forked from pivotal-cf/docs-pcf-install
-
Notifications
You must be signed in to change notification settings - Fork 0
/
cloudform-om-config.html.md.erb
336 lines (257 loc) · 17.1 KB
/
cloudform-om-config.html.md.erb
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
---
title: Configuring Ops Manager Director on AWS
owner: Ops Manager
---
<strong><%= modified_date %></strong>
<html class="list-style-none"></html>
This topic describes how to configure the Ops Manager Director after deploying the CloudFormation template for [Pivotal Cloud Foundry](https://network.pivotal.io/products/pivotal-cf) (PCF) on Amazon
Web Services (AWS).
Use this topic when [Installing Pivotal Cloud Foundry Using AWS CloudFormation](./cloudform-install.html).
<p class="note"><strong>Note</strong>: You can also perform the procedures in this topic using the Ops Manager API. For more information, see the <a href="ops-man-api.html">Using the Ops Manager API</a> topic.</p>
## <a id='access-om'></a>Step 1: Access Ops Manager ##
<p class="note"><strong>Note</strong>: For security, Ops Manager 1.7 and later require that you log in using a fully qualified domain name.</a></p>
1. In a web browser, navigate to the fully qualified domain you created in _Configuring DNS for PCF on AWS_.
1. When Ops Manager starts for the first time, you must choose one of the following:
* [Use an Identity Provider](#idp): If you use an Identity Provider, an external identity server maintains your user database.
* [Internal Authentication](#internal): If you use Internal Authentication, PCF maintains your user database.
<%= image_tag("select-authentication.png") %>
### <a id='idp'></a>Use an Identity Provider (IdP) ###
<%= partial 'using_idp_ops_manager' %>
### <a id='internal'></a>Internal Authentication ###
1. When redirected to the **Internal Authentication** page, you must complete the following steps:
* Enter a **Username**, **Password**, and **Password confirmation** to create an Admin user.
* Enter a **Decryption passphrase** and the **Decryption passphrase confirmation**. This passphrase encrypts the Ops Manager datastore, and is not recoverable if lost.
* If you are using an **HTTP proxy** or **HTTPS proxy**, follow the instructions in the [Configuring Proxy Settings for the BOSH CPI](./pcf-director-proxy-settings.html) topic.
* Read the **End User License Agreement**, and select the checkbox to accept the terms.
* Click **Setup Authentication**.
<%= image_tag("om-login.png") %>
1. Log in to Ops Manager with the Admin username and password that you created in the previous step.
<%= image_tag("cf-login.png") %>
## <a id='aws-config'></a>Step 2: AWS Config Page ##
1. Click the **Ops Manager Director** tile.
<%= image_tag("cloudform/om-tile.png") %>
1. Select **AWS Config** to open the **AWS Management Console Config** page.
<%= image_tag("cloudform/aws-config.png") %>
1. Select **Use AWS Keys** or **Use AWS Instance Profile**.
* If you choose to use AWS keys, complete the fields with information from
the **[Outputs](./../customizing/cloudform-dns-config.html#outputs)** tab for your stack in the AWS Console:
* **Access Key ID**: Use the value of **PcfIamUserAccessKey**.
* **AWS Secret Key**: Use the value of **PcfIamUserSecretAccessKey**.
* If you choose to use an AWS instance profile, enter the name of your AWS
Identity and Access Management (IAM) profile.
1. Complete the remainder of the **AWS Management Console Config** page with the following information.
* **VPC ID**: Use the value of **PcfVpc** from your **Outputs** tab.
* **Security Group ID**: Use the value of **PcfVmsSecurityGroup** from your **Outputs** tab.
* **Key Pair Name**: Use the name of your pre-existing AWS key pair.
* **SSH Private Key**: Open your AWS key pair `.pem` file in a
text editor. Copy the contents of the `.pem` file and paste it into the
**SSH Private Key** field.
* **Region**: Select the region where you deployed Ops Manager.
* **Encrypt EBS Volumes**: Select this checkbox to enable full encryption
on persistent disks of all BOSH-deployed virtual machines (VMs), except
for the Ops Manager VM and Director VM. See the [Configuring Amazon EBS
Encryption for PCF on AWS](cloudform-om-ebs-config.html) topic for
details about using EBS encryption.
1. Click **Save**.
## <a id='director-config'></a>Step 3: Director Config Page ##
1. Select **Director Config** to open the **Director Config** page.
<%= image_tag("images/cloudform/director_aws.png") %>
1. Enter at least two of the following NTP servers in the **NTP Servers (comma
delimited)** field, separated by a comma: `0.amazon.pool.ntp.org,1.amazon.pool.ntp.org,2.amazon.pool.ntp.org,3.amazon.pool.ntp.org`
1. (Optional) Enter your **JMX Provider IP Address** if you are [Using JMX Bridge](./../customizing/use-metrics.html).
1. (Optional) Enter your **Bosh HM Forwarder IP Address** if you are using the BOSH HM Forwarder.
1. Select the **Enable VM Resurrector Plugin** checkbox to enable the Ops
Manager Resurrector functionality and increase Pivotal Application Service (PAS) availability.
1. Select **Enable Post Deploy Scripts** to run a post-deploy script after deployment. This script allows the job to execute additional commands against a deployment.
1. Select **Recreate all VMs** to force BOSH to recreate all VMs on the next deploy. This process does not destroy any persistent disk data.
1. Select **Enable bosh deploy retries** if you want Ops Manager to retry failed BOSH operations up to five times.
1. Select **Keep Unreachable Director VMs** if you want to preserve Ops Manager Director VMs after a failed deployment for troubleshooting purposes.
1. Select **HM Pager Duty Plugin** to enable Health Monitor integration with PagerDuty.
<%= image_tag("images/director_hm_pager.png") %>
* **Service Key**: Enter your API service key from PagerDuty.
* **HTTP Proxy**: Enter an HTTP proxy for use with PagerDuty.
1. Select **HM Email Plugin** to enable Health Monitor integration with email.
<%= image_tag("images/director_hm_email.png") %>
* **Host**: Enter your email hostname.
* **Port**: Enter your email port number.
* **Domain**: Enter your domain.
* **From**: Enter the address for the sender.
* **Recipients**: Enter comma-separated addresses of intended recipients.
* **Username**: Enter the username for your email server.
* **Password**: Enter the password password for your email server.
* **Enable TLS**: Select this checkbox to enable Transport Layer Security.
1. For **Blobstore Location**, select **S3 Compatible Blobstore** and complete the following steps:
<%= image_tag("images/director_blobstore.png") %>
* In a browser, reference the [Amazon Simple Storage Service (Amazon S3) table](http://docs.aws.amazon.com/general/latest/gr/rande.html#s3_region), and find the region for your AWS account.
* Prepend `https://` to the **Endpoint** for your region, and copy it into
the Ops Manager **S3 Endpoint** field. For example, in the **us-west-2** region, enter `https://s3-us-west-2.amazonaws.com` into the field.
* Complete the following fields with information from the **Outputs** tab in the AWS Console:
* **Bucket Name**: Use the value of **PcfOpsManagerS3Bucket**.
* **Access Key ID**: Use the value of **PcfIamUserAccessKey**.
* **AWS Secret Key**: Use the value of **PcfIamUserSecretAccessKey**.
* Select **V2 Signature** or **V4 Signature**. If you select **V4 Signature**, enter your **Region**.
* *AWS recommends using Signature Version 4 when possible.*
<p class="note"><strong>Note</strong>: For more information about AWS S3 Signatures, see the AWS <a href="http://docs.aws.amazon.com/AmazonS3/latest/API/sig-v4-authenticating-requests.html">Authenticating Requests</a> documentation.</p>
1. For **Database Location**, select **Internal**.
1. (Optional) **Director Workers** sets the number of workers available to execute Director tasks. This field defaults to `5`.
1. (Optional) **Max Threads** sets the maximum number of threads that the Ops Manager Director can run simultaneously. Pivotal recommends that you leave the field blank to use the default value, unless doing so results in rate limiting or errors on your IaaS.
1. (Optional) To add a custom URL for your Ops Manager Director, enter a valid hostname in **Director Hostname**. You can also use this field to configure [a load balancer in front of your Ops Manager Director](https://discuss.pivotal.io/hc/en-us/articles/225420588).
1. Click **Save**.
<p class="note"><strong>Note</strong>: For more information about AWS S3 Signatures, see the AWS <a href="http://docs.aws.amazon.com/AmazonS3/latest/API/sig-v4-authenticating-requests.html">Authenticating Requests</a> documentation.</p>
## <a id='az'></a>Step 4: Create Availability Zones Page ##
1. Select **Create Availability Zones**.
<%= image_tag("cloudform/create-az.png") %>
1. Use the following steps to create three Availability Zones for your apps to use:
1. Click **Add** three times.
1. For **Amazon Availability Zone**, enter the values corresponding to these keys from the **Outputs** tab in the AWS Console.
* **PcfManagementSubnetAZ1AvailabilityZone**
* **PcfManagementSubnetAZ2AvailabilityZone**
* **PcfManagementSubnetAZ3AvailabilityZone**
1. Click **Save**.
## <a id='om-networks'></a>Step 5: Create Networks Page ##
1. Select **Create Networks**.
<%= image_tag("cloudform/create-networks.png") %>
1. (Optional) Select **Enable ICMP checks** to enable ICMP on your networks. Ops Manager uses ICMP checks to confirm that components within your network are reachable.
1. Perform the following steps to add the network configuration you created for your VPC in the [Step 4: Create a VPC](pcf-aws-manual-config.html#pcfaws-vpc) section of the <em>Manually Configuring PCF for AWS</em> topic:
1. Click **Add Network**.
1. For **Name**, enter `pcf-management-network`.
1. Create a subnet for each availability zone by clicking **Add Subnet**. Refer to the table below for the information required to create all three subnets:
<table>
<tr>
<th>VPC Subnet ID</th>
<th>CIDR</th>
<th>Reserved IP Ranges</th>
<th>DNS</th>
<th>Gateway</th>
<th>Availability Zones</th>
</tr>
<tr>
<td>The value of `PcfManagementSubnetAZ1` from the AWS outputs tab.</td>
<td>`10.0.16.0/28`</td>
<td>`10.0.16.0-10.0.16.4`</td>
<td>`169.254.169.253`</td>
<td>`10.0.16.1`</td>
<td>The value of `PcfManagementSubnetAZ1AvailabilityZone` from the AWS outputs tab. </td>
</tr>
<tr>
<td>The value of `PcfManagementSubnetAZ2` from the AWS outputs tab.</td>
<td>`10.0.16.16/28`</td>
<td>`10.0.16.16-10.0.16.20`</td>
<td>`169.254.169.253`</td>
<td>`10.0.16.17`</td>
<td>The value of `PcfManagementSubnetAZ2AvailabilityZone` from the AWS outputs tab.</td>
</tr>
<tr>
<td>The value of `PcfManagementSubnetAZ3` from the AWS outputs tab</td>
<td>`10.0.16.32/28`</td>
<td>`10.0.16.32-10.0.16.36`</td>
<td>`169.254.169.253`</td>
<td>`10.0.16.33`</td>
<td>The value of `PcfManagementSubnetAZ3AvailabilityZone` from the AWS outputs tab.</td>
</tr>
</table>
<br><br>
1. Click **Add Network**.
1. For **Name**, enter `pcf-ert-network`.
1. Create a subnet for each availability zone by clicking **Add Subnet**. Refer to the table below for the information required to create all three subnets:
<table>
<tr>
<th>VPC Subnet ID</th>
<th>CIDR</th>
<th>Reserved IP Ranges</th>
<th>DNS</th>
<th>Gateway</th>
<th>Availability Zones</th>
</tr>
<tr>
<td>The value of `PcfERTSubnetAZ1` from the AWS outputs tab.</td>
<td>`10.0.4.0/24`</td>
<td>`10.0.4.0-10.0.4.4`</td>
<td>`169.254.169.253`</td>
<td>`10.0.4.1`</td>
<td>The value of `PcfERTSubnetAZ1AvailabilityZone` from the AWS outputs tab.</td>
</tr>
<tr>
<td>The value of `PcfERTSubnetAZ2` from the AWS outputs tab.</td>
<td>`10.0.5.0/24`</td>
<td>`10.0.5.0-10.0.5.4`</td>
<td>`169.254.169.253`</td>
<td>`10.0.5.1`</td>
<td>The value of `PcfERTSubnetAZ2AvailabilityZone` from the AWS outputs tab.</td>
</tr>
<tr>
<td>The value of `PcfERTSubnetAZ3` from the AWS outputs tab.</td>
<td>`10.0.6.0/24`</td>
<td>`10.0.6.0-10.0.6.4`</td>
<td>`169.254.169.253`</td>
<td>`10.0.6.1`</td>
<td>The value of `PcfERTSubnetAZ3AvailabilityZone` from the AWS outputs tab.</td>
</tr>
</table>
<br><br>
1. Click **Add Network**.
1. Check the **Service Network** box. This allows you to dynamically provision VMs in this network for use with on-demand services. Ops Manager does not provision VMs within the specified CIDR range.
1. Enter `pcf-services-network` in **Name** field.
1. Create a subnet for each availability zone by clicking **Add Subnet**. Refer to the table below for the information required to create all three subnets:
<table>
<tr>
<th>VPC Subnet ID</th>
<th>CIDR</th>
<th>Reserved IP Ranges</th>
<th>DNS</th>
<th>Gateway</th>
<th>Availability Zones</th>
</tr>
<tr>
<td>The value of `PcfServicesSubnetAZ1` from the AWS outputs tab.</td>
<td>`10.0.8.0/24`</td>
<td>`10.0.8.0-10.0.8.3`</td>
<td>`169.254.169.253`</td>
<td>`10.0.8.1`</td>
<td>The value of `PcfServicesSubnetAZ1AvailabilityZone` from the AWS outputs tab.</td>
</tr>
<tr>
<td>The value of `PcfServicesSubnetAZ2` from the AWS outputs tab.</td>
<td>`10.0.9.0/24`</td>
<td>`10.0.9.0-10.0.9.3`</td>
<td>`169.254.169.253`</td>
<td>`10.0.9.1`</td>
<td>The value of `PcfServicesSubnetAZ2AvailabilityZone` from the AWS outputs tab.</td>
</tr>
<tr>
<td>The value of `PcfServicesSubnetAZ3` from the AWS outputs tab.</td>
<td>`10.0.10.0/24`</td>
<td>`10.0.10.0-10.0.10.3`</td>
<td>`169.254.169.253`</td>
<td>`10.0.10.1`</td>
<td>The value of `PcfServicesSubnetAZ3AvailabilityZone` from the AWS outputs tab.</td>
</tr>
</table>
1. Click **Save**.
## <a id="assign-azs"></a>Step 6: Assign AZs and Networks Page##
1. Select **Assign AZs and Networks**.
1. Use the drop-down menu to select a **Singleton Availability Zone**. The Ops Manager Director installs in this Availability Zone.
1. Use the drop-down menu to select `pcf-management-network` for your Ops Manager Director.
1. Click **Save**.
## <a id='security'></a>Step 7: Security Page ##
1. Select **Security**.
<%= image_tag("../images/om-security.png") %>
1. In **Trusted Certificates**, enter a custom certificate authority (CA) certificate to insert into your organization's certificate trust chain. This feature enables all BOSH-deployed components in your deployment to trust a custom root certificate. If you want to use Docker Registries for running app instances in Docker containers, use this field to enter your certificate for your private Docker Registry. See the [Using Docker Registries](../opsguide/docker-registry.html) topic for more information.
1. Choose **Generate passwords** or **Use default BOSH password**. Pivotal recommends that you use the **Generate passwords** option for greater security.
1. Click **Save**. To view your saved Director password, click the **Credentials** tab.
## <a id='syslog'></a>Step 8: Syslog Page
<%= partial 'syslog_bosh' %>
## <a id='resource-config'></a>Step 9: Resource Config Page
1. Select **Resource Config**.
<%= image_tag("../images/resource-config-aws.png") %>
1. Adjust any values as necessary for your deployment. Under the **Instances**, **Persistent Disk Type**, and **VM Type** fields, choose **Automatic** from the drop-down menu to allocate the recommended resources for the job. If the **Persistent Disk Type** field reads **None**, the job does not require persistent disk space.
<p class="note"><strong>Note</strong>: If you set a field to <strong>Automatic</strong> and the recommended resource allocation changes in a future version, Ops Manager automatically uses the updated recommended allocation.</p>
## <a id='complete'></a>Step 10: Complete the Ops Manager Director Installation ##
1. Click the **Installation Dashboard** link to return to the Installation
Dashboard.
1. Click **Apply Changes**. If the following ICMP error message appears, click
**Ignore errors and start the install**.
<%= image_tag("cloudform/install-error.png") %>
1. Ops Manager Director installs. This may take a few moments. When the installation process successfully completes, the **Changes Applied** window appears.
<%= image_tag("cloudform/ops-manager-complete.png") %>
1. After you complete this procedure, follow the instructions in the [Deploying PAS on AWS CloudFormation](./cloudform-er-config.html) topic.