Configuring Ops Manager Director for OpenStack

Page last updated:

This topic describes how to configure the Ops Manager Director after deploying Pivotal Cloud Foundry (PCF) on OpenStack. Use this topic when Installing Pivotal Cloud Foundry on OpenStack.

Before beginning this procedure, ensure that you have successfully completed all steps in the Provisioning the OpenStack Infrastructure topic. After you complete this procedure, follow the instructions in the Installing Elastic Runtime after Deploying PCF on OpenStack topic.

Note: You can also perform the procedures in this topic using the Ops Manager API. For more information, see the Using the Ops Manager API topic.

Step 1: Access Ops Manager

Note: For security, Ops Manager 1.7 and later require that you log in using a fully qualified domain name to access Ops Manager.

  1. In a web browser, navigate to the fully qualified domain you created in the Create a DNS Entry step of Provisioning the OpenStack Infrastructure.

  2. When Ops Manager starts for the first time, you must choose one of the following:

    • Use an Identity Provider: If you use an Identity Provider, an external identity server maintains your user database.
    • Internal Authentication: If you use Internal Authentication, Pivotal Cloud Foundry (PCF) maintains your user database.

    Select authentication

Use an Identity Provider

  1. Log in to your IdP console and download the IdP metadata XML. Optionally, if your IdP supports metadata URL, you can copy the metadata URL instead of the XML.

  2. Copy the IdP metadata XML or URL to the Ops Manager Use an Identity Provider log in page. Meta om

    Note: The same IdP metadata URL or XML is applied for the BOSH Director. If you use a separate IdP for BOSH, copy the metadata XML or URL from that IdP and enter it into the BOSH IdP Metadata text box in the Ops Manager log in page.

  3. Enter your Decryption passphrase. Read the End User License Agreement, and select the checkbox to accept the terms.

  4. Your Ops Manager log in page appears. Enter your username and password. Click Login.

  5. Download your SAML Service Provider metadata (SAML Relying Party metadata) by navigating to the following URLs:

    • 5a. Ops Manager SAML service provider metadata: https://OPS-MAN-FQDN:443/uaa/saml/metadata
    • 5b. BOSH Director SAML service provider metadata: https://BOSH-IP-ADDRESS:8443/saml/metadata

    Note: To retrieve your BOSH-IP-ADDRESS, navigate to the Ops Manager Director tile > Status tab. Record the Ops Manager Director IP address.

  6. Configure your IdP with your SAML Service Provider metadata. Import the Ops Manager SAML provider metadata from Step 5a above to your IdP. If your IdP does not support importing, provide the values below.

    • Single sign on URL: https://OPS-MAN-FQDN:443/uaa/saml/SSO/alias/OPS-MAN-FQDN
    • Audience URI (SP Entity ID): https://OP-MAN-FQDN:443/uaa
    • Name ID: Email Address
    • SAML authentication requests are always signed
  7. Import the BOSH Director SAML provider metadata from Step 5b to your IdP. If the IdP does not support an import, provide the values below.

    • Single sign on URL: https://BOSH-IP:8443/saml/SSO/alias/BOSH-IP
    • Audience URI (SP Entity ID): https://BOSH-IP:8443
    • Name ID: Email Address
    • SAML authentication requests are always signed
  8. Return to the Ops Manager Director tile, and continue with the configuration steps below.

Use Internal Authentication

  1. When redirected to the Internal Authentication page, you must complete the following steps:

    • Enter a Username, Password, and Password confirmation to create an Admin user.
    • Enter a Decryption passphrase and the Decryption passphrase confirmation. This passphrase encrypts the Ops Manager datastore, and is not recoverable.
    • If you are using an HTTP proxy or HTTPS proxy, follow the instructions in the Configuring Proxy Settings for the BOSH CPI topic.
    • Read the End User License Agreement, and select the checkbox to accept the terms.
    • Click Setup Authentication.

    Om login

  2. Log in to Ops Manager with the Admin username and password you created in the previous step.

    Cf login

Step 2: Complete the OpenStack Config Page

  1. In the left navigation of your OpenStack dashboard, click Project > Compute > Access & Security. Select the API Access tab.

  2. Record the Service Endpoint for the Identity service. You use this Service Endpoint as the Authentication URL for Ops Manager in a later step.

    Record endpoint

  3. In the PCF Ops Manager Installation Dashboard, click the Ops Manager Director tile.

    Om tile

  4. Select OpenStack Config.

  5. Complete the OpenStack Management Console Config page with the following information:

    • Authentication URL: Enter the Service Endpoint for the Identity service that you recorded in a previous step.
    • Keystone Version: Choose a Keystone version. If you choose v3, you must enter a Domain to authenticate against.
    • Username: Enter your OpenStack Horizon username.
    • Password: Enter your OpenStack Horizon password.
    • Tenant: Enter your OpenStack tenant name.
    • Region: Enter RegionOne, or another region if recommended by your OpenStack administrator.
    • Select OpenStack omNetwork Type: Select either Nova, the legacy OpenStack networking model, or Neutron, the newer networking model.
    • Ignore Server Availability Zone: Do not select the checkbox.
    • Security Group Name: Enter opsmanager. You created this Security Group when Provisioning the OpenStack Infrastructure.
    • Key Pair Name: Enter the name of the key pair that you created in the Configure Security step of the Provisioning the OpenStack Infrastructure topic.
    • SSH Private Key: In a text editor, open the key pair file that you downloaded in the Configure Security step of the Provisioning the OpenStack Infrastructure topic. Copy and paste the contents of the key pair file into the field.
    • (Optional) API SSL Certificate: If, in your OpenStack Dashboard, you have configured API SSL termination, enter your API SSL Certificate.
    • Disable DHCP: Do not select the checkbox unless your setup requires it.
    • Select OpenStack Network Type: Select either Nova, the legacy networking model, or Neutron, the OpenStack networking model.

    Om openstack config

  6. Click Save.

Step 3: (Optional) Complete the Advanced Config Page

Note: This is an advanced option. Most users leave this field blank.

  1. In Ops Manager, select Advanced Infrastructure Config. Om advanced infra

  2. If your OpenStack environment requires specific connection options, enter them in the Connection Options field in JSON format. For example: 'connection_options' => { 'read_timeout' => 200 }

  3. Click Save.

Step 4: Complete the Director Config Page

  1. In Ops Manager, select Director Config.

    Director config

  2. Enter one or more NTP servers in the NTP Servers (comma delimited) field. For example, us.pool.ntp.org.

  3. (Optional) Enter your JMX Provider IP Address if you are Using JMX Bridge.

  4. (Optional) Enter your Bosh HM Forwarder IP Address if you are using the BOSH HM Forwarder.

  5. Select the Enable VM Resurrector Plugin checkbox to enable the Ops Manager Resurrector functionality and increase Elastic Runtime availability.

  6. Select Enable Post Deploy Scripts to run a post-deploy script after deployment. This script allows the job to execute additional commands against a deployment.

  7. Select Recreate all VMs to force BOSH to recreate all VMs on the next deploy. This process does not destroy any persistent disk data.

  8. Select Enable bosh deploy retries if you want Ops Manager to retry failed BOSH operations up to five times.

  9. Select Keep Unreachable Director VMs if you want to preserve Ops Manager Director VMs after a failed deployment for troubleshooting purposes.

  10. Select HM Pager Duty Plugin to enable Health Monitor integration with PagerDuty. Director hm pager

    • Service Key: Enter your API service key from PagerDuty.
    • HTTP Proxy: Enter an HTTP proxy for use with PagerDuty.
  11. Select HM Email Plugin to enable Health Monitor integration with email. Director hm email

    • Host: Enter your email hostname.
    • Port: Enter your email port number.
    • Domain: Enter your domain.
    • From: Enter the address for the sender.
    • Recipients: Enter comma-separated addresses of intended recipients.
    • Username: Enter the username for your email server.
    • Password: Enter the password password for your email server.
    • Enable TLS: Select this checkbox to enable Transport Layer Security.
  12. For Blobstore Location, select S3 Compatible Blobstore and complete the following steps using information from the ec2rc.sh file: Director blobstore

    • In a text editor, open the ec2rc.sh file that you downloaded in Step 8: Download Credentials for S3 Blob Storage. Use the file to populate the fields described below.
    • Blobstore Location: Select the S3 Compatible Blobstore option.
    • S3 Endpoint: Use S3_URL from the ec2rc.sh file.
    • Bucket Name: Enter pcf.
    • Access Key: Use EC2_ACCESS_KEY from the ec2rc.sh file.
    • Secret Key: Use EC2_SECRET_KEY from the ec2rc.sh file.
  13. Select a Database Location. By default, PCF deploys and manages a database for you. If you choose to use an External MySQL Database, complete the associated fields with information obtained from your external MySQL Database provider. Director database

  14. (Optional) Director Workers sets the number of workers available to execute Director tasks. This field defaults to 5.

  15. (Optional) For Max Threads, enter the number of operations the Ops Manager Director can perform simultaneously.

  16. (Optional) To add a custom URL for your Ops Manager Director, enter a valid hostname in Director Hostname. You can also use this field to configure a load balancer in front of your Ops Manager Director.

  17. Click Save.

Note: If you select to use an internal database, back up your data frequently to ensure you have saved the latest copy.

Step 5: Complete the Create Availability Zones Page

  1. In Ops Manager, select Create Availability Zones.

    Create az

  2. Enter the name of the availability zone that you selected when Provisioning the OpenStack Infrastructure.

  3. Click Save.

Step 6: Complete the Create Networks Page

  1. In the left navigation of your OpenStack dashboard, click Project > Network > Networks.

  2. Click the name of the network that contains the private subnet where you deployed the Ops Manager VM. The OpenStack Network Detail page displays your network settings.

    View network info

  3. In Ops Manager, select Create Networks.

    Om create networks config

  4. Select Enable ICMP checks to enable ICMP on your networks. Ops Manager uses ICMP checks to confirm that components within your network are reachable. Review the Configure Security topic to ensure you have setup ICMP in your Security Group.

  5. Use the following steps to create one or more Ops Manager networks using information from your OpenStack network:

    • Click Add Network.
    • Enter a unique Name for the network.
    • If you want to dynamically provision VMs in this network for use with on-demand services, select the Service Networks checkbox. When the checkbox is selected, Ops Manager does not provision VMs within the specified CIDR range.
    • Click Add Subnet to create one or more subnets for the network.
    • For Network ID, use the ID from the OpenStack page.
    • For CIDR, use the Network Address from the OpenStack page.
    • For Reserved IP Ranges, use the first 10 IP addresses of the Network Address range, and the private IP address of the Ops Manager instance that you recorded in the Associate a Floating IP Address step of the Provisioning the OpenStack Infrastructure topic.
    • For DNS, enter one or more Domain Name Servers.
    • For Gateway, use the Gateway IP from the OpenStack page.
    • For Availability Zones, select which Availability Zones to use with the network.
  6. Click Save.

Step 7: Complete the Assign AZs and Networks Page

  1. Select Assign Availability Zones.

    Assign az

  2. From the Singleton Availability Zone drop-down menu, select the availability zone that you created in a previous step. The Ops Manager Director installs in this Availability Zone.

  3. Use the drop-down menu to select the Network that you created in a previous step. Ops Manager Director installs in this network.

  4. Click Save.

Step 8: Complete the Security Page

  1. Select Security. Om security

  2. In Trusted Certificates, enter a custom certificate authority (CA) certificate to insert into your organization’s certificate trust chain. This feature enables all BOSH-deployed components in your deployment to trust a custom root certificate. If you want to use Docker Registries for running app instances in Docker containers, use this field to enter your certificate for your private Docker Registry. See the Using Docker Registries topic for more information.

  3. Choose Generate passwords or Use default BOSH password. Pivotal recommends that you use the Generate passwords option for greater security.

  4. Click Save. To view your saved Director password, click the Credentials tab.

Step 9: Complete the Syslog Page

  1. Select Syslog. Syslog bosh

  2. (Optional) To send BOSH Director system logs to a remote server, select Yes.

  3. In the Address field, enter the IP address or DNS name for the remote server.

  4. In the Port field, enter the port number that the remote server listens on.

  5. In the Transport Protocol dropdown menu, select TCP, UDP, or RELP. This selection determines which transport protocol is used to send the logs to the remote server.

  6. (Optional) Mark the Enable TLS checkbox to use TLS encryption when sending logs to the remote server.

    • In the Permitted Peer field, enter either the name or SHA1 fingerprint of the remote peer.
    • In the SSL Certificate field, enter the SSL certificate for the remote server.
  7. Click Save.

Step 10: Complete the Resource Config Page

  1. Select Resource Config. Om resource config
  2. Adjust any values as necessary for your deployment, such as increasing the persistent disk size. Select Automatic from the drop-down menu to provision the amount of persistent disk predefined by the job. If the persistent disk field reads None, the job does not require persistent disk space.

    Note: Ops Manager v1.11 and above require a Director VM with at least 8 GB memory.

    Note: If you set a field to Automatic and the recommended resource allocation changes in a future version, Ops Manager automatically uses the updated recommended allocation.

  3. Click Save.

Step 11: Complete Ops Manager Director Installation

  1. Click the Installation Dashboard link to return to the Installation Dashboard.

  2. Click Apply Changes. If the following ICMP error message appears, click Ignore errors and start the install.

    Icmp error

  3. Ops Manager Director installs. The image shows the Changes Applied message that Ops Manager displays when the installation process successfully completes.

    Om installed

  4. After you complete this procedure, follow the instructions in the Installing Elastic Runtime after Deploying PCF on OpenStack topic.


Return to Installing Pivotal Cloud Foundry on OpenStack.

Create a pull request or raise an issue on the source for this page in GitHub