Salesforce

Complete Installation

Printable View
« Go Back
Information
Complete Installation
UUID-49ef4c9d-ecad-d9b2-a562-ae0f4c619ede
Article Content

On-Premises Installation Guide PDF

Important

As of January 25, 2023, customers can no longer perform new deployments of on-premises instances. Deployments before this date are still supported and will be upgraded as necessary until this solution reaches end of life.

For more information on available stacks and hosting options, see Supported Stacks for On-Premises and About OneTrust Hosting Options, Locations, and Backup.

Note

To upgrade your on-premises instance, please contact your account executive to request a new installer package to ensure full compatibility of the latest available services.

Configure .envs file

  1. In the installer package navigate to folder …/admin-portal/k8s-deployment/inventory_template

  2. Open and edit .envs file.

  3. Enter preferred namespace name and the host selected for installation:

    export OT_NAMESPACE_MAIN=""
export OT_MAIN_HOST=""

  4. Update the Docker registry configuration, Should get from OneTrust.

    export OT_DOCKER_REGISTRY=""
export DOCKER_USER=""

  5. In Self Managed section, update the values as below:

    export CLUSTER_NAME="" should be blank
export EXTERNAL_LOADBALANCER="false"

  6. In the LOCAL CLUSTER section, export LOCAL_CLUSTER="false" should be false

  7. Select from the below steps based on the tech stack of the application is being installed, then return to Step 8.

  8. Give the values for the Password Encryption:

    export IS_ENCRYPTION="false"

    Note

    1. If we have encryption setup then the above place holder should be set true

    2. If true , copy the encryptKeyStore.jks file from ...admin-portal\k8s-deployment\tools\admin-portal-keystore\keystore and place in the folder path ...admin-portal\k8s-deployment\encryption_dependencies

  9. Save the changes once the above steps are completed.

  10. Enter the number of replica count is set to '1' by default. Update the count as '2' during the deployment.

    export OT_REPLICAS="2"

AWS Configurations

  1. Make the below set of configurations specific to AWS cloud:

    export CLOUD_AWS="true"
export AWS_REGION=""
export EKS_CLUSTER="" 
export OT_CERT_ARN= ""

  2. Update AWS Elastic File System configuration:

    export OT_AWS_EFS_ID=""
export OT_AWS_EFS_REGION=""
export OT_AWS_EFS_DNS=""

Azure Configurations

  • Make the below set of configurations specific to Azure cloud:

    export CLOUD_AZURE="true"
export CLOUD_AZURE_SUBSCRIPTION=""
export CLOUD_AZURE_RG=""
export CLOUD_AZURE_AKS_CLUSTER=""

Admin Portal: Setup for Encryption of Passwords & Secrets

This is an optional configuration.

  1. Navigate to the …/k8s-deployment/tools/admin-portal-keystore/keystore folder path and copy the encryption.jks file and paste it in encryption dependencies folder /k8s-deployment/encryption_dependencies.

    Note

    Keep this file safe, this is the master key used to encrypt and decrypt passwords.

  2. Navigate to /k8s-deployment/_templates/secrets and open config.properties file, add the following properties:

    encrypt.key-store.location=file:/config/encryption_dependencies/encryptKeyStore.jks
encrypt.keystore.password= (get from the application.onprem)
encrypt.key-store.alias=configKey
encrypt.key-store.secret= (same as encrypt.keystore.password)
encrypt.key-store.type=JCEKS

  3. Navigate to the command line terminal (WSL or bash) where we will execute the shell scripts.

  4. Execute installation script by entering ./install_admin_portal.sh encrypt.

  5. Enter docker registry password

  6. Confirm the printed parameters are accurate.

     Do these values look good? (y/n): {Enter "y" if the above enter value is good}

  7. Once the Deployment is done, run the below command:

    kubectl get pods -n {namespace}

  8. Get the config pod name, run the below command to encrypt the password by modifying the value:

    kubectl -n {namespace} exec -it {config pod name} -- sh -c "curl http://localhost:8100/encrypt -d {password/secret key to encrypt}"

  9. Encrypt below passwords in …\admin-portal\k8s-deployment\properties\services\application-onprem.properties file using the command in step 8.

    SQL

    db.password

    MongoDB

    spring.data.mongodb.password
spring.data.mongodb.admin.password

    Encryption values

    encryption.masterKeyStorePassword
encryption.masterKeyPassword
consentmanager.jwt.key.password
encrypt.keyStore.password

    Note

    If the external Redis connection is used, the Redis password should be encrypted.

  10. Encrypt below SMTP password in …\admin-portal\k8s-deployment\properties\services\notification-onprem.properties file using the command in step 8.

    spring.mail.password=

Installing Admin Portal Pod

  1. Navigate to …/admin-portal/k8s-deployment and create a new folder called inventory.

  2. Copy the updated .envs file from inventory_template folder to newly created inventory folder.

  3. Open command line terminal (WSL or bash) where we will execute the shell scripts.

  4. Navigate the directory to .../k8s-deployment/

  5. Execute installation script by entering ./install_admin_portal.sh install command. You will be prompted to install any of the required dependencies if they do not exist.

  6. Enter docker registry password

  7. The values updated as part of the .envs file for the cloud selected will be displayed.

  8. Confirm the printed parameters are accurate.

    Do these values look good? (y/n): {Enter "y" if the above enter value is good}

  9. In next steps, it prints the components to be installed.

    Do these values look good? (y/n): {Enter "y" if the above enter value is good}

  10. The installer will create the namespaces/services/deployments in the cluster based on the input values provided.

  11. Check the running pods in the namespace by executing below command:

    kubectl get pods -n {namespace}

  12. After all the services are healthy, we need to update the DNS domain name in the selected cloud provider.

  13. Execute the below command to get the public IP address:

    kubectl get ingress –n {namespace}

  14. Copy the external IP address of the load balancer type.

  15. Add the DNS entry in the DNS manager for the IP address obtained.

Run the Translations

  1. Navigate to …/admin-portal/k8s-deployment/tools/sql-server path.

  2. Execute the below command:

    Note

    To run the below command Java 11.0.11 SE should be installed.

    ./run-translations-prod.sh -r <package-version> -dh <host> -du <username> -dp <password> -jn delta-translation-6.35.0-1 -jp "<translation file path>" -ft true

  3. Navigate back to the terminal and execute the below command to restart the globalization service:

    kubectl rollout restart deployment/globalization -n {name space}

Tenant Namespace Migration (applicable from 6.22.0 build and should be ran once)

Note

The following migration steps should be ran if:

  1. Deploying to 6.22.0+ for the first time.

  2. Upgrading from lower version to 6.22.0+.

  1. Run the below command to get the globalization pod ID:

    kubectl get pods -n {namespace}

  2. Copy the globalization pod ID and run the below command to ssh in the pod:

    kubectl --namespace {namespace} exec -it pod/{globalization MS pod name} -- /bin/sh

  3. Run the below curl command, 202 status will be displayed on the completion:

    curl -vi -X POST http://localhost:8080/globalization/v1/tenants/{tenantId}/migrate/namespaces -H "x-onetrust-local: true"

Header
x-onetrust-local: true

  4. Log in to SQL and execute the below query in the ZenDB. Check the above mentioned tenantID entry exists:

    select * from [Globalization].[TenantMigrationHistory]

    Note

    To get the tenantid run the below sql query

    select * from [IDENTITY].[Tenant] where name='{TenantOrganizationName}';

Create Account

  1. Execute the below command and get the account microservice pod name:

    kubectl get pods -n <namespace>

  2. Run the below command to sh into the account microservice:

    kubectl --namespace <namespace> exec -it pod/< Account microservice pod name> -- /bin/sh

  3. Navigate to folder ../ot-onprem-installer-main-app-lkgba/admin-portal/k8s-deployment/tools

  4. Open create-tenant text file and copy the content, paste in terminal where we have sh the account microservice. This may take a few seconds to complete, after completion the created Tenant GUID will be displayed.

  5. User will receive an email with a link to complete the tenant registration. After the successful account creation, navigate to SQL server and remove the dbcreator role for the Dbuser created and restart the SQL server (MSSQLSERVER) service.

Set SQL Compatibility Level

  1. To check the SQL compatibility on the ZenDB and tenant DB , run the below query from the master database

    SELECT name, compatibility_level
FROM sys.databases;

  2. If the SQL compatibility level is less than 160 , run the below query from the master database

    ALTER DATABASE <DB NAME> SET COMPATIBILITY_LEVEL = 160;

Access Admin Portal

Open the registration email and launch the application using the URL in the email. You will be prompted to create a password to complete your registration and log in to the application.

Configure SAML Signing Certificate (optional)

  1. Edit access-mgmt-onprem.properties in folder ..k8s-deployment\properties\services and add the following values:

    onetrust.access.saml.keystore-base64=<cert base 64 jks string>

onetrust.access.saml.keystore-secret=<enter the cert password>

onetrust.access.saml.keystore-alias=<cert alias name>

  2. For "onetrust.access.saml.keystore-base64= " value , Navigate to the path where pfx file is present (..\admin-portal\k8s-deployment) and run the below command in the terminal:

    cat {pfxname}.pfx | base64 | tr -d " \t\n\r"

  3. Copy the value from above command and add to the "onetrust.access.saml.keystore-base64=" in access-mgmt-onprem property file

  4. For "onetrust.access.saml.keystore-alias=" value, run the below command in the terminal

    keytool -v -list -storetype pkcs12 -keystore <pfx file name>.pfx

  5. Copy the value from above command and add to the "onetrust.access.saml.keystore-alias=" in access-mgmt-onprem property file

Branding Setup

  1. Execute below querey in ZenDB:

    select * [Branding].[ContentResource]

  2. If you see any value in the table then execute the update query:

    update [Branding].[ContentResource]
set value='https://cdn.1trust.app/images/app/20210810-OneTrust-EnvironmentLogin-Box.png'
where [Key] = 'panelImage'

  3. If you don't see any value in the table, then execute the below query:

    INSERT INTO [Branding].[ContentResource] ([Guid], [Key], [Value], [createdBy], [CreateDt])
VALUES ('B5699599-15B9-466A-8923-462C70A52A8B','panelImage',
'https://www.onetrust.com/img/BrandingResource/onetrust_login-graphic_background.png',
'00000000-0000-0000-0000-000000000000', getUTCDATE());

  4. You can now begin to customize the logo and branding from the application.

Next Steps:
 
Article Visibility
3,761
Translation
English
Checked
Powered by