環境の準備

appdctl show boot

サンプル出力：

NAME             | STATUS    | ERROR
------------------+-----------+-------
 enable-time-sync | Succeeded | --
 firewall-setup   | Succeeded | --
 hostname         | Succeeded | --
 microk8s-setup   | Succeeded | --
 ssh-setup        | Succeeded | --
 storage-setup    | Succeeded | --
 cert-setup       | Succeeded | --

appdctl show cluster
microk8s status

出力に、クラスタの一部であるノードの Running ステータスが true として表示されることを確認します。

出力例

NODE           | ROLE  | RUNNING 
----------------+-------+---------
 10.0.0.1:19001 | voter | true    
 10.0.0.2:19001 | voter | true    
 10.0.0.3:19001 | voter | true

Plain YAML

CODECopy

#!/bin/bash set -euo pipefail # Assuming /var/appd/config/secrets.yaml is now a plain, unencrypted YAML file. # The '.encrypted' extension and 'helm secrets decrypt' command are removed. TENANT=$(yq .hybrid.controller.tenantAccountName /var/appd/config/secrets.yaml) CONTROLLER_DNS_DOMAIN=$(grep -v "^ *\t* *{{" /var/appd/config/globals.yaml.gotmpl | yq -r '.hybrid.controller.domainName') DNS_DOMAIN=$(grep -v "^ *\t* *{{" /var/appd/config/globals.yaml.gotmpl | yq -r '.dnsDomain') echo Verify the Virtual Appliance tenant should be \'${TENANT}\' echo Verify the Virtual Appliance domain name should be \'${DNS_DOMAIN}\' echo Verify the Controller domain name should be \'${CONTROLLER_DNS_DOMAIN}\' echo for server_name in "$CONTROLLER_DNS_DOMAIN" "${DNS_DOMAIN}" "${TENANT}.${CONTROLLER_DNS_DOMAIN}" "${TENANT}-tnt-con.${DNS_DOMAIN}" "${TENANT}-tnt-con.${CONTROLLER_DNS_DOMAIN}"; do if ! getent hosts "${server_name}" > /dev/null; then echo "Please add DNS entry for ${server_name} for controller host IP, VA is not able to resolve it currently" fi done for server_name in "${TENANT}.auth.${DNS_DOMAIN}" "${TENANT}-tnt-authn.${DNS_DOMAIN}"; do if ! getent hosts "${server_name}" > /dev/null; then echo "Please double-check on standalone controller that DNS can resolve entry for ${server_name} as VA ingress IP" fi done

#!/bin/bash
set -euo pipefail

# Assuming /var/appd/config/secrets.yaml is now a plain, unencrypted YAML file.
# The '.encrypted' extension and 'helm secrets decrypt' command are removed.
TENANT=$(yq .hybrid.controller.tenantAccountName /var/appd/config/secrets.yaml)
CONTROLLER_DNS_DOMAIN=$(grep -v "^ *\t* *{{" /var/appd/config/globals.yaml.gotmpl | yq -r '.hybrid.controller.domainName')
DNS_DOMAIN=$(grep -v "^ *\t* *{{" /var/appd/config/globals.yaml.gotmpl | yq -r '.dnsDomain')
echo Verify the Virtual Appliance tenant should be \'${TENANT}\'
echo Verify the Virtual Appliance domain name should be \'${DNS_DOMAIN}\'
echo Verify the Controller domain name should be \'${CONTROLLER_DNS_DOMAIN}\'
 
echo
for server_name in "$CONTROLLER_DNS_DOMAIN" "${DNS_DOMAIN}" "${TENANT}.${CONTROLLER_DNS_DOMAIN}" "${TENANT}-tnt-con.${DNS_DOMAIN}" "${TENANT}-tnt-con.${CONTROLLER_DNS_DOMAIN}"; do
  if ! getent hosts "${server_name}" > /dev/null; then
    echo "Please add DNS entry for ${server_name} for controller host IP, VA is not able to resolve it currently"
  fi
done
for server_name in "${TENANT}.auth.${DNS_DOMAIN}" "${TENANT}-tnt-authn.${DNS_DOMAIN}"; do
  if ! getent hosts "${server_name}" > /dev/null; then
    echo "Please double-check on standalone controller that DNS can resolve entry for ${server_name} as VA ingress IP"
  fi
done

Encrypted YAML

CODECopy

#!/bin/bash set -euo pipefail TENANT=$(helm secrets decrypt /var/appd/config/secrets.yaml.encrypted | yq .hybrid.controller.tenantAccountName) CONTROLLER_DNS_DOMAIN=$(grep -v "^ *\t* *{{" /var/appd/config/globals.yaml.gotmpl | yq -r '.hybrid.controller.domainName') DNS_DOMAIN=$(grep -v "^ *\t* *{{" /var/appd/config/globals.yaml.gotmpl | yq -r '.dnsDomain') echo Verify the Virtual Appliance tenant should be \'${TENANT}\' echo Verify the Virtual Appliance domain name should be \'${DNS_DOMAIN}\' echo Verify the Controller domain name should be \'${CONTROLLER_DNS_DOMAIN}\' echo for server_name in "$CONTROLLER_DNS_DOMAIN" "${DNS_DOMAIN}" "${TENANT}.${CONTROLLER_DNS_DOMAIN}" "${TENANT}-tnt-con.${DNS_DOMAIN}" "${TENANT}-tnt-con.${CONTROLLER_DNS_DOMAIN}"; do if ! getent hosts "${server_name}" > /dev/null; then echo "Please add DNS entry for ${server_name} for controller host IP, VA is not able to resolve it currently" fi done for server_name in "${TENANT}.auth.${DNS_DOMAIN}" "${TENANT}-tnt-authn.${DNS_DOMAIN}"; do if ! getent hosts "${server_name}" > /dev/null; then echo "Please double-check on standalone controller that DNS can resolve entry for ${server_name} as VA ingress IP" fi done

#!/bin/bash
set -euo pipefail
TENANT=$(helm secrets decrypt /var/appd/config/secrets.yaml.encrypted  | yq .hybrid.controller.tenantAccountName)
CONTROLLER_DNS_DOMAIN=$(grep -v "^ *\t* *{{" /var/appd/config/globals.yaml.gotmpl | yq -r '.hybrid.controller.domainName')
DNS_DOMAIN=$(grep -v "^ *\t* *{{" /var/appd/config/globals.yaml.gotmpl | yq -r '.dnsDomain')
echo Verify the Virtual Appliance tenant should be \'${TENANT}\'
echo Verify the Virtual Appliance domain name should be \'${DNS_DOMAIN}\'
echo Verify the Controller domain name should be \'${CONTROLLER_DNS_DOMAIN}\'
 
echo
for server_name in "$CONTROLLER_DNS_DOMAIN" "${DNS_DOMAIN}" "${TENANT}.${CONTROLLER_DNS_DOMAIN}" "${TENANT}-tnt-con.${DNS_DOMAIN}" "${TENANT}-tnt-con.${CONTROLLER_DNS_DOMAIN}"; do
  if ! getent hosts "${server_name}" > /dev/null; then
    echo "Please add DNS entry for ${server_name} for controller host IP, VA is not able to resolve it currently"
  fi
done
for server_name in "${TENANT}.auth.${DNS_DOMAIN}" "${TENANT}-tnt-authn.${DNS_DOMAIN}"; do
  if ! getent hosts "${server_name}" > /dev/null; then
    echo "Please double-check on standalone controller that DNS can resolve entry for ${server_name} as VA ingress IP"
  fi
done

自己署名証明書には、追加した DNS エントリを含む、新しく作成された証明書をインポートします。

keytool -import -trustcacerts -alias s1as \
-file <certificate.crt> \
-keystore <ControllerInstallation>/platform/product/controller/appserver/jetty/etc/keystore.jks

プレーン YAML

JSONCopy

#!/bin/bash set -euo pipefail TENANT=$(yq .hybrid.controller.tenantAccountName /var/appd/config/secrets.yaml) DNS_DOMAIN=$(grep -v "^ *\t* *{{" /var/appd/config/globals.yaml.gotmpl | yq -r '.dnsDomain') DNS_NAMES=$(grep -v "^ *\t* *{{" /var/appd/config/globals.yaml.gotmpl | yq -r '.dnsNames|join(" ")') echo Verify the Virtual Appliance tenant should be \'${TENANT}\' echo Verify the Virtual Appliance domain name should be \'${DNS_DOMAIN}\' echo Verify the Virtual Appliance node names are: ${DNS_NAMES} echo If creating and importing into VA a Custom Ingress Certificate, include the following SANs: for server_name in "$DNS_DOMAIN" "${TENANT}.${DNS_DOMAIN}" "*.${DNS_DOMAIN}" "${TENANT}.auth.${DNS_DOMAIN}" "${TENANT}-tnt-authn.${DNS_DOMAIN}" $DNS_NAMES; do echo " ${server_name}" done

#!/bin/bash
set -euo pipefail
TENANT=$(yq .hybrid.controller.tenantAccountName /var/appd/config/secrets.yaml)
DNS_DOMAIN=$(grep -v "^ *\t* *{{" /var/appd/config/globals.yaml.gotmpl | yq -r '.dnsDomain')
DNS_NAMES=$(grep -v "^ *\t* *{{" /var/appd/config/globals.yaml.gotmpl | yq -r '.dnsNames|join(" ")')

echo Verify the Virtual Appliance tenant should be \'${TENANT}\'
echo Verify the Virtual Appliance domain name should be \'${DNS_DOMAIN}\'
echo Verify the Virtual Appliance node names are: ${DNS_NAMES}

echo If creating and importing into VA a Custom Ingress Certificate, include the following SANs:
for server_name in "$DNS_DOMAIN" "${TENANT}.${DNS_DOMAIN}" "*.${DNS_DOMAIN}" "${TENANT}.auth.${DNS_DOMAIN}" "${TENANT}-tnt-authn.${DNS_DOMAIN}" $DNS_NAMES; do
        echo "  ${server_name}"
done

暗号化された YAML

JSONCopy

#!/bin/bash set -euo pipefail TENANT=$(helm secrets decrypt /var/appd/config/secrets.yaml.encrypted | yq .hybrid.controller.tenantAccountName) DNS_DOMAIN=$(grep -v "^ *\t* *{{" /var/appd/config/globals.yaml.gotmpl | yq -r '.dnsDomain') DNS_NAMES=$(grep -v "^ *\t* *{{" /var/appd/config/globals.yaml.gotmpl | yq -r '.dnsNames|join(" ")') echo Verify the Virtual Appliance tenant should be \'${TENANT}\' echo Verify the Virtual Appliance domain name should be \'${DNS_DOMAIN}\' echo Verify the Virtual Appliance node names are: ${DNS_NAMES} echo If creating and importing into VA a Custom Ingress Certificate, include the following SANs: for server_name in "$DNS_DOMAIN" "${TENANT}.${DNS_DOMAIN}" "*.${DNS_DOMAIN}" "${TENANT}.auth.${DNS_DOMAIN}" "${TENANT}-tnt-authn.${DNS_DOMAIN}" $DNS_NAMES; do echo " ${server_name}" done

#!/bin/bash
set -euo pipefail
TENANT=$(helm secrets decrypt /var/appd/config/secrets.yaml.encrypted  | yq .hybrid.controller.tenantAccountName)
DNS_DOMAIN=$(grep -v "^ *\t* *{{" /var/appd/config/globals.yaml.gotmpl | yq -r '.dnsDomain')
DNS_NAMES=$(grep -v "^ *\t* *{{" /var/appd/config/globals.yaml.gotmpl | yq -r '.dnsNames|join(" ")')
echo Verify the Virtual Appliance tenant should be \'${TENANT}\'
echo Verify the Virtual Appliance domain name should be \'${DNS_DOMAIN}\'
echo Verify the Virtual Appliance node names are: ${DNS_NAMES}

echo If creating and importing into VA a Custom Ingress Certificate, include the following SANs:
for server_name in "$DNS_DOMAIN" "${TENANT}.${DNS_DOMAIN}" "*.${DNS_DOMAIN}" "${TENANT}.auth.${DNS_DOMAIN}" "${TENANT}-tnt-authn.${DNS_DOMAIN}" $DNS_NAMES; do
        echo "  ${server_name}"
done

vi globals.yaml.gotmpl

仮想アプライアンスで、ネットワークアクセス、SSL 証明書を使用したセキュア通信、および設定済みデータベース接続が確立されていることを確認します。