Prepare for installation
Before installing IA Cloud, you have to configure the environment.
First, make sure that:
- An application user exists on each server, according to the requirements.
- The installation directory (for example,
/opt/workfusion) exists on the Master server, and the application user is its owner.
Get installation package
In the installation directory, create another folder for the WorkFusion installation package (
PACKAGE_DIR), for example,/opt/workfusion/wf_installer. Grant the read access to the directory to all users:$ mkdir -p /opt/workfusion/wf_installer $ chmod 0755 /opt/workfusion/wf_installerDownload the provided installation package with any file retrieving tool, for example,
wgetorcurl:$ curl 'https://LINK_TO_INSTALLER' --output /opt/workfusion/workfusion-full-package-<VERSION>.tar.gzIf the Internet access is not available on the Master server, download the installer and copy it as
/opt/workfusion/workfusion-full-package-.tar.gzon the Master server.note
When downloading the Analytics component, you can select the following packages:
- Newer package with Tableau 2021.4.3 containing the out-of-the-box Log4j fix:
WorkFusionAnalyticsInstaller-10.1.7-tableau-2021-4-2.zip. - Standard package with Tableau 2018.3.2:
WorkFusionAnalyticsInstaller-10.1.7.0.zip. In this case, you must mitigate the Log4j issue manually, by following the guide.
- Newer package with Tableau 2021.4.3 containing the out-of-the-box Log4j fix:
Extract the downloaded package to the directory:
$ tar -xzvf /opt/workfusion/workfusion-full-package-<VERSION>.tar.gz --strip 1 -C /opt/workfusion/wf_installer
Configure installation server
To configure the Master server, specify hostnames, ports, and installation parameters in the configuration files.
Specify hostnames
Before configuring installation parameters, you must already have proper DNS resolution configured of all servers hostnames.
In your PACKAGE_DIR directory, open the hosts.yml configuration file and enter the prepared hostnames of each component according to the selected setup type: high-availability (HA) or the Basic one.
$ vi hosts.yml
# The 'vi' text editor is used in the example
# Press 'i' to enter the editing mode.
# Add the required DNS name.
# After you add the values, press <Esc>, then type ":wq", and press <Return> to save the changes and quit the editing mode.
The DNS settings are different for the high availability and basic setup. See the corresponding tab.
important
When specifying DNS names in hosts.yml, use lowercase letters only.
mssql_hostname: host-mssql1.example.com
master_hostnames: host-master1.example.com,host-master2.example.com,host-master3.example.com
agent_hostnames: host-agent1.example.com,host-agent2.example.com,host-agent3.example.com
rpa_hostnames: host-rpa1.example.com,host-rpa2.example.com
bi_hostnames: host-bi1.example.com,host-bi2.example.com
ocrwin_hostnames: # Starting from 10.1.4.1., Windows-based OCR is not supported for the new installations. Keep the value of the ocrwin_hostnames parameter empty. You can use windows-based OCR if you perform an upgrade from the previous version and already have WinOCR.
# Mandatory DNS aliases
vault_lb_hostname: host-vault-lb1.example.com
minio_lb_hostname: host-minio-lb1.example.com
minio_ui_lb_hostname: host-minio-ui-lb1.example.com
nexus_lb_hostname: host-nexus-lb1.example.com
rabbitmq_lb_hostname: host-rabbitmq-lb1.example.com
mesos_lb_hostname: host-mesos-lb1.example.com
marathon_lb_hostname: host-marathon-lb1.example.com
workspace_lb_hostname: host-workspace-lb1.example.com
workfusion_lb_hostname: host-workfusion-lb1.example.com
bot_manager_lb_hostname: host-bot-manager-lb1.example.com
kibana_lb_hostname: host-kibana-lb1.example.com
ocr_lb_hostname: host-ocr-lb1.example.com
bi_lb_hostname: host-bi-lb1.example.com
keycloak_lb_hostname: host-auth-lb1.example.com
mssql_hostname: host-mssql1.example.com
master_hostnames: host-master1.example.com
agent_hostnames: host-agent1.example.com
rpa_hostnames: host-rpa1.example.com
bi_hostnames: host-bi1.example.com
ocrwin_hostnames: # Starting from 10.1.4.1., Windows-based OCR is not supported for the new installations. Keep the value of the ocrwin_hostnames parameter empty. You can use windows-based OCR if you perform an upgrade from the previous version and already have WinOCR.
# Mandatory DNS aliases
vault_lb_hostname: host-vault-lb1.example.com
minio_lb_hostname: host-minio-lb1.example.com
minio_ui_lb_hostname: host-minio-ui-lb1.example.com
nexus_lb_hostname: host-nexus-lb1.example.com
rabbitmq_lb_hostname: host-rabbitmq-lb1.example.com
mesos_lb_hostname: host-mesos-lb1.example.com
marathon_lb_hostname: host-marathon-lb1.example.com
workspace_lb_hostname: host-workspace-lb1.example.com
workfusion_lb_hostname: host-workfusion-lb1.example.com
bot_manager_lb_hostname: host-bot-manager-lb1.example.com
kibana_lb_hostname: host-kibana-lb1.example.com
ocr_lb_hostname: host-ocr-lb1.example.com
bi_lb_hostname: host-bi-lb1.example.com
keycloak_lb_hostname: host-auth-lb1.example.com
Specify ports
First, make sure you have opened the network equipment ports used by components for internal communications. After that, on the Master server, in the PACKAGE_DIRdirectory, edit the ports.yml file to specify the ports.
$ vi ports.yml
Click to open a sample ports.yml file
# !IMPORTANT
# It is highly advised NOT to changed any ports in this ports.yml file as they are used for product components inter-communication and are NOT externally facing.
# The ports which you might have a reason to change are located in config.yml.
# If you decide to change any ports here:
# - ensure that NONE of the ports in this file have duplicated values (ports on linux and windows machines may have duplicates);
# - ensure ports defined in ports.yml don't conflict with ports defined in config.yml (lb_port, lb_port_ssl, ssh_port, winrm_port (for windows hosts))
# - ensure you don't use privileged port values from range '1-1024'.
# - 80/443 can ONLY be used for lb_port/lb_port_ssl settings in config.yml.
# Don't change the ports which are marked "Don't change it" in comment. Otherwise installation or upgrade may fail.
# However, there might be several reasons when you want to change some ports here, in ports.yml:
#
# 1. You have a firewall policy which restricts 80/443 ports from EXTERNAL access from browsers (or internally for inter-server communication).
# For example, you've changed "lb_port/lb_port_ssl" ports in config.yml from 80/443 to 8080/8443.
# In this case you need to change "nginx_port/nginx_port_ssl" in ports.yml to different values to avoid port conflicts, for example to "8088/8444"
#
# 2. You have a firewall policy in your network which restricts some port from this file for INTERNAL communication between servers of Workfusion IA Cloud environment.
# In this case you have information about which exact ports are restricted. If don't find them in this file, it's OK. You don't need to change anything.
# If you find some restricted port, read port description firstly. You need to change it ONLY if it listens on '0.0.0.0'.
# If port is marked as "Listens on 127.0.0.1" it means that it doesn't take part in communication between any servers, and binds to local interface. Thus firewall restriction will not take affect.
# ALL Servers (MASTER, AGENT, RPA)
nginx_port: '8080' # Listens on 0.0.0.0. Nginx HTTP port. Redirects requests to "nginx_port_ssl".
nginx_port_ssl: '8443' # Listens on 0.0.0.0. Nginx HTTPS port. Used to proxy requests from Haproxy (from lb_port_ssl) to destination product components.
nginx_status_port: '50080' # Listens on 127.0.0.1. Nginx HTTP port for statistics page. Used for monitoring.
# Master server ports
tds_port: '9090' # Listens on 127.0.0.1 (HTTP). Spring Boot port where task-dispatcher is listening.
tds_mtls_port: '9092' # Listens on 0.0.0.0 (HTTPS). Nginx port. Proxies requests from to 'tds_port'. Validates client certs .
vault_port: '8200' # Listens on 0.0.0.0 (HTTPS). Hashicorp Vault port.
vault_cluster_port: '8201' # Listens on 0.0.0.0 (HTTPS). Port on which Vault listens for server-to-server cluster requests. Only active nodes have active listeners. When a node becomes active it will start cluster listeners, and when it becomes standby it will stop them.
nexus_port: '8082' # Listens on 127.0.0.1 (HTTP). Sonatype Nexus port.
etcd_cluster_port: '2380' # Listens on 0.0.0.0 (HTTPS). ETCD cluster port.
etcd_port: '2379' # Listens on 0.0.0.0 (HTTPS). ETCD server port.
kes_port: '7373' # Listens on 0.0.0.0 (HTTPS). MinIO KES port
kes_proxy_port: '7374' # Listens on 0.0.0.0 (HTTPS). HAPROXY and Load Balancer port for KES.
minio_api_port: '9000' # Listens on 127.0.0.1 (HTTP). Minio API port (S3 emulator).
minio_ui_port: '9001' # Listens on 127.0.0.1 (HTTP). Minio UI port (for access from browser).
elasticsearch_port: '9200' # Listens on 0.0.0.0 (HTTPS). Elasticsearch port.
elasticsearch_transport_port: '9300' # Listens on 0.0.0.0 (HTTPS). Elasticsearch port to bind for communication between nodes (used in HA mode).
logstash_filebeat_port: '4567' # Listens on 0.0.0.0 (HTTPS). Logstash port.
logstash_metricbeat_port: '4569' # Listens on 0.0.0.0 (HTTPS). Logstash port.
logstash_heartbeat_port: '4571' # Listens on 0.0.0.0 (HTTPS). Logstash port.
logstash_bep_metrics_port: '15072' # Listens on 0.0.0.0 (HTTPS). Logstash port.
logstash_bep_logs_port: '4570' # Listens on 0.0.0.0 (HTTPS). Logstash port.
logstash_ocr_metrics_port: '15073' # Listens on 0.0.0.0 (HTTPS). Logstash port.
rabbitmq_api_port: '15672' # Listens on 127.0.0.1 (HTTP). RabbitMQ API port.
rabbitmq_api_proxy_port: '9064' # Listens on 0.0.0.0 (HTTPS). Nginx port. Proxies requests to 'rabbitmq_api_port'.
rabbitmq_amqp_port: '5672' # Listens on 0.0.0.0 (TLS ecrtypted AMQP). RabbitMQ message Queue port.
rabbitmq_erlang_distr_server_port: '25672' # Listens on 0.0.0.0 (TCP). Port used for rabbitmq cluster inter-node and CLI tool communication
rabbitmq_erlang_distr_client_ports: '35672-35682' # Listen on 0.0.0.0 (TCP). Inter-node Communication Port Range for rabbitmq cluster
rabbitmq_erlang_empd_port: '4369' # Listens on 0.0.0.0 (TCP). The port where Erlang Port Mapper Daemonepmd (or "epmd") is listening. This daemon acts as a name server on all hosts of rabbitmq cluster. When rabbitmq node starts, the node has a name and it obtains an address from the host OS kernel
zookeeper_port: '2181' # Listens on 0.0.0.0 (ZK). Zookeeper port. Used by mesos and marathon as they don't support SSL communication with ZK.
zookeeper_secure_port: '2281' # Listens on 0.0.0.0 (ZK/SSL). Zookeeper SSL port. Used by Worfusion IA Cloud product components.
zookeeper_cluster_port: '2888' # Listens on 0.0.0.0 (TCP). Zookeeper peers use this port to connect to other peers. More specifically, ZooKeeper server uses this port to connect followers to the leader. When a new leader arises, a follower opens a TCP connection to the leader using this port
zookeeper_leader_election_port: '3888' # Listens on 0.0.0.0 (TCP). Zookeeper port used for leader election. Because the default leader election also uses TCP, Zookeeper cannot use the same "zookeeper_cluster_port" for this. Thus it is required to have another port for leader election
workfusion_port: '7080' # Listens on 127.0.0.1 (HTTP). Tomcat port where Control Tower is listening.
workfusion_tomcat_cluster_port: '7088' # Listens on 127.0.0.1 (HTTP). Tomcat port for Control Tower clustering.
ct_hazelcast_port: '5702' # Don't change it. Listens on 0.0.0.0 (HTTPS). Hazelcast port for Control Tower. If you change it installation will fail on Control Tower startup (RCM-4175)
workspace_port: '5080' # Listens on 127.0.0.1 (HTTP). Workspace port.
sqc_port: '4080' # Listens on 127.0.0.1 (HTTP). Tomcat port where AutoQC is listening.
sqc_tomcat_cluster_port: '4088' # Listens on 127.0.0.1 (HTTP). Tomcat port for SQC clustering.
sqc_mtls_port: '4084' # Listens on 0.0.0.0 (HTTPS). Nginx port. Proxies requests using http to localhost's 'sqc_port'.
sqc_mtls_client_port: '4082' # Listens on 127.0.0.1 (HTTP). Nginx port. Used by CT to send requests to SQC service. Forwards requests using HTTPS to LB, to SQC endpoint
bot_manager_port: '5555' # Listens on 127.0.0.1 (HTTP). Spring Boot port where bot-manager service is listening.
kibana_port: '5601' # Listens on 127.0.0.1 (HTTP). Kibana port.
wms_mtls_client_port: '9095' # Don't change it. Listens on 127.0.0.1 (HTTP). Nginx port. Used by CT to proxy requests to WMS service mtls endpoint.
ags_mtls_client_port: '9077' # Don't change it. Listens on 127.0.0.1 (HTTP). Nginx port. Used by CT to proxy requests to AGS service mtls endpoint.
workspace_mtls_client_port: '5082' # Listens on 127.0.0.1 (HTTP). Nginx port. Used by Workers to proxy requests to Workspace mtls endpoint (/workspace/api/internal).
workfusion_mtls_client_port: '7081' # Listens on 127.0.0.1 (HTTP). Nginx port. Used by Workers to proxy requests to Control Tower mtls endpoint (internal-api).
vault_proxy_port: '8202' # Listens on 0.0.0.0 (HTTPS). HAPROXY and Load Balancer port for Vault.
zoonavigator_port: '8090' # Listens on 127.0.0.1 (HTTP). Not used by default. Zoonavigator port. Used only if you install product with "install_zoonavigator: true" option (not secure).
keycloak_port: '9099' # Listens on 127.0.0.1 (HTTPS). Used in product versions 10.2+. Jboss Keycloak port.
keycloak_tcpping_port: '7600' # Listens on 0.0.0.0 (HTTPS). Used in product versions 10.2+. Used for Keycloak in tcpping protocol for HA installation.
keycloak_ajp_port: '8009' # Listens on 127.0.0.1. Used in product versions 10.2+. AJP Keycloak port.
keycloak_management_http_port: '9990' # Listens on 127.0.0.1 (HTTP). Used in product versions 10.2+. Defines the HTTP connection used by Wildfly CLI and web console.
keycloak_modcluster_port: '23364' # Listens on 224.0.1.105 multicast address. Used in product versions 10.2+. Used in modcluster module.
keycloak_mail_smtp_port: '25' # Listens on 127.0.0.1. Used in product versions 10.2+. Mail smtp port.
wms_port: '9091' # Listens on 127.0.0.1 (HTTP). Spring Boot port where worker-management-service is listening.
wms_mtls_port: '9093' # Listens on 0.0.0.0 (HTTPS). Nginx port. Proxies requests to 'wms_port'.
ags_port: '9070' # Listens on 127.0.0.1 (HTTP). Spring Boot port where automl-gateway-service is listening.
ags_mtls_port: '9073' # Listens on 0.0.0.0 (HTTPS). Nginx port. Proxies requests to 'ags_port'.
ams_port: '9071' # Listens on 127.0.0.1 (HTTP). Spring Boot port where automl-model-service is listening.
ams_mtls_port: '9075' # Listens on 0.0.0.0 (HTTPS). Nginx port. Proxies requests to 'ams_port'.
amms_port: '9072' # Listens on 127.0.0.1 (HTTP). Spring Boot port where automl-model-management-service is listening.
amms_mtls_port: '9076' # Listens on 0.0.0.0 (HTTPS). Nginx port. Proxies requests to 'amms_port'.
abs_port: '9080' # Listens on 127.0.0.1 (HTTP). Spring Boot port where automl-billing-service is listening.
abs_mtls_port: '9094' # Listens on 0.0.0.0 (HTTPS). Nginx port. Proxies requests to 'abs_port'
apm_port: '8203' # Listens on 127.0.0.1 (HTTP). Elastic APM port where APM server is listening.
ocr_port: '9002' # Listens on 127.0.0.1 (HTTP). Spring Boot port where OCR Rest API is listening.
marathon_port: '8480' # Don't change it. Listens on 0.0.0.0 (HTTPS). Marathon Port.
marathon_communication_port: '15000' # Listens on 0.0.0.0 (HTTPS). The port used by Marathon for libprocess communication between clustered nodes.
mesos_master_port: '5050' # Listens on 0.0.0.0 (HTTPS). Mesos master port.
hazelcast_server_app_port: '9061' # Listens on 127.0.0.1 (HTTP). Spring-boot port where hazelcast-server is listening.
hazelcast_server_app_mtls_port: '9063' # Listens on 0.0.0.0 (HTTPS). Nginx port. Proxies requests to 'hazelcast_server_app_port'.
hazelcast_server_communication_port: '9702' # Don't change it. Listens on 0.0.0.0 (HTTPS). Hazelcast server port.
tds_mtls_client_port: '9097' # Don't change it. Listens on 127.0.0.1 (HTTP). Nginx port. Used by WMS to proxy requests to TDS mtls endpoint.
ams_mtls_client_port: '9085' # Listens on 127.0.0.1 (HTTP). Nginx port. Used by AGS to proxy requests to AMS mtls endpoint.
amms_mtls_client_port: '9087' # Listens on 127.0.0.1 (HTTP). Nginx port. Used by AGS to proxy requests to AMMS mtls endpoint.
nfs_lockd_tcp_port: '32800' # NFS lockd TCP port. Used by internal NFS server only in non-HA mode, and only when "nfs_enabled: True". Added here for observability.
nfs_lockd_udp_port: '32700' # NFS lockd UDP port. Used by internal NFS server only in non-HA mode, and only when "nfs_enabled: True". Added here for observability.
nfs_mountd_port: '20048' # Don't change it. NFS mountd TCP/UDP port. Used by internal NFS server only in non-HA mode, and only when "nfs_enabled: True". Added here for observability.
nfs_portmap_port: '111' # Don't change it. NFS portmap TCP/UDP port. Used by internal NFS server only in non-HA mode, and only when "nfs_enabled: True". Added here for observability.
nfsd_port: '2049' # Don't change it. NFS daemon TCP/UDP port. Used by internal NFS server only in non-HA mode, and only when "nfs_enabled: True". Added here for observability.
dataset_management_port: '9074' # Listens on 127.0.0.1 (HTTP). Spring Boot port where Dataset Management is listening.
dataset_management_mtls_port: '9079' # Listens on 0.0.0.0 (HTTPS). Nginx port. Proxies requests to 'dataset_management_port'.
dataset_management_mtls_client_port: '9081' # Don't change it. Listens on 127.0.0.1 (HTTP). Nginx port. Used by AutoML to proxy requests to Dataset Management Service mtls endpoint.
labeling_service_port: '9078' # Listens on 127.0.0.1 (HTTP). Spring Boot port where Labeling Service is listening.
manual_task_renderer_app_port: '8990' # Listens on 127.0.0.1 (HTTP). Spring Boot port where manual task renderer is listening.
jmx_monitoring_tds_port: '10600' # Listens on 127.0.0.1 (HTTP). Not used by default. Task-dispatcher-service JMX monitoring port. Used only if you deploy product with "jmx_monitoring_enabled: true" setting (not secure).
jmx_monitoring_ct_port: '10602' # Listens on 127.0.0.1 (HTTP). Not used by default. Control Tower JMX monitoring port. Used only if you deploy product with "jmx_monitoring_enabled: true" setting (not secure).
jmx_monitoring_ws_port: '10604' # Listens on 127.0.0.1 (HTTP). Not used by default. Workspace JMX monitoring port. Used only if you deploy product with "jmx_monitoring_enabled: true" setting (not secure).
jmx_monitoring_bm_port: '10605' # Listens on 127.0.0.1 (HTTP). Not used by default. Bot-manager JMX monitoring port. Used only if you deploy product with "jmx_monitoring_enabled: true" setting (not secure).
jmx_monitoring_sqc_port: '10601' # Listens on 127.0.0.1 (HTTP). Not used by default. SQC JMX monitoring port. Used only if you deploy product with "jmx_monitoring_enabled: true" setting (not secure).
jmx_monitoring_wms_port: '10606' # Listens on 127.0.0.1 (HTTP). Not used by default. Worker-management-service JMX monitoring port. Used only if you deploy product with "jmx_monitoring_enabled: true" setting (not secure).
jmx_monitoring_ags_port: '10607' # Listens on 127.0.0.1 (HTTP). Not used by default. Automl-gateway-service JMX monitoring port. Used only if you deploy product with "jmx_monitoring_enabled: true" setting (not secure).
jmx_monitoring_ams_port: '10608' # Listens on 127.0.0.1 (HTTP). Not used by default. Automl-model-service JMX monitoring port. Used only if you deploy product with "jmx_monitoring_enabled: true" setting (not secure).
jmx_monitoring_amms_port: '10609' # Listens on 127.0.0.1 (HTTP). Not used by default. Automl-model-management-service JMX monitoring port. Used only if you deploy product with "jmx_monitoring_enabled: true" setting (not secure).
jmx_monitoring_hs_port: '10610' # Listens on 127.0.0.1 (HTTP). Not used by default. Hazelcast-server JMX monitoring port. Used only if you deploy product with "jmx_monitoring_enabled: true" setting (not secure).
jmx_monitoring_ocr_rest_port: '10612' # Listens on 127.0.0.1 (HTTP). Not used by default. OCR Rest JMX monitoring port. Used only if you deploy product with "jmx_monitoring_enabled: true" setting (not secure).
jmx_monitoring_dataset_management_port: '10613' # Listens on 127.0.0.1 (HTTP). Not used by default. Dataset Management JMX monitoring port. Used only if you deploy product with "jmx_monitoring_enabled: true" setting (not secure).
jmx_monitoring_labeling_service_port: '10614' # Listens on 127.0.0.1 (HTTP). Not used by default. Labeling Service JMX monitoring port. Used only if you deploy product with "jmx_monitoring_enabled: true" setting (not secure).
jmx_monitoring_abs_port: '10615' # Listens on 127.0.0.1 (HTTP). Not used by default. Automl-billing-service JMX monitoring port. Used only if you deploy product with "jmx_monitoring_enabled: true" setting (not secure).
# AGENT server ports
mesos_slave_port: '5051' # Listens on 0.0.0.0 (HTTPS). Mesos Agent port.
mesos_slave_port_range: '40000-44000' # Listens on 0.0.0.0 (HTTPS). Ports range on mesos Agent(s) used for communication with Mesos Master (ports from this range are opened randomly during tasks execution).
input_connector_rest_port: '8081' # Listens on 0.0.0.0 (HTTP) input-connector-rest port.
# Additional ports listening on AGENT server(s): ags_mtls_client_port, workfusion_mtls_client_port, workspace_mtls_client_port
# RPA Windows Server ports
bot_manager_mtls_client_port: '5555' # Listens on 127.0.0.1 (HTTP). Nginx port. Used by workers to proxy requests to bot-manager from RPA server.
rdp_port: '3389' # Listens on 0.0.0.0 (RDP). Remote Desktop port. Used by bot manager to login into RPA server.
# Additional ports listening on RPA servers: {nginx_port}, {nginx_port_ssl}, {workfusion_mtls_client_port}, {ags_mtls_client_port}
# BI Windows Server ports
wf_tableau_port: '8850' # Listens on 127.0.0.1 (HTTP). Tableau administration port.
# Additional ports listening on BI servers: {lb_port, lb_port_ssl}
Specify RPA users
To configure RPA servers, on the Master server, in the PACKAGE_DIR directory, edit the rpa.yml file, and add the credentials of the RPA users for all RPA servers.
$ vi rpa.yml
Click to open a sample RPA.yml file
rpa_ad_domain: ''
rpa_machines:
rpa1.example.com:
-
unit: 'master'
username: 'USERNAME'
password: 'PASSWORD'
-
unit: 'unit_1'
username: 'USERNAME'
password: 'PASSWORD'
-
unit: 'unit_2'
username: 'USERNAME'
password: 'PASSWORD'
rpa2.example.com:
-
unit: 'master'
username: 'USERNAME'
password: 'PASSWORD'
-
unit: 'unit_1'
username: 'USERNAME'
password: 'PASSWORD'
-
unit: 'unit_2'
username: 'USERNAME'
password: 'PASSWORD'
The file contains the following configurable parameters:
rpa_ad_domain: if Active Directory Domain users are used forunit, specify the Active Directory domain name for therpa_ad_domainsetting. Example:rpa_ad_domain: 'EXAMPLE.COM'.rpa[X].example.com: the RPA host. Specify the same host inhosts.yml. If you have several hosts, add them to therpa.ymlandhosts.ymlfiles. Each host must include at least one of the following user's configuration blocks.unit: type of the user. Possible values:master: Bot Master user.unit_[X]: Bot Unit user.If you use Windows Server 2016 on your RPA server (the RPD-to-RDP RPA installation), specify one
unit: 'master'and all the Bot Unit users (unit: 'unit_1',unit: 'unit_2', and so on) on this host. Each host can have a different number of users.vdi: a non-RDP user. If you have Windows 10 or 8 as your RPA server OS (VDI installation), specify only oneunit:'vdi'on this host.
username: name of theunituser.For Active Directory, specify users in the format:
DOMAIN\usernameorLOCALHOST\usernameif they belong to different types. For example, BotMaster is a domain account, while BotUnits are local.password: password of theunituser.
note
You can also complete the file automatically. For details, see rpa.yml options.
Specify installation parameters
By default, the config.yml file doesn't contain passwords. You must generate them with the following script or set manually.
To specify the installation parameters:
On the Master server, in the
PACKAGE_DIRdirectory, change the permissions for theconfig.ymlfile:$ sudo chmod 644 config.ymlOpen the
config.ymlfile. In the parameteransible_vault_password, change the ansible vault password:$ vi config.ymlThe password is used to encrypt
config.ymlat the subsequent step and is asked several times during the installation. Ensure to secure and memorize it.For the high availability setup only. In
config.yml, in the HA mode section, set the following mandatory parameter to enable the high availability mode:ha_mode: true.Note: skip this step if you plan to set up IA Cloud Enterprise in the basic mode.
On the Master server, run the following command to automatically generate passwords for the WorkFusion internal services according to product policies.
$ ./install.sh passwords generateAs a result, in
config.yml, passwords for most services are created, except for the following end-user ones:rpa_pass: bi_pass:Alternatively, you can set the passwords manually. In that case, remember to use only Latin letters and allowed symbols. If needed, change other secrets and parameters. After that, save and close the file.
When creating passwords, make sure they are strong enough and meet the following requirements:
- At least one space should be present between each 'key: value'.
- It is strongly advised to enclose values with special symbols into single quotes.
- Standard English symbols must be used.
- Passwords must be not shorter that 6 symbols and not longer than 20 symbols.
- Passwords must contain at least one uppercase character [A-Z].
- Passwords must contain at least one lowercase character [a-z].
- Passwords must contain at least one numeric character [0-9].
- Passwords must contain at least one of the following special symbols unless limitations are explicitly described in comments: @#^*():,.}[]<>/.
- Passwords must NOT contain spaces or the following symbols: ;"!?&'{$|`%.
Note: in the
#MSSQLsection, specify the corresponding MS SQL login names and passwords you created earlier.Configure KMS server for MinIO encryption
OPTIONAL
By default, MinIO uses the internal Vault server as Key Management Service (KMS) for data encryption. You can use your own external AWS KMS or Azure Key Vault Server-Side Encryption Per-Deployment Key (SSE-S3) instead.
To enable SSE-S3, do the following:
Follow the official MinIO guide at https://min.io/docs/minio/linux/administration/server-side-encryption/server-side-encryption-sse-s3.html. Also, remember to check the provider-specific instructions:
After configuring the external providers, in
config.yml, specify the following parameters:For AWS KMS:
vault_kes_kms_provider: False aws_kes_kms_provider: True azure_kes_kms_provider: False aws_secretsmanager_region: '' # AWS region where your KMS is located (for example us-east-1) aws_secretsmanager_access_key: '' # AWS Access Key to access your KMS aws_secretsmanager_secret_key: '' # AWS Secret Key to access your KMSFor Azure KMS:
vault_kes_kms_provider: False aws_kes_kms_provider: False azure_kes_kms_provider: True azure_key_vault_endpoint: '' # Use your KeyVault instance endpoint. azure_key_vault_tenant_id: '' # The ID of the tenant the client belongs to - e.g: "41a37d4e-b3c4-49f4-b330-1114fb0271c8". azure_key_vault_client_id: '' # The ID of the client - e.g: "c3b7badf-cd2b-4297-bece-4de5f2e575f6". azure_key_vault_client_secret: '' # The value of the client secret - e.g: "-.j4XP6Sa7E39.KWn-SL~Dgbz~H-H-TPxT".Hashicorp KeyVault does not require additional settings.
vault_kes_kms_provider: True aws_kes_kms_provider: False azure_kes_kms_provider: False
Run the following command to encrypt both the
config.ymlandrpa.ymlfiles:$ ./install.sh encrypt configNote that the installer doesn't allow you to start the installation until
config.ymlis encrypted.If needed, you can edit the encrypted files later with the following commands:
$ cd /opt/workfusion/wf_installer $ ./install.sh edit_config master #edit config.yml $ ./install.sh edit_rpa_config master #edit rpa.yml
Prepare certificates
To prepare certificates:
Login via SSH to the Master server and add the prepared
ca.crt,server.crt, andserver.keyto thePACKAGE_DIR/certificates/directory. Skip the step if you do not have them.$ ls -la PACKAGE_DIR/certificates/ total 24 drwxr-xr-x. 3 ec2-user ec2-user 78 Sep 24 14:47 . drwxr-xr-x. 12 ec2-user ec2-user 4096 Sep 27 17:20 .. -rw-r--r--. 1 ec2-user ec2-user 2984 Sep 24 14:42 ca.crt -rw-r--r--. 1 ec2-user ec2-user 4835 Sep 24 14:42 server.crt -rw-r--r--. 1 ec2-user ec2-user 1674 Sep 24 14:42 server.keyGenerate the additional client certificates used internally by the Workfusion services for communication and authentication among each other. Execute the following command on the Master server:
$ ./install.sh certs generateThe command creates the
_auth_internal/sub-directory inside thecertificates/directory and generates all required internal certs. If you didn't add yourca.crt,server.crt, andserver.keyfiles to the/certificatesdirectory, they are also generated automatically (self-signed).Here is how the certificates and directory's content must look like:
$ cd PACKAGE_DIR/ $ tree certificates/ certificates/ ├── _auth_internal │ ├── elasticsearch.crt │ ├── elasticsearch.key │ ├── elk-ca.crt │ ├── elk-ca.key │ ├── kibana.crt │ ├── kibana.key │ ├── logstash.crt │ ├── logstash.key │ ├── logstash.p12 │ ├── mtls-ca.crt │ ├── mtls-ca.key │ ├── mtls-client.crt │ ├── mtls-client.key │ ├── vault_admin.crt │ ├── vault_admin.p12 │ ├── vault_workfusion.crt │ └── vault_workfusion.p12 ├── ca.crt ├── server.crt └── server.key
Install Workfusion license
To install the WorkFusion license, copy the provided license.properties file to the PACKAGE_DIR directory, for example, /opt/workfusion/wf_installer/license.properties.
If you install the Product on your own, request the license file from your WorkFusion Account Manager or via the Service Desk. For more information, see Activate Workfusion license.
Update manifest file for Analytics
important
Follow the steps below only if you are installing Analytics in the Single-point mode using the new package with Tableau 2021.4.3 (WorkFusionAnalyticsInstaller-10.2.4-tableau-2021-4-2.zip).
In all other cases, skip this instruction, and go to the next step.
On the Master server, edit the INSTALL_DIR/manifest.yml file and change the values of the following variables:
- `versions.analytics_installer`:
```bash
versions:
...
analytics_installer: 10.2.4-tableau-2021-4-2
...
```
- `sources.analytics_installer`:
```bash
sources:
...
analytics_installer: WorkFusionAnalyticsInstaller-10.2.4-tableau-2021-4-2.zip
...
```
Prepare MS SQL server
important
If you use the Cloud Database services, such as AWS RDS, Azure, or GCP MSSQL, before proceeding, in
config.yml, update the following parameters:cloud_platform: 'gcp' # Specify the Cloud provider you use. Available options are 'azure', 'gcp', 'aws'. cloud_sql_service: false # Set to 'true' if you use a cloud service as a database (Cloud SQL Server or Azure SQL Server)If you use the on-premise SQL instance, set both parameters to 'false'.
cloud_platform: false cloud_sql_service: false
To prepare the MS SQL server, do the following:
On the Master server, check that MS SQL meets the requirements:
$ ./install.sh precheck mssql # Checks that MSSQL credentials are set correctly in config.yml, # database exists, wf_dba_user exists and has db_owner roleIf all checks have passed successfully, run the following command to grant necessary permissions for database schemas.
$ ./install.sh configure mssql # Creates all required schemas in Workfusion DB, # creates and maps DB users to provided MSSQL logins, # and assigns correct user permissions per schemas
Run additional root steps
Additionally, you have to run steps that require root privileges. Depending on your company's policy, sudo permissions may be temporarily granted to the application user, or another user with the root privileges can execute this set of tasks.
If you decide to grant these privileges to the application user, it is recommended to revoke them after the installation for security reasons.
Select the tab with the user that matches your case:
If your application user has sudo permissions, run the following command:
$ ./install.sh preinstall full
Suppose your security policy still allows running third-party scripts by an application user with the granted sudo permissions (for example, your OPs engineer). In that case, there's a quick way to execute all required actions.
Note: before running ./install.sh, execute echo $ANSIBLE_REMOTE_USER to make sure that you have specified the correct username.
Run the following commands:
$ export ANSIBLE_VAULT_PASS="<ansible_vault_password>"
$ export ANSIBLE_REMOTE_USER="<linux_user_with_sudo>"
$ export ANSIBLE_PRIVATE_KEY_FILE="</path_to_ssh_key>"
# Give temporary ownership of the installation directory to your sudo user
$ sudo chown -R <SUDO_USER> PACKAGE_DIR
# For Linux components execute
$ ./install.sh preinstall full -e ansible_user=$ANSIBLE_REMOTE_USER -e skip_rpa=true -e skip_bi=true -e skip_ocrwin=true
# For Windows components execute
$ ./install.sh preinstall full -e skip_common=true -e skip_lb=true -e skip_agent=true -e skip_master=true
# Clean the .ansible directory in /tmp
$ sudo rm -rf /tmp/.ansible/
# Revert ownership of installation directory
$ sudo chown -R WFUSER PACKAGE_DIR
If your security policy doesn't allow users to have sudo privileges, you can execute the preinstall root steps as another user that already has these rights. Here, provide ownership of the PACKAGE_DIR directory to that user, perform preinstall, and then revert ownership:
Run the following commands to make sure that you have specified the correct username:
$ export ANSIBLE_VAULT_PASS="<ansible_vault_password>"
$ export ANSIBLE_REMOTE_USER="<linux_user_with_sudo>"
$ export ANSIBLE_PRIVATE_KEY_FILE="</path_to_ssh_key>"
# Give temporary ownership of the installation directory to your sudo user
$ sudo chown -R <sudo_user> PACKAGE_DIROn the Master2 server, run the following command:
./install.sh preinstall ha-deps -c local --limit master[1]On the Master1 server, run the following command:
./install.sh preinstall master -c local --limit master[0]Again, on the Master2 server, run the following command:
./install.sh preinstall master -c local --limit master[1]On the Master3 server, run the following command:
./install.sh preinstall master -c local --limit master[2]`On the Agent1 server, run the following command:
./install.sh preinstall agent -c local --limit agent[0]`On the Agent2 server, run the following command:
./install.sh preinstall agent -c local --limit agent[1]On the Agent3 server, run the following command:
./install.sh preinstall agent -c local --limit agent[2]Revert ownership of the installation directory:
sudo chown -R WFUSER PACKAGE_DIR
Your company's security policy may forbid running third-party scripts to users with the sudo privileges.
In such a situation here, run the following steps manually:
- Set
sysctlparameters. - Assign setcap capabilities to a customer-facing web server (HAProxy). This step is only required if a customer-facing web server accepts connections on privileged ports (below 1025).
- Set up the NFS server. This step is required for non-HA deployments when you don't plan to use external NAS.
Set sysctl parameters
To set the sysctl parameters:
Create the
systemdunit file for thesupervisordmanagement tool used for all IA Cloud services:Calculate ulimits values based on the following example. Use your "number of vCPU" values for the calculations.
- LimitNOFILE: "number of vCPU multiplied by 25,000"
- LimitNPROC: "number of vCPU multiplied by 1,280"
Copy the following example to a text editor and replace the default values (here, 200000 and 10240) with the values calculated in the previous step.
Here, the example is provided for eight vCPUs. If you have other values, use them for the calculations. Remember to change
INSTALL_DIR,User, andGroupaccording to your environment.[Unit]
Description=supervisord
Requires=local-fs.target
After=local-fs.target
[Service]
Environment=INSTALL_DIR=/opt/workfusion WF_PYTHON_VERSION=py37
User=wfuser
Group=wfuser
LimitNOFILE=200000
LimitNPROC=10240
LimitMEMLOCK=infinity
Type=simple
Restart=on-failure
RestartSec=10
StartLimitInterval=300
StartLimitBurst=5
TimeoutStartSec=300
TimeoutStopSec=30
SendSIGKILL=yes
ExecStart=/bin/bash -c ' \
while [ ! -f ${INSTALL_DIR}/tools/wfmanager ]; \
do \
sleep 30; \
echo "$(date) Waiting for wfmanager to be installed..."; \
done; \
source ${INSTALL_DIR}/environment.sh \
&& exec supervisord -c ${INSTALL_DIR}/supervisord/conf/supervisord.conf'
[Install]
WantedBy=multi-user.targetCopy and paste the updated example to the file
/etc/systemd/system/supervisord.service.
Run the following commands to enable autostart of the
supervisordservice:$ systemctl daemon-reload
$ systemctl enable supervisord.service
$ systemctl start supervisord.serviceRun the following commands to set the required startup parameters for Elasticsearch:
cat << EOF > /etc/sysctl.d/elasticsearch.conf
vm.max_map_count=262144
EOF
sysctl -p /etc/sysctl.d/elasticsearch.confRepeat steps 1-3 on all Linux servers.
Configure swap on Master servers
To configure swap on the Master servers, do the following:
Run the following command to create a 16GB file:
dd if=/dev/zero of=/wf_ram.swap bs=1M count=16000Prepare the created file to be used as a swap file:
mkswap /wf_ram.swapAdd swap file to
/etc/fstab:echo "/wf_ram.swap none swap sw 0 0" >> /etc/fstabEnable swap:
swapon -aTo verify that swap is enabled, run the command:
swapon -s
# Filename Type Size Used Priority
# /wf_ram.swap file xxxx 40704 -2
Configure setcap for HAProxy
Note: this step is only required if HAProxy accepts connections on privileged ports (below 1025).
To configure setcap, on the Master server, copy the HAProxy binary to the installation directory and enable HAProxy to run under the application user on privileged ports:
$ mkdir -p /opt/workfusion/haproxy/bin
$ cd /opt/workfusion/wf_installer/
$ cp sources/haproxy-<version>-wf-bundled.bin /opt/workfusion/haproxy/bin/haproxy
$ chmod 0750 /opt/workfusion/haproxy/bin/haproxy
$ chown -R wfuser:wfuser /opt/workfusion/haproxy/bin
$ /usr/sbin/setcap CAP_NET_BIND_SERVICE=+eip /opt/workfusion/haproxy/bin/haproxy
$ echo net.ipv4.tcp_tw_recycle=0 >> /etc/sysctl.conf && sysctl -p
Set NFS server
Note: this step is required for non-HA deployments when you are not planning to use external NAS.
To set the NFS server:
On the Master server, install the required packaged dependencies for your OS version:
$ os_version=$(awk -F'=' '/VERSION_ID/{ gsub(/"/,""); print $2}' /etc/os-release)
$ nfs_utils_package=$(cat manifest.yml | grep "nfs_utils_rhel${os_version}" | tail -n 1 | awk '{print $2}')
$ yum -y localinstall /opt/workfusion/wf_installer/sources/${nfs_utils_package}Prepare a shared directory on the local (non-NAS) NFS server.
Enable and start rpcbind by running the commands as
root:$ systemctl enable rpcbind
$ systemctl daemon-reload
$ systemctl start rpcbind
$ systemctl status rpcbindCreate the NFS-server configuration file by running the commands as
root:cat << EOF > /etc/sysconfig/nfs
# TCP port rpc.lockd should listen on.
LOCKD_TCPPORT=32800
# UDP port rpc.lockd should listen on.
LOCKD_UDPPORT=32700
#
# Optional arguments passed to rpc.nfsd. See rpc.nfsd(8)
RPCNFSDARGS=""
# Optional arguments passed to rpc.mountd. See rpc.mountd(8)
RPCMOUNTDOPTS=""
# Port rpc.mountd should listen on.
MOUNTD_PORT=20048
#
# Optional arguments passed to rpc.statd. See rpc.statd(8)
STATDARG=""
# Optional arguments passed to sm-notify. See sm-notify(8)
SMNOTIFYARGS=""
#
# Optional arguments passed to rpc.idmapd. See rpc.idmapd(8)
RPCIDMAPDARGS=""
#
RPCGSSDARGS=""
#
# Enable usage of gssproxy. See gssproxy-mech(8).
GSS_USE_PROXY="yes"
#
# Optional arguments passed to blkmapd. See blkmapd(8)
BLKMAPDARGS=""
EOFIn the exports file /etc/exports, add the following line by pasting and running the example as
root:cat << EOF >> /etc/exports
/opt/workfusion/vds-data *(fsid=0,rw,async,no_root_squash,no_subtree_check,insecure)
EOFStart the NFS-server:
$ systemctl enable nfs-server
$ systemctl start nfs-server
$ systemctl status nfs-server
Set NFS clients
On each Agent server, mount the vds-data directory:
On each Agent server, install the required packages for your OS version:
$ os_version=$(awk -F'=' '/VERSION_ID/{ gsub(/"/,""); print $2}' /etc/os-release)
$ nfs_utils_package=$(cat manifest.yml | grep "nfs_utils_rhel${os_version}" | tail -n 1 | awk '{print $2}')
$ yum -y localinstall /opt/workfusion/wf_installer/sources/${nfs_utils_package}Mount the
vds-datadirectory either from the Master server configured to serve as NFS server on the previous step or the directory from the external NAS server. For sample commands, refer to the instructions.
Apply configuration to all servers
If you are installing the Product in the multi-point way, copy the PACKAGE_DIR directory to all other Linux servers. Otherwise, skip this step.