Scale out Workspace ONE Access for high availability in VMware Aria Suite Lifecycle
Workspace ONE Access
for high availability in VMware Aria Suite Lifecycle
To increase high availability options in
Workspace ONE Access
, use VMware Aria Suite Lifecycle
. Note that the VMware Identity Manager and
Workspace ONE Access
terms are
used interchangeably in VMware Aria Suite Lifecycle
product documentation.For a
Workspace ONE Access
cluster and
replace certificate actions, take a snapshot of the Workspace ONE Access
nodes before performing any scaling
operations. For related information about replacing the VMware Identity Manager
certificate, see Replace your Workspace ONE Access certificate by using VMware Aria Suite Lifecycle.You should configure a load balancer and
add its VIP to the certificate before performing the scale-out operation. For
information about configuring a load balancer, see the product documentation. For additional information, refer to the
VMware Aria Automation
and VMware Aria Automation Orchestrator
Load BalancingWorkspace ONE Access
load-balancing documentation to configure highly-available identity provider for
VMware Aria Automation
.Workspace ONE Access
does not support
SSL passthrough. You must manually import the certificate into the load balancer
before performing this scale-out operation.- Take a snapshot of theWorkspace ONE Accessnode andVMware Aria Suite Lifecyclebefore you perform the scale-out operation. Scale out allows you to go from one node to three nodes.
- Verify that there is a certificate already added in theVMware Aria Suite LifecycleLocker. This certificate should include in the SAN field the FQDN of the three nodes and load balancer. IPs are optional.
- Verify that there is a single A and single PTR DNS record created for each of the two new nodes and the load balancer.
- The Scale Out operation requires four additional IPs - two for the secondary nodes, one for the load balancer, and one for the delegate IP. The delegate IP does not require a DNS record.
- Replace the certificate on the standaloneWorkspace ONE Accessnode. The certificate should also have the SAN entries of all the three nodes or wild-card certificate. For information on replacing certificates, see Replace certificate for VMware Aria Suite Lifecycle products.
- Scale-In is not supported when you deployWorkspace ONE Accesscluster throughVMware Aria Suite Lifecycle.If you apply KB 87185 patch on a single node appliance, and then perform scale-out to cluster operations, follow KB 87185 to apply the patch on the scaled out nodes.
- Navigate toEnvironments, on the environment page, clickAdd Component.
- Enter theInfrastructuredetails and clickNext.
- Enter theNetworkdetails and clickNext.Verify that the primary node and the additional components use the same default gateway and they are connected with each other.
- On theProduct Properties, the certificate details are auto-populated.
- On theComponentstab, selectTake product snapshotorRetain product snapshot taken. If theTake product snapshotis set to true, the snapshot is taken prior to starting scale out, and can be rolled back to its initial state during a scale out failure, the snapshot is taken with the prefixLCM_AUTOGENERATED. If theRetain product snapshot takenis set to true, it can be retained.A snapshot rollback action is available for the failed scale out request on the requests page.
- Enter the load balancer host name.
- Enter a delegate IP address.The delegate IP address is used internally as a proxy to postgres master (primary). It should be a free or an available IP address. This is not same as the IP address used to load-balance the application.You can add two components of type secondary and provide an FQDN and IP address. It is recommended for aWorkspace ONE Accesscluster to contain of three nodes behind a load balancer.
- Click and run the pre-check.
- ClickSubmit.If you do not restart the appliance, the scale-out procedure fails with anunable to find root certificateerror.