Install a Multi-Node Air-Gapped Deployment

The install assumes that you have CentOS 7 as your operating system. Check your CentOS 7 version.

$ sudo cat /etc/centos-release

Set the user for the target machine to a username of your choice. For example, autoid.

$ sudo adduser autoid

Set the password for the user you created in the previous step.

$ sudo passwd autoid

Configure the user for passwordless sudo.

$ echo "autoid  ALL=(ALL)  NOPASSWD:ALL" | sudo tee /etc/sudoers.d/autoid

Add administrator privileges to the user.

$ sudo usermod -aG wheel autoid

Change to the user account.

$ su - autoid

Install yum-utils package on the deployer machine. yum-utils is a utilities manager for the Yum RPM package repository. The repository compresses software packages for Linux distributions.

$ sudo yum install -y yum-utils

Create the installation directory. Note that you can use any install directory for your system as long as your run the deployer.sh script from there. Also, the disk volume where you have the install directory must have at least 8GB free space for the installation.

$ mkdir ~/autoid-config

On the deployer machine, run ssh-keygen to generate an RSA keypair, and then click Enter. You can use the default filename. Enter a password for protecting your private key.

$ ssh-keygen -t rsa -C "autoid"

Copy the SSH key to the autoid-config directory.

$ cp ~/.ssh/id_rsa ~/autoid-config

Change the privileges to the file.

$ chmod 400 ~/autoid-config/id_rsa

On the deployer machine, change to the installation directory.

$ cd ~/autoid-config/

Log in to the ForgeRock Google Cloud Registry (gcr.io) using the registry key. The registry key is only available to ForgeRock Autonomous Identity customers. For specific instructions on obtaining the registry key, see How To Configure Service Credentials (Push Auth, Docker) in Backstage.

$ docker login -u _json_key -p "$(cat autoid_registry_key.json)" https://gcr.io/forgerock-autoid

Login Succeeded

Run the create-template command to generate the deployer.sh script wrapper. Note that the command sets the configuration directory on the target node to /config. Note that the --user parameter eliminates the need to use sudo while editing the hosts file and other configuration files.

$ docker run --user=$(id -u) -v ~/autoid-config:/config -it gcr.io/forgerock-autoid/deployer:2021.8.2 create-template

Open the ~/autoid-config/vars.yml file, set the offline_mode property to true, and then save the file.

offline_mode: true

Download the Docker images. This step downloads software dependencies needed for the deployment and places them in the autoid-packages directory.

$ sudo ./deployer.sh download-images

Create a tar file containing all of the Autonomous Identity binaries.

$ tar czf autoid-packages.tgz deployer.sh autoid-packages/*

Copy the autoid-packages.tgz to a portable hard drive.

Create the ~/autoid-config directory if you haven’t already.

$ mkdir ~/autoid-config

Unpack the tar file.

$ tar xf autoid-packages.tgz -C ~/autoid-config

On the air-gap host node, copy the SSH key to the ~/autoid-config directory.

$ cp ~/.ssh/id_rsa ~/autoid-config

Change the privileges to the file.

$ chmod 400 ~/autoid-config/id_rsa

Change to the configuration directory.

$ cd ~/autoid-config

Install Docker.

$ sudo ./deployer.sh install-docker

Log out and back in.

Change to the configuration directory.

$ cd ~/autoid-config

Import the deployer image.

$ ./deployer.sh import-deployer

Create the configuration template using he create-template command. This command creates a configuration file, ansible.cfg.

$ ./deployer.sh create-template

Make the script executable.

$ chmod +x deployer.sh

To see the list of commands, enter deployer.sh.

$ ./deployer.sh

Usage: deployer <command>

Commands:
  create-template
  download-images
  import-deployer
  encrypt-vault
  decrypt-vault
  run
  create-tar
  install-docker
  install-dbutils
  upgrade

Open a text editor and edit the ~/autoid-config/ansible.cfg to set up the remote user and SSH private key file location on the target node. Make sure that the remote_user exists on the target node and that the deployer machine can ssh to the target node as the user specified in the id_rsa file.

[defaults]
host_key_checking = False
remote_user = autoid
private_key_file = id_rsa

On the deployer machine, open a text editor and edit the ~/autoid-config/vars.yml file to configure specific settings for your deployment:

Open a text editor and enter the public IP addresses of the target machines in the ~/autoid-config/hosts file. Make sure the target host IP addresses are accessible from the deployer machine. The following is an example of the ~/autoid-config/hosts file:

[docker-managers]
10.128.0.90

[docker-workers]
10.128.0.170

[docker:children]
docker-managers
docker-workers

[cassandra-seeds]
10.128.0.175
10.128.0.34

[spark-master]
10.128.0.180

[spark-workers]
10.128.0.176
10.128.0.177

[spark:children]
spark-master
spark-workers

[mongo_master]
#ip#  mongodb_master=True

[mongo_replicas]
#ip-1#
##ip-2#
##…​

[mongo:children]
mongo_replicas
mongo_master

# ELastic Nodes
[odfe-master-node]
10.128.0.178

[odfe-data-nodes]
10.128.0.184

[kibana-node]
10.128.0.184

[notebook]
#ip#

Set the Autonomous Identity passwords, located at ~/autoid-config/vault.yml.

configuration_service_vault:
    basic_auth_password: ~@C~O>@%^()-_+=|<Y*$$rH&&/m#g{?-o!z/1}2??3=!*&

cassandra_vault:
    cassandra_password: ~@C~O>@%^()-_+=|<Y*$$rH&&/m#g{?-o!z/1}2??3=!*&
    cassandra_admin_password: ~@C~O>@%^()-_+=|<Y*$$rH&&/m#g{?-o!z/1}2??3=!*&
    keystore_password: Acc#1234
    truststore_password: Acc#1234

mongo_vault:
    mongo_admin_password: ~@C~O>@%^()-_+=|<Y*$$rH&&/m#g{?-o!z/1}2??3=!*&
    mongo_root_password: ~@C~O>@%^()-_+=|<Y*$$rH&&/m#g{?-o!z/1}2??3=!*&
    keystore_password: Acc#1234
    truststore_password: Acc#1234

elastic_vault:
    elastic_admin_password: ~@C~O>@%^()-_+=|<Y*$$rH&&/m#g{?-o!z/1}2??3=!*&
    elasticsearch_password: ~@C~O>@%^()-_+=|<Y*$$rH&&/m#g{?-o!z/1}2??3=!*&
    keystore_password: Acc#1234
    truststore_password: Acc#1234

Encrypt the vault file that stores the Autonomous Identity passwords, located at ~/autoid-config/vault.yml. The encrypted passwords will be saved to /config/.autoid_vault_password . The /config/ mount is internal to the deployer container.

$ ./deployer.sh encrypt-vault

Run the deployment.

$ ./deployer.sh run

Configure your DNS servers to access Autonomous Identity dashboard on the target node. The following domain names must resolve to the IP address of the target node: <target-environment>-ui.<domain-name>.

If DNS cannot resolve target node hostname, edit it locally on the machine that you want to access Autonomous Identity using a browser. Open a text editor and add an entry in the /etc/hosts (Linux/Unix) file or C:\Windows\System32\drivers\etc\hosts (Windows) for the self-service and UI services for each managed target node.

<Target IP Address>  <target-environment>-ui.<domain-name>

34.70.190.144  autoid-ui.forgerock.com

If you set up a custom domain name and target environment, add the entries in /etc/hosts. For example:

34.70.190.144  myid-ui.abc.com

Open a browser. If you set up your own url, use it for your login.

$ https://autoid-ui.forgerock.com/

Log in as a test user.

test user: bob.rodgers@forgerock.com
password: <password>