Pivotal Container Service v1.1

Configuring Ops Manager on GCP

Page last updated:

This topic describes how to configure Ops Manager for Pivotal Container Service (PKS) on Google Cloud Platform (GCP).

Note: You can also perform the procedures in this topic using the Ops Manager API. For more information, see Using the Ops Manager API.

Step 1: Access Ops Manager

Note: If you have Pivotal Application Service (PAS) installed, we strongly recommend installing PKS on a separate instance of Ops Manager for security reasons. For more information, see PAS and PKS Deployments with Ops Manager.

  1. In a web browser, navigate to the fully qualified domain name (FQDN) of Ops Manager that you set up in Deploying Ops Manager on GCP. For example,

    Note: Using an ephemeral IP address to access Ops Manager can cause authentication errors upon subsequent access. Pivotal recommends accessing Ops Manager using the FQDN.

  2. When Ops Manager starts for the first time, you must choose one of the following:

    Select authentication

Use an Identity Provider (IdP)

  1. Log in to your IdP console and download the IdP metadata XML. Optionally, if your IdP supports metadata URL, you can copy the metadata URL instead of the XML.

  2. Copy the IdP metadata XML or URL to the Ops Manager Use an Identity Provider log in page.

    Meta om

    Note: The same IdP metadata URL or XML is applied for the BOSH Director. If you use a separate IdP for BOSH, copy the metadata XML or URL from that IdP and enter it into the BOSH IdP Metadata text box in the Ops Manager log in page.

  3. Enter your Decryption passphrase. Read the End User License Agreement, and select the checkbox to accept the terms.

  4. Your Ops Manager login page appears. Enter your username and password. Click Login.

  5. Download your SAML Service Provider metadata (SAML Relying Party metadata) by navigating to the following URLs:

    • 5a. Ops Manager SAML service provider metadata: https://OPS-MAN-FQDN:443/uaa/saml/metadata
    • 5b. BOSH Director SAML service provider metadata: https://BOSH-IP-ADDRESS:8443/saml/metadata

    Note: To retrieve your BOSH-IP-ADDRESS, navigate to the Ops Manager Director tile > Status tab. Record the Ops Manager Director IP address.

  6. Configure your IdP with your SAML Service Provider metadata. Import the Ops Manager SAML provider metadata from Step 5a above to your IdP. If your IdP does not support importing, provide the values below.

    • Single sign on URL: https://OPS-MAN-FQDN:443/uaa/saml/SSO/alias/OPS-MAN-FQDN
    • Audience URI (SP Entity ID): https://OP-MAN-FQDN:443/uaa
    • Name ID: Email Address
    • SAML authentication requests are always signed
  7. Import the BOSH Director SAML provider metadata from Step 5b to your IdP. If the IdP does not support an import, provide the values below.

    • Single sign on URL: https://BOSH-IP:8443/saml/SSO/alias/BOSH-IP
    • Audience URI (SP Entity ID): https://BOSH-IP:8443
    • Name ID: Email Address
    • SAML authentication requests are always signed
  8. Return to the Ops Manager Director tile, and continue with the configuration steps below.

Internal Authentication

  1. When redirected to the Internal Authentication page, you must complete the following steps:

    • Enter a Username, Password, and Password confirmation to create an Admin user.
    • Enter a Decryption passphrase and the Decryption passphrase confirmation. This passphrase encrypts the Ops Manager datastore, and is not recoverable if lost.
    • If you use an HTTP proxy or HTTPS proxy, follow the instructions in Configuring Proxy Settings for the BOSH CPI.
    • Read the End User License Agreement, and select the checkbox to accept the terms.
    • Click Setup Authentication.

    Om login

  2. Log in to Ops Manager with the Admin username and password that you created in the previous step.

    Cf login

Step 2: Google Cloud Platform Config

  1. Click the Google Cloud Platform tile within the Installation Dashboard.

    Gcp om config

  2. Select Google Config. Complete the following fields:

    • Project ID: Enter your GCP project ID in all lower case, such as: your-gcp-project-id.
    • Default Deployment Tag: Enter the MY-PKS prefix that you used when creating the GCP resources for this PCF installation. This prefix matches the tags for the allow-pks-all firewall rule you created in the Create Firewall Rules for the Network step of Preparing GCP Before Deploying PKS.
    • Select AuthJSON and enter the contents of the JSON file that you downloaded for the BOSH/Ops Manager service account that you created in the Create Service Accounts step of Preparing GCP Before Deploying PKS.

      Note: As an alternative, you can select The Ops Manager VM Service Account option to use the service account automatically created by GCP for the Ops Manager VM.

      Google config
  3. Click Save.

Step 3: Director Config Page

  1. Select Director Config to open the Director Config page.

    Director gcp

  2. In the NTP Servers (comma delimited) field, enter

    Note: The NTP server configuration only updates after VM recreation. Ensure that you select the Recreate all VMs checkbox if you modify the value of this field.

  3. Leave the JMX Provider IP Address field blank.

  4. Leave the Bosh HM Forwarder IP Address field blank.

  5. Select the Enable VM Resurrector Plugin checkbox to enable the Ops Manager Resurrector functionality and increase runtime availability.

  6. Select Enable Post Deploy Scripts to run a post-deploy script after deployment. This script allows the job to execute additional commands against a deployment.

    Note: You must enable post-deploy scripts to install PKS.

  7. (Optional) Select Recreate all VMs to force BOSH to recreate all VMs on the next deploy. This process does not destroy any persistent disk data.

  8. Select Enable bosh deploy retries for Ops Manager to retry failed BOSH operations up to five times.

    Note: If you use Ops Manager v2.2, Pivotal recommends disabling Allow Legacy Agents. Disabling the field allows Ops Manager to implement TLS secure communications.

  9. (Optional) Select Keep Unreachable Director VMs if you want to preserve BOSH Director VMs after a failed deployment for troubleshooting purposes.

  10. (Optional) Select HM Pager Duty Plugin to enable Health Monitor integration with PagerDuty. Director hm pager

    • Service Key: Enter your API service key from PagerDuty.
    • HTTP Proxy: Enter an HTTP proxy for use with PagerDuty.
  11. (Optional) Select HM Email Plugin to enable Health Monitor integration with email.

    Director hm email

    • Host: Enter your email hostname.
    • Port: Enter your email port number.
    • Domain: Enter your domain.
    • From: Enter the address for the sender.
    • Recipients: Enter comma-separated addresses of intended recipients.
    • Username: Enter the username for your email server.
    • Password: Enter the password for your email server.
    • Enable TLS: Select this checkbox to enable Transport Layer Security.
  12. Select a Blobstore Location to either configure the blobstore as an internal server or an external endpoint. Because the internal server is unscalable and less secure, Pivotal recommends you configure an external blobstore.

    Note: After you deploy Ops Manager, you cannot change the blobstore location.

    • Internal: Select this option to use an internal blobstore. Ops Manager creates a new VM for blob storage. No additional configuration is required.
    • S3 Compatible Blobstore: Select this option to use an external S3-compatible endpoint. Follow the procedures in Sign up for Amazon S3 and Create a Bucket from the AWS documentation. When you have created an S3 bucket, complete the following steps:
      1. S3 Endpoint: Navigate to the Regions and Endpoints topic in the AWS documentation. Locate the endpoint for your region in the Amazon Simple Storage Service (S3) table and construct a URL using your region’s endpoint. For example, if you are using the us-west-2 region, the URL you create would be Enter this URL into the S3 Endpoint field in Ops Manager.
      2. Bucket Name: Enter the name of the S3 bucket.
      3. Access Key and Secret Key: Enter the keys you generated when creating your S3 bucket.
      4. Select V2 Signature or V4 Signature. If you select V4 Signature, enter your Region.

        Note: AWS recommends using Signature Version 4. For more information about AWS S3 Signatures, see the Authenticating Requests documentation.

    • GCS Blobstore: Select this option to use an external Google Cloud Storage (GCS) endpoint. To create a GCS bucket, follow the procedures in Creating Storage Buckets. When you have created a GCS bucket, complete the following steps:
      1. Bucket Name: Enter the name of your GCS bucket.
      2. Storage Class: Select the storage class for your GCS bucket. For more information, see Storage Classes in the GCP documentation.
      3. Service Account Key: Enter the contents of the JSON file associated with the service account that you created for BOSH/Ops Manager in the Create Service Accounts step of Preparing GCP Before Deploying PKS. Blobstore
  13. For Database Location, select Internal.

  14. (Optional) Modify the Director Workers value, which sets the number of workers available to execute Director tasks. This field defaults to 5.

  15. (Optional) Max Threads sets the maximum number of threads that the BOSH Director can run simultaneously. Pivotal recommends that you leave the field blank to use the default value, unless doing so results in rate limiting or errors on your IaaS.

  16. Leave the Director Hostname field blank.

  17. Ensure the Disable BOSH DNS server for troubleshooting purposes checkbox is not selected.

    WARNING: Do not disable BOSH DNS if you are deploying PKS.

  18. (Optional) To set a custom banner that users see when logging in to the Director using SSH, enter text in the Custom SSH Banner field. Disable bosh dns

  19. Click Save.

Step 4: Create Availability Zones Page

  1. Select Create Availability Zones.
  2. Click Add.
  3. For Google Availability Zone:

    • Enter one of the zones that you associated to the NAT instances. For example, if you are using the us-central1 region and selected us-central1-a as one of the zones for your NAT instances, enter us-central1-a.
    • Click Add.
    • Repeat the above step for all the availability zones that you associated to instances in the Create NAT Instances step of Preparing GCP Before Deploying PKS. Availability zones multiple
    • Click Save.
  4. Repeat the above step for each availability zone you use in your deployment. When you are done, click Save.

Step 5: Create Networks Page

  1. Select Create Networks.
  2. Make sure Enable ICMP checks is not selected. GCP routers do not respond to ICMP pings.
  3. Click Add Network and create the following networks:

    • pks-infrastructure for Ops Manager, the BOSH Director, and NAT instances.
    • pks-main for the PKS control plane. In non-production environments, you can choose to combine pks-infrastructure and pks-main into a single network.
    • pks-services for creating the master and worker VMs for Kubernetes clusters. The CIDR should not conflict with the pod overlay network or the reserved Kubernetes services CIDR of

    Note: Pivotal recommends that you use the Google-provided DNS server,, as your default DNS server. Do not use

    Infrastructure Network Field Configuration
    Name pks-infrastructure
    Google Network Name MY-PKS-virt-net/MY-PKS-subnet-infrastructure-GCP-REGION/GCP-REGION
    Reserved IP Ranges
    Main Network Field Configuration
    Name pks-main
    Google Network Name MY-PKS-virt-net/MY-PKS-subnet-pks-GCP-REGION/GCP-REGION
    Reserved IP Ranges
    Service Network Field Configuration
    Name pks-services
    Google Network Name MY-PKS-virt-net/MY-PKS-subnet-services-GCP-REGION/GCP-REGION
    Reserved IP Ranges

Step 6: Assign AZs and Networks Page

  1. Select Assign AZs and Networks.
  2. Use the drop-down menu to select a Singleton Availability Zone. The BOSH Director installs in this Availability Zone.
  3. Under Network, select the pks-infrastructure network for your BOSH Director.
  4. Click Save.

Step 7: Security Page

  1. Select Security.

    Om security

  2. In Trusted Certificates, enter a custom certificate authority (CA) certificate to insert into your organization’s certificate trust chain. This feature enables all BOSH-deployed components in your deployment to trust a custom root certificate.

    • You do not need to enter anything in this field if you are using self-signed certificates.
    • If you want to use Docker Registries for running app instances in Docker containers, enter the certificate for your private Docker Registry in this field. For more information, see Using Docker Registries.
  3. Choose Generate passwords or Use default BOSH password. Pivotal recommends that you use the Generate passwords option for greater security.

  4. Click Save. To view your saved Director password, click the Credentials tab.

Step 8: Syslog Page

  1. Select Syslog.

    Syslog bosh

  2. (Optional) To send BOSH Director system logs to a remote server, select Yes.

  3. In the Address field, enter the IP address or DNS name for the remote server.

  4. In the Port field, enter the port number that the remote server listens on.

  5. In the Transport Protocol dropdown menu, select TCP, UDP, or RELP. This selection determines which transport protocol is used to send the logs to the remote server.

  6. (Optional) Mark the Enable TLS checkbox to use TLS encryption when sending logs to the remote server.

    • In the Permitted Peer field, enter either the name or SHA1 fingerprint of the remote peer.
    • In the SSL Certificate field, enter the SSL certificate for the remote server.
  7. Click Save.

Step 9: Resource Config Page

  1. Select Resource Config.

  2. Ensure that the Internet Connected checkboxes are not selected for any jobs. This checkbox gives VMs a public IP address that enables outbound Internet access. In Preparing GCP Before Deploying PKS, you provisioned a Network Address Translation (NAT) box to provide Internet connectivity to your VMs. For more information about using NAT in GCP, see Virtual Private Cloud (VPC) Network Overview in the GCP documentation.

Step 10: Complete the Ops Manager Director Installation

  1. Click the Installation Dashboard link to return to the Installation Dashboard.

  2. Click Apply Changes. If the following ICMP error message appears, return to the Network Config screen, and make sure you have deselected the Enable ICMP Checks box. Then click Apply Changes again.

    Install error

  3. Ops Manager Director installs. This may take a few moments. When the installation process successfully completes, the Changes Applied window appears.

    Ops manager complete

Next Steps

After you complete this procedure, follow the instructions in Configuring a GCP Load Balancer for the PKS API.

Please send any feedback you have to

Create a pull request or raise an issue on the source for this page in GitHub