Installing and Configuring PASW
Warning: Pivotal Cloud Foundry (PCF) v2.4 is no longer supported because it has reached the End of General Support (EOGS) phase as defined by the Support Lifecycle Policy. To stay up to date with the latest software and security updates, upgrade to a supported version.
This topic describes how to install and configure the Pivotal Application Service for Windows (PASW) tile. The PASW tile installs Windows Diego Cells in your Pivotal Cloud Foundry (PCF) deployment.
If you have the PASW 2012 R2 tile installed, see Migrating from PASW 2012 R2 to PASW for more information about the changes in features and functionality between the two tile versions.
The PASW tile inherits settings from the Pivotal Application Service (PAS) tile. The PAS tile settings in this section affect the Windows Diego Cells that the PASW tile deploys.
If your foundation does not use real certificates, you must disable SSL certificate verification for all Windows Diego Cells before you install and configure the PASW tile. If your foundation uses real certificates, you do not need to disable SSL.
Note: Only disable SSL certificate verification for development and testing environments that use a placeholder or dummy certificate. Do not disable SSL certificate verification for production environments.
To disable SSL validation on development and testing environments:
In the PAS tile, select Networking.
Select the Disable SSL certificate verification for this environment checkbox.
Click Apply Changes.
For more information, see the Procedure: Terminate SSL/TLS at HAProxy section of Configuring SSL/TLS Termination at HAProxy.
Download the Pivotal Application Service for Windows product file from Pivotal Network.
Within Pivotal Application Service for Windows, download the Windows FS Injector tool for your workstation OS.
The Injector tool,
winfs-injector, is an executable binary that adds the Windows Server container base image into the product file. This step requires internet access and can take up to 20 minutes.
Note: You need the
tarexecutables in your
winfs-injector.exe. For example, copy
tar.exeto a directory in your
To add the Windows Server container base image to the product file, run the following command:
winfs-injector --input-tile PASW-DOWNLOAD-PATH --output-tile PASW-IMPORTABLE-PATH
PASW-DOWNLOAD-PATHis the path and filename to the PASW product file you downloaded.
PASW-IMPORTABLE-PATHis the desired output path for the importable product file.
C:\Users\admin> winfs-injector --input-tile ^ c:\temp\pas-windows-2.4.0-build.1.pivotal ^ --output-tile c:\temp\pas-windows-2.4.0-build.1-INJECTED.pivotal
For information about troubleshooting
winfs-injector, see Missing Local Certificates for Windows File System Injector in Troubleshooting Windows Cells.
To enable forwarding BOSH job logs to an external syslog server, add the following BOSH add-on to a
releases: - name: windows-syslog version: latest addons: - name: windows-syslog include: stemcell: - os: ((Stemcell OS e.g., windows2019)) jobs: - name: syslog_forwarder_windows properties: syslog: address: ((IP address of the syslog server)) port: ((Port of the syslog server)) transport: ((tcp or udp)) # Optional. If you enabled SSL certificate # verification in PAS, you must configure # `tls_enabled:` and `ca_cert:`. tls_enabled: true ca_cert: ((TLS CA certificate of the syslog server)) release: windows-syslog
For more information about BOSH add-ons, see Addons Block in the BOSH documentation.
Navigate to the Ops Manager Installation Dashboard and click Import a Product.
To add the PASW tile to the Import a Product product list, select the importable
PASW-IMPORTABLE-PATHfile on your workstation.
To add the PASW tile to your staging area, click + under the Pivotal Application Service for Windows product listing.
Click the newly added Pivotal Application Service for Windows tile.
Select Assign AZs and Networks or Assign Networks. The name of the pane varies depending on your IaaS.
Assign your AZs and networks and click Save.
Select VM Options.
Select one of the following for Manage Administrator Password:
- To randomize the admin password, select Use random password. If you select this option, the admin password is not retrievable by an operator. This is the default selection.
- To set the same admin password for every Windows Diego Cell, select Set the password. If you select this option, this password can be used to access any Windows Diego Cell. For example, you can use this password to open Remote Desktop Protocol (RDP) sessions.
(Optional) To start the Microsoft beta port of the OpenSSH daemon on port 22 on all VMs, select the BETA: Enable BOSH-native SSH support on all VMs checkbox. If you select this option, users can SSH into Windows VMs with the
bosh sshcommand, and enter a CMD terminal as an admin user. They can then run
powershell.exeto start a PowerShell session.
Note: This feature is in beta and not considered production-ready.
(Optional) To enable all VMs to support connection through RDP, select Enable Remote Desktop Protocol.
(Optional) To configure a Key Management Service (KMS) that your volume-licensed Windows Diego Cell can register with, do the following:
- Select Enable.
- For the Host field, enter the KMS hostname.
- For the Port field, enter the port number. The default port number is
(Optional) To deploy your PASW app workloads to an isolation segment, select Application Containers and perform the steps in the Assign a Tile to an Isolation Segment section of Windows Cells in Isolation Segments.
(Optional) To configure Windows Diego Cells to send Windows Event logs to an external syslog server, select System Logging and perform the steps in the Forward Windows Event Logs to a Syslog Server section of Troubleshooting Windows Cells.
Select Smoke Tests.
Select one of the following locations for smoke tests to run:
- To run smoke tests in a temporary space in the default org, select Temporary space within the system organization. PASW deletes the space after smoke tests finish.
- To specify the org and space where smoke tests run, select Specified org and space. You must enter a domain available for routing and that domain must be accessible to the org. Enter the following:
- In the Organization field, enter the Application Service org to use when running tests.
- In the Space field, enter the Application Service space to use when running tests.
- In the Domain field, enter the domain that the org has access to for running smoke tests.
(Optional) To configure memory and disk overcommit for your Windows Diego Cells, select Advanced Features and do the following:
(Optional) To enable advanced features in PASW, select Advanced Features and do the following:
- To configure memory and disk overcommit for your Windows Diego Cells,
follow the steps below:
- Enter the total desired amount of Diego Cell memory in the Cell Memory Capacity (MB) field. For the current cell memory capacity settings, see the Windows Diego Cell row on the Resource Config pane.
- Enter the total desired amount of Diego Cell disk capacity in the Cell Disk Capacity (MB) field.
For the current cell disk capacity settings, see the Windows Diego Cell row
on the Resource Config pane.
Note: Due to the risk of app failure and the deployment-specific nature of disk and memory use, Pivotal has no recommendation about how much, if any, memory or disk space to overcommit.
- To use the
cftag as the deployment name in your PASW metrics, select the Use “cf” as deployment name in emitted metrics instead of unique name checkbox. By default, this checkbox is disabled, and the metrics are emitted with the BOSH deployment name of your PASW tile.
Note: Enable the Use “cf” as deployment name in emitted metrics instead of unique name checkbox only if it is required for backward compatibility with previous versions of PCF.
- Click Save.
- To configure memory and disk overcommit for your Windows Diego Cells, follow the steps below:
- To ensure that you receive the most up-to-date HWC buildpack, set the Install HWC Buildpack Errand to On.
- To ensure that a smoke test is run against your Application Service installation, set the Smoke Test Errand to On.
To configure your tile resources, do the following:
- Navigate to the Resource Config pane of the PASW tile.
- Use the dropdown menus to configure Windows Diego Cell. For more information, see Disk Size of Windows Diego Cells below.
- Click Save.
Note: Provision your Master Compilation Job with at least 100 GB of disk space.
Windows stemcells v1803.2 and later in the 1803 line support ephemeral disks. If your PASW deployment is based on one of these stemcells, the recommended disk size for your Windows Diego Cells is as follows:
|IaaS||Recommended Windows Diego Cell Disk Size|
Note: If you use vSphere, you must create your own stemcell. The default root disk size of Windows stemcells v1803.2 and later in the 1803 line is 30 GB. Pivotal recommends setting the root disk size of your Windows stemcell for vSphere to 30 GB. For more information, see Creating a Windows Stemcell for vSphere Manually or Creating a Windows Stemcell for vSphere Using stembuild (Beta).
Go to Stemcell Library.
Retrieve the stemcell that you downloaded or created in Downloading or Creating a Windows Stemcell.
Follow the steps in Importing and Managing Stemcells to upload the Windows stemcell to Pivotal Application Service for Windows.
- Return to the Ops Manager Installation Dashboard.
- Select Review Pending Changes.
- Select the PASW tile and review the changes. For more information, see Reviewing Pending Product Changes.
- Select Apply Changes to install the Pivotal Application Service for Windows tile.
To run Windows Diego Cells in multiple isolation segments, you must create and configure additional PASW tiles. For more information, see Windows Cells in Isolation Segments.