forked from pivotal-cf/docs-pcf-install
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathcloudform-om-config.html.md.erb
247 lines (175 loc) · 15 KB
/
cloudform-om-config.html.md.erb
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
---
title: Configuring Ops Manager Director on AWS
owner: Ops Manager
---
<strong><%= modified_date %></strong>
<html class="list-style-none"></html>
This topic describes how to configure the Ops Manager Director after deploying the CloudFormation template for [Pivotal Cloud Foundry](https://network.pivotal.io/products/pivotal-cf) (PCF) on Amazon
Web Services (AWS).
Use this topic when [Installing Pivotal Cloud Foundry Using AWS CloudFormation](./cloudform.html).
Before beginning this procedure, ensure that you have successfully completed all
steps in the [Deploying the CloudFormation Template for PCF on AWS](./cloudform-template.html) and the [Launching an Ops Manager Director Instance on AWS CloudFormation](./cloudform-om-deploy.html) topics.
After you complete this procedure, follow the instructions in the [Deploying Elastic Runtime on AWS CloudFormation](./cloudform-er-config.html) topic.
<p class="note"><strong>Note</strong>: You can also perform the procedures in this topic using the Ops Manager API. For more information, see the <a href="ops-man-api.html">Using the Ops Manager API</a> topic.</p>
## <a id='outputs'></a>Step 1: Open the Outputs Tab in AWS Stacks ##
<%= partial 'aws_stacks_view_outputs' %>
## <a id='access-om'></a>Step 2: Access Ops Manager ##
<p class="note"><strong>Note</strong>: For security, Ops Manager 1.7 and later require that you log in using a fully qualified domain name.</a></p>
1. In a web browser, navigate to the fully qualified domain you created in the [Create a DNS Entry](./cloudform-om-deploy.html#create-dns) step of [Launching an Ops Manager Director Instance on AWS](./cloudform-om-deploy.html).
1. When Ops Manager starts for the first time, you must choose one of the following:
* [Use an Identity Provider](#idp): If you use an Identity Provider, an external identity server maintains your user database.
* [Internal Authentication](#internal): If you use Internal Authentication, PCF maintains your user database.
<%= image_tag("select-authentication.png") %>
### <a id='idp'></a>Use an Identity Provider (IdP) ###
<%= partial 'using_idp_ops_manager' %>
### <a id='internal'></a>Internal Authentication ###
1. When redirected to the **Internal Authentication** page, you must complete the following steps:
* Enter a **Username**, **Password**, and **Password confirmation** to create an Admin user.
* Enter a **Decryption passphrase** and the **Decryption passphrase confirmation**. This passphrase encrypts the Ops Manager datastore, and is not recoverable if lost.
* If you are using an **HTTP proxy** or **HTTPS proxy**, follow the instructions in the [Configuring Proxy Settings for the BOSH CPI](./pcf-director-proxy-settings.html) topic.
* Read the **End User License Agreement**, and select the checkbox to accept the terms.
* Click **Setup Authentication**.
<%= image_tag("om-login.png") %>
1. Log in to Ops Manager with the Admin username and password that you created in the previous step.
<%= image_tag("cf-login.png") %>
## <a id='aws-config'></a>Step 3: AWS Config Page ##
1. Click the **Ops Manager Director** tile.
<%= image_tag("cloudform/om-tile.png") %>
1. Select **AWS Config** to open the **AWS Management Console Config** page.
<%= image_tag("cloudform/aws-config.png") %>
1. Select **Use AWS Keys** or **Use AWS Instance Profile**.
* If you choose to use AWS keys, complete the fields with information from
the **[Outputs](#outputs)** tab for your stack in the AWS Console:
* **Access Key ID**: Use the value of **PcfIamUserAccessKey**.
* **AWS Secret Key**: Use the value of **PcfIamUserSecretAccessKey**.
* If you choose to use an AWS instance profile, enter the name of your AWS
Identity and Access Management (IAM) profile.
1. Complete the remainder of the **AWS Management Console Config** page with the following information.
* **VPC ID**: Use the value of **PcfVpc** from your **Outputs** tab.
* **Security Group ID**: Open the AWS EC2 Dashboard and click **Security
Groups**. Select the security group with the **Description** `PCF VMs
Security Group`. Copy the **Group ID** of this group into the Ops Manager
**Security Group ID** field.
* **Key Pair Name**: Use the name of your pre-existing AWS key pair.
You selected this key pair name when you first
[deployed Ops Manager Director](cloudform-om-deploy.html#deploy).
* **SSH Private Key**: Open your AWS key pair `.pem` file in a
text editor. Copy the contents of the `.pem` file and paste it into the
**SSH Private Key** field.
* **Region**: Select the region where you deployed Ops Manager.
* **Encrypt EBS Volumes**: Select this checkbox to enable full encryption
on persistent disks of all BOSH-deployed virtual machines (VMs), except
for the Ops Manager VM and Director VM. See the [Configuring Amazon EBS
Encryption for PCF on AWS](cloudform-om-ebs-config.html) topic for
details on using EBS encryption.
1. Click **Save**.
## <a id='director-config'></a>Step 4: Director Config Page ##
1. Select **Director Config** to open the **Director Config** page.
<%= image_tag("images/cloudform/director_aws.png") %>
1. In the **NTP Servers (comma delimited)** field, enter at least two of the
following NTP servers, separated by a comma:
* `0.amazon.pool.ntp.org`
* `1.amazon.pool.ntp.org`
* `2.amazon.pool.ntp.org`
* `3.amazon.pool.ntp.org`
1. (Optional) Enter your **JMX Provider IP Address** if you are [Using JMX Bridge](./../customizing/use-metrics.html).
1. Select the **Enable VM Resurrector Plugin** checkbox to enable the Ops
Manager Resurrector functionality and increase Elastic Runtime availability.
1. Select **Enable Post Deploy Scripts** to run a post-deploy script after deployment. This script allows the job to execute additional commands against a deployment.
1. Select **Recreate all VMs** to force BOSH to recreate all VMs on the next deploy. This process does not destroy any persistent disk data.
1. Select **Enable bosh deploy retries** if you want Ops Manager to retry failed BOSH operations up to five times.
1. Select **Keep Unreachable Director VMs** if you want to preserve Ops Manager Director VMs after a failed deployment for troubleshooting purposes.
1. Select **HM Pager Duty Plugin** to enable Health Monitor integration with PagerDuty.
<%= image_tag("images/director_hm_pager.png") %>
* **Service Key**: Enter your API service key from PagerDuty.
* **HTTP Proxy**: Enter an HTTP proxy for use with PagerDuty.
1. Select **HM Email Plugin** to enable Health Monitor integration with email.
<%= image_tag("images/director_hm_email.png") %>
* **Host**: Enter your email hostname.
* **Port**: Enter your email port number.
* **Domain**: Enter your domain.
* **From**: Enter the address for the sender.
* **Recipients**: Enter comma-separated addresses of intended recipients.
* **Username**: Enter the username for your email server.
* **Password**: Enter the password password for your email server.
* **Enable TLS**: Select this checkbox to enable Transport Layer Security.
1. For **Blobstore Location**, select **S3 Compatible Blobstore** and complete the following steps:
<%= image_tag("images/director_blobstore.png") %>
* In a browser, reference the [**Amazon Simple Storage Service (Amazon S3) table** ](http://docs.aws.amazon.com/general/latest/gr/rande.html#s3_region), and find the region for your AWS account.
* Prepend `https://` to the **Endpoint** for your region, and copy it into
the Ops Manager **S3 Endpoint** field. For example, in the **us-west-2** region, enter `https://s3-us-west-2.amazonaws.com` into the field.
* Complete the following fields with information from the **Outputs** tab in the AWS Console:
* **Bucket Name**: Use the value of **PcfOpsManagerS3Bucket**.
* **Access Key ID**: Use the value of **PcfIamUserAccessKey**.
* **AWS Secret Key**: Use the value of **PcfIamUserSecretAccessKey**.
* Select **V2 Signature** or **V4 Signature**. If you select **V4 Signature**, enter your **Region**.
* *AWS recommends using Signature Version 4 when possible.*
<p class="note"><strong>Note</strong>: For more information about AWS S3 Signatures, see the AWS <a href="http://docs.aws.amazon.com/AmazonS3/latest/API/sig-v4-authenticating-requests.html">Authenticating Requests</a> documentation.</p>
1. For **Database Location**, select **External MySQL Database**. Complete the following fields with information from the **Outputs** tab in the AWS Console.
<%= image_tag("images/director_database.png") %>
* **Host**: Use the value of **PcfRdsAddress**.
* **Port**: Use the value of **PcfRdsPort**.
* **Username**: Use the value of **PcfRdsUsername**.
* **Password**: Use the value of **PcfRdsPassword**.
* **Database**: Use the value of **PcfRdsDBName**.
1. **Max Threads** sets the maximum number of threads that the Ops Manager Director can run simultaneously. Pivotal recommends that you leave the field blank to use the default value, unless doing so results in rate limiting or errors on your IaaS.
1. (Optional) To add a custom URL for your Ops Manager Director, enter a valid hostname in **Director Hostname**. You can also use this field to configure [a load balancer in front of your Ops Manager Director](https://discuss.pivotal.io/hc/en-us/articles/225420588).
1. Click **Save**.
<p class="note"><strong>Note</strong>: For more information about AWS S3 Signatures, see the AWS <a href="http://docs.aws.amazon.com/AmazonS3/latest/API/sig-v4-authenticating-requests.html">Authenticating Requests</a> documentation.</p>
## <a id='az'></a>Step 5: Create Availability Zones Page ##
<p class="note"><b>Note</b>: Pivotal recommends at least three Availability Zones for a highly available installation of Elastic Runtime.</p>
1. Select **Create Availability Zones**.
<%= image_tag("cloudform/create-az.png") %>
1. Use the following steps to create one or more Availability Zones for your applications to use:
* Click **Add**.
* For **Amazon Availability Zone**, enter the value of **PcfPrivateSubnetAvailabilityZone** from the **Outputs** tab in the AWS Console.
* **(Optional)** If you are using a second **Amazon Availability Zone**, click **Add**. Enter the value of **PcfPrivateSubnet2AvailabilityZone** from the **Outputs** tab in the AWS Console.
* Click **Save**.
## <a id='network'></a>Step 6: Create Networks Page ##
1. Select **Create Networks**.
<%= image_tag("cloudform/create-networks.png") %>
1. Select **Enable ICMP checks** to enable ICMP on your networks. Ops Manager uses ICMP checks to confirm that components within your network are reachable.
1. Use the following steps to create one or more Ops Manager networks:
* Click **Add Network**.
* Enter a unique **Name** for the network.
* If you want to dynamically provision VMs in this network for use with on-demand services, select the **Service Networks** checkbox. When the checkbox is selected, Ops Manager does not provision VMs within the specified CIDR range.
* Click **Add Subnet** to create one or more subnets for the network.
<p class="note"><strong>Note</strong>: To use the <a href="http://docs.pivotal.io/p-identity/index.html">Single Sign-On for PCF</a> service, you must configure a network with only one subnet.</p>
* In the **VPC Subnet ID** field, use the value of **PcfPrivateSubnetId** from the **Outputs** tab in the AWS Console.
* For **CIDR**, enter `10.0.16.0/20`. Ops Manager deploy VMs to this CIDR block.
* For **Reserved IP Ranges**, enter `10.0.16.1-10.0.16.9`. Ops Manager avoids deploying VMs to any IP address in this range.
* Enter `10.0.0.2` for **DNS** and `10.0.16.1` for **Gateway**.
* Select which **Availability Zones** to use with the network.
* **(Optional)** If you are using a second subnet, click **Add Subnet**. In the **VPC Subnet ID** field, use the value of **PcfPrivateSubnet2Id**. Enter the rest of the fields using the information provided above.
<p class="note"><strong>Note</strong>: If you are using multiple Availability Zones, you must add a new network with at least one subnet for each Availability Zone.</p>
1. Click **Save**.
1. If the following ICMP error message appears, you can ignore the warning. Dismiss the warning, and move on to the next step.
<%= image_tag("cloudform/config-error.png") %>
## <a id="assign-azs"></a>Step 7: Assign AZs and Networks Page##
1. Select **Assign AZs and Networks**.
<%= image_tag("images/assign-az.png") %>
1. Use the drop-down menu to select a **Singleton Availability Zone**. The Ops Manager Director installs in this Availability Zone.
1. Use the drop-down menu to select a **Network** for your Ops Manager Director.
1. Click **Save**.
## <a id='security'></a>Step 8: Security Page ##
1. Select **Security**.
<%= image_tag("../images/om-security.png") %>
1. In **Trusted Certificates**, enter a custom certificate authority (CA) certificate to insert into your organization's certificate trust chain. This feature enables all BOSH-deployed components in your deployment to trust a custom root certificate. If you want to use Docker Registries for running app instances in Docker containers, use this field to enter your certificate for your private Docker Registry. See the [Using Docker Registries](../opsguide/docker-registry.html) topic for more information.
1. Choose **Generate passwords** or **Use default BOSH password**. Pivotal recommends that you use the **Generate passwords** option for greater security.
1. Click **Save**. To view your saved Director password, click the **Credentials** tab.
## <a id='syslog'></a>Step 9: Syslog Page
<%= partial 'syslog_bosh' %>
## <a id='resource-config'></a>Step 10: Resource Config Page
1. Select **Resource Config**.
<%= image_tag("cloudform/resource-config-new.png") %>
1. Adjust any values as necessary for your deployment. Under the **Instances**, **Persistent Disk Type**, and **VM Type** fields, choose **Automatic** from the drop-down menu to allocate the recommended resources for the job. If the **Persistent Disk Type** field reads **None**, the job does not require persistent disk space.
<p class="note"><strong>Note</strong>: If you set a field to <strong>Automatic</strong> and the recommended resource allocation changes in a future version, Ops Manager automatically uses the updated recommended allocation.</p>
## <a id='complete'></a>Step 11: Complete the Ops Manager Director Installation ##
1. Click the **Installation Dashboard** link to return to the Installation
Dashboard.
1. Click **Apply Changes**. If the following ICMP error message appears, click
**Ignore errors and start the install**.
<%= image_tag("cloudform/install-error.png") %>
1. Ops Manager Director installs. This may take a few moments. When the installation process successfully completes, the **Changes Applied** window appears.
<%= image_tag("cloudform/ops-manager-complete.png") %>
1. After you complete this procedure, follow the instructions in the [Deploying Elastic Runtime on AWS CloudFormation](./cloudform-er-config.html) topic.