Deploying Ops Manager on AWS Manually
Page last updated:
This topic describes how to deploy Pivotal Operations Manager for Pivotal Cloud Foundry (PCF) on Amazon Web Services (AWS).
Note: To install PCF with the Enterprise Pivotal Container Service (Enterprise PKS) runtime, you must use Terraform. Manual installation is not currently supported. See Installing and Configuring Ops Manager on AWS in the Enterprise PKS documentation.
Before you deploy Ops Manager, see the preparation steps in Preparing to Deploy Ops Manager on AWS Manually.
After you complete this procedure, follow the instructions in Configuring BOSH Director on AWS Manually.
Step 1: Launch an Ops Manager AMI
To launch an Amazon Machine Image (AMI) for Ops Manager, do the following:
Navigate to the Pivotal Operations Manager section of Pivotal Network.
Select the version of Ops Manager you want to install from the Releases dropdown.
In the Release Download Files, click the file named Pivotal Ops Manager for AWS to download a PDF.
Open the PDF and identify the AMI ID for your region.
Return to the EC2 Dashboard.
Click AMIs from the Images menu.
Select Public images from the dropdown filter that says Owned by me.
Paste the AMI ID for your region into the search bar and press enter.
Note: There is a different AMI for each region. If you cannot locate the AMI for your region, verify that you have set your AWS Management Console to your desired region. If you still cannot locate the AMI, log in to the Pivotal Network and file a support ticket.
(Optional) If you want to encrypt the VM that runs Ops Manager with AWS Key Management Service (KMS), perform the following additional steps:
- Right click the row that lists your AMI and click Copy AMI.
- Select your Destination region.
- Enable Encryption. For more information about AMI encryption, see Encryption and AMI Copy from the Copying an AMI topic in the AWS documentation.
- Select your Master Key. To create a new custom key, see Creating Keys in the AWS documentation.
- Click Copy AMI. You can use the new AMI you copied for the following steps.
Select the row that lists your Ops Manager AMI and click Launch.
Choose m3.large for your instance type and click Next: Configure Instance Details.
Configure the following for your instance:
- Network: Select the VPC that you created.
- Subnet: Select
pcf-public-subnet-az0
to allow traffic from public IP addresses, orpcf-management-subnet-az0
to allow traffic only from private IP addresses. - Auto-assign for Public IP: Select Enable to allow traffic from public IP addresses, or Disable to allow traffic only from private IP addresses.
- IAM role: Select the IAM role associated with your pcf-user profile. If you have not created one, click Create new IAM role and follow the Guidelines for Creating User Roles on AWS.
- For all other fields, accept the default values.
Click Next: Add Storage and adjust the Size (GiB) value. The default persistent disk value is 50 GB. Pivotal recommends increasing this value to a minimum of 100 GB.
Click Next: Tag Instance.
On the Add Tags page, add a tag with the key
Name
and valuepcf-ops-manager
.Click Next: Configure Security Group.
Select the
pcf-ops-manager-security-group
that you created in Step 5: Configure a Security Group for Ops Manager in Preparing to Deploy Ops Manager on AWS Manually.Click Review and Launch and confirm the instance launch details.
Click Launch.
Select the
pcf-ops-manager-key
key pair, confirm that you have access to the private key file, and click Launch Instances. You use this key pair to access the Ops Manager VM.Click View Instances to access the Instances page on the EC2 Dashboard.
Step 2: Create Web Load Balancer
On the EC2 Dashboard, click Load Balancers.
Click Create Load Balancer.
Under Application Load Balancer, click Create.
For Step 1: Configure Load Balancer, do the following:
- Under Basic Configuration, do the following:
- For Name, enter
pcf-web-elb
. - For Scheme, select internet-facing to allow traffic from public IP addresses, or internal to allow traffic only from private IP addresses.
- For IP address type, select the type of IP addresses that you want to allow.
- For Name, enter
- Under Listeners, click Add listener. For Load Balancer Protocol, select HTTPS.
- Under Availability Zones, select all availability zones.
- Click Next: Configure Security Settings.
- Under Basic Configuration, do the following:
For Step 2: Configure Security Settings, do the following:
- Under Select default certificate, do one of the following:
- If you already have a certificate from AWS Certificate Manager (ACM), select Choose a certificate from ACM.
- If you do not have a certificate from ACM, select Upload a certificate to ACM. For more information, see Importing Certificates into AWS Certificate Manager in the AWS documentation.
Note: For a production or production-like environment, use a certificate from a Certificate Authority (CA). This can be an internal certificate or a purchased certificate. For a sandbox environment, you can use a self-signed certificate.
- For Certificate Name, select the desired certificate.
- For Security Policy, select the policy you created in Step 3: Create an IAM User for PCF in Preparing to Deploy Ops Manager on AWS Manually.
- Click Next: Configure Security Groups.
- Under Select default certificate, do one of the following:
For Step 3: Configure Security Groups, do the following:
- Under Assign a security group, select Select an existing security group.
- From the list of security groups, select the
pcf-web-elb-security-group
security group that you configured in Step 7: Configure a Security Group for the Web ELB in Preparing to Deploy Ops Manager on AWS Manually. - Click Next: Configure Routing.
For Step 4: Configure Routing, do the following:
- Under Target Group, enter the following values:
- Name: Enter
pcf-web-elb-target-group
. - Target type: Select Instance.
- Protocol: Select HTTP.
- Port: Enter
80
.
- Name: Enter
- Under Health checks, senter the following values:
- Protocol: Select HTTP.
- Path: Enter
/health
.
- Under Advanced health check settings, enter the following values:
- Port: Select override and enter
8080
. - Healthy threshold: Enter
6
. - Unhealthy threshold: Enter
3
. - Timeout: Enter
3
. - Interval: Enter
5
. - Success codes: Enter
200
.
- Port: Select override and enter
- Click Next: Register Targets.
- Under Target Group, enter the following values:
For Step 5: Register Targets, accept the default values and click Next: Review.
For Step 6: Review, review the load balancer details and then click Create. A message appears to confirm AWS successfully created the load balancer.
Step 3: Create SSH Load Balancer
From the Load Balancers page, click Create Load Balancer.
Select Classic Load Balancer.
Configure the load balancer with the following information:
- Load Balancer name: Enter
pcf-ssh-elb
. - Create LB Inside: Select the
pcf-vpc
VPC that you created in Step 4: Create a VPC in Preparing to Deploy Ops Manager on AWS Manually. - If you want to allow traffic from public IP addresses, ensure that the Create an internal load balancer checkbox is not selected. If you want to allow traffic only from private IP addresses, select this checkbox.
- Load Balancer name: Enter
Under Listener Configuration, add the following rules:
Load Balancer Protocol Load Balancer Port Instance Protocol Instance Port TCP 2222 TCP 2222 Under Select Subnets, select either the public or private subnets you configured in Step 4: Create a VPC in Preparing to Deploy Ops Manager on AWS Manually, and click Next: Assign Security Groups.
On the Assign Security Groups page, select the security group
pcf-ssh-elb-security-group
you configured in Step 8: Configure a Security Group for the SSH ELB in Preparing to Deploy Ops Manager on AWS Manually, and click Next: Configure Security Settings.On the Configure Security Settings page, ignore the Improve your load balancer’s security error message and click Next: Configure Health Check.
On the Configure Health Check page, enter the following values:
- Ping Protocol: Select
TCP
. - Ping Port: Set to
2222
. - Interval: Set to
5
seconds. - Response Timeout: Set to
3
seconds. - Unhealthy threshold: Set to
3
. - Health threshold: Set to
6
.
- Ping Protocol: Select
Click Next: Add EC2 Instances.
Accept the defaults on the Add EC2 Instances page and click Next: Add Tags.
Accept the defaults on the Add Tags page and click Review and Create.
Review and confirm the load balancer details, and click Create.
Step 4: Create TCP Load Balancer
From the Load Balancers page, click Create Load Balancer.
Select Classic Load Balancer.
Configure the load balancer with the following information:
- Load Balancer name: Enter
pcf-tcp-elb
. - Create LB Inside: Select the
pcf-vpc
VPC that you created in Step 4: Create a VPC in Preparing to Deploy Ops Manager on AWS Manually. - If you want to allow traffic from public IP addresses, ensure that the Create an internal load balancer checkbox is not selected. If you want to allow traffic only from private IP addresses, select this checkbox.
- Load Balancer name: Enter
Under Listener Configuration, add the following rules:
Load Balancer Protocol Load Balancer Port Instance Protocol Instance Port TCP 1024 TCP 1024 TCP 1025 TCP 1025 TCP 1026 TCP 1026 … … … … TCP 1123 TCP 1123
The...
entry above indicates that you must add listening rules for each port between 1026 and 1123.Under Select Subnets, select either the public or private subnets you configured in Step 4: Create a VPC in Preparing to Deploy Ops Manager on AWS Manually, and click Next: Assign Security Groups.
On the Assign Security Groups page, select the security group
pcf-tcp-elb-security-group
you configured in Step 9: Configure a Security Group for the TCP ELB in Preparing to Deploy Ops Manager on AWS Manually, and click Next: Configure Security Settings.On the Configure Security Settings page, ignore the Improve you load balancer’s security error message and click Next: Configure Health Check.
On the Configure Health Check page, enter the following values:
- Ping Protocol: Select
TCP
. - Ping Port: Set to
80
. - Interval: Set to
5
seconds. - Response Timeout: Set to
3
seconds. - Unhealthy threshold: Set to
3
. - Health threshold: Set to
6
.
- Ping Protocol: Select
Click Next: Add EC2 Instances.
Accept the defaults on the Add EC2 Instances page and click Next: Add Tags.
Accept the defaults on the Add Tags page and click Review and Create.
Review and confirm the load balancer details, and click Create.
Step 5: Configure DNS Records
Perform the following steps for all three of the load balancers you created in previous steps, named
pcf-web-elb
,pcf-ssh-elb
, andpcf-tcp-elb
:- From the Load Balancers page, select the load balancer.
- On the Description tab, locate the Basic Configuration section and record the DNS name of the load balancer.
Click Instances on the left navigation to view your EC2 instances.
Select the
PcfOpsManInstance
instance created by Cloudformation.On the Description tab, record the value for IPv4 Public IP.
Navigate to your DNS provider and create the following CNAME and A records:
- CNAME:
*.apps.DOMAIN.com
and*.system.DOMAIN.com
points to the DNS name of thepcf-web-elb
load balancer. - CNAME:
ssh.DOMAIN.com
points to the DNS name of thepcf-ssh-elb
load balancer. - CNAME:
tcp.DOMAIN.com
points to the DNS name of thepcf-tcp-elb
load balancer. - A:
pcf.DOMAIN.com
points to the public IP address of thepcf-ops-manager
EC2 instance. WhereDOMAIN
is a domain name. VMware recommends that you use the same domain name for each record.
- CNAME:
Step 6: Secure the NAT Instance
On the EC2 Dashboard, click Instances.
Select the NAT instance, which has an instance type of t3.medium.
From the Actions menu, select Networking>Change Security Groups.
Change the NAT security group from the default group to the
pcf-nat-security-group
NAT security group that you created in Step 10: Configure a Security Group for the Outbound NAT in Preparing to Deploy Ops Manager on AWS Manually.Click Assign Security Groups.
Step 7: Create RDS Subnet Group
Navigate to the RDS Dashboard.
Perform the following steps to create a RDS Subnet Group for the two RDS subnets:
- Click Subnet Groups>Create DB Subnet Group.
- Enter the following values:
- Name: Enter
pcf-rds-subnet-group
. - Description: Enter a description to identify this subnet group.
- VPC ID: Select
pcf-vpc
. - Availability Zone and Subnet ID: Choose the AZ and subnet for
pcf-rds-subnet-az0
and click Add.
- Name: Enter
- Repeat the steps above to add
pcf-rds-subnet-az1
andpcf-rds-subnet-az2
to the group. - Click Create.
The following screenshot shows a completed subnet group.
Note: On the Subnet Group page, you may need to refresh the page to view the new group.
Step 8: Create a MySQL Database Using AWS RDS
Note: You must have an empty MySQL database when you install or reinstall PCF on AWS.
Navigate to the RDS Dashboard.
Click Instances>Launch DB Instance to launch the wizard.
Select MySQL.
Select the MySQL radio button under Production to create a database for production environments.
Click Next Step.
Specify the following database details:
- DB Instance Class: Select db.m3.large - 2 vCPU, 7.5 GiB RAM.
- Multi-AZ Deployment: Select Yes.
- Storage Type: Select
Provisioned IOPS (SSD)
. - Allocated Storage: Enter 100 GB.
- DB Instance Identifier: Enter
pcf-ops-manager-director
. - Enter a secure Master Username and Master Password.
Note: Record the username and password. You need these credentials later when configuring the Director Config page in the BOSH Director tile.
Click Next Step.
On the Configure Advanced Settings page, enter the following values:
- VPC: Select
pcf-vpc
. - Subnet Group: Select the
pcf-rds-subnet-group
you created in Step 7: Create RDS Subnet Group. - Publicly Accessible: Select No.
- VPC Security Groups: Select the
pcf-rds-security-group
that you created in Step 11: Configure a Security Group for MySQL in Preparing to Deploy Ops Manager on AWS Manually. - Database Name: Enter
bosh
. - Accept the default values for the remaining fields.
- VPC: Select
Click Launch DB Instance. Launching the instance may take several minutes.
Next Steps
When the instance has launched, you can do either of the following:
- Review Required AWS Objects to verify that you created the correct resources in AWS.
- Proceed to Configuring BOSH Director on AWS to continue deploying PCF.