LATEST VERSION: 1.10 - CHANGELOG
Pivotal Cloud Foundry v1.10

Configuring Ops Manager Director on AWS

Page last updated:

This topic describes how to configure the Ops Manager Director after deploying the CloudFormation template for Pivotal Cloud Foundry (PCF) on Amazon Web Services (AWS). Use this topic when Installing Pivotal Cloud Foundry Using AWS CloudFormation.

Before beginning this procedure, ensure that you have successfully completed all steps in the Deploying the CloudFormation Template for PCF on AWS and the Launching an Ops Manager Director Instance on AWS CloudFormation topics. After you complete this procedure, follow the instructions in the Deploying Elastic Runtime on AWS CloudFormation topic.

Note: You can also perform the procedures in this topic using the Ops Manager API. For more information, see the Using the Ops Manager API topic.

Step 1: Open the Outputs Tab in AWS Stacks

  1. In the dashboard of your AWS Console, click CloudFormation. The Stacks Dashboard displays.

  2. Select the pcf-stack checkbox, then select the Outputs tab.

    Aws cloudform stacks

    In the steps described below, use the information from the Value column of the Outputs tab to configure your PCF installation.

Step 2: Access Ops Manager

Note: For security, Ops Manager 1.7 and later require that you log in using a fully qualified domain name.

  1. In a web browser, navigate to the fully qualified domain you created in the Create a DNS Entry step of Launching an Ops Manager Director Instance on AWS.

  2. When Ops Manager starts for the first time, you must choose one of the following:

    Select authentication

Use an Identity Provider (IdP)

  1. Log in to your IdP console and download the IdP metadata XML. Optionally, if your IdP supports metadata URL, you can copy the metadata URL instead of the XML.

  2. Copy the IdP metadata XML or URL to the Ops Manager Use an Identity Provider log in page. Meta om

    Note: The same IdP metadata URL or XML is applied for the BOSH Director. If you are using a separate IdP for BOSH, copy the metadata XML or URL from that IdP and enter it into the BOSH IdP Metadata text box in the Ops Manager log in page.

  3. Enter your Decryption passphrase. Read the End User License Agreement, and select the checkbox to accept the terms.

  4. Your Ops Manager log in page appears. Enter your username and password. Click Login.

  5. Download your SAML Service Provider metadata (SAML Relying Party metadata) by navigating to the following URLs:

    • 5a. Ops Manager SAML service provider metadata: https://OPS-MAN-FQDN:443/uaa/saml/metadata
    • 5b. BOSH Director SAML service provider metadata: https://BOSH-IP-ADDRESS:8443/saml/metadata

    Note: To retrieve your BOSH-IP-ADDRESS, navigate to the Ops Manager Director tile > Status tab. Record the Ops Manager Director IP address.

  6. Configure your IdP with your SAML Service Provider metadata. Import the Ops Manager SAML provider metadata from Step 5a above to your IdP. If your IdP does not support importing, provide the values below.

    • Single sign on URL: https://OPS-MAN-FQDN:443/uaa/saml/SSO/alias/OPS-MAN-FQDN
    • Audience URI (SP Entity ID): https://OP-MAN-FQDN:443/uaa
    • Name ID: Email Address
    • SAML authentication requests are always signed
  7. Import the BOSH Director SAML provider metadata from Step 5b to your IdP. If the IdP does not support an import, provide the values below.

    • Single sign on URL: https://BOSH-IP:8443/saml/SSO/alias/BOSH-IP
    • Audience URI (SP Entity ID): https://BOSH-IP:8443
    • Name ID: Email Address
    • SAML authentication requests are always signed
  8. Return to the Ops Manager Director tile, and continue with the configuration steps below.

Internal Authentication

  1. When redirected to the Internal Authentication page, you must complete the following steps:

    • Enter a Username, Password, and Password confirmation to create an Admin user.
    • Enter a Decryption passphrase and the Decryption passphrase confirmation. This passphrase encrypts the Ops Manager datastore, and is not recoverable if lost.
    • If you are using an HTTP proxy or HTTPS proxy, follow the instructions in the Configuring Proxy Settings for the BOSH CPI topic.
    • Read the End User License Agreement, and select the checkbox to accept the terms.
    • Click Setup Authentication.

    Om login

  2. Log in to Ops Manager with the Admin username and password that you created in the previous step.

    Cf login

Step 3: AWS Config Page

  1. Click the Ops Manager Director tile.

    Om tile

  2. Select AWS Config to open the AWS Management Console Config page.

    Aws config

  3. Select Use AWS Keys or Use AWS Instance Profile.

    • If you choose to use AWS keys, complete the fields with information from the Outputs tab for your stack in the AWS Console:
      • Access Key ID: Use the value of PcfIamUserAccessKey.
      • AWS Secret Key: Use the value of PcfIamUserSecretAccessKey.
    • If you choose to use an AWS instance profile, enter the name of your AWS Identity and Access Management (IAM) profile.
  4. Complete the remainder of the AWS Management Console Config page with the following information.

    • VPC ID: Use the value of PcfVpc from your Outputs tab.
    • Security Group ID: Open the AWS EC2 Dashboard and click Security Groups. Select the security group with the Description PCF VMs Security Group. Copy the Group ID of this group into the Ops Manager Security Group ID field.
    • Key Pair Name: Use the name of your pre-existing AWS key pair. You selected this key pair name when you first deployed Ops Manager Director.
    • SSH Private Key: Open your AWS key pair .pem file in a text editor. Copy the contents of the .pem file and paste it into the SSH Private Key field.
    • Region: Select the region where you deployed Ops Manager.
    • Encrypt EBS Volumes: Select this checkbox to enable full encryption on persistent disks of all BOSH-deployed virtual machines (VMs), except for the Ops Manager VM and Director VM. See the Configuring Amazon EBS Encryption for PCF on AWS topic for details on using EBS encryption.
  5. Click Save.

Step 4: Director Config Page

  1. Select Director Config to open the Director Config page.

    Director aws

  2. In the NTP Servers (comma delimited) field, enter at least two of the following NTP servers, separated by a comma:

    • 0.amazon.pool.ntp.org
    • 1.amazon.pool.ntp.org
    • 2.amazon.pool.ntp.org
    • 3.amazon.pool.ntp.org
  3. (Optional) Enter your Metrics IP Address if you are Using JMX Bridge.

  4. Select the Enable VM Resurrector Plugin checkbox to enable the Ops Manager Resurrector functionality and increase Elastic Runtime availability.

  5. Select Enable Post Deploy Scripts to run a post-deploy script after deployment. This script allows the job to execute additional commands against a deployment.

  6. Select Recreate all VMs to force BOSH to recreate all VMs on the next deploy. This process does not destroy any persistent disk data.

  7. Select Enable bosh deploy retries if you want Ops Manager to retry failed BOSH operations up to five times.

  8. Select Keep Unreachable Director VMs if you want to preserve Ops Manager Director VMs after a failed deployment for troubleshooting purposes.

  9. Select HM Pager Duty Plugin to enable Health Monitor integration with PagerDuty. Director hm pager

    • Service Key: Enter your API service key from PagerDuty.
    • HTTP Proxy: Enter an HTTP proxy for use with PagerDuty.
  10. Select HM Email Plugin to enable Health Monitor integration with email. Director hm email

    • Host: Enter your email hostname.
    • Port: Enter your email port number.
    • Domain: Enter your domain.
    • From: Enter the address for the sender.
    • Recipients: Enter comma-separated addresses of intended recipients.
    • Username: Enter the username for your email server.
    • Password: Enter the password password for your email server.
    • Enable TLS: Select this checkbox to enable Transport Layer Security.
  11. For Blobstore Location, select S3 Compatible Blobstore and complete the following steps: Director blobstore

    • In a browser, reference the Amazon Simple Storage Service (Amazon S3) table , and find the region for your AWS account.
    • Prepend https:// to the Endpoint for your region, and copy it into the Ops Manager S3 Endpoint field. For example, in the us-west-2 region, enter https://s3-us-west-2.amazonaws.com into the field.
    • Complete the following fields with information from the Outputs tab in the AWS Console:
      • Bucket Name: Use the value of PcfOpsManagerS3Bucket.
      • Access Key ID: Use the value of PcfIamUserAccessKey.
      • AWS Secret Key: Use the value of PcfIamUserSecretAccessKey.
    • Select V2 Signature or V4 Signature. If you select V4 Signature, enter your Region.
      • AWS recommends using Signature Version 4 when possible.

    Note: For more information about AWS S3 Signatures, see the AWS Authenticating Requests documentation.

  12. For Database Location, select External MySQL Database. Complete the following fields with information from the Outputs tab in the AWS Console. Director database

    • Host: Use the value of PcfRdsAddress.
    • Port: Use the value of PcfRdsPort.
    • Username: Use the value of PcfRdsUsername.
    • Password: Use the value of PcfRdsPassword.
    • Database: Use the value of PcfRdsDBName.
  13. Max Threads sets the maximum number of threads that the Ops Manager Director can run simultaneously. Pivotal recommends that you leave the field blank to use the default value, unless doing so results in rate limiting or errors on your IaaS.

  14. (Optional) To add a custom URL for your Ops Manager Director, enter a valid hostname in Director Hostname. You can also use this field to configure a load balancer in front of your Ops Manager Director.

  15. Click Save.

Note: For more information about AWS S3 Signatures, see the AWS Authenticating Requests documentation.

Step 5: Create Availability Zones Page

Note: Pivotal recommends at least three Availability Zones for a highly available installation of Elastic Runtime.

  1. Select Create Availability Zones. Create az
  2. Use the following steps to create one or more Availability Zones for your applications to use:
    • Click Add.
    • For Amazon Availability Zone, enter the value of PcfPrivateSubnetAvailabilityZone from the Outputs tab in the AWS Console.
    • (Optional) If you are using a second Amazon Availability Zone, click Add. Enter the value of PcfPrivateSubnet2AvailabilityZone from the Outputs tab in the AWS Console.
    • Click Save.

Step 6: Create Networks Page

  1. Select Create Networks. Create networks
  2. Select Enable ICMP checks to enable ICMP on your networks. Ops Manager uses ICMP checks to confirm that components within your network are reachable.
  3. Use the following steps to create one or more Ops Manager networks:

    • Click Add Network.
    • Enter a unique Name for the network.
    • If you want to dynamically provision VMs in this network for use with on-demand services, select the Service Networks checkbox. When the checkbox is selected, Ops Manager does not provision VMs within the specified CIDR range.
    • Click Add Subnet to create one or more subnets for the network.

      Note: To use the Single Sign-On for PCF service, you must configure a network with only one subnet.

    • In the VPC Subnet ID field, use the value of PcfPrivateSubnetId from the Outputs tab in the AWS Console.
    • For CIDR, enter 10.0.16.0/20. Ops Manager deploy VMs to this CIDR block.
    • For Reserved IP Ranges, enter 10.0.16.1-10.0.16.9. Ops Manager avoids deploying VMs to any IP address in this range.
    • Enter 10.0.0.2 for DNS and 10.0.16.1 for Gateway.
    • Select which Availability Zones to use with the network.
    • (Optional) If you are using a second subnet, click Add Subnet. In the VPC Subnet ID field, use the value of PcfPrivateSubnet2Id. Enter the rest of the fields using the information provided above.

    Note: If you are using multiple Availability Zones, you must add a new network with at least one subnet for each Availability Zone.

  4. Click Save.

  5. If the following ICMP error message appears, you can ignore the warning. Dismiss the warning, and move on to the next step.

    Config error

Step 7: Assign AZs and Networks Page

  1. Select Assign AZs and Networks. Assign az
  2. Use the drop-down menu to select a Singleton Availability Zone. The Ops Manager Director installs in this Availability Zone.
  3. Use the drop-down menu to select a Network for your Ops Manager Director.
  4. Click Save.

Step 8: Security Page

  1. Select Security. Om security

  2. In Trusted Certificates, enter a custom certificate authority (CA) certificate to insert into your organization’s certificate trust chain. This feature enables all BOSH-deployed components in your deployment to trust a custom root certificate. If you want to use Docker Trusted Registries for running app instances in Docker containers, use this field to enter your certificate for your private Docker Trusted Registry. See the Using Docker Trusted Registries topic for more information.

  3. Choose Generate passwords or Use default BOSH password. Pivotal recommends that you use the Generate passwords option for greater security.

  4. Click Save. To view your saved Director password, click the Credentials tab.

Step 9: Resource Config Page

  1. Select Resource Config. Resource config new
  2. Adjust any values as necessary for your deployment. Under the Instances, Persistent Disk Type, and VM Type fields, choose Automatic from the drop-down menu to allocate the recommended resources for the job. If the Persistent Disk Type field reads None, the job does not require persistent disk space.

    Note: If you set a field to Automatic and the recommended resource allocation changes in a future version, Ops Manager automatically uses the updated recommended allocation.

Step 10: Complete the Ops Manager Director Installation

  1. Click the Installation Dashboard link to return to the Installation Dashboard.

  2. Click Apply Changes. If the following ICMP error message appears, click Ignore errors and start the install.

    Install error

  3. Ops Manager Director installs. This may take a few moments. When the installation process successfully completes, the Changes Applied window appears.

    Ops manager complete

  4. After you complete this procedure, follow the instructions in the Deploying Elastic Runtime on AWS CloudFormation topic.

Create a pull request or raise an issue on the source for this page in GitHub