-cluster
  <timestamp> Created a sample profile.yml file
  <timestamp> Sample Control Plane inventory file created
  <timestamp> Created a sample telemetry config file: /opt/wss/<cluster_name>/telegraf_plugin/prometheus_remote_write.conf.example
  <timestamp> Successfully initialized
  

結果：

此命令會建立下列檔案：

• 叢集詳細目錄檔案：/opt/wss/<cluster_name>/cp-cluster/cp-cluster.ini
• 部署組態檔：/opt/wss/<cluster_name>/profile.yml

設定叢集詳細目錄

cp-cluster.ini 檔案會定義下列項目：

• 基礎結構/平台節點
• Omnissa Access 節點

產生 SSH 私密金鑰檔案：

如果您打算使用 ansible_ssh_private_key_file 連線至叢集節點 (而非使用 ansible_password)，請先產生下列金鑰檔案，再填入 cp-cluster.ini 檔案內容。

# On bootstrap node follow below steps
# change to configuser
su configuser

# Generate Public and private keys
ssh-keygen -t <cipher>

# Copy public Key to all other machines (Access+Infra+platform)
ssh-copy-id configuser@10.0.0.X 
# Repeat this for all cluster VMs from bootstrap VM

# Test login work with other machines without password
ssh configuser@10.0.0.X
# You should be able to login to 10.0.0.X from bootstrap without credentials

# Exit from 10.0.0.X by using exit command, so that you are in bootstrap machine. 
exit 
# Exit as configuser; run again to return to root

# create a directory in bootstrap machine
mkdir -p /opt/wss/<cluster_name>/cp-cluster/private-key

# Copy the private key to PATH
cp /home/configuser/.ssh/id_<cipher> /opt/wss/<cluster_name>/cp-cluster/private-key

# change the permission of file
chmod 400 /opt/wss/<cluster_name>/cp-cluster/private-key/id_<cipher>

自動填入 cp-cluster.ini 檔案的程序：

執行以下命令：

update-cluster-ini INI_FILE=/opt/wss/<cluster_name>/cp-cluster/cp-cluster.ini

# Output

[root@bootstrap configuser]# update-cluster-ini INI_FILE=/opt/wss/<cluster_name>/cp-cluster/cp-cluster.ini
Enter User (this is the user created at OVA deployment): configuser
Use (1) password or (2) ssh_private_key_file?
Enter 1 or 2: 1
Enter password:
Deployment size: (1) small  (2) medium  (3) large
Enter 1, 2, or 3: 1
Enter Omnissa Access Node IPs (2 IPs required, comma or space separated): 10.0.0.x 10.0.0.x
Enter infra and platform node IPs (3 IPs required, comma or space separated): 10.0.0.x 10.0.0.x 10.0.0.x 
Moved existing /opt/wss/<cluster_name>/cp-cluster/cp-cluster.ini to /opt/wss/<cluster_name>/cp-cluster/cp-cluster.ini.bkp.20260714_052152
Written /opt/wss/<cluster_name>/cp-cluster/cp-cluster.ini (small): access=2, infra=3, asset=2.

**附註：**系統提示輸入密碼時，請輸入在 OVA 部署期間用於 configuser 帳戶的相同密碼。此密碼在叢集中的所有啟動程序節點、Omnissa Access 節點和基礎結構/平台節點上都必須相同。

手動更新 cp-cluster.ini 檔案的程序：

1. 開啟 cp-cluster.ini 檔案。例如：

   vi /opt/wss/<cluster_name>/cp-cluster/cp-cluster.ini
   

2. 依照下列內嵌指示更新檔案。

   附註：ansible_user 必須一律設為 configuser。

   接著，請選擇下列其中一種驗證方法：

   • ansible_password — 確認此欄位已設為 configuser 密碼。
   • ansible_ssh_private_key_file — 使用為 configuser 產生的 SSH 私密金鑰 (請參閱上方的產生 SSH 私密金鑰檔案)。

   請擇一使用，勿同時使用兩種方法。

   [linux:children]
   asset_server_linux
   consul_server_linux
   general_compute_linux
   kafka_controller_linux
   kafka_server_linux
   nomad_server_linux
   opensearch_leader_linux
   opensearch_data_linux
   postgres_linux
   vault_server_linux
   general_compute_nginx_http
   general_compute_access_linux
   
   # This template includes sample IPs. Please update these to match your specific environment settings.
   
   # Provide IPs to asset server nodes
   [asset_server_linux]
   10.0.0.1
   10.0.0.2
   
   # Provide IPs to all Infrastructure/Platform and Omnissa Access nodes
   [consul_server_linux]
   10.0.0.1
   10.0.0.2
   10.0.0.3
   10.0.0.4
   10.0.0.5
   
   # Provide IPs to all Infrastructure/Platform and Omnissa Access nodes
   [vault_server_linux]
   10.0.0.1
   10.0.0.2
   10.0.0.3
   10.0.0.4
   10.0.0.5
   
   # Provide IPs to all Infrastructure/Platform and Omnissa Access nodes
   [nomad_server_linux]
   10.0.0.1
   10.0.0.2
   10.0.0.3
   10.0.0.4
   10.0.0.5
   
   # Provide IPs to kafka controller nodes
   [kafka_controller_linux]
   10.0.0.1
   10.0.0.2
   10.0.0.3
   
   # Provide IPs to kafka server nodes
   [kafka_server_linux]
   10.0.0.1
   10.0.0.2
   10.0.0.3
   
   # Provide IPs to postgres server nodes
   [postgres_linux]
   10.0.0.1
   10.0.0.2
   10.0.0.3
   
   # Provide IPs to Opensearch leader nodes
   [opensearch_leader_linux]
   10.0.0.1
   10.0.0.2
   10.0.0.3
   
   # Provide IPs to Opensearch data nodes
   [opensearch_data_linux]
   10.0.0.1
   10.0.0.2
   10.0.0.3
   
   # Provide IPs to General compute nodes
   [general_compute_linux]
   10.0.0.1
   10.0.0.2
   10.0.0.3
   
   # Provide IPs to access compute nodes
   [general_compute_access_linux]
   10.0.0.4
   10.0.0.5
   
   # Provide IPs to Nginx HTTP server nodes
   [general_compute_nginx_http]
   10.0.0.4
   10.0.0.5
   
   [linux:vars]
   # Uncomment ansible_user, ansible_password or ansible_ssh_private_key_file below to provide common credentials to connect to each of the specified nodes
   # Only one of password or ssh private key can be provided
   #ansible_user=
   #ansible_password=
   #ansible_ssh_private_key_file=
   

更新 profile.yml 檔案

此程序可確保初始階段僅部署核心基礎結構服務。

profile.yml 檔案 (/opt/wss/<cluster_name>/profile.yml) 包含叢集環境的部署層級組態設定。主要用於設定：

• 時間同步 (NTP)

• 共用儲存區 (NFS)

• 集中式記錄整合

  記錄區段可讓叢集服務將記錄轉送至下列集中式記錄平台：

  • Loki
  • OpenSearch
  • Syslog

  範例結構：

  # logging:
  # loki_server:
  #    url:
  #    username:
  #    password:
  # opensearch:
  #    url: https://10.0.0.x:<port>
  #    username: host-logging-writer
  #    password: *******
  #    index_prefix: access_logs
  # syslog_servers:
  #    host:
  #    protocol: udp
  #    port: 514
  #    syslog_cert_passphrase:   # only if your syslog client key in the logging directory is passphrase-protected  
  

重要注意事項

• 部署後變更記錄組態，可能需要重新部署或升級才會生效。
• 僅取消註解並設定所需的區段。
• 確保可從叢集節點連線至所有外部服務 (NTP、NFS、記錄伺服器)。
• 此程序並非必要，但如果您的組織設有 NTP 伺服器，您可以啟用 NTP 伺服器組態，並使用伺服器位址加以更新

操作程序：

1. 開啟 profile.yml 檔案。例如：

   vi /opt/wss/<cluster_name>/profile.yml
   

2. 取消註解用於設定叢集之 NFS 型共用儲存區 (如有需要) 和 NTP 伺服器 (建議) 的設定，如下所示：

   # Uncomment and provide NTP server to configure for time synchronization on the cluster nodes
   # ntp_server:
   
   # Uncomment and provide NFS server to configure Network File Share on the cluster nodes
   # nfs_host: 10.0.0.x
   # nfs_path:
   # nfs_version: 4
   

3. 檢閱 profile.yml 檔案的其餘內容，並更新其他必要區段，例如記錄和度量。

4. 儲存 profile.yml 檔案。

5. 執行下列命令以驗證 profile.yml 檔案。

   wso cp precheck
   
   # Output
   Cluster Size is (small)...
   The following errors were found in the cluster configuration:
   logging configuration is not set
   telemetry configuration is not set
   nfs backup server info is not set
   
   Please fix the above errors and validate the cluster configuration again.
   

   **附註：**如果 wso cp precheck 回報尚未設定記錄、遙測或 NFS 備份伺服器資訊，而您尚未設定這些選用設定，則出現這些錯誤屬於預期行為。您可以放心忽略這些錯誤，然後繼續執行 wso access validate。

驗證叢集詳細目錄檔案

• 更新詳細目錄檔案 (.ini) 後，請加以驗證。例如：

  wso access validate
  
  # OUTPUT
  <timestamp> Inventory file validated successfully.
  

  **附註：**即使 wso cp precheck 先前回報組態錯誤，wso access validate 仍可能回報成功。這是預期行為 — 無論預先檢查是否出現任何警告，都請繼續執行 wso access validate。