PCF on vSphere Requirements

Page last updated:

Warning: Pivotal Cloud Foundry (PCF) v2.4 is no longer supported because it has reached the End of General Support (EOGS) phase as defined by the Support Lifecycle Policy. To stay up to date with the latest software and security updates, upgrade to a supported version.

This guide describes how to install Pivotal Cloud Foundry (PCF) on vSphere.

If you experience a problem while following the steps below, refer to the Known Issues topics or to Diagnosing Problems in PCF.

General Requirements

The following are general requirements for deploying and managing a PCF deployment with Ops Manager and Pivotal Application Service (PAS):

  • A wildcard DNS record that points to your router or load balancer. Alternatively, you can use a service such as xip.io. For example,

    • PAS gives each application its own hostname in your app domain.
    • With a wildcard DNS record, every hostname in your domain resolves to the IP address of your router or load balancer, and you do not need to configure an A record for each app hostname. For example, if you create a DNS record *.example.com pointing to your load balancer or router, every application deployed to the example.com domain resolves to the IP address of your router.
  • At least one wildcard TLS certificate that matches the DNS record you set up above, *.example.com.

  • Sufficient IP allocation:

    • One static IP address for either HAProxy or one of your Gorouters
    • One static IP address for each job in the Ops Manager tile. See the Resource Config pane for each tile for a full list.
    • One static IP address for each job listed below:
      • Consul
      • NATS
      • File Storage
      • MySQL Proxy
      • MySQL Server
      • Backup Restore Node
      • HAProxy
      • Router
      • MySQL Monitor
      • Diego Brain
      • TCP Router
    • One IP for each VM instance created by the service.
    • An additional IP address for each compilation worker. So the formula for total IPs needed is IPs needed = static IPs + VM instances + compilation workers.

      Note: Pivotal recommends that you allocate at least 36 dynamic IP addresses when deploying Ops Manager and PAS. BOSH requires additional dynamic IP addresses during installation to compile and deploy VMs, install PAS, and connect to services.

  • One or more NTP servers if not already provided by your IaaS.

  • (Recommended) A network without DHCP available for deploying the PAS VMs.

    Note: If you have DHCP, refer to the Troubleshooting Guide to avoid issues with your installation.

  • (Optional) External storage. When you deploy PCF, you can select internal file storage or external file storage, either network-accessible or IaaS-provided, as an option in the PAS tile. Pivotal recommends using external storage whenever possible. See Configure File Storage for a discussion of how file storage location affects platform performance and stability during upgrades.

  • (Optional) External databases. When you deploy PCF, you can select internal or external databases for the BOSH Director and for PAS. Pivotal recommends using external databases in production deployments. An external database must be configured to use the UTC timezone.

  • (Optional) External user stores. When you deploy PCF, you can select a SAML user store for Ops Manager or a SAML or LDAP user store for PAS, to integrate existing user accounts.

  • The most recent version of the Cloud Foundry Command Line Interface (cf CLI).


vSphere Requirements

Note: If you are using the Cisco Nexus 1000v Switch, refer to the Using the Cisco Nexus 1000v Switch with Ops Manager topic for more information.

Note: When installing Ops Manager on a vSphere environment with multiple ESXi hosts, you must use network-attached or shared storage devices. Local storage devices do not support sharing across multiple ESXi hosts.

Minimum Resource Requirements for PCF Deployment with Pivotal Application Service

The following are the minimum resource requirements for maintaining a Pivotal Cloud Foundry (PCF) deployment with Ops Manager and Pivotal Application Service (PAS) on vSphere:

  • vSphere v6.7, v6.5, or v6.0
  • Disk space: 2 TB recommended
  • Memory: 120 GB
  • Two public IP addresses: One for PAS and one for Ops Manager
  • vCPU cores: 80
  • Overall CPU: 28 GHz
  • vSphere editions: Enterprise Plus or Premium. These editions include Distributed Resource Scheduler (DRS), which is required by PAS.
  • Ops Manager must have HTTPS access to vCenter and ESX hosts on TCP port 443.
  • A configured vSphere cluster:
    • If you enable vSphere DRS (Distributed Resource Scheduler) for the cluster, you must set the Automation level to Partially automated or Fully automated. If you set the Automation level to Manual, the BOSH automated installation will fail with a power_on_vm error when BOSH attempts to create virtual machines (VMs).
    • Disable hardware virtualization if your vSphere hosts do not support VT-X/EPT. If you are unsure whether the VM hosts support VT-x/EPT, you should disable this setting. If you leave this setting enabled and the VM hosts do not support VT-x/EPT, then each VM requires manual intervention in vCenter to continue powering on without the Intel virtualized VT-x/EPT. Refer to the vCenter help topic at Configuring Virtual Machines > Setting Virtual Processors and Memory > Set Advanced Processor Options for more information.
  • If you configure an external load balancer, an HTTP keep-alive connection timeout greater than five seconds

Note: If you are deploying PCF behind a firewall, see the Preparing Your Firewall for Deploying Pivotal Cloud Foundry topic.

Minimum Resource Requirements for PCF Deployment with Small Footprint PAS

The following are the minimum resource requirements for maintaining a PCF deployment with Ops Manager and Small Footprint PAS on vSphere:

  • 1 vSphere cluster/1 AZ
  • 2 resource pools: 1 for NSX-T components and 1 for PAS or PKS
  • 3 hosts minimum for vSphere HA (4 hosts for vSphere VSAN)
  • Shared storage/VSAN
  • 1 NSX Manager
  • 3 NSX controllers
  • 4 large edge VMs in a cluster
  • PCF: Ops Manager, the BOSH Director, and Small Footprint PAS

Instance Number and Scaling Requirements

By default, PAS deploys the number of VM instances required to run a highly available configuration of PCF. If you are deploying a test or sandbox PCF that does not require HA, then you can scale down the number of instances in your deployment.

For information about the number of instances required to run a minimal, non-HA PCF deployment, see Scaling PAS.

vSphere Service Account Requirements

Ops Manager requires read/write permissions to the data center level of the vSphere Inventory Hierarchy to successfully install. Pivotal recommends defining a custom role for the service account that has all privileges for all objects in the data center, including propagating privileges to children.

For a complete list of the minimum required vSphere privileges, see the vSphere Service Account Requirements topic.

Since Ops Manager passes all required credentials through to BOSH, you only need one service account with the required vSphere privileges to complete the installation. Setting up separate service accounts for Ops Manager and BOSH is not necessary or recommended.

Note: You can also apply the default VMware Administrator System Role to the service account to achieve the appropriate permission level.

vSphere Security Documents

Step 1: Install Ops Manager

Complete the following procedures to install Ops Manager on vSphere:

  1. Deploying Ops Manager to vSphere

  2. Configuring BOSH Director on vSphere

(Optional) Step 2: Install the IPsec Add-on

The PCF IPsec add-on secures network traffic within a PCF deployment and provides internal system protection if a malicious actor breaches your firewall. See the Securing Data in Transit with the IPsec Add-on topic for installation instructions.

Note: You must install the PCF IPsec add-on before installing any other tiles to enable the IPsec functionality. Pivotal recommends installing IPsec immediately after Ops Manager, and before installing the PAS tile.

(Optional) Step 3: Install the NSX-T Tile

The NSX-T tile provides a single network for containers, VMs, and other entities. It enables NSX to enforce C2C policy and operators to configure additional policies through NSX Manager.

  • You must install the NSX-T tile after you install or upgrade the BOSH Director tile.
  • You must install the NSX-T tile before you install or upgrade the PAS tile.

See the NSX-T Container Plug-In for Kubernetes and Cloud Foundry - Installation and Administration Guide for more information.

Step 4: Install PAS

To install PAS on vSphere, perform the procedures in the Deploying PAS on vSphere topic.

Step 5: Create New User Accounts

Once you have successfully deployed PCF, add users to your account. Refer to the Creating New PAS User Accounts topic for more information.

Step 6: Target Your Deployment

Use the Cloud Foundry Command Line Interface (cf CLI) to target your deployment. If you have not installed the cf CLI, follow the instructions in Installing the cf CLI. For more information about the cf CLI, see Getting Started with the cf CLI.

Note: To obtain the UAA admin name and password, refer to PAS Credentials in Ops Manager. You can also use the user that you created in Apps Manager, or create another user with the create-user command.

Additional Configuration

See the following topics for additional configuration information: