Updating IPsec to Run with Xenial Stemcells
Note: Pivotal Platform is now part of VMware Tanzu. In v1.9 and later, Pivotal IPsec is named IPsec for VMware Tanzu.
Page last updated:
Ops Manager products and tiles that are released after July 2018 require Ubuntu Xenial stemcells instead of Ubuntu Trusty stemcells. You need to verify that your IPsec for VMware Tanzu deployment is configured correctly to support products running on Xenial.
This topic describes how to determine if your existing deployment of IPsec can be deployed to VMs that run on Xenial. This topic also explains how to update your IPsec if it does not support Xenial.
Follow the instructions on this page if you use IPsec with any products or tiles that use Xenial stemcells. See Product Tiles that Use Xenial Stemcells below.
Do I Need to Modify IPsec?
IPsec v1.9.9 runs correctly on Xenial-based VMs if the IPsec runtime config
includes the ubuntu-xenial
property.
Review the following table and make any required changes before you upgrade to Xenial stemcells.
If you are using this version of IPsec… | do the following… |
---|---|
1.9.9 | Verify that your runtime config file, ipsec-addon.yml , includes
stemcell: - os: ubuntu-trusty - os: ubuntu-xenialIf it does not, then follow the procedure, Add the Xenial Stemcell Property to IPsec below. |
v1.9.4 and earlier | Install IPsec v1.9.9. |
If you use IPsec without adding the ubuntu-xenial
property to the runtime config,
the VMs running on Xenial are not able to communicate with the rest of the system.
Product Tiles that Use Xenial Stemcells
Ensure that you have added the ubuntu-xenial
property to IPsec runtime config
before you install any product tiles that use Xenial stemcells.
For a list of Ops Manager tile releases that now use Xenial, see Tiles Using Xenial Stemcells.
Add the Xenial Stemcell Property to IPsec
If you use IPsec v1.9.9 without the ubuntu-xenial
property in the runtime config, then you must add it to your
existing ipsec-addon.yml
and redeploy. Follow these steps:
SSH into the Ops Manager VM. For how to do this, see SSH into Ops Manager.
To retrieve and save the IPsec runtime config, run the following command:
bosh -e BOSH-ENVIRONMENT runtime-config –name ipsec > /tmp/ipsec-addon.yml
Where
BOSH-ENVIRONMENT
is the alias you set for the BOSH Director.For example:
$ bosh -e my-env runtime-config –name ipsec-addon > /tmp/ipsec-addon.yml
Edit the
ipsec-addon.yml
file to add- os: ubuntu-xenial
underproperties: {}
as shown below:addons: - name: ipsec-addon jobs: - name: ipsec release: ipsec properties: {} include: stemcell: - os: ubuntu-trusty - os: ubuntu-xenial
To update the runtime config, run the following command:
bosh -e BOSH-ENVIRONMENT update-runtime-config --name=ipsec /tmp/ipsec-addon.yml
For example:
bosh -e my-env update-runtime-config --name=ipsec-addon /tmp/ipsec-addon.yml
Navigate to the Installation Dashboard in Ops Manager.
If you are using Ops Manager v2.3 or later, click Review Pending Changes. For more information about this Ops Manager page, see Reviewing Pending Product Changes.
Click Apply Changes.