将 SUSE Multi-Linux Manager 代理部署为虚拟机 - VMware

1. 在 Web UI 中，导航到系统  代理配置，然后填写所需数据：

2. In the Proxy FQDN field type fully qualified domain name for the proxy.

3. In the Parent FQDN field type fully qualified domain name for the SUSE Multi-Linux Manager Server or another SUSE Multi-Linux Manager Proxy.

4. In the Proxy SSH port field type SSH port on which SSH service is listening on SUSE Multi-Linux Manager Proxy. Recommended is to keep default 8022.

5. In the Max Squid cache size [MB] field type maximal allowed size for Squid cache. Recommended is to use at most 80% of available storage for the containers.

   2 GB 表示默认的代理 squid 缓存大小。需要根据您的环境调整此大小。

   In the SSL certificate selection list choose if a new server certificate should be generated for SUSE Multi-Linux Manager Proxy, an existing one should be used, or the SSL part should be skipped entirely. You can consider generated certificates as SUSE Multi-Linux Manager builtin (self signed) certificates. If SUSE Multi-Linux Manager server runs on Kubernetes, the generated certificate option is not possible and replaced with no SSL certificate as they are managed outside the containers.

   Depending on the choice then provide either path to signing CA certificate to generate a new certificate or path to an existing certificate and its key to be used as proxy certificate. If the SSL part is skipped, the resulting configuration archive does not carry server_crt, server_key or ca_crt; the deployment is then responsible for providing the proxy certificate and root CA out-of-band (for Kubernetes deployments this means creating proxy-cert and uyuni-ca manually — see the TLS setup section of the Kubernetes proxy deployment page).

   The CA certificates generated by the server are stored in the /var/lib/containers/storage/volumes/root/_data/ssl-build directory.

   有关现有或自定义证书的详细信息以及企业和中间证书的概念，请参见 导入 SSL 证书。

6. Click Generate to register a new proxy FQDN in the SUSE Multi-Linux Manager Server and generate a configuration archive (config.tar.gz) containing details for the container host.

7. 片刻之后，系统会显示文件可供下载。请将此文件保存在本地。

1. 通过 SSH 连接到您的容器主机。

2. 执行以下命令（替换其中的服务器和代理 FQDN）：

   mgrctl exec -ti 'spacecmd proxy_container_config_generate_cert -- dev-pxy.example.com dev-srv.example.com 2048 email@example.com -o /tmp/config.tar.gz'

3. 从服务器容器复制生成的配置：

   mgrctl cp server:/tmp/config.tar.gz

1. 通过 SSH 连接到您的服务器容器主机。

2. Execute the following commands, replacing the Server and Proxy FQDN:

   for f in ca.crt proxy.crt proxy.key; do
     mgrctl cp $f server:/tmp/$f
   done
   mgrctl exec -ti 'spacecmd proxy_container_config -- -p 8022 pxy.example.com srv.example.com 2048 email@example.com /tmp/ca.crt /tmp/proxy.crt /tmp/proxy.key -o /tmp/config.tar.gz'

3. 如果您的设置使用中间 CA，请同时复制该证书，并在命令中通过 -i 选项（可根据需要多次提供）包含该证书：

   mgrctl cp intermediateCA.pem server:/tmp/intermediateCA.pem
   mgrctl exec -ti 'spacecmd proxy_container_config -- -p 8022 -i /tmp/intermediateCA.pem pxy.example.com srv.example.com 2048 email@example.com /tmp/ca.crt /tmp/proxy.crt /tmp/proxy.key -o /tmp/config.tar.gz'

4. 从服务器容器复制生成的配置：

   mgrctl cp server:/tmp/config.tar.gz

1. 通过 SSH 连接到您的服务器容器主机。

2. Execute the following commands, replacing the Server and Proxy FQDN:

   for f in ca.crt proxy.crt proxy.key; do
     mgrctl cp $f server:/tmp/$f
   done
   mgrctl exec -ti 'spacecmd proxy_container_config_nossl -- -p 8022 pxy.example.com srv.example.com 2048 email@example.com -o /tmp/config.tar.gz'

3. 从服务器容器复制生成的配置：

   mgrctl cp server:/tmp/config.tar.gz