OpenStack must be installed on the host where you will be installing MSX. The OpenStack RC file (typically named openrc.sh) is used by command-line clients to set environmental variables and to provide credentials that are required for using OpenStack services. This section describes the steps for downloading the OpenStack RC file and preparing it for use. The steps given here are to be performed on the host in which you will be installing MSX.

You will need to configure the main.yml variables file before proceeding with the installation.

vi /msx-3.10.0/ansible/group_vars/all/main.yml

This section lists the parameters from the main.yml file that must be configured while installing MSX. For a complete list of parameters with default values, see Appendix: Sample Property File.

• OpenStack Parameters to Change in main.yml:

  • os_image: Same as the downloaded CentOS file (CentOS-7-x86_64-GenericCloud-1804_02.qcow2).

  • os_fip_pool: Change this setting to ‘external’ if your network in OpenStack is named as ‘external.’

  • os_ext_net: Change this setting to ‘external’ if your network in OpenStack is named as ‘external.’

  • DNS and NTP Settings for OpenStack: Change the DNS and NTP default setting to settings that match your environment.

• proxy / no_proxy settings:

Proxy/no_proxy settings are not required to deploy MSX. In some cases, however, to enable Google Map or other functionality that requires Internet access, you would need to set the proxy values.

Provide the proxy settings based on your requirements:

• If your deployment requires a proxy server (shown below), then uncomment both #proxy: and #no_proxy: and set their values. The no_proxy: list must contain the values shown below, but you can also append other servers that do not require proxy functionality.

proxy: <proxy_server>

no_proxy: localhost,registry.service.consul,vault.service.consul,consul.service.consul,.service.consul,*.service.consul,kubernetes

• SSH Key Settings:

Set the SSH key details. If you would like to change the default key names, they will also need to be updated in main.yml.

• ssh_public_key_file: /msx-3.10.0/ansible/keys/id_rsa.pub

• ssh_private_key_file: /msx-3.10.0/ansible/keys/id_rsa

• External IP addresses:

  • use_existing_ips: Set use_existing_ips to ‘yes,’ if you want to use the same public IP addresses across the MSX deployment. Ensure that these external IP addresses are available as Floating IP addresses or Elastic IP addresses in your OpenStack Project and Virtual Private Cloud, respectively. Also, specify these IP addresses in the external_addresses.yml file.

• FQDN Settings / Route Settings: As part of the MSX installation, route53 can be used to register the FQDN of the MSX portal to the ciscovms.com domain. If you want to use the ciscomsx.com domain, change the settings to:

  • use_route53: true

  • vms_domain: Has to be a domain you control in route53, for example, ciscomsx.com.

  • vms_subdomain: Has to be unique in your domain and must not contain "." , "_”, or the uppercase letters, for example, the subdomain can be msxservices.

Note

If the use_route53 variable is set to 'true' in FQDN Setting / Route Settings, you need to export the https_proxy with the value used in the proxy / no_proxy settings and then unset it immediately after creating infra. export https_proxy=<proxy_server > If the use_route53 variable is set to false, then you can skip this step.

• SMTP Settings for the Email Notifications:

  • smtp_server

  • SMTP port number

• GOOGLE API KEY Settings:

- google_api_key: <your_Google_API_key>

• Provider_Name, Provider_Display_Name, and Provider_Description must be same as OS_TENANT_NAME.

• Elastic Search Volume Size

Use this setting to change the elastic search volume size. Default is 100 GB.

• License Token for CSR VPN: Only applicable if you are deploying MSX in the Dual data center mode. Provide license token from your smart account to license the CSRs that are used to set up a tunnel across the two data centers.

• iPNP SSL HARDENING variable: ipnp in MSX supports TLS version 1.0,1.1, and 1.2 for SSL handshake with devices. You can configure this value during installation. Depending on the configuration of the devices in your deployment, set this variable to one of the given values:

  • 0: Supports TLS 1.0, 1.1, and 1.2

  • 1: Supports TLS 1.1 and 1.2

  • 2: Supports TLS 1.2

  Note	For enhanced security, we recommend that you use TLS 1.1 or higher.

• AWS Parameters to Change in main.yml:

  • Ensure that you have set the _tag parameters to enable easier instance searching and management.

  • Make sure to choose the region that is closest to you. Remember that some newer regions may not have enough Availability Zones within those regions. Typically, MSX is deployed across three Availability Zones, but you can deploy using two, if necessary. Contact Cisco Technical Assistance Center (TAC) for more details.

MSX includes some basic cron-based functionality that provides the ability to automate backups on a schedule as opposed to running manual backups from the Deployer node. Backup jobs are configured using UTC, and timing can be customized per database. Backups include persistent data from Cassandra, Consul, CockroachDB, Elasticsearch, NSO, and Action Orchestrator, which contains ArangoDB and Postgres.

To enable the cron job backups:

1. Edit group_vars/all/cron_backup_vars.yml to set your cron schedules and other information. Refer to the comments in the yml file below for guidance.

   Note	Lookup variables are used if they are set in the environment or if you run the export command. For example, you might export these keys: S3_ACCESS_KEY_ID and S3_SECRET_ACCESS_KEY. You will not need to do this in a default AWS setup unless you are backing up to a different account.

   
   --- 
   
   ### NOTE: cron_schedule should be set using UTC 
   
   cron_backup_components: 
   
     consul: 
   
       cron_schedule: "1 0 * * *" 
   
     nso: 
   
       cron_schedule: "30 0 * * *" 
   
     cassandra: 
   
       cron_schedule: "5 0 * * *" 
   
     elasticsearch: 
   
       cron_schedule: "15 0 * * *" 
   
       ### Elasticsearch does incremental snapshots by default. Select 
   
       ### the timeframe to make a full snapshot: 
   
       ###   daily/weekly/monthly (daily is the default) 
   
       full_backup: "daily" 
   
     cockroachdb: 
   
       cron_schedule: "0 1 * * *" 
   
     etcd: 
   
       cron_schedule: "" 
   
     arangodb: 
   
       cron_schedule: "0 2 * * *" 
   
   ### For OpenStack deployments or AWS deployments where you will backup to an S3 bucket in another account, 
   
   ### uncomment and edit the below options where necessary. 
   
   ###   endpoint (required) 
   
   ###      **NOTE:** for AWS S3 based endpoints use the region specific endpoint ie s3.us-west-2.amazonaws.com 
   
   ###   region (required for AWS S3 based endpoints) 
   
   ###   bucket (required) 
   
   ###   access_key (required) 
   
   ###   secret_key (required) 
   
   ###   session_token (optional) 
   
   ###   base_path (optional) 
   
   ###   protocol (optional, defaults to https. endpoint must not be self-signed for https) 
   
   ###   proxy_xxx (optional), but if you need to define a proxy the _host, _port, _scheme are required 
   
   # s3_backup: 
   
   #   endpoint: '<s3-endpoint>' 
   
   #   region: '<s3-region>' 
   
   #   bucket: '<bucket-name>' 
   
   #   access_key: "{{ lookup('env', 'S3_ACCESS_KEY_ID') }}" 
   
   #   secret_key: "{{ lookup('env', 'S3_SECRET_ACCESS_KEY') }}"  
   
   #   session_token: "{{ lookup('env', 'S3_SESSION_TOKEN') }}" 
   
   #   base_path: '<base-path>' 
   
   #   protocol: 'https' 
   
   #   proxy_host: "{{ proxy | urlsplit('hostname') }}" 
   
   #   proxy_port: "{{ proxy | urlsplit('port') }}" 
   
   #   proxy_scheme: "{{ proxy | urlsplit('scheme') }}" 
   
   #   proxy_username: "{{ lookup('env', 'PROXY_USERNAME') }}" 
   
   #   proxy_password: "{{ lookup('env', 'PROXY_PASSWORD') }}" 
    

2. Change to the Ansible directory.

   cd to /msx/ansible

3. Set the environment variable for the Ansible Vault password:

   export ANSIBLE_VAULT_PASSWORD_FILE=<vault_pwd_path> 

   Where <vault_pwd_path> = /msx-3.10.0/ansible/vault/password.txt

4. Run cron-backup.yml to start the backup schedule.

   ansible-playbook cron-backup.yml

   The process will take approximately 15 minutes (with an Elasticsearch restart). Otherwise, it will only take a couple of minutes if no restart is needed.

5. Log in to the Kubernetes cluster so that you can check that the jobs are running according to schedule.

   #login to k8s master  
   ssh -F ssh.cfg centos@<master-ip>

6. On the Kubernetes master, change user to sudo.

   sudo su

7. List all the cron jobs in Kubernetes.

   kubectl -n vms get cronjobs

   The following is the output of the command:

   NAME      SCHEDULE    SUSPEND   ACTIVE   LAST SCHEDULE   AGE 
   curator   1 0 * * *   False     0        <none>          13h 

For both AWS and OpenStack, you must change the default 0.0.0.0/0 CIDR for inbound SSH connections to the MSX Inception node. Edit ansible/group_vars/all/inception_ssh_cidrs.yml file to create an allowed list that matches your access requirements. For example:

inception_ssh_cidrs:

- 192.0.2.0/24

- 198.51.100.0/24

- 203.0.113.0/24

To access AWS from the command line, you need to create a credential file and save it as /root/.aws/credentials.

[default]
aws_access_key_id = AKIAIYH6GL7Z5EXAMPLE
aws_secret_access_key = v4Bj/5W6Lz0xtSzhuKnSs3135bmBJY3H/EXAMPLE

Note	The access_key_id and secret_access_key are generated from within AWS.