이 페이지에서는 고객 사이트에서 Google Distributed Cloud (GDC) 에어갭 어플라이언스를 설정하고 구성하는 방법을 설명합니다.
첫 번째 부팅 시 드라이브는 사람의 개입 없이 잠금 해제됩니다.
드라이브를 복호화하고 머신을 부팅합니다.
각 GDC 에어갭 어플라이언스는 각 블레이드에 삽입된 Yubikey와 함께 배송됩니다. 금색 면이 위를 향하도록 유비키가 올바르게 삽입되어 있는지 확인합니다. 키가 삽입되면 해당 서버와 페어링되며 다른 서버로 이동할 수 없습니다.
GDC 오프라인 어플라이언스가 부팅되려면 이러한 YubiKey가 해당 서버 블레이드의 원래 슬롯에 있어야 합니다.
어플라이언스 구성
입력 구성 파일의 모든 필드가 정확한지 확인합니다. 다음 단계에 따라 파일을 서버 블레이드에 복사하면 최종 구성이 자동으로 시작되며 쉽게 중지할 수 없습니다.
입력 구성 파일을 198.18.0.6 IP 주소가 할당된 서버 블레이드의 /var/lib/assets/ciq_configure_input.yaml 경로로 전송합니다.
이 보관 파일의 콘텐츠에 cellcfg 백업, ID 공급자 사용자 인증 정보, 스위치 사용자 인증 정보, 198.18.0.6 IP 주소에 할당된 서버 블레이드의 SSH 키가 포함되어 있는지 확인합니다.
비상 액세스를 위해 별도의 보안 매체 (예: USB 드라이브)에 보관 파일을 저장합니다.
어플라이언스 사용자 삭제 및 어플라이언스 설치 서비스 중지
비상 사용자 인증 정보 백업이 완료되면 198.18.0.6 IP 주소가 할당된 서버 블레이드에서 다음 명령어를 실행하여 기본 어플라이언스 사용자 계정을 삭제하고 설치 서비스를 중지합니다. 나중에 198.18.0.6 IP 주소가 할당된 서버 블레이드를 사용하려면 비상 사용자 인증 정보를 사용하면 됩니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-04(UTC)"],[[["\u003cp\u003eThis document guides you through the setup and configuration of a Google Distributed Cloud (GDC) air-gapped appliance at a customer site.\u003c/p\u003e\n"],["\u003cp\u003eThe process involves decrypting the appliance drives using YubiKeys, which are shipped separately and must remain in the server post-installation until the system is returned.\u003c/p\u003e\n"],["\u003cp\u003eYou'll configure the appliance using the \u003ccode\u003egdcloud appliance configure\u003c/code\u003e command, answering questions about DNS, BGP, data plane networks, uplinks, and optional external NTP and HSM information.\u003c/p\u003e\n"],["\u003cp\u003eYou have the option to connect the appliance to your existing identity provider (IdP) or use the automatically installed Keycloak IdP, and if you choose to use the Keycloak IdP it is crucial to save the credentials provided during the installation process.\u003c/p\u003e\n"],["\u003cp\u003eThe \u003ccode\u003ecellcfg\u003c/code\u003e directory, generated during configuration, must be backed up, as it is necessary for updating and patching the appliance.\u003c/p\u003e\n"]]],[],null,["# Configure the appliance and install software\n\nThis page describes how to set up and configure Google Distributed Cloud (GDC) air-gapped appliance\nat the customer site.\n\nOn first boot, the drives are unlocked without human intervention.\n| **Important:** To access the URLs on this page, you must connect to the internet. The URLs are provided for use when you have such access.\n\nDecrypt the drive and boot the machine\n--------------------------------------\n\nEach GDC air-gapped appliance is shipped with Yubikeys inserted into each blade. Ensure that the yubikeys are correctly inserted with the gold side facing up. Once the key is inserted it is paired with that server and cannot be moved to a different server.\nThese Yubikeys must be in their original slots in the corresponding server blade\nin order for the GDC air-gapped appliance to boot.\n| **Important:** The Yubikeys must be inserted in each blade prior to executing the bootstrapping process. Incorrectly following this step will result in a failed bootstrap.\n\nConfigure the appliance\n-----------------------\n\nVerify all fields of the input configuration file are accurate. Once the file is copied to the server blade in the following steps, the final configuration begins automatically and cannot easily be stopped.\n\n1. Transfer the input configuration file to the path\n `/var/lib/assets/ciq_configure_input.yaml` on the server blade assigned the\n `198.18.0.6` IP address.\n\n scp configuration-input.yaml applianceusr@198.18.0.6:/var/lib/assets/ciq_configure_input.yaml\n\n2. The configuration starts automatically and saves output in the\n `/var/log/gdch-install.txt` file.\n\n3. Configuration is expected to take 4-5 hours. Monitor progress with one of the following:\n\n - Monitor the `/var/log/gdch-install.txt` file with the following:\n\n ssh applianceusr@198.18.0.6 'tail -f /var/log/gdch-install.txt'\n\n The install is complete when the cleanup phase has completed. The log shows a line like the following: \n\n \u003c\u003c\u003c Completed phase: cleanup\n\n - Alternatively, you can look for the status of the installation service, with the following:\n\n ssh applianceusr@198.18.0.6 'systemctl status gdch-app-install'\n\n The output indicates the status of the installation. In particular, the `Active` field indicates if the install is ongoing, failed, or inactive. When the line indicates that the install process is inactive and has a status of `0/SUCCESS`, the installation is complete.\n\nBack up the credentials\n-----------------------\n\nRetrieve the device emergency credentials and store them in a secure location\n\n1. Create a backup archive of the access credentials by running the following, enter the `applianceusr` password when prompted:\n\n ssh applianceusr@198.18.0.6 'sudo -S /var/lib/release/gdcloud appliance install --phase=postinstall'\n\n2. Copy the credential backup to the bootstrapper by running the following, enter the `applianceusr` password when prompted:\n\n ssh applianceusr@198.18.0.6 'sudo -S setfacl -m u:applianceusr:rwx /var/lib/assets/credentials.tar.gz'\n scp applianceusr@198.18.0.6:/var/lib/assets/credentials.tar.gz .\n\n3. Verify the contents of this archive include, the cellcfg backup, identity provider credentials, switch credentials, and SSH keys for the server blade assigned to the `198.18.0.6` IP address.\n\n4. Store the archive on a separate, secure medium (such as a USB drive) for\n emergency access.\n\nDelete appliance user and stop appliance install services\n---------------------------------------------------------\n\nAfter the backup of emergency credentials is completed, run the following\ncommand on the server blade assigned the `198.18.0.6` IP address to delete the\ndefault appliance user account and stop install services. In order to use the server blade assigned the `198.18.0.6` IP address in the future, you can use [emergency credentials](/distributed-cloud/hosted/docs/latest/appliance/admin/setup#back_up_emergency_credentials).\n\n1. Execute the following to remove the default user access and secure the device\n\n ssh applianceusr@198.18.0.6 'sudo -S /usr/local/bin/cleanup_appliance_user.sh'\n\nManage YubiKeys\n---------------\n\nAfter the installation completes, the YubiKeys must stay in the server until you\n[return the system](/distributed-cloud/hosted/docs/latest/appliance/admin/return-device)."]]
