LATEST VERSION: v1.2 - RELEASE NOTES
Pivotal Container Service v1.2

Configuring Ops Manager on AWS

Page last updated:

This topic describes how to configure Ops Manager to deploy the BOSH Director for Pivotal Container Service (PKS) on Amazon Web Services (AWS).

Note: You can also perform the procedures in this topic using the Ops Manager API. For more information, see the Using the Ops Manager API topic.

Prerequisites

To complete the procedures in this topic, you must have access to the output from when you ran terraform apply to create resources for this deployment in Deploying Ops Manager on AWS. You can view this output at any time by running terraform output. You use the values in your Terraform output to configure the BOSH Director tile.

In addition to the Terraform output, ensure you have the following:

  • The Terraform CLI
  • In your AWS project, ensure you have an IAM user with the following permissions:
    • AmazonEC2FullAccess
    • AmazonRDSFullAccess
    • AmazonRoute53FullAccess
    • AmazonS3FullAccess
    • AmazonVPCFullAccess
    • IAMFullAccess

Step 1: Access Ops Manager

Note: If you have Pivotal Application Service (PAS) installed, we strongly recommend installing PKS on a separate instance of Ops Manager for security reasons.

  1. In a web browser, navigate to the fully qualified domain name (FQDN) of Ops Manager. Use the ops_manager_dns value from running terraform output.

  2. When Ops Manager starts for the first time, you must choose one of the following:

    Select authentication

Use an Identity Provider (IdP)

  1. Log in to your IdP console and download the IdP metadata XML. Optionally, if your IdP supports metadata URL, you can copy the metadata URL instead of the XML.

  2. Copy the IdP metadata XML or URL to the Ops Manager Use an Identity Provider log in page. Meta om

    Note: The same IdP metadata URL or XML is applied for the BOSH Director. If you use a separate IdP for BOSH, copy the metadata XML or URL from that IdP and enter it into the BOSH IdP Metadata text box in the Ops Manager login page.

  3. Enter your Decryption passphrase. Read the End User License Agreement, and select the checkbox to accept the terms.

  4. Your Ops Manager login page appears. Enter your username and password. Click Login.

  5. Download your SAML Service Provider metadata (SAML Relying Party metadata) by navigating to the following URLs:

    • 5a. Ops Manager SAML service provider metadata: https://OPS-MAN-FQDN:443/uaa/saml/metadata
    • 5b. BOSH Director SAML service provider metadata: https://BOSH-IP-ADDRESS:8443/saml/metadata

    Note: To retrieve your BOSH-IP-ADDRESS, navigate to the BOSH Director tile > Status tab. Record the BOSH Director IP address.

  6. Configure your IdP with your SAML Service Provider metadata. Import the Ops Manager SAML provider metadata from Step 5a above to your IdP. If your IdP does not support importing, provide the values below.

    • Single sign on URL: https://OPS-MAN-FQDN:443/uaa/saml/SSO/alias/OPS-MAN-FQDN
    • Audience URI (SP Entity ID): https://OP-MAN-FQDN:443/uaa
    • Name ID: Email Address
    • SAML authentication requests are always signed
  7. Import the BOSH Director SAML provider metadata from Step 5b to your IdP. If the IdP does not support an import, provide the values below.

    • Single sign on URL: https://BOSH-IP:8443/saml/SSO/alias/BOSH-IP
    • Audience URI (SP Entity ID): https://BOSH-IP:8443
    • Name ID: Email Address
    • SAML authentication requests are always signed
  8. Return to the BOSH Director tile and continue with the configuration steps below.

Note: For an example of how to configure SAML integration between Ops Manager and your IdP, see the Configuring Active Directory Federation Services as an Identity Provider topic.

Internal Authentication

  1. When redirected to the Internal Authentication page, you must complete the following steps:

    • Enter a Username, Password, and Password confirmation to create an Admin user.
    • Enter a Decryption passphrase and the Decryption passphrase confirmation. This passphrase encrypts the Ops Manager datastore, and is not recoverable if lost.
    • If you are using an HTTP proxy or HTTPS proxy, follow the instructions in the Configuring Proxy Settings for the BOSH CPI topic.
    • Read the End User License Agreement, and select the checkbox to accept the terms.
    • Click Setup Authentication.

    Om login

  2. Log in to Ops Manager with the Admin username and password that you created in the previous step.

    Cf login

Step 2: AWS Config Page

  1. Click the BOSH Director tile.

    Om tile

  2. Select AWS Config to open the AWS Management Console Config page.

    Aws config

  3. Select Use AWS Keys or Use AWS Instance Profile.

    • If you choose to use AWS keys, complete the following fields:
      • Access Key ID: Enter the value of iam_user_access_key from the Terraform output.
      • AWS Secret Key: Enter the value of iam_user_secret_key from the Terraform output.
    • If you choose to use an AWS instance profile, enter the name of your AWS Identity and Access Management (IAM) profile.
  4. Complete the remainder of the AWS Management Console Config page with the following information.

    • VPC ID: Enter the value of vpc_id from the Terraform output.
    • Security Group ID: Enter the value of vms_security_group_id from the Terraform output.
    • Key Pair Name: Enter the value of ops_manager_ssh_public_key_name from the Terraform output.
    • SSH Private Key: Run terraform output to view the value of ops_manager_ssh_private_key and enter it into this field. ops_manager_ssh_private_key is a sensitive value and does not display when you run terraform apply.
    • Region: Select the region where you deployed Ops Manager.
    • Encrypt Linux EBS Volumes: Select this checkbox to enable full encryption on persistent disks of all BOSH-deployed virtual machines (VMs), except for the Ops Manager VM and BOSH Director VM. See the Configuring Amazon EBS Encryption topic for details about using Elastic Block Store (EBS) encryption.
    • Custom Encryption Key (Optional) Once you enable EBS encryption, you may want to specify a custom Key Management Service (KMS) encryption key. If you don’t enter a value, your custom encryption key will default to the account key. For more information, see Configuring Amazon EBS Encryption.
  5. Click Save.

Step 3: Director Config Page

  1. Select Director Config to open the Director Config page.

    Director aws

  2. Enter at least two of the following NTP servers in the NTP Servers (comma delimited) field, separated by a comma: 0.amazon.pool.ntp.org,1.amazon.pool.ntp.org,2.amazon.pool.ntp.org,3.amazon.pool.ntp.org

  3. Leave the JMX Provider IP Address field blank.

  4. Leave the Bosh HM Forwarder IP Address field blank.

  5. Select the Enable VM Resurrector Plugin checkbox to enable the Ops Manager Resurrector functionality.

  6. Select Enable Post Deploy Scripts to run a post-deploy script after deployment. This script allows the job to execute additional commands against a deployment.

    Note: You must enable post-deploy scripts to install PKS.

  7. Select Recreate all VMs to force BOSH to recreate all VMs on the next deploy. This process does not destroy any persistent disk data.

  8. Select Enable bosh deploy retries if you want Ops Manager to retry failed BOSH operations up to five times.

  9. Select Keep Unreachable Director VMs if you want to preserve BOSH Director VMs after a failed deployment for troubleshooting purposes.

  10. Select HM Pager Duty Plugin to enable Health Monitor integration with PagerDuty.

    Director hm pager

    • Service Key: Enter your API service key from PagerDuty.
    • HTTP Proxy: Enter an HTTP proxy for use with PagerDuty.
  11. Select HM Email Plugin to enable Health Monitor integration with email.

    Director hm email

    • Host: Enter your email hostname.
    • Port: Enter your email port number.
    • Domain: Enter your domain.
    • From: Enter the address for the sender.
    • Recipients: Enter comma-separated addresses of intended recipients.
    • Username: Enter the username for your email server.
    • Password: Enter the password for your email server.
    • Enable TLS: Select this checkbox to enable Transport Layer Security.
  12. For Blobstore Location, select S3 Compatible Blobstore and complete the following steps: Director blobstore

    1. In a browser, reference the Amazon Simple Storage Service (Amazon S3) table, and find the region for your AWS account.
    2. Prepend https:// to the Endpoint for your region, and copy it into the Ops Manager S3 Endpoint field. For example, in the us-west-2 region, enter https://s3-us-west-2.amazonaws.com into the field.
    3. Complete the following fields:
      • Bucket Name: Enter the value of ops_manager_bucket from the Terraform output.
      • Access Key ID: Enter the value of iam_user_access_key from the Terraform output.
      • AWS Secret Key: Enter the value of iam_user_secret_key from the Terraform output.
    4. Select V2 Signature or V4 Signature. If you select V4 Signature, enter your Region.

      Note: AWS recommends using Signature Version 4 when possible. See Authenticating Requests in the AWS documentation.

  13. For Database Location, if you choose to configure an external MySQL database with Amazon Relational Database Service (RDS) or another service, select External MySQL Database and complete the fields below. Otherwise, select Internal. For more information about creating a RDS MySQL instance, see Creating a MySQL DB Instance in the AWS documentation.

    • Host: Enter the value of your host.
    • Port: Enter your port number. For example, 3306.
    • Username: Enter your username.
    • Password: Enter your password.
    • Database: Enter your database name.
  14. (Optional) Director Workers sets the number of workers available to execute Director tasks. This field defaults to 5.

  15. (Optional) Max Threads sets the maximum number of threads that the BOSH Director can run simultaneously. Pivotal recommends that you leave the field blank to use the default value, unless doing so results in rate limiting or errors on your IaaS.

  16. (Optional) To add a custom URL for your BOSH Director, enter a valid hostname in Director Hostname. You can also use this field to configure a load balancer in front of your BOSH Director. For more information, see How to Set Up a Load Balancer in Front of Operations Manager Director in the Pivotal Knowledge Base.

  17. (Optional) Enter your list of comma-separated Excluded Recursors to declare which IP addresses and ports should not be used by the DNS server.

  18. If you use Ops Manager v2.2, ensure the Disable BOSH DNS server for troubleshooting purposes checkbox is not selected.

    WARNING: Do not disable BOSH DNS if you are deploying PKS.

  19. (Optional) To set a custom banner that users see when logging in to the Director using SSH, enter text in the Custom SSH Banner field. Disable bosh dns

  20. Click Save.

Step 4: Create Availability Zones Page

  1. Select Create Availability Zones.

    Create az

  2. Use the following steps to create three Availability Zones for your apps to use:

    1. Click Add three times.
    2. For Amazon Availability Zone, enter the values corresponding to the key management_subnet_availability_zones from the Terraform output.
    3. Click Save.

Step 5: Create Networks Page

  1. Select Create Networks. Create networks

  2. (Optional) Select Enable ICMP checks to enable ICMP on your networks. The BOSH Director uses ICMP checks to confirm that components within your network are reachable.

  3. Perform the following steps to add the network configuration you created for your VPC:

    1. Click Add Network.
    2. For Name, enter pcf-management-network.
    3. For each availability zone, click Add Subnet and use the information in the following table to create three subnets.
      First Subnet Field Configuration
      VPC Subnet ID The first value of management_subnet_ids from the Terraform output.
      CIDR 10.0.16.0/28
      Reserved IP Ranges 10.0.16.0-10.0.16.4
      DNS 10.0.0.2
      Gateway 10.0.16.1
      Availability Zones The first value of management_subnet_availability_zones from the Terraform output.
      Second Subnet Field Configuration
      VPC Subnet ID The second value of management_subnet_ids from the Terraform output.
      CIDR 10.0.16.16/28
      Reserved IP Ranges 10.0.16.16-10.0.16.20
      DNS 10.0.0.2
      Gateway 10.0.16.17
      Availability Zones The second value of management_subnet_availability_zones from the Terraform output.
      Third Subnet Field Configuration
      VPC Subnet ID The third value of management_subnet_ids from the Terraform output.
      CIDR 10.0.16.32/28
      Reserved IP Ranges 10.0.16.32-10.0.16.36
      DNS 10.0.0.2*
      Gateway 10.0.16.33
      Availability Zones The third value of management_subnet_availability_zones from the Terraform output.

      * If you set a VPC CIDR other than the ones recommended above, enter the second IP address in your VPC CIDR. For example, for a 10.0.0.0/24 VPC CIDR, enter 10.0.0.2 in each subnet.


    4. Click Add Network.
    5. For Name, enter pcf-pas-network.
    6. For each availability zone, click Add Subnet and use the information in the following table to create three subnets.
      First Subnet Field Configuration
      VPC Subnet ID The first value of pas_subnet_ids from the Terraform output.
      CIDR 10.0.4.0/24
      Reserved IP Ranges 10.0.4.0-10.0.4.4
      DNS 10.0.0.2
      Gateway 10.0.4.1
      Availability Zones The first value of pas_subnet_availability_zones from the Terraform output.
      Second Subnet Field Configuration
      VPC Subnet ID The second value of pas_subnet_ids from the Terraform output.
      CIDR 10.0.5.0/24
      Reserved IP Ranges 10.0.5.0-10.0.5.4
      DNS 10.0.0.2
      Gateway 10.0.5.1
      Availability Zones The second value of pas_subnet_availability_zones from the Terraform output.
      Third Subnet Field Configuration
      VPC Subnet ID The third value of pas_subnet_ids from the Terraform output.
      CIDR 10.0.6.0/24
      Reserved IP Ranges 10.0.6.0-10.0.6.4
      DNS 10.0.0.2*
      Gateway 10.0.6.1
      Availability Zones The third value of pas_subnet_availability_zones from the Terraform output.

      * If you set a VPC CIDR other than the ones recommended above, enter the second IP address in your VPC CIDR. For example, for a 10.0.0.0/24 VPC CIDR, enter 10.0.0.2 in each subnet.


    7. Click Add Network.
    8. For Name, enter pcf-services-network.
    9. For each availability zone, click Add Subnet and use the information in the following table to create three subnets.
      First Subnet Field Configuration
      VPC Subnet ID The first value of services_subnet_ids from the Terraform output.
      CIDR 10.0.8.0/24
      Reserved IP Ranges 10.0.8.0-10.0.8.3
      DNS 10.0.0.2
      Gateway 10.0.8.1
      Availability Zones The first value of services_subnet_availability_zones from the Terraform output.
      Second Subnet Field Configuration
      VPC Subnet ID The second value of services_subnet_ids from the Terraform output.
      CIDR 10.0.9.0/24
      Reserved IP Ranges 10.0.9.0-10.0.9.3
      DNS 10.0.0.2
      Gateway 10.0.9.1
      Availability Zones The second value of services_subnet_availability_zones from the Terraform output.
      Third Subnet Field Configuration
      VPC Subnet ID The third value of services_subnet_ids from the Terraform output.
      CIDR 10.0.10.0/24
      Reserved IP Ranges 10.0.10.0-10.0.10.3
      DNS 10.0.0.2*
      Gateway 10.0.10.1
      Availability Zones The third value of services_subnet_availability_zones from the Terraform output.

      * If you set a VPC CIDR other than the ones recommended above, enter the second IP address in your VPC CIDR. For example, for a 10.0.0.0/24 VPC CIDR, enter 10.0.0.2 in each subnet.

  4. Click Save.

Step 6: Assign AZs and Networks Page

  1. Select Assign AZs and Networks.

  2. Use the drop-down menu to select a Singleton Availability Zone. The BOSH Director installs in this Availability Zone.

  3. Use the drop-down menu to select pcf-management-network for your BOSH Director.

  4. Click Save.

Step 7: Security Page

  1. Select Security.

    Om security

  2. In Trusted Certificates, enter your custom certificate authority (CA) certificates to insert into your organization’s certificate trust chain. This feature enables all BOSH-deployed components in your deployment to trust custom root certificates.

    Note: If you want to use Docker Registries for running app instances in Docker containers, enter the certificate for your private Docker Registry in this field. See Using Docker Registries in the Pivotal Cloud Foundry documentation for more information.

  3. Choose Generate passwords or Use default BOSH password. Pivotal recommends that you use the Generate passwords option for greater security.

  4. Click Save. To view your saved Director password, click the Credentials tab.

Step 8: Syslog Page

  1. Select Syslog. Syslog bosh

  2. (Optional) To send BOSH Director system logs to a remote server, select Yes.

  3. In the Address field, enter the IP address or DNS name for the remote server.

  4. In the Port field, enter the port number that the remote server listens on.

  5. In the Transport Protocol dropdown menu, select TCP, UDP, or RELP. This selection determines which transport protocol is used to send the logs to the remote server.

  6. (Optional) Pivotal strongly recommends that you enable TLS encryption when forwarding logs as they may contain sensitive information. For example, these logs may contain cloud provider credentials. To enable TLS, perform the following steps.

    • In the Permitted Peer field, enter either the name or SHA1 fingerprint of the remote peer.
    • In the SSL Certificate field, enter the SSL certificate for the remote server.
  7. Click Save.

Step 9: Resource Config Page

  1. Select Resource Config.

    Resource config aws

  2. Adjust any values as necessary for your deployment. Under the Instances, Persistent Disk Type, and VM Type fields, choose Automatic from the drop-down menu to allocate the recommended resources for the job. If the Persistent Disk Type field reads None, the job does not require persistent disk space.

    Note: If you set a field to Automatic and the recommended resource allocation changes in a future version, the BOSH Director automatically uses the updated recommended allocation.

Step 10: Complete the Ops Manager Installation

Follow the steps below to complete the Ops Manager installation:

  1. Return to the Ops Manager Installation Dashboard.
  2. Click Review Pending Changes. Select the product that you intend to deploy and review the changes. For more information, see Reviewing Pending Product Changes.

    Note: In Ops Manager v2.2, the Review Pending Changes page is a Beta feature. If you deploy PKS to Ops Manager v2.2, you can skip this step.

  3. Click Apply Changes.

If the following ICMP error message appears, click Ignore errors and start the install and start the installation.

Install error

Ops Manager installs. This may take a few moments. When the installation process successfully completes, the Changes Applied window appears.

Ops manager complete

Next Steps

After you complete this procedure, follow the instructions in Preparing AWS Before Deploying PKS.


Please send any feedback you have to pks-feedback@pivotal.io.

Create a pull request or raise an issue on the source for this page in GitHub