為彈性服務控制器中的VIM聯結器配置CVIM Openstack SSL證書
簡介
本檔案介紹在思科彈性服務控制器中為虛擬化基礎架構管理員(VIM)連線新增更新的Openstack RESTAPI SSL憑證的程式。
必要條件
需求
思科建議您瞭解以下主題：
- Cisco Elastic Services Controller
- Cisco VIM/Openstack
採用元件
本文中的資訊係根據以下軟體和硬體版本：
- 思科彈性服務控制器5.10.0.95
- Cisco VIM 4.2.2
注意：此過程也適用於在增加新的VIM聯結器時新增加證書。
本文中的資訊是根據特定實驗室環境內的裝置所建立。文中使用到的所有裝置皆從已清除（預設）的組態來啟動。如果您的網路運作中，請確保您瞭解任何指令可能造成的影響。
設定
續訂Openstack RESTAPI SSL證書（Cisco VIM環境的haproxy證書）後，彈性服務控制器報告VIM連線失敗。
[admin@lab-esc-1 ~]$ tail -100f /var/log/esc/yangesc.log
2024-04-09 10:35:36.148 WARN ===== SEND NOTIFICATION STARTS =====
2024-04-09 10:35:36.148 WARN Type: VIM_CONNECTION_STATE
2024-04-09 10:35:36.148 WARN Status: FAILURE
2024-04-09 10:35:36.148 WARN Status Code: 500
2024-04-09 10:35:36.148 WARN Status Msg: VIM Connection State Down
2024-04-09 10:35:36.148 WARN Vim connector id: cvim-openstack-lab
2024-04-09 10:35:36.148 WARN ===== SEND NOTIFICATION ENDS =====
[admin@lab-esc-1 ~]$ sudo escadm vim show
{
"id":"cvim-openstack-lab",
"type":"OPENSTACK",
"last_checked":"2024-04-09T10:35:36.099",
"status":"CONNECTION_FAILED",
"status_message":"Unable to establish VIM connection",
}
組態
列出Elastic Services Controller truststore中的當前證書：
[admin@lab-esc-1 ~]$ escadm truststore show --verbose
esc, Mar 30, 2024, trustedCertEntry,
cvim-openstack-lab, Apr 4, 2024, trustedCertEntry,
將CA證書檔案複製/傳輸到彈性服務控制器VM。
1. 對於主用-備用彈性服務控制器設定，請將證書複製到主用VM。
2. 對於主用-主用ESC設定，請將證書複製到Geo-Primary Leader VM。
[admin@lab-esc-1 ~]$ ls -l /home/admin
-rw-r--r--. 1 admin admin 1911 Apr 9 06:20 cvim-openstack-lab-renewed_haproxy.crt
透過執行escadm truststore add命令向彈性服務控制器信任庫增加證書。
1. File引數是指型別為X.509 v1、v2和v3證書以及PKCS#7的CA證書檔案。
2. Alias引數是唯一的，它是指為此特定CA證書指定的名稱。
[admin@lab-esc-1 ~]$ sudo escadm truststore add --alias cvim-openstack-lab-renewed --file cvim-openstack-lab-renewed_haproxy.crt --verbose
CA certificate "cvim-openstack-lab-renewed" added successfully.
On ESC setup running ETSI, restart ETSI by running "sudo escadm etsi restart". All other components will reload the certificate automatically.
驗證
使用本節內容，確認您的組態是否正常運作。
驗證是否已成功將證書增加到Elastic Services Controller truststore。
[admin@lab-esc-1 ~]$ sudo escadm truststore show --verbose
esc, Mar 30, 2024, trustedCertEntry,
cvim-openstack-lab, Apr 4, 2024, trustedCertEntry,
cvim-openstack-lab-renewed, Apr 9, 2024, trustedCertEntry,
驗證VIM連線是否已啟動。
[admin@lab-esc-1 esc]$ sudo escadm vim show
{
"id":"cvim-openstack-lab",
"type":"OPENSTACK",
"last_checked":"2024-04-09T11:15:57.157",
"status":"CONNECTION_SUCCESSFUL",
"status_message":"Successfully connected to VIM"
}
[admin@lab-esc-1 ~]$ tail -100f /var/log/esc/yangesc.log
2024-04-09 11:15:57.188 INFO ===== SEND NOTIFICATION STARTS =====
2024-04-09 11:15:57.188 INFO Type: VIM_CONNECTION_STATE
2024-04-09 11:15:57.188 INFO Status: SUCCESS
2024-04-09 11:15:57.188 INFO Status Code: 200
2024-04-09 11:15:57.188 INFO Status Msg: VIM Connection State Up
2024-04-09 11:15:57.189 INFO Vim connector id: cvim-openstack-lab
2024-04-09 11:15:57.189 INFO ===== SEND NOTIFICATION ENDS =====
選擇性步驟
對於證書續訂，請在增加新證書後確認VIM連線已啟動後刪除舊證書。
[admin@lab-esc-1 ~]$ sudo escadm truststore delete --alias cvim-openstack-lab --verbose
CA certificate "cvim-openstack-lab" deleted successfully
[admin@lab-esc-1 ~]$ sudo escadm truststore show --verbose
esc, Mar 30, 2024, trustedCertEntry,
cvim-openstack-lab-renewed, Apr 9, 2024, trustedCertEntry,
疑難排解
本節提供的資訊可用於對組態進行疑難排解。
在增加新服務後，彈性服務控制器truststore將自動重新載入，因此VIM連線必須自動啟動。檢查escmanager日誌以在發生故障時進行故障排除。
[admin@lab-esc-1 ~]$ tail -100f /var/log/esc/escamanager.log
2024-04-09 11:15:55.369 INFO [SslManager.java:run:262] Change of type ENTRY_MODIFY is detected on truststore. Trigger reloading.
2024-04-09 11:15:55.370 INFO [SslManager.java:loadESCTruststore:215] ESC truststore file loaded successfully.
2024-04-09 11:15:55.375 INFO [SslManager.java:loadESCTruststore:226] Added Java default Root CA certificates: 136
2024-04-09 11:15:55.376 INFO [VimUtils.java:reloadVimManagerTrustStore:1057] Starting request to reload VimManager truststore.
2024-04-09 11:15:55.430 INFO [VimUtils.java:reloadVimManagerTrustStore:1065] Completed request to reload vimManager truststore.
2024-04-09 11:15:55.430 INFO [SslManager.java:run:270] Reloading of truststore is done.
2024-04-09 11:15:57.183 INFO [VimAuthenticationService.java:updateVimStatusFromNotification:709] Vim status message: VIM reachable; connection state: CONNECTED
2024-04-09 11:15:57.183 INFO [VimAuthenticationService.java:processVimStatusNotification:784] Sending VIM Status notification for vim cvim-openstack-lab, status CONNECTION_SUCCESSFUL
2024-04-09 11:16:31.428 INFO [VimUtils.java:getAuthStatusById:1077] VIM ID - cvim-openstack-lab, VimInfo is : VimInfoHolder [vimStatus=VIM_STATUS_REACHABLE, vimUserStatus=VIM_USER_STATUS_AUTHENTICATED, ts=2024-04-09T11:15:57.157]
修訂記錄
| 修訂 | 發佈日期 | 意見 |
|---|---|---|
1.0 |
29-Apr-2024 |
初始版本 |
意見