Configuring Ops Manager Director on GCP

Page last updated:

This topic describes how to configure the Ops Manager Director for Pivotal Cloud Foundry (PCF) on Google Cloud Platform (GCP).

Note: You can also perform the procedures in this topic using the Ops Manager API. For more information, see the Using the Ops Manager API topic.

Step 1: Access Ops Manager

  1. In a web browser, navigate to the fully qualified domain name (FQDN) of Ops Manager that you set up in Launching an Ops Manager Director Instance on GCP.

    Note: In order to set up Ops Manager authentication correctly, Pivotal recommends using a Fully Qualified Domain Name (FQDN) to access Ops Manager. Using an ephemeral IP address to access Ops Manager can cause authentication errors upon subsequent access.

  2. When Ops Manager starts for the first time, you must choose one of the following:

    Select authentication

Use an Identity Provider (IdP)

  1. Log in to your IdP console and download the IdP metadata XML. Optionally, if your IdP supports metadata URL, you can copy the metadata URL instead of the XML.

  2. Copy the IdP metadata XML or URL to the Ops Manager Use an Identity Provider log in page. Meta om

    Note: The same IdP metadata URL or XML is applied for the Ops Manager Director. If you are using a separate IdP for BOSH, copy the metadata XML or URL from that IdP and enter it into the BOSH IdP Metadata text box in the Ops Manager log in page.

  3. Enter values for the fields listed below. Failure to provide values in these fields results in a 500 error.

    • SAML admin group: Enter the name of the SAML group that contains all Ops Manager administrators.
    • SAML groups attribute: Enter the groups attribute tag name with which you configured the SAML server.
  4. Enter your Decryption passphrase. Read the End User License Agreement, and select the checkbox to accept the terms.

  5. Your Ops Manager log in page appears. Enter your username and password. Click Login.

  6. Download your SAML Service Provider metadata (SAML Relying Party metadata) by navigating to the following URLs:

    • 5a. Ops Manager SAML service provider metadata: https://OPS-MAN-FQDN:443/uaa/saml/metadata
    • 5b. Ops Manager Director SAML service provider metadata: https://OPS-MANAGER-IP-ADDRESS:8443/saml/metadata

    Note: To retrieve your OPS-MANAGER-IP-ADDRESS, navigate to the Status tab in the Ops Manager Director tile. Record the Ops Manager Director IP address.

  7. Configure your IdP with your SAML Service Provider metadata. Import the Ops Manager SAML provider metadata from Step 5a above to your IdP. If your IdP does not support importing, provide the values below.

    • Single sign on URL: https://OPS-MAN-FQDN:443/uaa/saml/SSO/alias/OPS-MAN-FQDN
    • Audience URI (SP Entity ID): https://OP-MAN-FQDN:443/uaa
    • Name ID: Email Address
    • SAML authentication requests are always signed
  8. Import the Ops Manager Director SAML provider metadata from Step 5b to your IdP. If the IdP does not support an import, provide the values below.

    • Single sign on URL: https://OPS-MANAGER-IP-ADDRESS:8443/saml/SSO/alias/OPS-MANAGER-IP-ADDRESS
    • Audience URI (SP Entity ID): https://OPS-MANAGER-IP-ADDRESS:8443
    • Name ID: Email Address
    • SAML authentication requests are always signed
  9. Return to the Ops Manager Director tile and continue with the configuration steps below.

Note: For an example of how to configure SAML integration between Ops Manager and your IdP, see the Configuring Active Directory Federation Services as an Identity Provider topic.

Internal Authentication

  1. When redirected to the Internal Authentication page, you must complete the following steps:

    • Enter a Username, Password, and Password confirmation to create an Admin user.
    • Enter a Decryption passphrase and the Decryption passphrase confirmation. This passphrase encrypts the Ops Manager datastore, and is not recoverable if lost.
    • If you are using an HTTP proxy or HTTPS proxy, follow the instructions in the Configuring Proxy Settings for the BOSH CPI topic.
    • Read the End User License Agreement, and select the checkbox to accept the terms.
    • Click Setup Authentication.

    Om login

  2. Log in to Ops Manager with the Admin username and password that you created in the previous step.

    Cf login

Step 2: Google Cloud Platform Config

  1. Click the Google Cloud Platform tile within the Installation Dashboard. Gcp om config
  2. Select Google Config. Complete the following fields:

    • Project ID: Enter your GCP project ID in all lower case, such as: your-gcp-project-id.
    • Default Deployment Tag: Enter pcf-vms.
    • Select an authentication mechanism for the Ops Manager VM:

      • The Ops Manager VM Service Account: Select this option to use the service account automatically created by GCP for the Ops Manager VM.

        To use this option, the project-wide service account that you set up in Set up an IAM Service Account must be assigned the Service Account Actor role.

      • AuthJSON: As an alternative, select this option, and in the field below enter the contents of the JSON file that you downloaded in the Set up an IAM Service Account section of the Preparing to Deploy PCF on GCP topic.

        Google config

  3. Click Save.

Step 3: Director Config Page

  1. Select Director Config to open the Director Config page.

    Director gcp

  2. In the NTP Servers (comma delimited) field, enter

  3. (Optional) If you are using JMX Bridge, enter your JMX Provider IP Address.

  4. (Optional) Enter your Bosh HM Forwarder IP Address if you are using the BOSH HM Forwarder.

  5. Select the Enable VM Resurrector Plugin checkbox to enable the Ops Manager Resurrector functionality and increase Elastic Runtime availability.

  6. Select Enable Post Deploy Scripts to run a post-deploy script after deployment. This script allows the job to execute additional commands against a deployment.

  7. Select Recreate all VMs to force BOSH to recreate all VMs on the next deploy. This process does not destroy any persistent disk data.

  8. Select Enable bosh deploy retries if you want Ops Manager to retry failed BOSH operations up to five times.

  9. Select Keep Unreachable Director VMs if you want to preserve Ops Manager Director VMs after a failed deployment for troubleshooting purposes.

  10. (Optional) Select HM Pager Duty Plugin to enable Health Monitor integration with PagerDuty. Director hm pager

    • Service Key: Enter your API service key from PagerDuty.
    • HTTP Proxy: Enter an HTTP proxy for use with PagerDuty.
  11. (Optional) Select HM Email Plugin to enable Health Monitor integration with email. Director hm email

    • Host: Enter your email hostname.
    • Port: Enter your email port number.
    • Domain: Enter your domain.
    • From: Enter the address for the sender.
    • Recipients: Enter comma-separated addresses of intended recipients.
    • Username: Enter the username for your email server.
    • Password: Enter the password password for your email server.
    • Enable TLS: Select this checkbox to enable Transport Layer Security.
  12. For Blobstore Location, select Internal.

  13. For Database Location, if you configured an external MySQL database such as Cloud SQL, select External MySQL Database and complete the fields below. Otherwise, select Internal. For more information about creating a Cloud SQL instance, see Quickstart for Cloud SQL for MySQL in the Google Cloud documentation.

    • Host: Enter the value of your host.
    • Port: Enter your port number. For example, 3306.
    • Username: Enter your username.
    • Password: Enter your password.
    • Database: Enter your database name.
  14. (Optional) Director Workers sets the number of workers available to execute Director tasks. This field defaults to 5.

  15. (Optional) Max Threads sets the maximum number of threads that the Ops Manager Director can run simultaneously. Pivotal recommends that you leave the field blank to use the default value, unless doing so results in rate limiting or errors on your IaaS.

  16. (Optional) To add a custom URL for your Ops Manager Director, enter a valid hostname in Director Hostname. You can also use this field to configure a load balancer in front of your Ops Manager Director.

    Director workers

  17. Click Save.

Step 4: Create Availability Zones Page

Note: Pivotal recommends at least three availability zones for a highly available installation of Elastic Runtime. For an example of a three availability zone deployment, see Reference Architecture for Pivotal Cloud Foundry on GCP.

  1. Select Create Availability Zones.
  2. Click Add.
  3. For a single availability zone deployment, in Google Availability Zone:
    • Enter the zone you associated to the backend service instance group of the HTTP(S) Load Balancer. For example, if you are using the us-central1 region and selected us-central1-a as the zone for your HTTP(S) Load Balancer instance group, enter us-central1-a. Availability zones
    • Click Save.
  4. For a multiple availability zone deployment, in Google Availability Zone:

    • Enter one of the zones that you associated to the backend service instance groups of the HTTP(S) Load Balancer. For example, if you are using the us-central1 region and selected us-central1-a as one of the zones for your HTTP(S) Load Balancer instance groups, enter us-central1-a.
    • Click Add
    • Repeat the above step for all the availability zones that you associated to instance groups in Preparing to Deploy PCF on GCP. Availability zones multiple
    • Click Save.
  5. Repeat the above step for all the availability zones you are using in your deployment. When you are done, click Save.

Step 5: Create Networks Page

  1. Select Create Networks.
  2. Make sure Enable ICMP checks is not selected. GCP routers do not respond to ICMP pings.
  3. Use the following steps to create one or more Ops Manager networks:
    • Click Add Network.
    • Enter a unique Name for the network.
    • If you want to dynamically provision VMs in this network for use with on-demand services, select the Service Networks checkbox. When the checkbox is selected, Ops Manager does not provision VMs within the specified CIDR range.

      Note: Do not select the Services Networks checkbox when configuring Ops Manager for the first time. If selected, the network may not appear as a drop-down option in the Assign AZ and Networks Page.

    • Under Subnets, complete the following fields:
      • Google Network Name: Enter the network, subnet and region names of the Google Network you created in Preparing to Deploy PCF on GCP. The format is NETWORK-NAME/SUBNET-NAME/REGION-NAME. For example, opsmgr/central/us-central1.

        Note: To use a shared VPC network, enter the shared VPC host project name before the network name in the format VPC-PROJECT-NAME/NETWORK-NAME/SUBNET-NAME/REGION-NAME. For example, vpc-project/opsmgr/central/us-central1. For more information, see Configuring a Shared VPC on GCP.

      • CIDR: Enter Ops Manager deploy VMs to this CIDR block.
      • Reserved IP Ranges: Enter Ops Manager avoids deploying VMs to any IP address in this range.
      • DNS: Enter This is also the gateway IP address.

        Note: Pivotal recommends using the gateway IP address as your default DNS server only if this IP address is reachable by all deployed VMs and apps. If you configure Application Security Groups (ASGs) that do not allow apps to reach the gateway IP address, for example, your applications will fail to resolve any DNS entries. In this case, you can use other Google-provided DNS servers such as or, as long as you whitelist these IP addresses in your configured ASGs.

      • Gateway: Enter
      • Availability Zones: Select the availability zone for the subnet. If you created multiple availability zones, select all listed availability zones.
    • If you want to add more subnets, click Add Subnet. Create networks
  4. Click Save.

Step 6: Assign AZs and Networks Page

  1. Select Assign AZs and Networks. Assign azs
  2. Use the drop-down menu to select a Singleton Availability Zone. The Ops Manager Director installs in this Availability Zone.
  3. Use the drop-down menu to select a Network for your Ops Manager Director.
  4. Click Save.

Step 7: Security Page

  1. Select Security.

    Om security

  2. In Trusted Certificates, enter your custom certificate authority (CA) certificates to insert into your organization’s certificate trust chain. This feature enables all BOSH-deployed components in your deployment to trust custom root certificates.

    To enter multiple certificates, paste your certificates one after the other. For example, format your certificates like the following:

    ------END CERTIFICATE------
    ------END CERTIFICATE------
    ------END CERTIFICATE------

    Note: If you want to use Docker Registries for running app instances in Docker containers, enter the certificate for your private Docker Registry in this field. See the Using Docker Registries topic for more information.

  3. Choose Generate passwords or Use default BOSH password. Pivotal recommends that you use the Generate passwords option for greater security.

  4. Click Save. To view your saved Director password, click the Credentials tab.

Step 8: Syslog Page

  1. Select Syslog. Syslog bosh

  2. (Optional) To send BOSH Director system logs to a remote server, select Yes.

  3. In the Address field, enter the IP address or DNS name for the remote server.

  4. In the Port field, enter the port number that the remote server listens on.

  5. In the Transport Protocol dropdown menu, select TCP, UDP, or RELP. This selection determines which transport protocol is used to send the logs to the remote server.

  6. (Optional) Pivotal strongly recommends that you enable TLS encryption when forwarding logs as they may contain sensitive information. For example, these logs may contain cloud provider credentials. To enable TLS, perform the following steps.

    • In the Permitted Peer field, enter either the name or SHA1 fingerprint of the remote peer.
    • In the SSL Certificate field, enter the SSL certificate for the remote server.
  7. Click Save.

Step 9: Resource Config Page

  1. Select Resource Config.

    Om resource config

  2. Ensure that the Internet Connected checkboxes are selected for all jobs. This gives all VMs a public IP address that enables outbound Internet access.

    Note: If you want to provision a Network Address Translation (NAT) box to provide Internet connectivity to your VMs instead of providing them with public IP addresses, deselect the Internet Connected checkboxes. For more information about using NAT in GCP, see the GCP documentation.

  3. Adjust any values as necessary for your deployment. Under the Instances, Persistent Disk Type, and VM Type fields, choose Automatic from the drop-down menu to allocate the recommended resources for the job. If the Persistent Disk Type field reads None, the job does not require persistent disk space.

    Note: Pivotal recommends provisioning an Ops Manager Director VM with at least 8 GB memory.

    Note: If you set a field to Automatic and the recommended resource allocation changes in a future version, Ops Manager automatically uses the updated recommended allocation.

Step 10: Complete the Ops Manager Director Installation

  1. Click the Installation Dashboard link to return to the Installation Dashboard.

  2. Click Apply Changes. If the following ICMP error message appears, return to the Network Config screen, and make sure you have deselected the Enable ICMP Checks box. Then click Apply Changes again.

    Install error

  3. Ops Manager Director installs. This may take a few moments. When the installation process successfully completes, the Changes Applied window appears.

    Ops manager complete

What to Do Next

After you complete this procedure, follow the instructions in the Deploying Elastic Runtime on GCP topic.

Create a pull request or raise an issue on the source for this page in GitHub