From 4e4d938b640c1a9025e5ebc07dccf0dd495b74f5 Mon Sep 17 00:00:00 2001 From: Konrad Bucheli Date: Thu, 15 Jan 2026 09:52:27 +0100 Subject: [PATCH] DMZ commissioning --- .../deployment/dmz_installation.md | 84 +++++-------------- 1 file changed, 21 insertions(+), 63 deletions(-) diff --git a/docs/admin-guide/deployment/dmz_installation.md b/docs/admin-guide/deployment/dmz_installation.md index 586c345b..96577aa7 100644 --- a/docs/admin-guide/deployment/dmz_installation.md +++ b/docs/admin-guide/deployment/dmz_installation.md @@ -2,80 +2,38 @@ The deployment in the DMZ ist the basically the same as [internaly](basic_installation), but there are a few points to consider: -- a firewall rule for puppet is needed - the commissioning can only be done in the special DMZ commissioning network -Because of this commissioning network we suggest that the DMZ VM gets for commissioning two interfaces, a "front-door" to the actual network where it will finally provide its service and the "back-door" in the commissioning network. After successful setup that interface will be removed. +Because of this commissioning network we have to change the network configuration after the initial setup. ## Preparation -- get static IP addresss for "front-door" interface -- For Puppet you need to [order a firewall rule](https://psi.service-now.com/psisp?id=psi_new_sc_cat_item&sys_id=faccb8644fe58f8422b0119f0310c7f7) from your machine to `puppet.psi.ch` using TCP port 8140. -- (let) the VM be set up with to interfaces, the first one in the final network ("front-door") and the second one attached to `172.23.206.0/24` ("back-door") -- get both MAC addresses -- prepare the node in Sysdb/`bob` with the "back-door" MAC address -- in Hiera following network configuration is suggested which keeps the "front-door" interface disabled for the start: +- get static IP address +- get MAC address +- prepare the node in Sysdb/`bob` with the MAC address +- for the start the default `auto` networking setup is required: ```yaml -networking::setup: managed - -networking::connections: - - dmz_network - - commissioning_network - -networking::connection::dmz_network: - mac_address: '00:50:56:9d:47:eb' - ipv4_method: 'disabled' - ipv6_method: 'disabled' - -networking::connection::commissioning_network: - mac_address: '00:50:56:9d:c7:fe' - ipv4_method: 'auto' - ipv6_method: 'disabled' +networking::setup: 'auto' ``` + ## Commissioning/Kickstart - commission/kickstart the node via network boot - for SSH access get assigned IP address from VMWare or Puppet facts or QIP -- at the moment puppet will fail, provide the IP address to your fellow friendly Core Linux Team member to manually finish the first boot -- if the configuration is fully ready, configure the "front-door" interface: - -```yaml -networking::setup: managed - -networking::connections: - - dmz_network - - commissioning_network - -networking::connection::dmz_network: - mac_address: '00:50:56:9d:47:eb' - ipv4_method: 'manual' - ipv4_address: '192.33.120.60/24' - ipv4_gateway: '192.33.120.1' - ipv6_method: 'disabled' - -networking::connection::commissioning_network: - mac_address: '00:50:56:9d:c7:fe' - ipv4_method: 'auto' - ipv6_method: 'disabled' ``` - -## Cleanup - -- check if you still have management access (`ssh`) over the front door interface -- remove the configuration of the "back-door" interface: - -```yaml -networking::setup: managed - -networking::connections: - - dmz_network - -networking::connection::dmz_network: - mac_address: '00:50:56:9d:47:eb' - ipv4_method: 'manual' - ipv4_address: '192.33.120.60/24' - ipv4_gateway: '192.33.120.1' - ipv6_method: 'disabled' +ssh -l root -J mgt-gw.psi.ch $IP ``` -- remove the "back-door" interface from the VM +- change network setup in hiera +```yaml +networking::setup: 'auto_static_ip' +``` +- add and active new IP on the node +``` +nmcli con add con-name dmz ifname ens33 type ethernet ip4 192.33.120.53/24 gw4 192.33.120.1 +nmcli con up dmz +``` +- assign final DMZ network in VMWare vSphere to the VM +- log into node and run `puppet agent -t` + +