Configuring BOSH Director on AWS

Page last updated:

This topic describes how to configure Pivotal Operations Manager to deploy Pivotal Platform on Amazon Web Services (AWS).

Before beginning this procedure, ensure that you have successfully completed all of the steps in Deploying Ops Manager on AWS Manually.

Step 1: Log Into Ops Manager

  1. In a web browser, navigate to the fully qualified domain you created in the Configure DNS Records step of Deploying Ops Manager on AWS Manually.

  2. Log into Ops Manager. To log in, see Log In to Ops Manager For the First Time.

Step 2: AWS Config Page

  1. Click the BOSH Director tile.

  2. Select AWS Config.

    The 'AWS Management Console Config' page in Ops Manager. See the following steps for information about each field.

  3. Select Use AWS Keys or Use AWS Instance Profile.

  4. Complete the rest of the AWS Management Console Config page:

    • Security Group ID: Enter the Group ID of the pcf-vms-security-group you created for your Pivotal Platform VMs in Step 6: Configure a Security Group for Pivotal Platform VMs in Preparing to Deploy Ops Manager on AWS Manually. Locate the Group ID in the Security Groups tab of your EC2 Dashboard.
    • Key Pair Name: Enter pcf-ops-manager-key.
    • SSH Private Key: Open the AWS key pair pcf-ops-manager-keys.pem file you generated in Step 3: Create an IAM User for Pivotal Platform in Preparing to Deploy Ops Manager on AWS Manually. Copy the contents of the .pem file and paste it into the SSH Private Key field.
    • Region: Select the region where you deployed Ops Manager.
    • Encrypt Linux EBS Volumes: Select this checkbox to enable full encryption on persistent disks of all BOSH-deployed VMs except the Ops Manager VM and Director VM. For more information about using EBS encryption, see Configuring Amazon EBS Encryption for Pivotal Platform on AWS.

      Note: Enabling EBS encryption only encrypts Linux VMs. The Windows VMs deployed with Pivotal Application Service for Windows (PASW) or PASW 2012 R2 are not encrypted.

  5. Click Save.

Step 3: Director Config Page

To configure the Director Config pane:

  1. Select Director Config.

    At the top of the image is the header 'Director Config' with a horizonal line underneath. Below the line are three text fields labeled, from top to bottom, 'NTP Servers (comma delimited)', and 'Bosh HM Forwarder IP Address'. The NTP Servers (comma delimited) field has a red asterisk, to denote that it is a required field. Below these text fields are five checkboxes. The first checkbox is labeled 'Enable VM Resurrector Plugin'. The second checkbox is labeled 'Enable Post Deploy Scripts'. The third checkbox is labeled 'Recreate All VMs', underneath which is the text 'This will force BOSH to recreate all VMs on the next deploy. Persistent disk will be preserved'. The fourth checkbox is labeled 'Recreate All Persistent Disks', underneath which is the text 'Checking this box will recreate all Persistent Disks for the Director and all other Tiles'. The fifth checkbox is labeled 'Enable bosh deploy retries', underneath which is the text 'This will attempt to re-deploy a failed deployment up to 5 times.'

  2. Enter at least two of the following NTP servers in the NTP Servers (comma delimited) field, separated by a comma: 0.amazon.pool.ntp.org,1.amazon.pool.ntp.org,2.amazon.pool.ntp.org,3.amazon.pool.ntp.org If your AWS environment is air gapped, consider using Amazon’s Time Sync Service which has a dedicated IP that does not require access to the internet or configuration changes to your security group or network ACL rules to access.

    1. The NTP server configuration only updates after VM recreation. If you modify the value of this field, select the Recreate VMs deployed by the BOSH Director checkbox to re-create your BOSH Director-deployed VMs and update the NTP server configuration. If you have any service tiles installed, ensure that the Recreate All Service Instances errand runs for each service tile.
  3. Leave the Bosh HM Forwarder IP Address field blank.

    Note: Starting in PAS v2.0, BOSH-reported component metrics are available in the Loggregator Firehose by default. If you continue to use the BOSH HM Forwarder to consume these component metrics, you may receive duplicate data. To prevent this, leave the Bosh HM Forwarder IP Address field blank.

  4. Select the Enable VM Resurrector Plugin checkbox to enable the BOSH Resurrector functionality and increase your runtime availability.

  5. Select Enable Post Deploy Scripts to run a post-deploy script after deployment. This script allows the job to execute additional commands against a deployment.

    Note: If you intend to install Enterprise PKS, you must enable post-deploy scripts.

  6. Select Recreate all VMs to force BOSH to recreate all VMs on the next deploy. This process does not recreate the BOSH Director VM or destroy any persistent disk data. This checkbox is cleared automatically after Apply Changes succeeds.

  7. Select Recreate All Persistent Disks to force BOSH to migrate and recreate persistent disks for the BOSH Director and all tiles. This process does not destroy any persistent disk data. This checkbox is cleared automatically after Apply Changes succeeds.

  8. Select Enable bosh deploy retries to instruct Ops Manager to retry failed BOSH operations up to five times.

  9. Select Skip Director Drain Lifecycle to prevent drain scripts from running when the BOSH Director is recreated.

  10. Select Store BOSH Job Credentials on tmpfs (beta) to store credentials for BOSH jobs on temporary file storage (tmpfs) memory, rather than on disk. You must recreate all VMs for this setting to take effect.

  11. Select Keep Unreachable Director VMs if you want to preserve BOSH Director VMs after a failed deployment for troubleshooting purposes.

  12. Select HM Pager Duty Plugin to enable Health Monitor integration with PagerDuty.
    At the top of the image is a selected checkbox labeled 'HM Pager Duty Plugin'. Below this checkbox are two text fields labeled, from top to bottom, 'Service Key' and 'HTTP Proxy'. The Service Key field has a red asterisk to denote that it is a required field, and contains the text 'YOUR-PAGERDUTY-SERVICE-KEY'. The HTTP Proxy field contains the text 'YOUR-HTTP-PROXY'.

    • Service Key: Enter your API service key from PagerDuty.
    • HTTP Proxy: Enter an HTTP proxy for use with PagerDuty.
  13. Select HM Email Plugin to enable Health Monitor integration with email.

    At the top of the image is a selected checkbox labeled 'HM Email Plugin'. Below this checkbox are seven text fields labeled, from top to bottom, 'Host', 'Port', 'Domain', 'From', 'Recipients', 'Username', and 'Password'. The Host field has a red asterisk and contains the text 'smtp.example.com'. The Port field has a red asterisk and contains the text '25'. The Domain field has a red asterisk and contains the text 'cloudfoundry.example.com'. The From field has a red asterisk and contains the text 'user2@example.com'. The Recipients field has a red asterisk and contains the text 'user@example.com, user1@example.com'. The Username field contains the text 'user'. The Password field contains eight asterisks. At the bottom of the image is a selected checkbox labeled 'Enable TLS'.

    • Host: Enter your email hostname.
    • Port: Enter your email port number.
    • Domain: Enter your domain.
    • From: Enter the address for the sender.
    • Recipients: Enter comma-separated addresses of intended recipients.
    • Username: Enter the username for your email server.
    • Password: Enter the password for your email server.
    • Enable TLS: Select this checkbox to enable Transport Layer Security to the email host.
  14. For CredHub Encryption Provider, you can choose whether BOSH CredHub stores its encryption key internally on the BOSH Director and CredHub VM, or in an external hardware security module (HSM). The HSM option is more secure.

    Before configuring an HSM encryption provider in the Director Config pane, you must follow the procedures and collect information described in Preparing CredHub HSMs for Configuration.

    Note: After you deploy Ops Manager with an HSM encryption provider, you cannot change BOSH CredHub to store encryption keys internally.

    At the top of the image are the words 'CredHub Encryption Provider' with two options underneath: a selected radio button labeled 'Internal', and a radio button labeled 'Luna HSM'. Below these radio buttons are three text fields, two text areas, three more text fields, and one more text area, all grayed-out and labeled with red asterisks to denote that they are required fields when 'Luna HSM' is selected. They are labeled, from top to bottom: 'Encryption Key Name', 'Provider Partition', 'Provider Partition Password', 'Provider Client Certificate', 'Provider Client Certificate Private Key', 'HSM Host Address', 'HSM Port Address', 'Partition Serial Number', and 'HSM Certificate'.

    • Internal: Select this option for internal CredHub key storage. This option is selected by default and requires no additional configuration.
    • Luna HSM: Select this option to use a SafeNet Luna HSM as your permanent CredHub encryption provider, and fill in the following fields:

      Note: If you use multiple HSM hosts, you must use the Ops Manager API to set or update the HSM configuration. For more information, see Updating director and Iaas properties (Experimental) in the Ops Manager API documentation.

      1. Encryption Key Name: Any name to identify the key that the HSM uses to encrypt and decrypt the CredHub data. Changing this key name after you deploy Ops Manager can cause service downtime.
      2. Provider Partition: The partition that stores your encryption key. Changing this partition after you deploy Ops Manager could cause service downtime. For this value and the ones below, use values gathered in Preparing CredHub HSMs for Configuration.
      3. Provider Partition Password
      4. Provider Client Certificate: The certificate that validates the identity of the HSM when CredHub connects as a client.
      5. Provider Client Certificate Private Key
      6. HSM Host Address
      7. HSM Port Address: If you do not know your port address, enter 1792.
      8. Partition Serial Number
      9. HSM Certificate: The certificate that the HSM presents to CredHub to establish a two-way mTLS connection.

  15. Select a Blobstore Location to either configure the blobstore as an internal server or an external endpoint. Because the internal server is unscalable and less secure, VMware recommends that you configure an external blobstore.

    Note: After you deploy Ops Manager, you cannot change the blobstore location.

    • Internal: Select this option to use an internal blobstore. Ops Manager creates a new VM for blob storage. No additional configuration is required.
      • Enable TLS: VMware recommends that you select this checkbox to enable TLS to the blobstore.

        Note: If you are using PASW 2016, make sure you have downloaded Windows stemcell v1709.10 or later before enabling TLS. For more information, see Stemcell v2019.x (Windows Server version 2019) Release Notes.

    • S3 Compatible Blobstore: Select this option to use an external S3-compatible endpoint. When you have created an S3 bucket, configure the following fields:
      1. S3 Endpoint:
        1. If you are using a public S3 endpoint:
          1. Locate the endpoint for your region. To find the endpoint, see the Amazon Simple Storage Service (S3) table in Regions and Endpoints in the AWS documentation.
          2. Construct a URL using your region’s endpoint. For example, if you are using the us-west-2 region, the URL you create would be https://s3.us-west-2.amazonaws.com. Enter this URL into the S3 Endpoint field.
        2. If you are using a non-public S3-compatible endpoint:
          1. Enter the URL for the non-public endpoint.
          2. SSH into the Ops Manager VM by running:
            ssh ubuntu@OPS-MANAGER-FQDN
            Where OPS-MANAGER-FQDN is the fully-qualified domain name (FQDN) of your Ops Manager deployment.
          3. Copy the custom public CA certificate you used to sign the S3 endpoint into the /etc/ssl/certs directory on the Ops Manager VM.
          4. On the Ops Manager VM, import the custom CA certificate into the Ops Manager VM truststore by running:
            sudo update-ca-certificates -f -v
          5. Add this custom CA certificate into the Trusted Certificates field in the Security page. For instructions, see Security Page.
      2. Bucket Name: Enter the name of the S3 bucket.
      3. Access Key and Secret Key: Enter the keys you generated when creating your S3 bucket.
      4. Select V2 Signature or V4 Signature. If you select V4 Signature, enter your Region.

        Note: AWS recommends using Signature Version 4. For more information about AWS S3 Signatures, see Authenticating Requests in the AWS documentation.

      5. S3 Backup Strategy: To configure whether and how to back up the BOSH Director’s S3 blobstore, select one of the following options:
        • No backups
        • Use a versioned bucket: This option uses blobstore bucket versioning to save backups. It requires an S3 blobstore that supports versioning.
        • Copy into an additional bucket: This option saves blobstore backups to a separate bucket, which is useful with blobstores that do not support versioning. This option requires you to configure the Backup Bucket Region and Backup Bucket Name fields.
    • GCS Blobstore: Select this option to use an external Google Cloud Storage (GCS) endpoint. At the top of the image, the 'GCP Blobstore' radio button is selected. Below this radio button is a text field labeled 'Bucket Name' with a red asterisk. Below this text field is a dropdown labeled 'Storage Class' with a red asterisk and the 'Regional' option selected. Below this dropdown is a text area labeled 'Service Account Key' with a red asterisk.
      To create a GCS bucket, follow the procedures in Creating Storage Buckets in the GCS documentation. To create a GCS bucket, you must have a GCS account. When you have created a GCS bucket, configure the following fields:
      1. Bucket Name: Enter the name of your GCS bucket.
      2. Storage Class: Select the storage class for your GCS bucket. For more information, see Storage Classes in the GCP documentation.
      3. Service Account Key: Follow the steps in Set up IAM Service Accounts in Preparing to Deploy Ops Manager on GCP Manually to download a JSON file with a private key. Enter the contents of the JSON file into the field.
      4. GCS Backup Strategy: To configure whether and how to back up the BOSH Director’s GCS blobstore, select one of the following options:
        • No backups
        • Copy into an additional bucket: This option saves blobstore backups to a bucket separate from the blobstore itself, and requires you to configure the Backup Bucket Region and Backup Bucket Name fields.

  16. For Database Location, select External MySQL Database and complete the following steps: At the top of the image are the words 'Database Location', underneath which are two options: one selected radio button labeled 'Internal', and one radio button labeled 'External MySQL Database'. Below these are five grayed-out text fields labeled, from top to bottom, 'Host', 'Port', 'Username', 'Password', and 'Database'. All have red asterisks, to denote that they are required fields when 'External MySQL Database' is selected.

    • From the AWS Console, navigate to the RDS Dashboard.
    • Select Instances, then click the arrow to the left of your instance and select the second icon to display the Details information.
    • Refer to the following table to retrieve the values for the Director Config page:
      RDS Instance Field BOSH Director Field
      Endpoint Host
      Port Port, which is 3306.
      DB Name Database, which is bosh.
      Username Username

    • For Password, enter the password that you defined for your MySQL database when you created in the Step 8: Create a MySQL Database using AWS RDS section of Deploying Ops Manager on AWS Manually. In addition, if you selected the Enable TLS for Director Database checkbox, you can fill out the following optional fields:
    • Enable TLS: Selecting this checkbox enables TLS communication between the BOSH Director and the database.
    • TLS CA: Enter the Certificate Authority for the TLS Certificate.
    • TLS Certificate: Enter the client certificate for mutual TLS connections to the database.
    • TLS Private Key: Enter the client private key for mutual TLS connections to the database.
    • Advanced DB Connection Options: If you would like to provide additional options for the database, use this field to provide a JSON-formatted options string.

  17. (Optional) Modify the Director Workers value, which sets the number of workers available to execute BOSH Director tasks. This field defaults to 5.

  18. (Optional) Max Threads sets the maximum number of threads that the BOSH Director can run simultaneously. VMware recommends that you leave the field blank to use the default value, unless doing so results in rate limiting or errors on your IaaS.

  19. (Optional) To add a custom URL for your BOSH Director, enter a valid hostname in Director Hostname. You can also use this field to configure a load balancer in front of your BOSH Director. For more information, see How to Set Up a Load Balancer in Front of Operations Manager Director in the Pivotal Support Knowlege Base.

    Three text fields labeled 'Director Workers', 'Max Threads', and 'Director Hostname'. The Director Workers field contains the text '5'. The Director Hostname field contains the text 'opsdirector.example.com'.

  20. (Optional) To set a custom banner that users see when logging in to the BOSH Director using SSH, enter text in the Custom SSH Banner field.

  21. (Optional) Enter your comma-separated custom Identification Tags. For example, iaas:foundation1, hello:world. You can use the tags to identify your foundation when viewing VMs or disks from your IaaS.

  22. Click Save.

Step 4: Create Availability Zones Page

Note: Pivotal recommends at least three availability zones (AZs) for a highly available installation of PAS. The procedures in Preparing to Deploy Ops Manager on AWS Manually use 3 AZs.

  1. Select Create Availability Zones. The 'Create Availability Zones' page in Ops Manager. See the following step for information about each field.

  2. To add the three AZs you specified in the Step 4: Create a VPC section of Preparing to Deploy Ops Manager on AWS Manually:

    1. Click Add.
    2. For Amazon Availability Zone, enter the name of the AZ.
    3. Repeat until you have entered all three AZs, in the format REGION-#a, REGION-#b, and REGION-#c. For example, us-west-2a, us-west-2b, and us-west-2c.
  3. Click Save.

Step 5: Create Networks Page

  1. Select Create Networks. The 'Create Networks' page in Ops Manager. See the following steps for information about each field.

  2. (Optional) Select Enable ICMP checks to enable ICMP on your networks. Ops Manager uses ICMP checks to confirm that components within your network are reachable.

  3. Perform the following steps to add the network configuration that you created for your VPC in the Create a VPC section of Preparing to Deploy Ops Manager on AWS Manually. Record your VPC CIDR if you set a CIDR other than the recommendation!

    1. Click Add Network.
    2. For Name, enter management.
    3. Create a subnet for each availability zone by clicking Add Subnet. Refer to the table below for the information required to create all three subnets:
      First
      Subnet
      VPC Subnet ID pcf-management-subnet-az0
      CIDR 10.0.16.0/28
      Reserved IP Ranges 10.0.16.0-10.0.16.4
      DNS 10.0.0.2*
      Gateway 10.0.16.1
      Availability Zones REGION-#a. Example: us-west-2a
      Second
      Subnet
      VPC Subnet ID pcf-management-subnet-az1
      CIDR 10.0.16.16/28
      Reserved IP Ranges 10.0.16.16-10.0.16.20
      DNS 10.0.0.2*
      Gateway 10.0.16.17
      Availability Zones REGION-#b. Example: us-west-2b
      Third
      Subnet
      VPC Subnet ID pcf-management-subnet-az2
      CIDR 10.0.16.32/28
      Reserved IP Ranges 10.0.16.32-10.0.16.36
      DNS 10.0.0.2*
      Gateway 10.0.16.33
      Availability Zones REGION-#c. Example: us-west-2c

      * If you set a VPC CIDR other than recommended, enter the second IP in your VPC CIDR. For example, for a 10.0.0.0/24 VPC CIDR, enter 10.0.0.2 in each subnet.


    4. Click Add Network.
    5. For Name, enter the name of your runtime. For example, tas or pks.
    6. Create a subnet for each availability zone by clicking Add Subnet. See the table below for the information required to create all three subnets:
      First
      Subnet
      VPC Subnet ID pcf-tas-subnet-az0 or pcf-pks-subnet-az0
      CIDR 10.0.4.0/24
      Reserved IP Ranges 10.0.4.0-10.0.4.4
      DNS 10.0.0.2*
      Gateway 10.0.4.1
      Availability Zones REGION-#a. Example: us-west-2a
      Second
      Subnet
      VPC Subnet ID pcf-tas-subnet-az1 or pcf-pks-subnet-az1
      CIDR 10.0.5.0/24
      Reserved IP Ranges 10.0.5.0-10.0.5.4
      DNS 10.0.0.2*
      Gateway 10.0.5.1
      Availability Zones REGION-#b. Example: us-west-2b
      Third
      Subnet
      VPC Subnet ID pcf-tas-subnet-az2 or pcf-pks-subnet-az2
      CIDR 10.0.6.0/24
      Reserved IP Ranges 10.0.6.0-10.0.6.4
      DNS 10.0.0.2*
      Gateway 10.0.6.1
      Availability Zones REGION-#c. Example: us-west-2c

      * If you set a VPC CIDR other than recommended, enter the second IP in your VPC CIDR. For example, for a 10.0.0.0/24 VPC CIDR, enter 10.0.0.2 in each subnet.


    7. Click Add Network.
    8. For Name, enter services.
    9. Create a subnet for each availability zone by clicking Add Subnet. Refer to the table below for the information required to create all three subnets:
      First
      Subnet
      VPC Subnet ID pcf-services-subnet-az0
      CIDR 10.0.8.0/24
      Reserved IP Ranges 10.0.8.0-10.0.8.3
      DNS 10.0.0.2*
      Gateway 10.0.8.1
      Availability Zones REGION-#a. Example: us-west-2a
      Second
      Subnet
      VPC Subnet ID pcf-services-subnet-az1
      CIDR 10.0.9.0/24
      Reserved IP Ranges 10.0.9.0-10.0.9.3
      DNS 10.0.0.2*
      Gateway 10.0.9.1
      Availability Zones REGION-#b. Example: us-west-2b
      Third
      Subnet
      VPC Subnet ID pcf-services-subnet-az2
      CIDR 10.0.10.0/24
      Reserved IP Ranges 10.0.10.0-10.0.10.3
      DNS 10.0.0.2*
      Gateway 10.0.10.1
      Availability Zones REGION-#c. Example: us-west-2c

      * If you set a VPC CIDR other than recommended, enter the second IP in your VPC CIDR. For example, for a 10.0.0.0/24 VPC CIDR, enter 10.0.0.2 in each subnet.

  4. Click Save.

    Note: If you are deploying Enterprise PKS with a Enterprise PKS workload load balancer, you must tag each AWS subnet with your Enterprise PKS Kubernetes cluster unique identifier before you create the load balancer. For more information about tagging subnets with a Enterprise PKS cluster unique identifier, see AWS Prerequisites.

    Note: After you deploy Ops Manager, you add subnets with overlapping Availability Zones to expand your network. For more information about configuring additional subnets, see Expanding Your Network with Additional Subnets.

Step 6: Assign AZs and Networks

  1. Select Assign AZs and Networks. The 'Assign AZs and Networks' page in Ops Manager. See the following steps for information about each field.

  2. Use the dropdown to select a Singleton Availability Zone. The BOSH Director is deployed into this AZ.

  3. Use the dropdown to select management under Network. The BOSH Director is deployed into this network.

  4. Click Save.

Step 7: Security Page

  1. Select Security. At the top of the image is the header 'Security' with a horizontal line underneath. Below the line is a text area labeled 'Trusted Certificates', below which is the text 'These certificates enable BOSH-deployed components to trust a custom root certificate.' Below this text is a selected checkbox labeled 'Include OpsManager Root CA in Trusted Certs', underneath which is the text 'Checking this box will place the OpsManager Root CA into the trusted certificate field. The Bosh Director will then place this CA into the trust store of every VM that it deploys.' Below this text are the words 'Generate VM passwords or use single password for all VMs', below which are two options: one selected radio button labeled 'Generate passwords', and one radio button labeled 'Use default BOSH password'. At the bottom of the image is a blue, rectangular button labeled 'Save'.

  2. In Trusted Certificates, enter your custom certificate authority (CA) certificates to insert into your organization’s certificate trust chain. This feature enables all BOSH-deployed components in your deployment to trust custom root certificates.

    To enter multiple certificates, paste your certificates one after the other. For example, format your certificates like the example below:

    -----BEGIN CERTIFICATE-----
    ABCDEFGH12345678ABCDEFGH12345678ABCDEFGH12345678AB
    EFGH12345678ABCDEFGH12345678ABCDEFGH12345678ABCDEF
    GH12345678ABCDEFGH12345678ABCDEFGH12345678...
    ------END CERTIFICATE------
    -----BEGIN CERTIFICATE-----
    BCDEFGH12345678ABCDEFGH12345678ABCDEFGH12345678ABB
    EFGH12345678ABCDEFGH12345678ABCDEFGH12345678ABCDEF
    GH12345678ABCDEFGH12345678ABCDEFGH12345678...
    ------END CERTIFICATE------
    -----BEGIN CERTIFICATE-----
    CDEFGH12345678ABCDEFGH12345678ABCDEFGH12345678ABBB
    EFGH12345678ABCDEFGH12345678ABCDEFGH12345678ABCDEF
    GH12345678ABCDEFGH12345678ABCDEFGH12345678...
    ------END CERTIFICATE------

    Note: If you want to use Docker registries to run PAS app instances in Docker containers, enter the certificate for your private Docker registry in this field. For more information about running app instances in PAS using Docker registries, see Using Docker Registries.

  3. To include the Ops Manager root CA in the Trusted Certificates field, select the Include OpsManager Root CA in Trusted Certs checkbox. BOSH Director includes this CA in the trust store of every VM that it deploys.

    Warning: If you are using Ops Manager to generate certificates for either a load balancer or router, then you must select this checkbox.

  4. Choose Generate passwords or Use default BOSH password. Pivotal recommends that you use the Generate passwords option for greater security.

  5. Click Save. To view your saved BOSH Director password, click the Credentials tab.

Step 8: BOSH DNS Config Page

The BOSH DNS Config pane allows you to configure DNS for BOSH Director by adding excluded recursors, a recursor timeout, and handlers.

The fields in the BOSH DNS Config pane are:

  • Excluded Recursors: Exclude recursor addresses, which are URL redirects, so that they are not contacted by the BOSH DNS server. For more information about how the BOSH DNS release selects recursors, see Recursors in Native DNS Support in the BOSH documentation.

  • Recursor Timeout: Specify a timeout for the BOSH DNS server to contact any connected recursor addresses. The time limit includes dialing, writing, and reading from the recursor. If any of these actions exceeds the time limit, the action fails.

  • Handlers: Specify recursor addresses that apply to specific domains. For example, you can use handlers to forward all requests to a domain to a private DNS for resolution. For more information about using handlers, see Additional Handlers in Native DNS Support in the BOSH documentation.

To add excluded recursors, a recursor timeout, or handlers to the BOSH DNS release:

  1. Select BOSH DNS Config. At the top of the image is the header 'BOSH DNS Config', underneath which is a horizontal line. Below the line are two text fields labeled, from top to bottom, 'Excluded Recursors' and 'Recursor Timeout'. Below these fields is a text area labeled 'Handlers', containing the text '[]'. To the right of this text area is the help text 'Enter a JSON-formatted list of optional custom domain handlers'. At the bottom of the image is a blue, rectangular button labeled 'Save'.

  2. (Optional) In Excluded Recursors, enter a list of prohibited recursor addresses.

  3. (Optional) In Recursor Timeout, enter a time limit for contacting the connected recursors.

    Note: This time limit must include one of the Go parse duration time units. For example, entering 5s sets the timeout limit to five seconds. For more information about supported time units, see func ParseDuration in the Go Programming Language documentation.

  4. (Optional) In Handlers, enter an array of custom domain handlers in JSON format. For example:

    [
      {
        "cache": {
          "enabled": true
        },
        "domain": "example.com",
        "source": {
          "type": "http",
          "url": "http://example.endpoint.local"
        }
      }
    ]
    
  5. Click Save.

Step 9: Syslog Page

  1. Select Syslog.

  2. (Optional) Select Yes to send BOSH Director system logs to a remote server.

  3. Enter the IP address or DNS name for the remote server in Address.

  4. Enter the port number that the remote server listens on in Port.

  5. Select TCP or UDP from the Transport Protocol dropdown. This selection determines which transport protocol is used to send the logs to the remote server.

  6. (Optional) Select the Enable TLS checkbox to send encrypted logs to remote server with TLS. After you select the checkbox:

    1. Enter either the name or SHA1 fingerprint of the remote peer in Permitted Peer.
    2. Enter the SSL certificate for the remote server in SSL Certificate.

      Note: VMware strongly recommends that you enable TLS encryption when you are forwarding logs. Logs can contain sensitive information, such as cloud provider credentials.

  7. (Optional) Enter an integer in Queue Size. This value specifies the number of log messages held in the buffer. The default value is 100,000.

  8. (Optional) Select the checkbox to Forward Debug Logs to an external source. This option is deselected by default. If you select it, you may generate a large amount of log data.

  9. (Optional) Enter configuration details for rsyslog in the Custom rsyslog Configuration field. This field requires the rainerscript syntax.

  10. Click Save.

Step 10: Resource Config Page

  1. Select Resource Config. The 'Resource Config' page in Ops Manager. See the following steps for information about each field.

  2. Adjust any values as necessary for your deployment. Under the Instances, VM Type, and Persistent Disk Type fields, choose Automatic from the dropdown to allocate the recommended resources for the job. If the Persistent Disk Type field reads None, the job does not require persistent disk space.

    Note: For the BOSH Director job, select a VM type with at least 8 GB memory.

    Note: If you set a field to Automatic and the recommended resource allocation changes in a future version, Ops Manager automatically uses the new recommended allocation.

    Note: If you install PASW, provision your Master Compilation Job with at least 100 GB of disk space.

  3. (Optional) To configure an Application Load Balancer (ALB) for your BOSH Director, click the icon next to the BOSH Director job name to see more fields. Enter your AWS target group name in the Load Balancers field for the BOSH Director job. Prepend the name with alb:. For example, enter alb:target-group-name.

    To create an ALB and target group, follow the procedures in Getting Started with Application Load Balancers in the AWS documentation. Then navigate to Target Groups in the EC2 Dashboard menu to find your target group Name.

    Note: To configure an ALB, you must have the following AWS IAM permissions.

    "elasticloadbalancing:DescribeLoadBalancers",
    "elasticloadbalancing:DeregisterInstancesFromLoadBalancer",
    "elasticloadbalancing:RegisterInstancesWithLoadBalancer",
    "elasticloadbalancing:DescribeTargetGroups",
    "elasticloadbalancing:RegisterTargets"

  4. Click Save.

Step 11: Complete the BOSH Director Installation

  1. Return to the Installation Dashboard.

  2. Click Review Pending Changes, then Apply Changes.

  3. BOSH Director begins to install. The Changes Applied window displays when the installation process successfully completes.

    A pop-up window with the text 'Changes Applied' is shown. A green circle that contains a white checkbox appears to the left of the text. A gray button on the bottom left of the pop-up reads 'Close', and a blue button on the bottom right reads 'Return to Installation Dashboard'.

Next Steps

After completing the procedures in this topic, you must configure a runtime for Pivotal Platform. You can install Pivotal Platform on AWS with the PAS runtime.

To configure PAS, see Configuring PAS.