Installing and Configuring PASW

This topic describes how to install and configure the Pivotal Application Service for Windows (PASW) tile.

If you have the PASW 2012 R2 tile installed, see Migrating from PASW 2012 R2 to PASW for more information about the changes in features and functionality between the two tile versions.

Overview

The PASW tile installs Windows Diego Cells in your Pivotal Cloud Foundry (PCF) deployment.

The PASW tile inherits settings from the Pivotal Application Service (PAS) tile and also includes additional configuration settings.

To install, configure, and deploy PASW:

  1. Complete the prerequisites. See Prerequisites.

  2. Download and install the PASW tile. See Install the Tile.

  3. Configure required settings for the tile. See Configure the Tile.

  4. Configure resources for the tile. See Configure Tile Resources.

  5. Upload the Windows stemcell to the tile. See Upload the Stemcell.

  6. Deploy the tile. See Deploy the Tile.

Prerequisites

Before you install and configure the PASW tile:

Windows FS Injector Prerequisites

You use the Windows FS Injector tool to install the PASW tile. The Windows FS Injector tool requires:

(Optional) Disable SSL Verification for a Development Environment

If your foundation does not use real certificates, you must disable SSL certificate verification for all Windows Diego Cells before you install and configure the PASW tile. If your foundation uses real certificates, you do not need to disable SSL.

Note: Only disable SSL certificate verification for development and testing environments that use a placeholder or dummy certificate. Do not disable SSL certificate verification for production environments.

To disable SSL validation on development and testing environments:

  1. Select Networking in the PAS tile.

  2. Select the Disable SSL certificate verification for this environment checkbox.

For more information, see Terminate SSL/TLS at HAProxy in Configuring SSL/TLS Termination at HAProxy.

Install the Tile

To install the PASW tile:

  1. Go to the Pivotal Application Service for Windows page on Pivotal Network.

  2. Download the Pivotal Application Service for Windows product file.

  3. Download the Windows FS Injector tool for your workstation OS. The Injector tool, winfs-injector, is an executable binary that adds the Windows Server container base image into the product file. This step requires internet access and can take up to 20 minutes.

    Note: You need the git and tar executables in your %PATH% to run winfs-injector.exe. For example, copy git.exe and tar.exe to a directory in your %PATH%.

  4. Add the Windows Server container base image to the product file by running:

    winfs-injector --input-tile PASW-DOWNLOAD-PATH --output-tile PASW-IMPORTABLE-PATH
    

    Where:

    • PASW-DOWNLOAD-PATH is the path and filename to the PASW product file you downloaded.
    • PASW-IMPORTABLE-PATH is the desired output path for the importable product file. For example:
      C:\Users\admin> winfs-injector --input-tile ^
      c:\temp\pas-windows-2.6.0-build.1.pivotal ^
      --output-tile c:\temp\pas-windows-2.6.0-build.1-INJECTED.pivotal
      
      For information about troubleshooting winfs-injector, see Missing Local Certificates for Windows File System Injector in Troubleshooting Windows Diego Cells.
  5. To enable forwarding BOSH job logs to an external syslog server, add the following BOSH add-on to a runtime_config YAML file:

    releases:
    - name: windows-syslog
      version: latest
    
    addons:
    - name: windows-syslog
      include:
        stemcell:
        - os: ((Stemcell OS e.g., windows2019))
      jobs:
      - name: syslog_forwarder_windows
        properties:
          syslog:
            address: ((IP address of the syslog server))
            port: ((Port of the syslog server))
            transport: ((tcp or udp))
            # Optional. If you enabled SSL certificate
            # verification in PAS, you must configure
            # `tls_enabled:` and `ca_cert:`.
            tls_enabled: true
            ca_cert: ((TLS CA certificate of the syslog server))
        release: windows-syslog
    

    For more information about BOSH add-ons, see Addons Block in Director Runtime Config in the BOSH documentation.

  6. Navigate to the Ops Manager Installation Dashboard and click Import a Product.

  7. To add the PASW tile to the Import a Product product list, select the importable PASW-IMPORTABLE-PATH file on your workstation.

  8. To add the PASW tile to your staging area, click + under the Pivotal Application Service for Windows product listing.

Configure the Tile

The following sections describe how to configure the settings for the PASW tile.

Assign Availability Zones and Networks

In Assign AZ and Networks, you assign jobs to your Availability Zones (AZs) and networks.

To configure AZs and networks:

  1. Click the PASW tile.

  2. Select Assign AZs and Networks or Assign Networks. The name of the pane varies depending on your IaaS.

  3. Assign your AZs and networks and click Save.

Configure VMs

In VM Options, you configure settings for accessing your VMs.

To configure VM access:

  1. Select VM Options.

  2. Select one of the following for Manage Administrator Password:

    • To randomize the admin password, select Use random password. If you select this option, the admin password is not retrievable by an operator. This is the default selection.
    • To set the same admin password for every Windows Diego Cell, select Set the password. If you select this option, this password can be used to access any Windows Diego Cell. For example, you can use this password to open Remote Desktop Protocol (RDP) sessions.
  3. (Optional) To start the Microsoft beta port of the OpenSSH daemon on port 22 on all VMs, select the BETA: Enable BOSH-native SSH support on all VMs checkbox. If you select this option, users can SSH into Windows VMs with the bosh ssh command, and enter a CMD terminal as an admin user. They can then run powershell.exe to start a PowerShell session.

    Note: This feature is in beta and not considered production-ready.

  4. (Optional) To enable all VMs to support connection through RDP, select Enable Remote Desktop Protocol.

  5. (Optional) To configure a Key Management Service (KMS) that your volume-licensed Windows Diego Cell can register with:

    1. Select Enable.
    2. For the Host field, enter the KMS hostname.
    3. For the Port field, enter the port number. The default port number is 1688.

    The enable KMS text fields: host and port

  6. Click Save.

Configure Smoke Tests

In Smoke Tests, you choose where to run smoke tests. The Smoke Tests errand runs basic functionality tests against your PASW deployment after an installation or update.

To configure smoke tests:

  1. Select Smoke Tests.

  2. Select one of the following locations for smoke tests to run:

    • To run smoke tests in a temporary space in the default org, select A temporary space within the system org. PASW deletes the space after smoke tests finish.
    • To specify the org and space where smoke tests run, select A specified org and space. You must enter a domain available for routing and that domain must be accessible to the org.
      • For Org, enter the org you want PASW to use when running smoke tests.
      • For Space, enter the space you want PASW to use when running smoke tests.
      • For Domain, enter the domain you want PASW to use when running smoke tests.

Configure Advanced Features

Advanced Features includes new functionality that might have certain constraints. Although these features are fully supported, Pivotal recommends caution when using them in production environments.

The following sections describe how to configure these advanced features.

Diego Cell Memory and Disk Overcommit

If your apps do not use the full allocation of disk space and memory set in Resource Config, you might want use this feature. These fields control the amount to overcommit disk and memory resources to each host VM.

For example, you might want to use the overcommit if your apps use a small amount of disk and memory capacity compared to the amounts set in the Resource Config settings for Windows Diego Cell.

Note: Due to the risk of app failure and the deployment-specific nature of disk and memory use, Pivotal has no recommendation for how much, if any, memory or disk space to overcommit.

To enable overcommit:

  1. Select Advanced Features.

  2. Enter in MB the total desired amount of Diego Cell memory in the Cell memory capacity (MB) field. See the Diego Cell row in Resource Config for the current Diego Cell memory capacity settings that this field overrides.

  3. Enter in MB the total desired amount of Diego Cell disk capacity in the Cell Disk Capacity (MB) field. Refer to the Diego Cell row in Resource Config for the current Diego Cell disk capacity settings that this field overrides.

    Note: Due to the risk of app failure and the deployment-specific nature of disk and memory use, Pivotal has no recommendation about how much, if any, memory or disk space to overcommit.

  4. Click Save.

Configure Errands

Errands are scripts that Ops Manager runs automatically when it installs or uninstalls a product, such as a new version of PAS. There are two types of errands: post-deploy errands run after the product is installed, and pre-delete errands run before the product in uninstalled.

By default, Ops Manager runs all errands.

In Errands, you can change these run rules. For each errand, you can select On to run it each time Ops Manager installs or uninstalls a product, or Off to never run it.

For more information about how Ops Manager manages errands, see Managing Errands in Ops Manager.

To configure errands:

  1. Select Errands.

  2. To ensure that you receive the most up-to-date HWC buildpack, set the Install HWC Buildpack Errand to On.

  3. To ensure that a smoke test is run against your PASW installation, set the Smoke Test Errand to On.

  4. Click Save.

(Optional) Configure Isolation Segments

To deploy your PASW app workloads to an isolation segment, select App Containers and follow the procedure in Assign a Tile to an Isolation Segment in Windows Diego Cells in Isolation Segments.

(Optional) Configure System Logging

To configure Windows Diego Cells to send Windows event logs to an external syslog server, select System Logging and follow the procedure in the Forward Windows Event Logs to a Syslog Server in Troubleshooting Windows Diego Cells.

Configure Tile Resources

In Resource Config, you must associate load balancers with the VMs in your deployment to enable traffic.

To configure your tile resources:

  1. Select Resource Config.

  2. Use the dropdowns to configure Windows Diego Cell. The table below shows the recommended Windows Diego Cell disk size for your IaaS:

    IaaS Recommended Windows Diego Cell Disk Size
    AWS 100 GB
    Azure 150 GB
    GCP 150 GB
    vSphere 100 GB

    Note: Windows stemcells in the v2019.x line support ephemeral disks.

  3. Provision your Master Compilation Job with at least 100 GB of disk space.

  4. Click Save.

Upload the Stemcell

After configuring resources for the PASW tile, you must upload the Windows stemcell to the tile.

To upload the stemcell:

  1. In the PASW tile, select Stemcell Library.

  2. Retrieve the stemcell that you downloaded or created in Downloading or Creating a Windows Stemcell.

  3. Follow the procedure in Importing and Managing Stemcells to upload the Windows stemcell to PASW.

Note: If you use vSphere, you must create your own stemcell. The default root disk size of Windows stemcells v2019.x line is 30 GB. Pivotal recommends setting the root disk size of your Windows stemcell for vSphere to 30 GB. For more information, see Creating a Windows Stemcell for vSphere Manually or Creating a Windows Stemcell for vSphere Using stembuild (Beta).

Deploy the Tile

After uploading the Windows stemcell to the PASW tile, you are ready to deploy the tile.

To deploy the PASW tile:

  1. Go to the Ops Manager Installation Dashboard.

  2. Click Review Pending Changes.

  3. Select the PASW tile and review the changes. For more information, see Reviewing Pending Product Changes.

  4. Click Apply Changes.

(Optional) Create More Tiles

To run Windows Diego Cells in multiple isolation segments, you must create and configure additional PASW tiles. For more information, see Windows Diego Cells in Isolation Segments.