Prepare the Virtual Appliance

Prepare certificates, keys, and environment requirements before installing a hybrid deployment.

Prepare certificates, keys, and environment requirements.

Create a Three-Node Cluster

Create a three-node Virtual Appliance cluster from the primary node.

  1. Log in to every node and verify the boot services.
  2. On the primary node, initialize the cluster using the two peer IP addresses.
  3. Verify that every member is ready, schedulable, and running.
    CODE 
    # Run on every node
appdctl show boot

    Every boot service reports Succeeded; all three nodes report READY=true, SCHEDULABLE=true, and RUNNING=true

    Sample Output:
    CODE 
    NAME              | STATUS    | ERROR 
-------------------+-----------+-------
 firewall-setup    | Succeeded | --    
 hostname          | Succeeded | --    
 netplan           | Succeeded | --    
 ssh-setup         | Succeeded | --    
 storage-setup     | Succeeded | --    
 cert-setup        | Succeeded | --    
 enable-time-sync  | Succeeded | --    
 microk8s-setup    | Succeeded | --    
 cloud-init-config | Succeeded | --
  4. Run this command on a primary node.
    CODE 
    # Run on the primary node
cd /home/appduser
appdctl cluster init <NODE_2_IP> <NODE_3_IP>
appdctl show cluster
microk8s status
    Warning: Keep at least two nodes active. If two nodes are unavailable, the cluster can lose data. If MicroK8s reports insufficient permissions, log out and back in before retrying.
    Sample Output:
    CODE 
    NODE             | INTERNAL IP   | K8S ROLE      | HA ROLE | READY | SCHEDULABLE
------------------+---------------+---------------+---------+-------+-------------
 ip-10-115-84-215 | 10.115.84.215 | control-plane | voter   | true  | true
 ip-10-115-85-239 | 10.115.85.239 | control-plane | voter   | true  | true
 ip-10-115-87-4   | 10.115.87.4   | control-plane | voter   | true  | true

Configure and Validate DNS

Configure DNS entries required for hybrid deployment communication.

  1. Log in to you primary node and open the /var/appd/config/globals.yaml.gotmpl file.
  2. Set dnsDomain to the Virtual Appliance URL.
    CODE 
    dnsDomain: <VA-Domain-Name>
  3. Ensure dnsNames contains localhost, the ingress domain, and every Virtual Appliance node name used in certificates.
  4. Run the supplied DNS checker.
    CODE 
    cd /var/appd/config
vi globals.yaml.gotmpl

bash /home/appduser/appd-charts/utils/check-dns.sh

    Example dnsNames configuration

    CODE 
    dnsDomain: va.example.com
dnsNames: &dnsNames
  - localhost
  - va.example.com
  - va-node-1.example.com
  - va-node-2.example.com
  - va-node-3.example.com
    Note: If registered names are not available, the source allows <node-ip>.nip.io. Some network policies block these names; use corporate DNS or an approved /etc/hosts mapping in that case.
  5. Optional: Replace the Virtual Appliance Ingress self-signed certificates.
    1. Generate the required SAN list.
    2. Obtain a certificate whose SANs include every configured DNS name.
    3. Copy the PEM key and ordered certificate bundle to the primary node.
    CODE 
    bash /home/appduser/appd-charts/utils/list-ingress-sans.sh
    Note:
    • ingress.crt must contain the leaf/server certificate, intermediate CA certificate(s), then root CA certificate.
    • If a load balancer terminates TLS, retrieve and trust the certificate chain presented by the load balancer, not the backend Controller.
    • For a custom Kafka certificate, include all three VA node IP addresses in its SANs.
The checker ends with DNS verification completed: 0 unresolved host(s).