在弹性服务控制器中为VIM连接器配置CVIM Openstack SSL证书
简介
本文档介绍在Cisco弹性服务控制器中为虚拟基础设施管理器(VIM)连接添加更新的Openstack RESTAPI SSL证书的过程。
先决条件
要求
Cisco 建议您了解以下主题：
- 思科弹性服务控制器
- 思科VIM/Openstack
使用的组件
本文档中的信息基于以下软件和硬件版本：
- 思科弹性服务控制器5.10.0.95
- 思科VIM 4.2.2
注意：此过程还适用于在添加新的VIM连接器时新添加证书。
本文档中的信息都是基于特定实验室环境中的设备编写的。本文档中使用的所有设备最初均采用原始（默认）配置。如果您的网络处于活动状态，请确保您了解所有命令的潜在影响。
配置
续订Openstack RESTAPI SSL证书（思科VIM环境的haproxy证书）后，弹性服务控制器报告VIM连接失败。
[admin@lab-esc-1 ~]$ tail -100f /var/log/esc/yangesc.log
2024-04-09 10:35:36.148 WARN ===== SEND NOTIFICATION STARTS =====
2024-04-09 10:35:36.148 WARN Type: VIM_CONNECTION_STATE
2024-04-09 10:35:36.148 WARN Status: FAILURE
2024-04-09 10:35:36.148 WARN Status Code: 500
2024-04-09 10:35:36.148 WARN Status Msg: VIM Connection State Down
2024-04-09 10:35:36.148 WARN Vim connector id: cvim-openstack-lab
2024-04-09 10:35:36.148 WARN ===== SEND NOTIFICATION ENDS =====
[admin@lab-esc-1 ~]$ sudo escadm vim show
{
"id":"cvim-openstack-lab",
"type":"OPENSTACK",
"last_checked":"2024-04-09T10:35:36.099",
"status":"CONNECTION_FAILED",
"status_message":"Unable to establish VIM connection",
}
配置
列出Elastic Services Controller truststore中存在的当前证书：
[admin@lab-esc-1 ~]$ escadm truststore show --verbose
esc, Mar 30, 2024, trustedCertEntry,
cvim-openstack-lab, Apr 4, 2024, trustedCertEntry,
将CA证书文件复制/传输到Elastic Services Controller VM。
1. 对于主用-备用弹性服务控制器设置，请将证书复制到主用VM。
2. 对于主用-主用ESC设置，将证书复制到地理主引导虚拟机。
[admin@lab-esc-1 ~]$ ls -l /home/admin
-rw-r--r--. 1 admin admin 1911 Apr 9 06:20 cvim-openstack-lab-renewed_haproxy.crt
通过执行escadm truststore add命令将证书添加到弹性服务控制器信任库。
1. File参数是指类型为X.509 v1、v2和v3证书以及PKCS#7的CA证书文件。
2. Alias参数是唯一的，它是指为此特定CA证书指定的名称。
[admin@lab-esc-1 ~]$ sudo escadm truststore add --alias cvim-openstack-lab-renewed --file cvim-openstack-lab-renewed_haproxy.crt --verbose
CA certificate "cvim-openstack-lab-renewed" added successfully.
On ESC setup running ETSI, restart ETSI by running "sudo escadm etsi restart". All other components will reload the certificate automatically.
验证
使用本部分可确认配置能否正常运行。
验证是否已成功将证书添加到Elastic Services Controller信任库。
[admin@lab-esc-1 ~]$ sudo escadm truststore show --verbose
esc, Mar 30, 2024, trustedCertEntry,
cvim-openstack-lab, Apr 4, 2024, trustedCertEntry,
cvim-openstack-lab-renewed, Apr 9, 2024, trustedCertEntry,
验证VIM连接是否已开启。
[admin@lab-esc-1 esc]$ sudo escadm vim show
{
"id":"cvim-openstack-lab",
"type":"OPENSTACK",
"last_checked":"2024-04-09T11:15:57.157",
"status":"CONNECTION_SUCCESSFUL",
"status_message":"Successfully connected to VIM"
}
[admin@lab-esc-1 ~]$ tail -100f /var/log/esc/yangesc.log
2024-04-09 11:15:57.188 INFO ===== SEND NOTIFICATION STARTS =====
2024-04-09 11:15:57.188 INFO Type: VIM_CONNECTION_STATE
2024-04-09 11:15:57.188 INFO Status: SUCCESS
2024-04-09 11:15:57.188 INFO Status Code: 200
2024-04-09 11:15:57.188 INFO Status Msg: VIM Connection State Up
2024-04-09 11:15:57.189 INFO Vim connector id: cvim-openstack-lab
2024-04-09 11:15:57.189 INFO ===== SEND NOTIFICATION ENDS =====
可选步骤
对于证书续订，请在添加新证书后确认VIM连接已建立后删除旧证书。
[admin@lab-esc-1 ~]$ sudo escadm truststore delete --alias cvim-openstack-lab --verbose
CA certificate "cvim-openstack-lab" deleted successfully
[admin@lab-esc-1 ~]$ sudo escadm truststore show --verbose
esc, Mar 30, 2024, trustedCertEntry,
cvim-openstack-lab-renewed, Apr 9, 2024, trustedCertEntry,
故障排除
本部分提供了可用于对配置进行故障排除的信息。
添加新的弹性服务控制器信任库后会自动重新加载，因此VIM连接必须自动启动。检查escmanager日志，在发生故障时进行故障排除。
[admin@lab-esc-1 ~]$ tail -100f /var/log/esc/escamanager.log
2024-04-09 11:15:55.369 INFO [SslManager.java:run:262] Change of type ENTRY_MODIFY is detected on truststore. Trigger reloading.
2024-04-09 11:15:55.370 INFO [SslManager.java:loadESCTruststore:215] ESC truststore file loaded successfully.
2024-04-09 11:15:55.375 INFO [SslManager.java:loadESCTruststore:226] Added Java default Root CA certificates: 136
2024-04-09 11:15:55.376 INFO [VimUtils.java:reloadVimManagerTrustStore:1057] Starting request to reload VimManager truststore.
2024-04-09 11:15:55.430 INFO [VimUtils.java:reloadVimManagerTrustStore:1065] Completed request to reload vimManager truststore.
2024-04-09 11:15:55.430 INFO [SslManager.java:run:270] Reloading of truststore is done.
2024-04-09 11:15:57.183 INFO [VimAuthenticationService.java:updateVimStatusFromNotification:709] Vim status message: VIM reachable; connection state: CONNECTED
2024-04-09 11:15:57.183 INFO [VimAuthenticationService.java:processVimStatusNotification:784] Sending VIM Status notification for vim cvim-openstack-lab, status CONNECTION_SUCCESSFUL
2024-04-09 11:16:31.428 INFO [VimUtils.java:getAuthStatusById:1077] VIM ID - cvim-openstack-lab, VimInfo is : VimInfoHolder [vimStatus=VIM_STATUS_REACHABLE, vimUserStatus=VIM_USER_STATUS_AUTHENTICATED, ts=2024-04-09T11:15:57.157]
修订历史记录
| 版本 | 发布日期 | 备注 |
|---|---|---|
1.0 |
29-Apr-2024 |
初始版本 |
反馈