Skip to main content
NetApp Console setup and administration

Manually deploy the NetApp Console agent in restricted mode

Contributors netapp-tonias
PDFs

If you want to use the NetApp Console with limited outbound connectivity, you need to manually deploy the Console agent in restricted mode.

If you don't want to use a marketplace subscription or are deploying Google Cloud, you need to manually install the Console agent.

Step 1: Prepare cloud permissions

Before you install the Console agent, prepare the cloud provider permissions it needs to manage resources.

Learn how to prepare cloud permissions.

Step 2: Enable Google Cloud APIs (Google Cloud only)

If you are installing the Console agent in Google Cloud, enable the required APIs in your project before installation. These APIs are needed for specific Cloud Volumes ONTAP features.

Steps

  1. Enable the APIs in your Google Cloud project

    • Cloud Build API (required for private mode Cloud Volumes ONTAP deployments using Infrastructure Manager)

    • Cloud Deployment Manager V2 API

    • Cloud Infrastructure Manager API

    • Cloud Logging API

    • Cloud Resource Manager API

    • Compute Engine API

    • Identity and Access Management (IAM) API

    • Cloud Key Management Service (KMS) API (required only if you are planning to use NetApp Backup and Recovery with customer-managed encryption keys (CMEK))

    • Cloud Quotas API (required for Cloud Volumes ONTAP deployments using Infrastructure Manager)

Step 3: Prepare network access

Allow the outbound endpoints required for the cloud provider where you install the Console agent.

Cloud provider endpoints

AWS environments

Allow these AWS service endpoints to manage AWS resources, including FSx for ONTAP.

Endpoints Purpose

AWS services (amazonaws.com):

  • CloudFormation

  • Elastic Compute Cloud (EC2)

  • Identity and Access Management (IAM)

  • Key Management Service (KMS)

  • Security Token Service (STS)

  • Simple Storage Service (S3)

To manage AWS resources. The endpoint depends on your AWS region. Refer to AWS documentation for details

Amazon FSx for NetApp ONTAP:

  • api.workloads.netapp.com

The web-based console contacts this endpoint to interact with the Workload Factory APIs to manage and operate FSx for ONTAP-based workloads.

Azure environments

Allow the endpoints that apply to your Azure region: public, Government, or China.

Endpoints Purpose

  • https://management.azure.com

  • https://login.microsoftonline.com

  • https://blob.core.windows.net

  • https://core.windows.net

To manage resources in Azure public regions.

  • https://management.usgovcloudapi.net

  • https://login.microsoftonline.us

  • https://*.blob.core.usgovcloudapi.net

  • https://core.usgovcloudapi.net

To manage resources in Azure Government regions.

  • https://management.chinacloudapi.cn

  • https://login.chinacloudapi.cn

  • https://blob.core.chinacloudapi.cn

  • https://core.chinacloudapi.cn

To manage resources in Azure China regions.

Google Cloud environments

Allow these Google Cloud API endpoints to manage resources in your project.

Endpoints Purpose

  • https://www.googleapis.com/compute/v1/

  • https://compute.googleapis.com/compute/v1

  • https://cloudresourcemanager.googleapis.com/v1/projects

  • https://www.googleapis.com/compute/beta

  • https://storage.googleapis.com/storage/v1

  • https://www.googleapis.com/storage/v1

  • https://iam.googleapis.com/v1

  • https://cloudkms.googleapis.com/v1

  • https://config.googleapis.com/v1/projects

To manage resources in Google Cloud.

NetApp Console endpoints

Allow the shared endpoints for NetApp Support, Console features, and Console agent deployment and upgrades.

Endpoints Purpose

  • https://mysupport.netapp.com

To obtain licensing information and to send AutoSupport messages to NetApp Support.

  • https://signin.b2c.netapp.com

To update NetApp Support Site (NSS) credentials or to add new NSS credentials to the NetApp Console.

  • https://support.netapp.com

To obtain licensing information and to send AutoSupport messages to NetApp Support as well as to receive software updates for Cloud Volumes ONTAP.

  • https://api.bluexp.netapp.com

  • https://netapp-cloud-account.auth0.com

  • https://netapp-cloud-account.us.auth0.com

  • https://console.netapp.com

  • https://components.console.bluexp.netapp.com

  • https://cdn.auth0.com

To provide features and services within the NetApp Console.

For non-Government regions, use the following endpoints:

  • https://bluexpinfraprod.eastus2.data.azurecr.io

  • https://bluexpinfraprod.azurecr.io

For Government regions, use the following endpoint instead:

  • https://occmclientinfragov.azurecr.us

To obtain images for Console agent deployment and upgrades.

For browser access and other networking requirements, see Prepare network access for restricted mode.

Step 4: Install Podman or Docker Engine

Depending on your operating system, either Podman or Docker Engine is required before installing the agent.

Example 1. Steps
Podman

Follow these steps to install and configure Podman:

  • Enable and start the podman.socket service

  • Install python3

  • Install the podman-compose package (varies by Red Hat version)

  • Add podman-compose to the PATH environment variable

  • If using Red Hat Enterprise Linux, verify that your Podman version is using Netavark Aardvark DNS instead of CNI

Note Adjust the aardvark-dns port (default: 53) after installing the agent to avoid DNS port conflicts. Follow the instructions to configure the port.
Steps

  1. Remove the podman-docker package if it's installed on the host.

    dnf remove podman-docker
rm /var/run/docker.sock

  2. Install Podman.

    You can obtain Podman from official Red Hat Enterprise Linux repositories.

    1. For Red Hat Enterprise Linux 9.6:

      sudo dnf install podman-5:<version>

      Where <version> is the supported version of Podman that you're installing. View the supported Podman versions.

    2. For Red Hat Enterprise Linux 9.1 to 9.4:

      sudo dnf install podman-4:<version>

      Where <version> is the supported version of Podman that you're installing. View the supported Podman versions.

    3. For Red Hat Enterprise Linux 8:

      sudo dnf install podman-4:<version>

      Where <version> is the supported version of Podman that you're installing. View the supported Podman versions.

  3. Enable and start the podman.socket service.

    sudo systemctl enable --now podman.socket

  4. Install python3.

    sudo dnf install python3

  5. Install the EPEL repository package if it's not already available on your system.

    This step is required because podman-compose is available from the Extra Packages for Enterprise Linux (EPEL) repository.

  6. If using Red Hat Enterprise 9:

    1. Install the EPEL repository package.

    sudo dnf install https://dl.fedoraproject.org/pub/epel/epel-release-latest-9.noarch.rpm

    1. Install podman-compose package 1.5.0.

      sudo dnf install podman-compose-1.5.0

  7. If using Red Hat Enterprise Linux 8:

    1. Install the EPEL repository package.

      sudo dnf install https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm

    2. Install podman-compose package 1.0.6.

      sudo dnf install podman-compose-1.0.6
      Note Using the dnf install command meets the requirement for adding podman-compose to the PATH environment variable. The installation command adds podman-compose to /usr/bin, which is already included in the secure_path option on the host.

    3. If using Red Hat Enterprise Linux 8, verify that your Podman version is using NetAvark with Aardvark DNS instead of CNI.

      1. Check to see if your networkBackend is set to CNI by running the following command:

        podman info | grep networkBackend

      2. If the networkBackend is set to CNI, you'll need to change it to netavark.

      3. Install netavark and aardvark-dns using the following command:

        dnf install aardvark-dns netavark

      4. Open the /etc/containers/containers.conf file and modify the network_backend option to use "netavark" instead of "cni".

        If /etc/containers/containers.conf doesn't exist, make the configuration changes to /usr/share/containers/containers.conf.

      5. Restart podman.

        systemctl restart podman

      6. Confirm networkBackend is now changed to "netavark" using the following command:

        podman info | grep networkBackend

  8. If associating this agent with a Cloud Volumes ONTAP system, consider increasing the number of threads associated with the agent to improve performance. Learn about increasing the agent's container thread limit.

Docker Engine

Follow the documentation from Docker to install Docker Engine.

Steps

  1. View installation instructions from Docker

    Follow the steps to install a supported Docker Engine version. Do not install the latest version, as it is unsupported by the Console.

  2. Verify that Docker is enabled and running.

    sudo systemctl enable docker && sudo systemctl start docker

Step 5: Manually install the NetApp Console restricted mode in your cloud environment (must use for Google Cloud)

You can install the Console agent manually on your own Linux host running in AWS, Azure, or Google Cloud.

Before you begin

You should have the following:

  • Root privileges to install the Console agent.

  • Details about a proxy server, if a proxy is required for internet access from the Console agent.

    You have the option to configure a proxy server after installation, but doing so requires restarting the Console agent.

  • A CA-signed certificate, if the proxy server uses HTTPS or if the proxy is an intercepting proxy.

Note You cannot set a certificate for a transparent proxy server when manually installing the Console agent. If you need to set a certificate for a transparent proxy server, you must use the Maintenance Console after installation. Learn more about the Agent Maintenance Console.
About this task

After installation, the Console agent automatically updates itself if a new version is available.

Steps

  1. If the http_proxy or https_proxy system variables are set on the host, remove them:

    unset http_proxy
unset https_proxy

    If you don't remove these system variables, the installation fails.

  2. Download the Console agent software and then copy it to the Linux host. You can download it either from the NetApp Console or the NetApp Support site.

    • NetApp Console: Go to Agents > Management > Deploy agent > On-prem > Manual install.

      Choose download the agent installer files or a URL to the files.

    • NetApp Support Site (needed if you don't already have access to the Console).

      Note Download the "online" agent installer that's meant for use in your network or in the cloud. A separate "offline" installer is available for the Console agent, but it's only supported with private mode deployments.

    • NetApp Support Site (needed if you don't already have access to the Console) NetApp Support Site.

  3. Assign permissions to run the script.

    chmod +x NetApp_Console_Agent_Cloud_<version>

    Where <version> is the version of the Console agent that you downloaded.

  4. If installing in a Government Cloud environment, disable the configuration checks. Learn how to disable configuration checks for manual installations.

  5. Run the installation script.

    ./NetApp_Console_Agent_Cloud_<version> --proxy <HTTP or HTTPS proxy server> --cacert <path and file name of a CA-signed certificate>

    You'll need to add proxy information if your network requires a proxy for internet access. You can add an explicit proxy during installation. The --proxy and --cacert parameters are optional and you won't be prompted to add them. If you have an explicit proxy server, you will need to enter the parameters as shown.

    Note If you want to configure a transparent proxy, you can do so after you've installed. Learn about the agent maintenance console.

    Here is an example of configuring an explicit proxy server with a CA-signed certificate:

    ./NetApp_Console_Agent_Cloud_v4.0.0 --proxy https://user:password@10.0.0.30:8080/ --cacert /tmp/cacert/certificate.cer
./NetApp_Console_Agent_Cloud_v4.0.0 --proxy https://user:password@10.0.0.30:8080/ --cacert /tmp/cacert/certificate.cer

    --proxy configures the Console agent to use an HTTP or HTTPS proxy server using one of the following formats:

    • http://address:port

    • http://user-name:password@address:port

    • http://domain-name%92user-name:password@address:port

    • https://address:port

    • https://user-name:password@address:port

    • https://domain-name%92user-name:password@address:port

      Note the following:

      • The user can be a local user or domain user.

      • For a domain user, you must use the ASCII code for a \ as shown above.

      • The Console agent doesn't support user names or passwords that include the @ character.

      • If the password includes any of the following special characters, you must escape that special character by prepending it with a backslash: & or !

        For example:

        http://bxpproxyuser:netapp1\!@address:3128

  6. If you used Podman, you'll need to adjust the aardvark-dns port.

    1. SSH to the Console agent virtual machine.

    2. Open podman /usr/share/containers/containers.conf file and modify the chosen port for Aardvark DNS service. For example, change it to 54.

      vi /usr/share/containers/containers.conf

      For example:

      # Port to use for dns forwarding daemon with netavark in rootful bridge
# mode and dns enabled.
# Using an alternate port might be useful if other DNS services should
# run on the machine.
#
dns_bind_port = 54

    3. Reboot the Console agent virtual machine.

Result

The Console agent is now installed. At the end of the installation, the Console agent service (occm) restarts twice if you specified a proxy server.

What's next?

Set up the NetApp Console.

Step 6: Set up NetApp Console

When you access the console for the first time, you are prompted to choose an organization for the Console agent and need to enable restricted mode.

Before you begin

The person who sets up the Console agent must log in to the Console using a login that doesn't already belong to a Console organization.

If your login is associated with another organization, you need to sign up with a new login. Otherwise, you do not see the option to enable restricted mode on the setup screen.

Steps

  1. Open a web browser from a host that has a connection to the Console agent instance and enter the following URL of the Console agent you installed.

  2. Sign up or log in to the NetApp Console.

  3. After you're logged in, set up the Console:

    1. Enter a name for the Console agent.

    2. Enter a name for a new Console organization.

    3. Select Are you running in a secured environment?

    4. Select Enable restricted mode on this account.

      Note that you can't change this setting after the account is created. You can't enable restricted mode later and you can't disable it later.

      If you deployed the Console agent in a Government region, the checkbox is already enabled and can't be changed. This is because restricted mode is the only mode supported in Government regions.

    5. Select Let's start.

Result

The Console agent is now installed and set up with your Console organization. All users need to access the Console using the IP address of the Console agent instance.

What's next?

Provide the Console with the permissions that you previously set up.

Step 7: Provide permissions to the Console agent

If you installed the Console agent manually, you need to give the permissions you set up earlier.

Learn how to prepare cloud permissions.

AWS IAM role

Attach the IAM role that you previously created to the EC2 instance where you installed the Console agent.

These steps apply only if you manually installed the Console agent in AWS. For AWS Marketplace deployments, you already associated the Console agent instance with an IAM role that includes the required permissions.

Steps

  1. Go to the Amazon EC2 console.

  2. Select Instances.

  3. Select the Console agent instance.

  4. Select Actions > Security > Modify IAM role.

  5. Select the IAM role and select Update IAM role.

AWS access key

Provide the NetApp Console with the AWS access key for an IAM user that has the required permissions.

Steps

  1. Select Administration > Credentials.

  2. Select Organization credentials.

  3. Select Add Credentials and follow the steps in the wizard.

    1. Credentials Location: Select Amazon Web Services > Agent.

    2. Define Credentials: Enter an AWS access key and secret key.

    3. Marketplace Subscription: Associate a Marketplace subscription with these credentials by subscribing now or by selecting an existing subscription.

    4. Review: Confirm the details about the new credentials and select Add.

Azure role

Go to the Azure portal and assign the Azure custom role to the Console agent virtual machine for one or more subscriptions.

Steps

  1. From the Azure Portal, open the Subscriptions service and select your subscription.

    It's important to assign the role from the Subscriptions service because this specifies the scope of the role assignment at the subscription level. The scope defines the set of resources that the access applies to. If you specify a scope at a different level (for example, at the virtual machine level), your ability to complete actions from within the NetApp Console will be affected.

    Microsoft Azure documentation: Understand scope for Azure RBAC

  2. Select Access control (IAM) > Add > Add role assignment.

  3. In the Role tab, select the Console Operator role and select Next.

    Note Console Operator is the default name provided in the policy. If you chose a different name for the role, then select that name instead.

  4. In the Members tab, complete the following steps:

    1. Assign access to a Managed identity.

    2. Select Select members, select the subscription in which the Console agent virtual machine was created, under Managed identity, choose Virtual machine, and then select the Console agent virtual machine.

    3. Select Select.

    4. Select Next.

    5. Select Review + assign.

    6. If you want to manage resources in additional Azure subscriptions, switch to that subscription and then repeat these steps.

Azure service principal

Provide the NetApp Console with the credentials for the Azure service principal that you previously set up.

Steps

  1. Select Administration > Credentials.

  2. Select Add Credentials and follow the steps in the wizard.

    1. Credentials Location: Select Microsoft Azure > Agent.

    2. Define Credentials: Enter information about the Microsoft Entra service principal that grants the required permissions:

      • Application (client) ID

      • Directory (tenant) ID

      • Client Secret

    3. Marketplace Subscription: Associate a Marketplace subscription with these credentials by subscribing now or by selecting an existing subscription.

    4. Review: Confirm the details about the new credentials and select Add.

Result

The NetApp Console now has the permissions that it needs to perform actions in Azure on your behalf.

Google Cloud service account

Associate the service account with the Console agent VM.

Steps

  1. Go to the Google Cloud portal and assign the service account to the Console agent VM instance.

    Google Cloud documentation: Changing the service account and access scopes for an instance

  2. If you want to manage resources in other projects, grant access by adding the service account with the Console agent role to that project. You'll need to repeat this step for each project.