forked from pivotal-cf/docs-pcf-install
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathgcp-om-config.html.md.erb
197 lines (136 loc) · 13.6 KB
/
gcp-om-config.html.md.erb
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
---
title: Configuring Ops Manager Director on GCP
owner: Ops Manager
---
<strong><%= modified_date %></strong>
<html class="list-style-none"></html>
This topic describes how to configure the Ops Manager Director for Pivotal Cloud Foundry (PCF) on Google Cloud Platform (GCP).
<p class="note"><strong>Note</strong>: You can also perform the procedures in this topic using the Ops Manager API. For more information, see the <a href="ops-man-api.html">Using the Ops Manager API</a> topic.</p>
## <a id='access-om'></a>Step 1: Access Ops Manager ##
1. In a web browser, navigate to the fully qualified domain name (FQDN) of Ops Manager that you set up in [Launching an Ops Manager Director Instance on GCP](./gcp-om-deploy.html).
<p class="note"><strong>Note</strong>: In order to set up Ops Manager authentication correctly, Pivotal recommends using a Fully Qualified Domain Name (FQDN) to access Ops Manager. Using an ephemeral IP address to access Ops Manager can cause authentication errors upon subsequent access.</p>
1. When Ops Manager starts for the first time, you must choose one of the following:
* [Use an Identity Provider](#idp): If you use an Identity Provider, an external identity server maintains your user database.
* [Internal Authentication](#internal): If you use Internal Authentication, PCF maintains your user database.
<%= image_tag("select-authentication.png") %>
### <a id='idp'></a>Use an Identity Provider (IdP) ###
<%= partial 'using_idp_ops_manager' %>
### <a id='internal'></a>Internal Authentication ###
1. When redirected to the **Internal Authentication** page, you must complete the following steps:
* Enter a **Username**, **Password**, and **Password confirmation** to create an Admin user.
* Enter a **Decryption passphrase** and the **Decryption passphrase confirmation**. This passphrase encrypts the Ops Manager datastore, and is not recoverable if lost.
* If you are using an **HTTP proxy** or **HTTPS proxy**, follow the instructions in the [Configuring Proxy Settings for the BOSH CPI]](./pcf-director-proxy-settings.html) topic.
* Read the **End User License Agreement**, and select the checkbox to accept the terms.
* Click **Setup Authentication**.
<%= image_tag("om-login.png") %>
1. Log in to Ops Manager with the Admin username and password that you created in the previous step.
<%= image_tag("cf-login.png") %>
## <a id='gcp-config'></a>Step 2: Google Cloud Platform Config ##
1. Click the **Google Cloud Platform** tile within the **Installation Dashboard**.
<%= image_tag("gcp/gcp-om-config.png") %>
1. Select **Google Config**. Complete the following fields:
* **Project ID**: Enter your GCP project ID in all lower case, such as: <code>your-gcp-project-id</code>.
* **Default Deployment Tag**: Enter `pcf-vms`.
* Select an authentication mechanism for the Ops Manager VM:
* **The Ops Manager VM Service Account**: Select this option to use the service account automatically created by GCP for the Ops Manager VM.
<p class="note">To use this option, the project-wide service account that you set up in [Set up an IAM Service Account](./gcp-prepare-env.html#iam_account) must be assigned the **Service Account Actor** role.</p>
* **AuthJSON**: As an alternative, select this option, and in the field below enter the contents of the JSON file that you downloaded in the [Set up an IAM Service Account](./gcp-prepare-env.html#iam_account) section of the _Preparing to Deploy PCF on GCP_ topic.
<%= image_tag("gcp/google_config.png") %>
1. Click **Save**.
## <a id='director-config'></a>Step 3: Director Config Page ##
1. Select **Director Config** to open the **Director Config** page.
<%= image_tag("gcp/director_gcp.png") %>
1. In the **NTP Servers (comma delimited)** field, enter `metadata.google.internal`.
<p class="note"><strong>Note</strong>: To resolve <code>metadata.google.internal</code> as the NTP server hostname, you must provide the two IP addresses for DNS configuration as described in <a href="#network">Step 5: Create Networks Page</a> of this procedure.</p>
1. (Optional) If you are using [JMX Bridge](./../customizing/use-metrics.html), enter your **JMX Provider IP Address**.
1. Select the **Enable VM Resurrector Plugin** checkbox to enable the Ops
Manager Resurrector functionality and increase Elastic Runtime availability.
1. Select **Enable Post Deploy Scripts** to run a post-deploy script after deployment. This script allows the job to execute additional commands against a deployment.
1. Select **Recreate all VMs** to force BOSH to recreate all VMs on the next deploy. This process does not destroy any persistent disk data.
1. Select **Enable bosh deploy retries** if you want Ops Manager to retry failed BOSH operations up to five times.
1. Select **Keep Unreachable Director VMs** if you want to preserve Ops Manager Director VMs after a failed deployment for troubleshooting purposes.
1. (Optional) Select **HM Pager Duty Plugin** to enable Health Monitor integration with PagerDuty.
<%= image_tag("images/director_hm_pager.png") %>
* **Service Key**: Enter your API service key from PagerDuty.
* **HTTP Proxy**: Enter an HTTP proxy for use with PagerDuty.
1. (Optional) Select **HM Email Plugin** to enable Health Monitor integration with email.
<%= image_tag("images/director_hm_email.png") %>
* **Host**: Enter your email hostname.
* **Port**: Enter your email port number.
* **Domain**: Enter your domain.
* **From**: Enter the address for the sender.
* **Recipients**: Enter comma-separated addresses of intended recipients.
* **Username**: Enter the username for your email server.
* **Password**: Enter the password password for your email server.
* **Enable TLS**: Select this checkbox to enable Transport Layer Security.
1. For **Blobstore Location**, select **Internal**.
1. For **Database Location**, select **Internal**.
1. **Max Threads** sets the maximum number of threads that the Ops Manager Director can run simultaneously. Pivotal recommends that you leave the field blank to use the default value, unless doing so results in rate limiting or errors on your IaaS.
1. (Optional) To add a custom URL for your Ops Manager Director, enter a valid hostname in **Director Hostname**. You can also use this field to configure [a load balancer in front of your Ops Manager Director](https://discuss.pivotal.io/hc/en-us/articles/225420588).
1. Click **Save**.
## <a id='az'></a>Step 4: Create Availability Zones Page ##
<p class="note"><b>Note</b>: Pivotal recommends at least three availability zones for a highly available installation of Elastic Runtime. For an example of a three availability zone deployment, see <a href="../refarch/gcp/gcp_ref_arch.html">Reference Architecture for Pivotal Cloud Foundry on GCP</a>.</p>
1. Select **Create Availability Zones**.
1. Click **Add**.
1. For a single availability zone deployment, in **Google Availability Zone**:
* Enter the zone you associated to the backend service instance group of the HTTP(S) Load Balancer. For example, if you are using the `us-central1` region and selected `us-central1-a` as the zone for your HTTP(S) Load Balancer instance group, enter `us-central1-a`.
<%= image_tag("gcp/availability_zones.png") %>
* Click **Save**.
1. For a multiple availability zone deployment, in **Google Availability Zone**:
* Enter one of the zones that you associated to the backend service instance groups of the HTTP(S) Load Balancer. For example, if you are using the `us-central1` region and selected `us-central1-a` as one of the zones for your HTTP(S) Load Balancer instance groups, enter `us-central1-a`.
* Click **Add**
* Repeat the above step for all the availability zones that you associated to instance groups in [Preparing to Deploy PCF on GCP](./gcp-prepare-env.html#create-http-and-instance-group).
<%= image_tag("gcp/availability_zones_multiple.png") %>
* Click **Save**.
1. Repeat the above step for all the availability zones you are using in your deployment. When you are done, click **Save**.
## <a id='network'></a>Step 5: Create Networks Page ##
1. Select **Create Networks**.
1. Make sure **Enable ICMP checks** is not selected. GCP routers do not respond to ICMP pings.
1. Use the following steps to create one or more Ops Manager networks:
* Click **Add Network**.
* Enter a unique **Name** for the network.
* If you want to dynamically provision VMs in this network for use with on-demand services, select the **Service Networks** checkbox. When the checkbox is selected, Ops Manager does not provision VMs within the specified **CIDR** range.
<p class="note"><strong>Note</strong>: Do not select the **Services Networks** checkbox when configuring Ops Manager for the first time. If selected, the network may not appear as a drop-down option in the [**Assign AZ and Networks Page**](#assign-azs).</p>
* Under **Subnets**, complete the following fields:
* **Google Network Name**: Enter the network, subnet and region names of the Google Network you created in [Preparing to Deploy PCF on GCP](./gcp-prepare-env.html#create_network). The format is `NETWORK-NAME/SUBNET-NAME/REGION-NAME`. For example, `opsmgr/central/us-central1`.
* **CIDR**: Enter `10.0.0.0/20`. Ops Manager deploy VMs to this CIDR block.
* **Reserved IP Ranges**: Enter `10.0.0.1-10.0.0.9`. Ops Manager avoids deploying VMs to any IP address in this range.
* **DNS**: Enter `169.254.169.254, 8.8.8.8`.
<p class="note"><strong>Note</strong>: The `169.254.169.254` address points to the [metadata server](https://cloud.google.com/compute/docs/storing-retrieving-metadata) that hosts metadata for GCP instances. The `8.8.8.8` corresponds to Google's public DNS server. Using both addresses provides PCF with the ability to reach external DNS from app containers, but also keeps NTP working in the event that a VM does not have access to the Internet.</p>
* **Gateway**: Enter `10.0.0.1`.
* **Availability Zones**: Select the availability zone for the subnet. If you created multiple availability zones, select all listed availability zones.
* If you want to add more subnets, click **Add Subnet**.
<%= image_tag("gcp/create-networks.png") %>
1. Click **Save**.
## <a id="assign-azs"></a>Step 6: Assign AZs and Networks Page##
1. Select **Assign AZs and Networks**.
<%= image_tag("gcp/assign_azs.png") %>
1. Use the drop-down menu to select a **Singleton Availability Zone**. The Ops Manager Director installs in this Availability Zone.
1. Use the drop-down menu to select a **Network** for your Ops Manager Director.
1. Click **Save**.
## <a id='security'></a>Step 7: Security Page ##
1. Select **Security**.
<%= image_tag("../images/om-security.png") %>
1. In **Trusted Certificates**, enter a custom certificate authority (CA) certificate to insert into your organization's certificate trust chain. This feature enables all BOSH-deployed components in your deployment to trust a custom root certificate.
* You do not need to enter anything in this field if you are using self-signed certificates.
* If you want to use Docker Registries for running app instances in Docker containers, enter the certificate for your private Docker Registry in this field. See the [Using Docker Registries](../opsguide/docker-registry.html) topic for more information.
1. Choose **Generate passwords** or **Use default BOSH password**. Pivotal recommends that you use the **Generate passwords** option for greater security.
1. Click **Save**. To view your saved Director password, click the **Credentials** tab.
## <a id='syslog'></a>Step 8: Syslog Page
<%= partial 'syslog_bosh' %>
## <a id='resource-config'></a>Step 9: Resource Config Page
1. Select **Resource Config**.
<%= image_tag("gcp/om_resource_config.png") %>
1. Ensure that the **Internet Connected** checkboxes are selected for all jobs. This gives all VMs a public IP address that enables outbound Internet access.
<p class="note"><strong>Note</strong>: If you want to provision a Network Address Translation (NAT) box to provide Internet connectivity to your VMs instead of providing them with public IP addresses, deselect the <strong>Internet Connected</strong> checkboxes. For more information about using NAT in GCP, see the <a href="https://cloud.google.com/compute/docs/networking">GCP documentation</a>.</p>
1. Adjust any values as necessary for your deployment. Under the **Instances**, **Persistent Disk Type**, and **VM Type** fields, choose **Automatic** from the drop-down menu to allocate the recommended resources for the job. If the **Persistent Disk Type** field reads **None**, the job does not require persistent disk space.
<p class="note"><strong>Note</strong>: If you set a field to <strong>Automatic</strong> and the recommended resource allocation changes in a future version, Ops Manager automatically uses the updated recommended allocation.</p>
## <a id='complete'></a>Step 10: Complete the Ops Manager Director Installation ##
1. Click the **Installation Dashboard** link to return to the Installation
Dashboard.
1. Click **Apply Changes**. If the following ICMP error message appears, return to the [**Network Config** screen](#network), and make sure you have deselected the **Enable ICMP Checks** box. Then click **Apply Changes** again.
<%= image_tag("cloudform/install-error.png") %>
1. Ops Manager Director installs. This may take a few moments. When the installation process successfully completes, the **Changes Applied** window appears.
<%= image_tag("cloudform/ops-manager-complete.png") %>
### <a id="next"></a> What to Do Next ###
After you complete this procedure, follow the instructions in the [Deploying Elastic Runtime on GCP](./gcp-er-config.html) topic.