This topic describes how to configure the BOSH Director tile within VMware Tanzu Operations Manager (Ops Manager) on Azure after Deploying Ops Manager on Azure.
See the following sections to prepare for configuring BOSH Director on Azure.
Before you perform the procedures in this topic, you must have completed the procedures in the following topics:
Note: You can also perform the procedures in this topic using the Ops Manager API. For more information, see Using the Ops Manager API.
If you use Azure Government Cloud, you must set custom VM types for a successful deployment. You can set custom VM types with the Ops Manager API. For more information, see Using the Ops Manager API.
Example curl command to set a VM types:
$ curl -k https://YOUR-OPS-MAN-FQDN/api/v0/vm_types -X
PUT -H "Authorization: bearer UAA-ACCESS-TOKEN"
"Content-Type: application/json" -d '{"vm_types":[
{"name": "Standard_D1_v2", "ram": 3584, "cpu": 1, "ephemeral_disk": 51200 },
{"name": "Standard_D2_v2", "ram": 7168, "cpu": 2, "ephemeral_disk": 102400 },
{"name": "Standard_D3_v2", "ram": 14336, "cpu": 4, "ephemeral_disk": 204800 },
{"name": "Standard_D4_v2", "ram": 28672, "cpu": 8, "ephemeral_disk": 409600 },
{"name": "Standard_D5_v2", "ram": 57344, "cpu": 8, "ephemeral_disk": 819200 },
{"name": "Standard_D11_v2", "ram": 14336, "cpu": 2, "ephemeral_disk": 102400 },
{"name": "Standard_D12_v2", "ram": 28672, "cpu": 4, "ephemeral_disk": 204800 },
{"name": "Standard_D13_v2", "ram": 57344, "cpu": 8, "ephemeral_disk": 409600 },
{"name": "Standard_D14_v2", "ram": 114688, "cpu": 16, "ephemeral_disk": 819200 },
{"name": "Standard_F1", "ram": 2048, "cpu": 1, "ephemeral_disk": 16384 },
{"name": "Standard_F2", "ram": 4096, "cpu": 2, "ephemeral_disk": 32768 },
{"name": "Standard_F4", "ram": 8192, "cpu": 4, "ephemeral_disk": 65536 },
{"name": "Standard_F8", "ram": 16384, "cpu": 8, "ephemeral_disk": 131072}]}'
To verify that you have successfully set your custom VM types, use the GET /api/v0/vm_types Ops Manager API endpoint.
You can use Generation 2 Azure VM types as the default VM type. For more information, see the Ops Manager v2.10.3 Release Notes.
The following table shows the mapping between Generation 1 and Generation 2 Azure VM types:
| Generation 1 VM Type | Generation 2 VM Type |
|---|---|
| Standard_DS1_v2 | Standard_B2s |
| Standard_DS2_v2 | Standard_D2s_v3 |
| Standard_DS3_v2 | Standard_D4s_v3 |
| Standard_DS4_v2 | Standard_D8s_v3 |
| Standard_DS5_v2 | Standard_D16s_v3 |
| Standard_D32s_v3 | |
| Standard_D48s_v3 | |
| Standard_D64s_v3 | |
| Standard_DS11_v2 | Standard_E2s_v3 |
| Standard_DS12_v2 | Standard_E4s_v3 |
| Standard_DS13_v2 | Standard_E8s_v3 |
| Standard_DS14_v2 | Standard_E16s_v3 |
| Standard_E20s_v3 | |
| Standard_E32s_v3 | |
| Standard_E48s_v3 | |
| Standard_E64s_v3 | |
| Standard_F1s | Standard_B1ms |
| Standard_F2s | Standard_F2s_v2 |
| Standard_F4s | Standard_F4s_v2 |
| Standard_F8s | Standard_F8s_v2 |
| Standard_F16s_v2 | |
| Standard_F32s_v2 | |
| Standard_F48s_v2 | |
| Standard_F64s_v2 |
In a web browser, navigate to the fully qualified domain name (FQDN) of Ops Manager that you created in Deploying Ops Manager on Azure.
Log into Ops Manager. To log in, see Log In to Ops Manager For the First Time.
Click the BOSH Director tile.
Select Azure Config.
Complete the following fields with information you obtained in Preparing to Deploy Ops Manager on Azure.
TENANT_ID.APPLICATION_ID that you created in the Create an AAD Application step of Preparing to Deploy Ops Manager on Azure.CLIENT_SECRET.Complete the following fields:
$RESOURCE_GROUP environment variable.$STORAGE_NAME environment variable.For Cloud Storage Type, select one of the following options based on your Azure VM storage settings.
Use Managed Disks: Select this option if you use Azure Managed Disks. For more information, see Azure Managed Disks Overview in the Microsoft documention. For Storage Account Type, select the storage option that corresponds with your Azure subscription. Select Standard_LRS for HDD-based storage or Premium_LRS for SSD-based storage.
Use Storage Accounts: Select this option if you use storage accounts to store your Azure VMs. Enter the base storage name that you used to create your deployment storage accounts, prepended and appended with the wildcard character *. For example, if you created accounts named xyzdeploymentstorage1, xyzdeploymentstorage2, and xyzdeploymentstorage3, enter *deploymentstorage*. Ops Manager requires that you specify an asterisk at both the beginning and the end of the base storage account name.
Caution: You can update your deployment from using storage accounts to using managed disks. However, after you select Use Managed Disks and deploy Ops Manager, you cannot change your deployment back to use storage accounts.
(Optional) Enter your Default Security Group. For more information about Network Security Groups, see Filter network traffic with network security groups in Microsoft Azure’s documentation.
Note: The Azure portal sometimes displays the names of resources with incorrect capitalization. Always use the Azure CLI to retrieve the correctly capitalized name of a resource.
For SSH Public Key, copy and paste the contents of your public key in the opsman.pub file. You created this file in Deploying Ops Manager on Azure.
For SSH Private Key, copy and paste the contents of your private key in the opsman file.
For VM Type Catalog, Select the VM Catalog that you want to use for your BOSH Managed VMs.
For Availability Mode, choose whether to use Availability Sets or Availability Zones. You can further configure this option in the Assign AZs and Networks pane. For more information, see Assign AZs and Networks.
Note: You can only choose between Availability Zones and Availability Sets in a staged BOSH Director tile that has not yet deployed. After you click Apply Changes and the BOSH Director deploys successfully, you cannot switch between Availability Zones and Availability Sets.
For Azure Environment, select the Azure cloud you want to use. VMware recommends Azure Commercial Cloud for most Azure environments.
Note: If you selected Azure Stack or Azure Government Cloud as your Azure environment, you must configure custom VM types. For more information, see Prerequisites for Azure Stack or Azure Government Cloud in Configuring BOSH Director on Azure.
Note: To deploy Ops Manager on Azure using Active Directory Federation Services (ADFS) refer to IaaS-Specific Global CPI Properties Are Configurable From the API.
(Optional) If you selected Azure Stack for your Azure Environment, complete the following Azure Stack-only fields:
local.azurestack.external.AzureAD for Authentication. If you want to use Azure China Cloud Active Directory for your authentication type, enter AzureChinaCloudAD.management.Click Save.
To configure the Director Config pane:
Select Director Config.
Enter any valid value for NTP Servers (comma delimited). A value is required but is ignored. For example, you can enter us.pool.ntp.org. By default, Azure VMs use a Precision Time Protocol (PTP) clock source. For more information, see Time sync for Linux VMs in Azure in the Azure documentation.
Leave the Bosh HM Forwarder IP Address field blank.
Note: Starting in Pivotal Application Service (PAS) v2.0, BOSH-reported component metrics are available in Loggregator Firehose by default. If you continue to use the BOSH HM Forwarder to consume these component metrics, you might receive duplicate data. To prevent this, leave the Bosh HM Forwarder IP Address field blank.
Select the Enable VM Resurrector Plugin checkbox to enable the BOSH Resurrector functionality and increase your runtime availability.
The Enable BOSH System Metrics Server checkbox is deprecated, only keep it selected if your metrics system relies upon the format used. It is recommended that you switch away from this format as soon as possible, as this option is going away in future releases.
Keep the Enable System Metrics checkbox selected to collect system metrics, including load, CPU, memory, swap, and disk metrics, and make them available for scraping from agents on each VM. This is recommended if you are using TAS, as it will scrape the agents automatically and insert the metrics into the regular logging and metrics egress stream. For a list of metrics collected, see System Metrics Agent in GitHub.
Select Enable Post Deploy Scripts to run a post-deploy script after deployment. This script allows the job to execute additional commands against a deployment.
Note: If you intend to install VMware Tanzu Kubernetes Grid Integrated Edition (TKGI), you must enable post-deploy scripts.
Select Recreate VMs deployed by the BOSH Director to force BOSH to re-create BOSH-deployed VMs on the next deploy. This process does not re-create the BOSH Director VM or destroy any persistent disk data. This checkbox is cleared automatically after a successful re-deployment.
Select Recreate BOSH Director VMs to force the BOSH Director VM to be re-created on the next deploy. This process does not destroy any persistent disk data. This checkbox is cleared automatically after a successful re-deployment.
Select Recreate All Persistent Disks to force BOSH to migrate and re-create persistent disks for the BOSH Director and all tiles. This process does not destroy any persistent disk data. This checkbox is cleared automatically after a successful re-deployment.
Select Enable bosh deploy retries to instruct Ops Manager to retry failed BOSH operations up to five times.
Select Skip Director Drain Lifecycle to prevent drain scripts from running when the BOSH Director is re-created.
Select Store BOSH Job Credentials on tmpfs (beta) to store credentials for BOSH jobs on temporary file storage (tmpfs) memory, rather than on disk. You must re-create all BOSH-deployed VMs for this setting to take effect.
Select Keep Unreachable Director VMs to preserve BOSH Director VMs after a failed deployment for troubleshooting purposes.
(Optional) Modify the Director Workers value, which sets the number of workers available to execute BOSH Director tasks. This field defaults to 5.
(Optional) Max Threads sets the maximum number of threads that the BOSH Director can run simultaneously. VMware recommends that you leave the field blank to use the default value, unless doing so results in rate limiting or errors on your IaaS.
(Optional) To add a custom URL for your BOSH Director, enter a valid hostname in Director Hostname. You can also use this field to configure a load balancer in front of your BOSH Director. For more information, see How to Set Up a Load Balancer in Front of Operations Manager Director in the VMware Tanzu Support knowledge base.
(Optional) To set a custom banner that users see when logging in to the BOSH Director using SSH, enter text in the Custom SSH Banner field.
(Optional) Enter your comma-separated custom Identification Tags. For example, iaas:foundation1, hello:world. You can use the tags to identify your foundation when viewing VMs or disks from your IaaS.
Note: Azure has limited space for identification tags. VMware recommends entering no more than five tags.
For Certificate Duration Overrides, you can choose whether certificates generated within Ops Manager and CredHub use the default duration specified for the certificate or a custom duration value that you specify.
On: Select this option to set a value to override the duration for certificates created by all products. If a product creates a certificate with a longer duration than the value you set, then the longer duration is used.
Note: After you set a certificate duration override, you must take additional steps to apply the setting to all certificates. For more information, see Overriding Duration for Certificates.
Select HM Pager Duty Plugin to enable Health Monitor integration with PagerDuty.
Select HM Email Plugin to enable Health Monitor integration with email.
For CredHub Encryption Provider, you can choose whether BOSH CredHub stores its encryption key internally on the BOSH Director and CredHub VM, or in an external hardware security module (HSM). The HSM option is more secure.
Before configuring an HSM encryption provider in the Director Config pane, you must follow the procedures and collect information described in Preparing CredHub HSMs for Configuration.
Note: After you deploy Ops Manager with an HSM encryption provider, you cannot change BOSH CredHub to store encryption keys internally.
Luna HSM: Select this option to use a SafeNet Luna HSM as your permanent CredHub encryption provider, and fill in the following fields:
Note: If you use multiple HSM hosts, you must use the Ops Manager API to set or update the HSM configuration. For more information, see Updating director and Iaas properties (Experimental) in the Ops Manager API documentation.
1792.Select a Blobstore Location to configure the blobstore as either an internal server or an external endpoint.
Note: After you deploy the BOSH Director, only Ops Manager users in Advanced Mode can change the blobstore location. For more information, see Ops Manager Fields That Lock On Deploy.
Internal: Select this option to use an internal blobstore. No additional configuration is required.
S3 Compatible Blobstore: Select this option to use an external S3-compatible endpoint. To create an S3 bucket, follow the procedures in Sign up for Amazon S3 and Creating a Bucket in the AWS documentation. When you have created an S3 bucket, configure the following fields:
S3 Endpoint:
us-west-2 region, the URL you create would be https://s3.us-west-2.amazonaws.com. Enter this URL into the S3 Endpoint field.If you are using a non-public S3-compatible endpoint (Ops Manager v2.10.19 or earlier):
SSH into the Ops Manager VM by running:
ssh ubuntu@OPS-MANAGER-FQDN
Where OPS-MANAGER-FQDN is the fully-qualified domain name (FQDN) of your Ops Manager deployment.
Copy the custom public CA certificate you used to sign the S3 endpoint into the /etc/ssl/certs directory on the Ops Manager VM.
On the Ops Manager VM, import the custom CA certificate into the Ops Manager VM truststore by running:
sudo update-ca-certificates -f -v
Add this custom CA certificate into the Trusted Certificates field in the Security page. For instructions, see Security Page.
Bucket Name: Enter the name of the S3 bucket.
Important: AWS ends support for path-style URLs for all S3 buckets created after September 30, 2020. For more information, see Support for Virtual-Hosted-Style URLs for AWS S3 Blobstores.
Note: This feature is only available for BOSH VMs that use Xenial stemcell line 621 or later.
Note: AWS recommends using Signature Version 4. For more information about AWS S3 Signatures, see Authenticating Requests in the AWS documentation.
GCS Blobstore: Select this option to use an external Google Cloud Storage (GCS) endpoint.
To create a GCS bucket, follow the procedures in Creating Storage Buckets in the GCS documentation. To create a GCS bucket, you must have a GCS account. When you have created a GCS bucket, configure the following fields:
Select a Database Location. By default, Ops Manager deploys and manages an Internal database for you. If you choose to use an External MySQL Database, complete the associated fields with information obtained from your external MySQL Database provider: Host, Port, Username, Password, and Database.
Note: Use of an External MySQL Database only applies to the BOSH Director. UAA and CredHub will not use these settings and will continue to use the Postgres database colocated with the BOSH Director.
Caution: After you deploy the BOSH Director, you cannot change the Database Location from an External MySQL Database to an Internal database or from an Internal database to an External MySQL Database.
In addition, if you selected the Enable TLS for Director Database checkbox, you can complete the following optional fields:
Click Save.
Create the following three networks:
Note: The Azure portal sometimes displays the names of resources with incorrect capitalization. Always use the Azure CLI to retrieve the correctly capitalized name of a resource.
To create the infrastructure network:
Select Create Networks.
(Optional) Select Enable ICMP checks if you want to enable ICMP on your networks. Ops Manager uses ICMP checks to confirm that components within your network are reachable.
Click Add Network. For name, enter infrastructure.
Under Subnets, create a subnet using the information in the following table:
| Name | infrastructure |
|---|---|
| Azure Network Name | Enter pcf-virtual-network/pcf-infrastructure-subnet. You can use either the NETWORK-NAME/SUBNET-NAME format or the RESOURCE-GROUP/NETWORK-NAME/SUBNET-NAME format. If you specify a resource group, it must exist under the same subscription ID that you provided in the Azure Config Page. |
| CIDR | Enter 10.0.4.0/26. |
| Reserved IP Ranges | Enter the first nine IP addresses of the subnet. For example, 10.0.4.1-10.0.4.9. |
| DNS | Enter 168.63.129.16. |
| Gateway | Enter the first IP address of the subnet. For example, 10.0.4.1. |
Click Save.
Note: After you deploy Ops Manager, you add subnets with overlapping Availability Zones to expand your network. For more information about configuring additional subnets, see Expanding Your Network with Additional Subnets.
To create the runtime network:
Click Add Network. For Name, enter the name of the runtime that you intend to deploy in this environment. For example, pas or pks.
Under Subnets, create a subnet using the information in the following table:
| Name | pas or pks |
|---|---|
| Azure Network Name | Enter pcf-virtual-network/pcf-pas-subnet or pcf-virtual-network/pcf-pks-subnet, depending on your runtime. You can use either the NETWORK-NAME/SUBNET-NAME format or the RESOURCE-GROUP/NETWORK-NAME/SUBNET-NAME format. If you specify a resource group, it must exist under the same subscription ID that you provided in the Azure Config Page. |
| CIDR | Enter 10.0.12.0/22. |
| Reserved IP Ranges | Enter the first nine IP addresses of the subnet. For example, 10.0.12.1-10.0.12.9. |
| DNS | Enter 168.63.129.16. |
| Gateway | Enter the first IP address of the subnet. For example, 10.0.12.1. |
Click Save.
To create the services network:
Click Add Network. For Name, enter services.
Under Subnets, create a subnet using the information in the following table:
| Name | services |
|---|---|
| Azure Network Name | Enter pcf-virtual-network/pcf-services-subnet. You can use either the NETWORK-NAME/SUBNET-NAME format or the RESOURCE-GROUP/NETWORK-NAME/SUBNET-NAME format. If you specify a resource group, it must exist under the same subscription ID that you provided in the Azure Config Page. |
| CIDR | Enter 10.0.8.0/22. |
| Reserved IP Ranges | Enter the first nine IP addresses of the subnet. For example, 10.0.8.1-10.0.8.9. |
| DNS | Enter 168.63.129.16. |
| Gateway | Enter the first IP address of the subnet. For example, 10.0.8.1. |
Click Save.
You might see red warnings. Ignore them only if Enable ICMP checks is not selected.
Note: The appearance of this page changes based on whether you are using Availability Zones or Availability Sets. For more information, see Azure Config Page.
Select Security. 
In Trusted Certificates, enter your custom certificate authority (CA) certificates to insert into your organization’s certificate trust chain. This feature enables all BOSH-deployed components in your deployment to trust custom root certificates.
To enter multiple certificates, paste your certificates one after the other. For example, format your certificates like the example below:
-----BEGIN CERTIFICATE----- ABCDEFGH12345678ABCDEFGH12345678ABCDEFGH12345678AB EFGH12345678ABCDEFGH12345678ABCDEFGH12345678ABCDEF GH12345678ABCDEFGH12345678ABCDEFGH12345678... ------END CERTIFICATE------ -----BEGIN CERTIFICATE----- BCDEFGH12345678ABCDEFGH12345678ABCDEFGH12345678ABB EFGH12345678ABCDEFGH12345678ABCDEFGH12345678ABCDEF GH12345678ABCDEFGH12345678ABCDEFGH12345678... ------END CERTIFICATE------ -----BEGIN CERTIFICATE----- CDEFGH12345678ABCDEFGH12345678ABCDEFGH12345678ABBB EFGH12345678ABCDEFGH12345678ABCDEFGH12345678ABCDEF GH12345678ABCDEFGH12345678ABCDEFGH12345678... ------END CERTIFICATE------
Note: If you want to use Docker registries to run TAS for VMs app instances in Docker containers, enter the certificate for your private Docker registry in this field. For more information about running app instances in TAS for VMs using Docker registries, see Using Docker Registries.
To include the Ops Manager root CA in the Trusted Certificates field, select the Include OpsManager Root CA in Trusted Certs checkbox. BOSH Director includes this CA in the trust store of every VM that it deploys.
Important: If you are using Ops Manager to generate certificates for either a load balancer or router, then you must select this checkbox.
To clear the default trusted certificates from all BOSH-deployed Linux VMs, select the Clear the Default Trusted Certificates Store checkbox. You must provide your own trusted certificates when selecting this checkbox as all TLS communication fails without trusted certificates available.
Note: This option is available in Ops Manager v2.10.21 and later.
Choose Generate passwords or Use default BOSH password. VMware recommends that you use the Generate passwords option for greater security.
Click Save. To view your saved BOSH Director password, click the Credentials tab.
The BOSH DNS Config pane allows you to configure DNS for BOSH Director by adding excluded recursors, a recursor timeout, and handlers.
The fields in the BOSH DNS Config pane are:
Excluded Recursors: Exclude recursor addresses, which are URL redirects, so that they are not contacted by the BOSH DNS server. For more information about how the BOSH DNS release selects recursors, see Recursors in Native DNS Support in the BOSH documentation.
Recursor Timeout: Specify a timeout for the BOSH DNS server to contact any connected recursor addresses. The time limit includes dialing, writing, and reading from the recursor. If any of these actions exceeds the time limit, the action fails.
Handlers: Specify recursor addresses that apply to specific domains. For example, you can use handlers to forward all requests to a domain to a private DNS for resolution. For more information about using handlers, see Additional Handlers in Native DNS Support in the BOSH documentation.
To add excluded recursors, a recursor timeout, or handlers to the BOSH DNS release:
Select BOSH DNS Config.
(Optional) In Excluded Recursors, enter a list of prohibited recursor addresses.
(Optional) In Recursor Timeout, enter a time limit for contacting the connected recursors.
Note: This time limit must include one of the Go parse duration time units. For example, entering 5s sets the timeout limit to five seconds. For more information about supported time units, see func ParseDuration in the Go Programming Language documentation.
(Optional) In Handlers, enter an array of custom domain handlers in JSON format. For example:
[
{
"cache": {
"enabled": true
},
"domain": "example.com",
"source": {
"type": "http",
"url": "http://example.endpoint.local"
}
}
]
Click Save.
Select Syslog.
(Optional) Select Yes to send BOSH Director system logs to a remote server.
Enter the IP address or DNS name for the remote server in Address.
Enter the port number that the remote server listens on in Port.
Select TCP or UDP from the Transport Protocol dropdown. This selection determines which transport protocol is used to send the logs to the remote server.
(Optional) Select the Enable TLS checkbox to send encrypted logs to remote server with TLS. After you select the checkbox:
Note: VMware strongly recommends that you enable TLS encryption when you are forwarding logs. Logs can contain sensitive information, such as cloud provider credentials.
(Optional) Enter an integer in Queue Size. This value specifies the number of log messages held in the buffer. The default value is 100,000.
(Optional) Select the checkbox to Forward Debug Logs to an external source. This option is deselected by default. If you select it, you may generate a large amount of log data.
(Optional) Enter configuration details for rsyslog in the Custom rsyslog Configuration field. This field requires the rainerscript syntax.
Click Save.
Select Resource Config.
Under the Instances, VM Type, and Persistent Disk Type fields, choose Automatic from the dropdown to allocate the recommended resources for the job. If the Persistent Disk Type field reads None, the job does not require persistent disk space.
Note: For the BOSH Director job, select a VM type with at least 8 GB memory.
Note: If you set a field to Automatic and the recommended resource allocation changes in a future version, Ops Manager automatically uses the updated recommended allocation.
Note: If you install VMware Tanzu Application Service for VMs [Windows] (TAS for VMs [Windows]), provision your Main Compilation Job with at least 100 GB of disk space.
(Optional) To add a load balancer to the BOSH Director:
Caution: This feature is not recommended for production use. The Azure load balancer does not support an override port in the healthcheck configuration.
Click Save.
Use the Ops Manager API to add custom properties to your VMs such as associated security groups and load balancers. For more information, see Managing Custom VM Extensions.
Click Review Pending Changes, then Apply Changes. If a red ICMP error message appears and you have deactivated ICMP, click Ignore errors and start the install.
BOSH Director installs. This may take a few moments. When the installation process successfully completes, the Changes Applied window appears.
Click the Ops Manager Installation Dashboard link to return to the Installation Dashboard.
(Optional) When Ops Manager finishes deploying, deploy BOSH Add-ons to your system. For more information, see Deploying BOSH Add-Ons.
Install one or more Ops Manager runtime environments to complete your installation. For more information, see Ops Manager Runtimes.
