Configuring Ops Manager Director on vSphere

Page last updated:

Warning: Pivotal Operations Manager v2.0 is no longer supported because it has reached the End of General Support (EOGS) phase as defined by the Support Lifecycle Policy. To stay up to date with the latest software and security updates, upgrade to a supported version.

This topic describes how to configure the Ops Manager Director for VMware vSphere.

Before you begin this procedure, ensure that you have successfully completed all steps in the Deploying BOSH and Ops Manager to vSphere topic. After you complete this procedure, follow the configuration instructions for the runtime you choose to install. For example, to install Pivotal Application Service (PAS), see the Deploying PAS on vSphere topic.

See Installing Runtimes for more information about Pivotal Cloud Foundry (PCF) runtimes.

Note: You can also perform the procedures in this topic using the Ops Manager API. For more information, see the Using the Ops Manager API topic.

Step 1: Set Up Ops Manager

  1. Navigate to the fully qualified domain of your Ops Manager in a web browser.

  2. The first time you start Ops Manager, you must choose one of the following:

Select authentication

Use an Identity Provider

  1. Log in to your IdP console and download the IdP metadata XML. Optionally, if your IdP supports metadata URL, you can copy the metadata URL instead of the XML.

  2. Copy the IdP metadata XML or URL to the Ops Manager Use an Identity Provider log in page. Meta om

    Note: The same IdP metadata URL or XML is applied for the Ops Manager Director. If you use a separate IdP for BOSH, copy the metadata XML or URL from that IdP and enter it into the BOSH IdP Metadata text box in the Ops Manager log in page.

  3. Enter values for the fields listed below. Failure to provide values in these fields results in a 500 error.

    • SAML admin group: Enter the name of the SAML group that contains all Ops Manager administrators.
    • SAML groups attribute: Enter the groups attribute tag name with which you configured the SAML server.
  4. Enter your Decryption passphrase. Read the End User License Agreement, and select the checkbox to accept the terms.

  5. Your Ops Manager log in page appears. Enter your username and password. Click Login.

  6. Download your SAML Service Provider metadata (SAML Relying Party metadata) by navigating to the following URLs:

    • 5a. Ops Manager SAML service provider metadata: https://OPS-MAN-FQDN:443/uaa/saml/metadata
    • 5b. Ops Manager Director SAML service provider metadata: https://OPS-MANAGER-IP-ADDRESS:8443/saml/metadata

    Note: To retrieve your OPS-MANAGER-IP-ADDRESS, navigate to the Status tab in the Ops Manager Director tile. Record the Ops Manager Director IP address.

  7. Configure your IdP with your SAML Service Provider metadata. Import the Ops Manager SAML provider metadata from Step 5a above to your IdP. If your IdP does not support importing, provide the values below.

    • Single sign on URL: https://OPS-MAN-FQDN:443/uaa/saml/SSO/alias/OPS-MAN-FQDN
    • Audience URI (SP Entity ID): https://OP-MAN-FQDN:443/uaa
    • Name ID: Email Address
    • SAML authentication requests are always signed
  8. Import the Ops Manager Director SAML provider metadata from Step 5b to your IdP. If the IdP does not support an import, provide the values below.

    • Single sign on URL: https://OPS-MANAGER-IP-ADDRESS:8443/saml/SSO/alias/OPS-MANAGER-IP-ADDRESS
    • Audience URI (SP Entity ID): https://OPS-MANAGER-IP-ADDRESS:8443
    • Name ID: Email Address
    • SAML authentication requests are always signed
  9. Return to the Ops Manager Director tile and continue with the configuration steps below.

Note: For an example of how to configure SAML integration between Ops Manager and your IdP, see the Configuring Active Directory Federation Services as an Identity Provider topic.

Internal Authentication

  1. When redirected to the Internal Authentication page, you must complete the following steps:

    • Enter a Username, Password, and Password confirmation to create an Admin user.
    • Enter a Decryption passphrase and the Decryption passphrase confirmation. This passphrase encrypts the Ops Manager datastore, and is not recoverable.
    • If you are using an HTTP proxy or HTTPS proxy, follow the instructions in the Configuring Proxy Settings for the BOSH CPI topic.
    • Read the End User License Agreement, and select the checkbox to accept the terms.

    Om login

Step 2: vCenter Config Page

  1. Log in to Ops Manager with the Admin username and password you created in the previous step.

    Cf login

  2. Click the Ops Manager Director tile.

    Vsphere tile

  3. Select vCenter Config.

    Vcenter config

  4. Enter the following information:

    • vCenter Host: The hostname of the vCenter that manages ESXi/vSphere.
    • vCenter Username: A vCenter username with create and delete privileges for virtual machines (VMs) and folders.
    • vCenter Password: The password for the vCenter user specified above.
    • Datacenter Name: The name of the datacenter as it appears in vCenter.
    • Virtual Disk Type: The Virtual Disk Type to provision for all VMs. For guidance about the virtual disk type to select, see Provisioning a Virtual Disk in vSphere.

      Note: The following fields do not allow whitespace. Including whitespace characters in datastore or datastore folder names causes an error.

    • Ephemeral Datastore Names (comma delimited): The names of the datastores that store ephemeral VM disks deployed by Ops Manager.
    • Persistent Datastore Names (comma delimited): The names of the datastores that store persistent VM disks deployed by Ops Manager.
    • VM Folder: The vSphere datacenter folder (default: pcf_vms) where Ops Manager places VMs.
    • Template Folder: The vSphere datacenter folder (default: pcf_templates) where Ops Manager places VMs.
    • Disk path Folder: The vSphere datastore folder (default: pcf_disk) where Ops Manager creates attached disk images. You must not nest this folder.
  5. Select a network configuration from one of the following:

    • Standard vCenter Networking: This is the default option when upgrading Ops Manager.
    • NSX Networking: Select this option to enable VMware NSX Network Virtualization.


  6. Configure NSX networking by entering the following information:

    • NSX Mode: Select either NSX-V or NSX-T.
    • NSX Address: The address of the NSX manager.
    • NSX Username: The username to connect to the NSX manager.
    • NSX Password: The password for the username specified above.
    • NSX CA Cert: A CA certificate in PEM format that authenticates to the NSX server. If the NSX Manager generated a self-signed certificate, you can retrieve the CA certificate using OpenSSL with the following command: openssl s_client -showcerts -connect NSX-MANAGER-ADDRESS:443 < /dev/null 2> /dev/null | openssl x509

      Note: To update NSX security group and load balancer information, see the Updating NSX Security Group and Load Balancer Information topic.

  7. Click Save.

Note: After your initial deployment, you will not be able to edit the VM Folder, Template Folder, and Disk path Folder names.

Step 3: Director Config Page

  1. Select Director Config.

    Vsphere director

  2. In the NTP Servers (comma delimited) field, enter your NTP server addresses.

    Note: The NTP server configuration only updates after VM recreation. Ensure that you select the Recreate all VMs checkbox if you modify the value of this field.

  3. Leave the JMX Provider IP Address field blank.

    Note: Starting from PCF v2.0, BOSH-reported component metrics are available in the Loggregator Firehose by default. Therefore, if you continue to use PCF JMX Bridge for consuming them outside of the Firehose, you may receive duplicate data. To prevent this, leave the JMX Provider IP Address field blank. For additional guidance, see BOSH System Metrics Available in Loggregator Firehose.

  4. Leave the Bosh HM Forwarder IP Address field blank.

    Note: Starting from PCF v2.0, BOSH-reported component metrics are available in the Loggregator Firehose by default. Therefore, if you continue to use the BOSH HM Forwarder for consuming them, you may receive duplicate data. To prevent this, leave the Bosh HM Forwarder IP Address field blank. For additional guidance, see BOSH System Metrics Available in Loggregator Firehose.

  5. Select the Enable VM Resurrector Plugin to enable Ops Manager Resurrector functionality. If you are installing PAS, this setting also increases availability in your deployment. For more information, see the Using Ops Manager Resurrector on VMware vSphere topic.

  6. Select Enable Post Deploy Scripts to run a post-deploy script after deployment. This script allows the job to execute additional commands against a deployment.

    Note: If you are deploying Pivotal Container Service (PKS), you must enable post-deploy scripts.

  7. Select Recreate all VMs to force BOSH to recreate all VMs on the next deploy. This process does not destroy any persistent disk data.

  8. Select Enable bosh deploy retries if you want Ops Manager to retry failed BOSH operations up to five times.

  9. Select Keep Unreachable Director VMs if you want to preserve Ops Manager Director VMs after a failed deployment for troubleshooting purposes.

  10. Select HM Pager Duty Plugin to enable Health Monitor integration with PagerDuty. Director hm pager

    • Service Key: Enter your API service key from PagerDuty.
    • HTTP Proxy: Enter an HTTP proxy for use with PagerDuty.
  11. Select HM Email Plugin to enable Health Monitor integration with email. Director hm email

    • Host: Enter your email hostname.
    • Port: Enter your email port number.
    • Domain: Enter your domain.
    • From: Enter the address for the sender.
    • Recipients: Enter comma-separated addresses of intended recipients.
    • Username: Enter the username for your email server.
    • Password: Enter the password for your email server.
    • Enable TLS: Select this checkbox to enable Transport Layer Security.
  12. For Blobstore Location, Pivotal recommends that you select Internal. However, if you select S3 Compatible Blobstore, complete the S3 Endpoint, Bucket Name, Access Key, Secret Key, V2 Signature/V4 Signature, and Region with information from your blobstore provider.

    Director blobstore

  13. By default, PCF deploys and manages an Internal database for you. If you choose to use an External MySQL Database, complete the associated fields with information obtained from your external MySQL Database provider: Host, Port, Username, Password, and Database.

    Director database

  14. (Optional) Director Workers sets the number of workers available to execute Director tasks. This field defaults to 5.

  15. (Optional) Max Threads sets the maximum number of threads that the BOSH Director can run simultaneously. For vSphere, the default value is 32. Leave the field blank to use this default value. Pivotal recommends that you use the default value unless doing so results in rate limiting or errors on your IaaS.

  16. (Optional) To add a custom URL for your BOSH Director, enter a valid hostname in Director Hostname. You can also use this field to configure a load balancer in front of your Ops Manager Director. For more information, see How to Set Up a Load Balancer in Front of Ops Manager Director in the Pivotal Knowledge Base.

    WARNING: In Ops Manager v2.0.25 and earlier, if you change the Director Hostname after your initial deployment, VMs become unavailable. This causes PCF downtime. To restore VM availability, enable Recreate All VMs and redeploy. This issue is resolved in Ops Manager v2.0.26 and later.

  17. (Optional) Enter your list of comma-separated Excluded Recursors to declare which IP addresses and ports should not be used by the DNS server.

  18. (Optional) To disable BOSH DNS, select the Disable BOSH DNS server for troubleshooting purposes checkbox. For more information about the BOSH DNS service discovery mechanism, see BOSH DNS Service Discovery for Application Containers in the PAS Release Notes.

    Breaking Change: Do not disable BOSH DNS without consulting Pivotal Support. If you opt out of the BOSH DNS feature, your PCF deployment cannot support NSX-T networking. For more information about disabling BOSH DNS, see Disabling or Opting Out of BOSH DNS in PCF in the Pivotal Knowledge Base.

    Note: If you are deploying PKS, do not disable BOSH DNS. If PAS and PKS are running on the same instance of Ops Manager, you cannot use the opt-out feature of BOSH DNS for your PAS without breaking PKS. If you want to opt out of BOSH DNS in your PAS deployment, install the tile on a separate instance of Ops Manager.

  19. (Optional) To set a custom banner that users see when logging in to the Director using SSH, enter text in the Custom SSH Banner field. Disable bosh dns

  20. Click Save.

Note: After your initial deployment, you cannot edit the Blobstore and Database locations.

Step 4: Create Availability Zone Page

Ops Manager Availability Zones (AZs) correspond to your vCenter clusters and resource pools. Multiple Availability Zones allow you to provide high-availability and load balancing to your apps. When you run more than one instance of an app, Ops Manager balances those instances across all of the Availability Zones assigned to the app. Pivotal recommends using at least three availability zones for a highly available installation of your chosen runtime.

  1. Select Create Availability Zones.

    Create az

  2. Use the following steps to create one or more Availability Zones for your apps to use:

    • Click Add.
    • Enter a unique Name for the Availability Zone.
    • Enter the name of an existing vCenter Cluster to use as an Availability Zone.
    • (Optional) Enter the name of a Resource Pool in the vCenter cluster that you specified above. The jobs running in this Availability Zone share the CPU and memory resources defined by the pool.

      Note: For the PAS runtime, see Availability Zones in vSphere for additional information.

  3. Click Save.

Step 5: Create Networks Page

  1. Select Create Networks.

    Create network

  2. Select Enable ICMP checks to enable ICMP on your networks. Ops Manager uses ICMP checks to confirm that components within your network are reachable.

  3. Use the following steps to create one or more Ops Manager networks:

    • Click Add Network.
    • Enter a unique Name for the network.
    • If you want to dynamically provision VMs in this network for use with on-demand services, select the Service Networks checkbox. When the checkbox is selected, Ops Manager does not provision VMs within the specified CIDR range.
    • Click Add Subnet to create one or more subnets for the network.
    • Enter the full path and vSphere Network Name as it displays in vCenter. For example, enter YOUR-DIRECTORY-NAME/YOUR-NETWORK-NAME. If your vSphere Network Name contains a forward slash character, replace the forward slash with the URL-encoded forward slash character %2f.
    • For CIDR, enter a valid CIDR block in which to deploy VMs. For example, enter
    • For Reserved IP Ranges, enter any IP addresses from the CIDR that you do not want BOSH to use in your installation. Ops Manager will not deploy VMs to any address in this range.
    • Enter your DNS and Gateway IP addresses.
    • Select which Availability Zones to use with the network.
  4. Click Save.

    Note: Multiple networks allow you to place vCenter on a private network and the rest of your deployment on a public network. Isolating vCenter in this manner denies access to it from outside sources and reduces possible security vulnerabilities.

    Note: If you are using the Cisco Nexus 1000v Switch, refer to the Using the Cisco Nexus 1000v Switch with Ops Manager topic for more information.

Step 6: Assign AZs and Networks Page

  1. Select Assign AZs and Networks. Assign az

  2. Use the drop-down menu to select a Singleton Availability Zone. The Ops Manager Director installs in this Availability Zone.

  3. Use the drop-down menu to select a Network for your Ops Manager Director.

  4. Click Save.

Step 7: Security Page

  1. Select Security. Om security

  2. In Trusted Certificates, enter your custom certificate authority (CA) certificates to insert into your organization’s certificate trust chain. This feature enables all BOSH-deployed components in your deployment to trust custom root certificates.

    To enter multiple certificates, paste your certificates one after the other. For example, format your certificates like the following:

    ------END CERTIFICATE------
    ------END CERTIFICATE------
    ------END CERTIFICATE------

    Note: If you want to use Docker Registries for running app instances in Docker containers, enter the certificate for your private Docker Registry in this field. See the Using Docker Registries topic for more information.

  3. Choose Generate passwords or Use default BOSH password. Pivotal recommends that you use the Generate passwords option for greater security.

  4. Click Save. To view your saved Director password, click the Credentials tab.

Step 8: Syslog Page

Note: BOSH Director logs contain sensitive information that should be considered privileged. For example, these logs may contain cloud provider credentials. If you choose to forward logs to an external syslog endpoint, Pivotal recommends using TLS encryption to prevent information from being intercepted by a third party.

  1. Select Syslog. Syslog bosh

  2. (Optional) To send BOSH Director system logs to a remote server, select Yes.

  3. In the Address field, enter the IP address or DNS name for the remote server.

  4. In the Port field, enter the port number that the remote server listens on.

  5. In the Transport Protocol dropdown menu, select TCP, UDP, or RELP. This selection determines which transport protocol is used to send the logs to the remote server.

  6. (Optional) Pivotal strongly recommends that you enable TLS encryption when forwarding logs as they may contain sensitive information. For example, these logs may contain cloud provider credentials. To enable TLS, perform the following steps.

    • In the Permitted Peer field, enter either the name or SHA1 fingerprint of the remote peer.
    • In the SSL Certificate field, enter the SSL certificate for the remote server.
  7. Click Save.

Step 9: Resource Config Page

  1. Select Resource Config.

    Vsphere om resources

  2. Adjust any values as necessary for your deployment. Under the Instances, Persistent Disk Type, and VM Type fields, choose Automatic from the drop-down menu to allocate the recommended resources for the job. If the Persistent Disk Type field reads None, the job does not require persistent disk space.

    Note: If you set a field to Automatic and the recommended resource allocation changes in a future version, Ops Manager automatically uses the updated recommended allocation.

  3. Click Save.

Step 10: Complete the Ops Manager Director Installation

  1. Click the Installation Dashboard link to return to the Installation Dashboard.

  2. Click Apply Changes on the right navigation.

  3. After you complete this procedure, follow the instructions in the Deploying PAS on vSphere topic.