After you deploy VMware Tanzu Operations Manager on Azure, follow the steps in this topic to configure the BOSH Director tile within Tanzu Operations Manager on Azure.

Prerequisites

See the following sections to prepare for your configuration of BOSH Director on Azure.

General prerequisites

Before you complete the procedures in this topic, you must have completed the procedures in the following topics:

You can also complete the procedures in this topic using the Tanzu Operations Manager API. For more information, see Using the Tanzu Operations Manager API.

Prerequisites for Azure Government Cloud

If you use Azure Government Cloud, you must set Azure Generation 2 VM types for a successful deployment. You can set custom VM types with the Tanzu Operations Manager API. For more information, see Using the Tanzu Operations Manager API.

Azure Government Cloud uses Azure Generation 2 VM types by default. If necessary, you can reconfigure the VMs in your deployment to use Azure Generation 1 VM types.

The following table shows the mapping between Generation 1 and Generation 2 Azure VM types:

Generation 1 VM Type Generation 2 VM Type
Standard_DS1_v2 Standard_B2s
Standard_DS2_v2 Standard_D2s_v3
Standard_DS3_v2 Standard_D4s_v3
Standard_DS4_v2 Standard_D8s_v3
Standard_DS5_v2 Standard_D16s_v3
Standard_D32s_v3
Standard_D48s_v3
Standard_D64s_v3
Standard_DS11_v2 Standard_E2s_v3
Standard_DS12_v2 Standard_E4s_v3
Standard_DS13_v2 Standard_E8s_v3
Standard_DS14_v2 Standard_E16s_v3
Standard_E20s_v3
Standard_E32s_v3
Standard_E48s_v3
Standard_E64s_v3
Standard_F1s Standard_B1ms
Standard_F2s Standard_F2s_v2
Standard_F4s Standard_F4s_v2
Standard_F8s Standard_F8s_v2
Standard_F16s_v2
Standard_F32s_v2
Standard_F48s_v2
Standard_F64s_v2

Step 1: Log into Tanzu Operations Manager

  1. In a web browser, navigate to the fully qualified domain name (FQDN) of Tanzu Operations Manager that you created in Deploying Tanzu Operations Manager on Azure.

  2. Log in to Tanzu Operations Manager. See Log In to Tanzu Operations Manager for the First Time.

Step 2: Azure Config page

  1. Click the BOSH Director tile.

  2. Click Azure Config.

    BOSH Director for Azure, Settings tab, Azure config pane.

  3. Complete the following fields with information you obtained in Preparing to Deploy Tanzu Operations Manager on Azure.

    • Subscription ID: Enter the ID of your Azure subscription.
    • Tenant ID: Enter your TENANT_ID.
    • Application ID: Enter the APPLICATION_ID that you created in the Create an AAD Application step of Preparing to Deploy Tanzu Operations Manager on Azure.
    • Client Secret: Enter your CLIENT_SECRET.

  4. Complete the following fields:

    • Resource Group Name: Enter the name of your resource group, which you exported as the $RESOURCE_GROUP environment variable.
    • BOSH Storage Account Name: Enter the name of your storage account, which you exported as the $STORAGE_NAME environment variable.

  5. From the Storage Tier ephemeral / persistent disks drop-down menu, click the storage option that corresponds with your Azure subscription:

    • For HDD-based storage, click Standard_LRS.
    • For SSD-based storage, click Premium_LRS.

  6. If you want all BOSH-created disks to use the same storage tier for the root and OS disks, select the Use same Storage Tier for root / OS disks check box. This overrides the default behavior, which is to use a storage tier based on the instance size. For more information, see the Azure documentation.

    Storage Tier ephemeral/persistent disks drop-down menu.

  7. For Cloud Storage Type, select one of the following options based on your Azure VM storage settings.

    • Use Managed Disks: Select this option if you use Azure Managed Disks. For more information, see Azure Managed Disks Overview in the Microsoft documentation.

      Cloud Storage Types: Select either Use Managed Disks or "Use Storage Accounts.

    • Use Storage Accounts: Select this option if you use storage accounts to store your Azure VMs. Enter the base storage name you used to create your deployment storage accounts, prepended and appended with the wildcard character *. For example, if you created accounts named xyzdeploymentstorage1, xyzdeploymentstorage2, and xyzdeploymentstorage3, enter *deploymentstorage*. Tanzu Operations Manager requires that you specify an asterisk at both the beginning and the end of the base storage account name.

      Caution You can update your deployment from using storage accounts to using managed disks. However, after you click Use Managed Disks and deploy Tanzu Operations Manager, you cannot change your deployment back to use storage accounts.

  8. (Optional) Enter your Default Security Group. For more information about Network Security Groups, see Filter network traffic with network security groups in the Microsoft Azure documentation.
    The Azure portal sometimes displays the names of resources with incorrect capitalization. Always use the Azure CLI to retrieve the correctly capitalized name of a resource.

  9. For SSH Public Key, copy and paste the contents of your public key in the opsman.pub file. You created this file in Deploying Tanzu Operations Manager on Azure.

  10. For SSH Private Key, copy and paste the contents of your private key in the opsman file.

  11. For VM Type Catalog, click the VM Catalog that you want to use for your BOSH Managed VMs.

  12. For Availability Mode, choose whether to use Availability Sets or Availability Zones. You can further configure this option in the Assign AZs and Networks pane. For more information, see Assign AZs and Networks. Availability Zones is selected by default, but you can choose Availability Sets.

    Important You can choose between Availability Zones and Availability Sets only in a staged BOSH Director tile that has not yet been deployed. After you click Apply Changes and the BOSH Director deploys successfully, you cannot switch between Availability Zones and Availability Sets.

  13. For Azure Environment, select the Azure cloud you want to use. VMware recommends Azure Commercial Cloud for most Azure environments.

If you selected Azure Government Cloud as your Azure environment, you must configure custom VM types. For more information, see Prerequisites for Azure Government Cloud in Configuring BOSH Director on Azure.

To deploy Tanzu Operations Manager on Azure using Active Directory Federation Services (ADFS) see ../opsguide/adfs-sso-configuration.html.

  1. (Optional) If you clicked Azure Stack for your Azure Environment, complete the following Azure Stack-only fields:

    1. For Domain, enter the domain for your Azure Stack deployment. For example, local.azurestack.external.
    2. Enter the Tenant Management Resource Endpoint from your AzureRM Environment Context. This URL changes with every ASDK installation.
    3. Enter AzureAD for Authentication. If you want to use Azure China Cloud Active Directory for your authentication type, enter AzureChinaCloudAD.
    4. Enter your Azure Stack Endpoint Prefix. For example management.
    5. Enter your Azure Stack CA Certificate. Azure Stack requires a custom CA certificate. Copy the certificate from your Azure Stack environment.

  2. Click Save.

Step 3: Director Config page

To configure the Director Config pane:

  1. Click Director Config.

    Director Config page

  2. Enter any valid value for NTP Servers (comma delimited). A value is required but is ignored. For example, you can enter us.pool.ntp.org. By default, Azure VMs use a Precision Time Protocol (PTP) clock source. For more information, see Time sync for Linux VMs in Azure in the Azure documentation.

    • The NTP server configuration updates only after VM recreation. If you modify the value of this field, select the Recreate VMs deployed by the BOSH Director check box to re-create your BOSH Director-deployed VMs and update the NTP server configuration. If you have any service tiles installed, ensure that the Recreate All Service Instances errand runs for each service tile.

  3. Leave the Bosh HM Forwarder IP Address text box blank. BOSH-reported component metrics are available in Loggregator Firehose by default. If you continue to use the BOSH HM Forwarder to consume these component metrics, you might receive duplicate data.

  4. Select the Enable VM Resurrector Plugin check box to enable the BOSH Resurrector functionality and increase your runtime availability.

  5. If you want to collect detailed metrics from BOSH-managed VMs, select the Enable System Metrics check box. For a list of metrics that the System Metrics Agent collects from BOSH-managed VMs, see System Metrics Agent on GitHub. When you select this check box, ensure that the System Metrics Scraper is able to connect on port 53035 to all BOSH-managed VMs.

  6. Select Enable Post Deploy Scripts to run a post deployment script after deployment. This script allows the job to execute additional commands against a deployment.

If you intend to install VMware Tanzu Kubernetes Grid Integrated Edition (TKGI), you must enable post-deploy scripts.

  1. Click Recreate VMs deployed by the BOSH Director to force BOSH to recreate BOSH-deployed VMs on the next deployment. This process does not recreate the BOSH Director VM or destroy any persistent disk data. This check box is cleared automatically after a successful redeployment.

  2. Select Recreate BOSH Director VMs to force the BOSH Director VM to be recreated on the next deploy. This process does not destroy any persistent disk data. This check box is cleared automatically after a successful redeployment.

  3. Select Recreate All Persistent Disks to force BOSH to migrate and recreate persistent disks for the BOSH Director and all tiles. This process does not destroy any persistent disk data. This check box is cleared automatically after a successful redeployment.

  4. Select Enable bosh deploy retries to instruct Tanzu Operations Manager to retry failed BOSH operations up to five times.

  5. Select Skip Director Drain Lifecycle to prevent drain scripts from running when the BOSH Director is recreated.

  6. Select Store BOSH Job Credentials on tmpfs (beta) to store credentials for BOSH jobs on temporary file storage (tmpfs) memory, rather than on disk. You must re-create all BOSH-deployed VMs for this setting to take effect.

  7. Select Keep Unreachable Director VMs to preserve BOSH Director VMs after a failed deployment for troubleshooting purposes.

  8. (Optional) Modify the Director Workers value, which sets the number of workers available to run BOSH Director tasks. The value in this text box defaults to 5.

  9. (Optional) Max Threads sets the maximum number of threads that the BOSH Director can run simultaneously. VMware recommends that you leave the text box blank to use the default value, unless doing so results in rate limiting or errors on your IaaS.

  10. (Optional) To add a custom URL for your BOSH Director, enter a valid hostname in the Director Hostname text box. You can also use this text box to configure a load balancer in front of your BOSH Director. For more information, see How to set up a Load Balancer in front of Tanzu Operations Manager Director.

    There are three text boxes, Director Workers, Max Threads, and Director Hostname.

  11. (Optional) To set a custom banner that users see when you log in to the BOSH Director using SSH, enter text in the Custom SSH Banner text box.

  12. (Optional) Enter your comma-separated custom Identification Tags. For example, iaas:foundation1, hello:world. You can use the tags to identify your foundation when viewing VMs or disks from your IaaS.

    Azure has limited space for identification tags. VMware recommends entering no more than five tags.

  13. For Certificate Duration Overrides, you can choose whether certificates generated within Tanzu Operations Manager and CredHub use the default duration specified for the certificate, or a custom duration value that you specify.

    Three fields: the On-Off option for the feature, CA Certificate Duration (days) text field, and Leaf Certificate Duration (days).

    • Off: Use this option to use default duration for certificates created by all products.

    • On: Use this option to set a value to override the duration for certificates created by all products. If a product creates a certificate with a longer duration than the value you set, the longer duration is used.

      1. CA Certificate Duration (days): Enter the number of days for which CA certificates are valid.
      2. Leaf Certificate Duration (days): Enter the number of days for which leaf certificates are valid. This value must be less than or equal to the CA certificate duration.

      After you set a certificate duration override, you must take additional steps to apply the setting to all certificates. For more information, see Overriding Duration for Certificates.

    Three fields: the Off-On option for the feature, CA Certificate Duration (days) text field, and Leaf Certificate Duration (days).

  14. Select HM Pager Duty Plugin to enable Health Monitor integration with PagerDuty.

    • Service Key: Enter your API service key from PagerDuty.
    • HTTP Proxy: Enter an HTTP proxy for use with PagerDuty.

    There is a selected check box, HM Pager Duty Plugin, and two text boxes, Service Key and HTTP Proxy.

  15. Select HM Email Plugin to enable Health Monitor integration with email.

    • Host: Enter your email host name.
    • Port: Enter your email port number.
    • Domain: Enter your domain.
    • From: Enter the address for the sender.
    • Recipients: Enter a comma-separated list of addresses of intended recipients.
    • Username: Enter the user name for your email server.
    • Password: Enter the password for your email server.
    • Enable TLS: Select this check box to enable Transport Layer Security to the email host.

    There is a selected check box, HM Email Plug-in, and seven text boxes: Host, Port, Domain, From, Recipients, Username, and Password.

  16. For CredHub Encryption Provider, you can choose whether BOSH CredHub stores its encryption key internally on the BOSH Director and CredHub VM, or in an external hardware security module (HSM). The HSM option is more secure.

    Before configuring an HSM encryption provider in the Director Config pane, you must follow the procedures and collect information described in Preparing CredHub HSMs for configuration.

    After you deploy Tanzu Operations Manager with an HSM encryption provider, you cannot change BOSH CredHub to store encryption keys internally.

    • Internal: Use this option for internal CredHub key storage. This option is selected by default and requires no additional configuration.

    • Luna HSM: Use this option to use a SafeNet Luna HSM as your permanent CredHub encryption provider, and fill in the following fields:

      If you use multiple HSM hosts, you must use the Tanzu Operations Manager API to set or update the HSM configuration. For more information, see Updating a staged director's properties in the Tanzu Operations Manager API documentation.

      1. Encryption Key Name: Any name to identify the key that the HSM uses to encrypt and decrypt the CredHub data. Changing this key name after you deploy Tanzu Operations Manager can cause service downtime.
      2. Provider Partition: The partition that stores your encryption key. Changing this partition after you deploy Tanzu Operations Manager could cause service downtime. For this value and the ones that follow, use values gathered in Preparing CredHub HSMs for configuration.
      3. Provider Partition Password
      4. Partition Serial Number
      5. Provider Client Certificate: The certificate that validates the identity of the HSM when CredHub connects as a client.
      6. Provider Client Certificate Private Key
      7. HSM Host Address
      8. HSM Port Address: If you do not know your port address, enter 1792.
      9. HSM Certificate: The certificate that the HSM presents to CredHub to establish a two-way mTLS connection.

    CredHub Encryption Provider page

  17. Click Blobstore Location to configure the blobstore as either an internal server or an external endpoint.

    After you deploy the BOSH Director, only Tanzu Operations Manager users in Advanced Mode can change the blobstore location. For more information, see Tanzu Operations Manager Fields That Lock On Deploy.

    • Internal: Use this option for an internal blobstore. No additional configuration is required.

    • S3 Compatible Blobstore: Use this option for an external S3-compatible endpoint. To create an S3 bucket, follow the procedures in Sign up for Amazon S3 and Creating a Bucket in the AWS documentation. When you have created an S3 bucket, configure the following fields:

      1. S3 Endpoint:

        1. If you are using a public S3 endpoint:
          1. Locate the endpoint for your region. To find the endpoint, see the Amazon Simple Storage Service (S3) table in Regions and Endpoints in the AWS documentation.
          2. Construct a URL using your region’s endpoint. For example, if you are using the us-west-2 region, the URL you create would be https://s3.us-west-2.amazonaws.com. Enter this URL into the S3 Endpoint field.

        2. If you are using a non-public S3-compatible endpoint (Tanzu Operations Manager v2.10.19 or earlier):

          1. Enter the URL for the non-public endpoint.

          2. SSH into the Tanzu Operations Manager VM by running:

            ssh ubuntu@OPS-MANAGER-FQDN

            Where OPS-MANAGER-FQDN is the fully-qualified domain name (FQDN) of your Tanzu Operations Manager deployment.

          3. Copy the custom public CA certificate you used to sign the S3 endpoint into the /etc/ssl/certs directory on the Tanzu Operations Manager VM.

          4. On the Tanzu Operations Manager VM, import the custom CA certificate into the Tanzu Operations Manager VM truststore by running:

            sudo update-ca-certificates -f -v

          5. Add this custom CA certificate into the Trusted Certificates field in the Security page. For instructions, see Security Page.

        3. If you are using a non-public S3-compatible endpoint (Tanzu Operations Manager v2.10.20 or later:
          1. Enter the URL for the non-public endpoint.
          2. Add the custom public CA certificate you used to sign the S3 endpoint to the Trusted Certificates field on the Director Config page.

      2. Bucket Name: Enter the name of the S3 bucket.

      3. URL Style: Click either path-style or domain-style to specify the URL style for the S3-compatible blobstore. By default, the blobstore uses domain-style URLs.

        AWS ends support for path-style URLs for all S3 buckets created after September 30, 2020. For more information, see Support for Virtual-Hosted-Style URLs for AWS S3 Blobstores.

      4. Access Key and Secret Key: Enter the keys you generated when creating your S3 bucket.
      5. Enable signed URLs: Select this check box to configure BOSH VMs to generate short lived, pre-signed URLs for communication between the BOSH Agent and blobstore. If you enable this feature, BOSH Agents do not use credentials to communicate with the blobstore, and VM disks do not store blobstore credentials. This feature is only available for BOSH VMs that use Xenial stemcell line 621 or later.
      6. Select V2 Signature or V4 Signature. If you select V4 Signature, enter your Region. AWS recommends using Signature Version 4 (V4). For more information about AWS S3 Signatures, see Authenticating Requests in the AWS documentation.
      7. S3 Backup Strategy: To configure whether and how to back up the BOSH Director’s S3 blobstore, select one of the following options:
        • No backups
        • Use a versioned bucket: This option uses blobstore bucket versioning to save backups. It requires an S3 blobstore that supports versioning.
        • Copy into an additional bucket: This option saves blobstore backups to a separate bucket, which is useful with blobstores that do not support versioning. This option requires you to configure the Backup Bucket Region and Backup Bucket Name fields.

    • GCS Blobstore: Use this option for an external Google Cloud Storage (GCS) endpoint.

      To create a GCS bucket, follow the procedures in Creating Storage Buckets in the GCS documentation. To create a GCS bucket, you must have a GCS account. When you have created a GCS bucket, configure the following fields:

      1. Bucket Name: Enter the name of your GCS bucket.
      2. Storage Class: Use this storage class for your GCS bucket. For more information, see Storage Classes in the GCP documentation.
      3. Service Account Key: Follow the steps in Set up IAM Service Accounts in Preparing to Deploy Tanzu Operations Manager on GCP to download a JSON file with a private key. Enter the contents of the JSON file into the text box.
      4. GCS Backup Strategy: To configure whether and how to back up the BOSH Director’s GCS blobstore, click one of the following options:
        • No backups
        • Copy into an additional bucket: This option saves blobstore backups to a bucket separate from the blobstore itself, and requires you to configure the Backup Bucket Region and Backup Bucket Name text boxes.

      On the Blobstore Location page, select "GCS Blobstore.

  18. Click Database Location. By default, Tanzu Operations Manager deploys and manages an Internal database for you. If you choose to use an External MySQL Database, complete the associated fields with information obtained from your external MySQL Database provider: Host, Port, Username, Password, and Database.

    Note Use of an External MySQL Database applies only to the BOSH Director. UAA and CredHub do not use these settings and continue to use the Postgres database co-located with the BOSH Director.

    After you deploy the BOSH Director, you cannot change the Database Location from an External MySQL Database to an Internal database or from an Internal database to an External MySQL Database.

    There are two radio buttons: Internal, and External MySQL Database. There are five text fields, Host, Port, Username, Password, and Database.

    In addition, if you selected the Enable TLS for Director Database check box, you can complete the following optional fields:

    • Enable TLS: Select this check box to enable TLS communication between the BOSH Director and the database.
    • TLS CA: Enter the Certificate Authority for the TLS Certificate.
    • TLS Certificate: Enter the client certificate for mutual TLS connections to the database.
    • TLS Private Key: Enter the client private key for mutual TLS connections to the database.
    • Advanced DB Connection Options: This text box accepts a JSON-formatted options string. It can be left blank unless directed by Broadcom Support.

    There are two radio buttons: Internal, and External MySQL Database. There are five text fields, Host, Port, Username, Password, and Database.

  19. Click Save.

Step 4: Create Networks page

Create the following three networks:

Important The Azure portal sometimes displays the names of resources with incorrect capitalization. Always use the Azure CLI to retrieve the correctly capitalized name of a resource.

Infrastructure network

To create the infrastructure network:

  1. Click Create Networks.

  2. (Optional) Click Enable ICMP checks if you want to enable ICMP on your networks. Tanzu Operations Manager uses ICMP checks to confirm that components in your network are reachable.

  3. Click Add Network. For name, enter infrastructure.

  4. Under Subnets, create a subnet using the information in the following table:

    Name infrastructure
    Azure Network Name Enter pcf-virtual-network/pcf-infrastructure-subnet.
    You can use either the NETWORK-NAME/SUBNET-NAME format or the RESOURCE-GROUP/NETWORK-NAME/SUBNET-NAME format. If you specify a resource group, it must exist under the same subscription ID that you provided in the Azure Config Page.
    CIDR Enter 10.0.4.0/26.
    Reserved IP Ranges Enter the first nine IP addresses of the subnet. For example, 10.0.4.1-10.0.4.9.
    DNS Enter 168.63.129.16.
    Gateway Enter the first IP address of the subnet. For example, 10.0.4.1.

    Create Networks pane

  5. Click Save. After you deploy Tanzu Operations Manager, you add subnets with overlapping Availability Zones to expand your network. For more information about configuring additional subnets, see Expanding Your Network with Additional Subnets.

Runtime network

To create the runtime network:

  1. Click Add Network. For Name, enter the name of the runtime that you intend to deploy in this environment. For example, pas or pks.

  2. Under Subnets, create a subnet using the information in the following table:

    Name pas or pks
    Azure Network Name Enter pcf-virtual-network/pcf-pas-subnet or pcf-virtual-network/pcf-pks-subnet, depending on your runtime.
    You can use either the NETWORK-NAME/SUBNET-NAME format or the RESOURCE-GROUP/NETWORK-NAME/SUBNET-NAME format. If you specify a resource group, it must exist under the same subscription ID that you provided in the Azure Config Page.
    CIDR Enter 10.0.12.0/22.
    Reserved IP Ranges Enter the first nine IP addresses of the subnet. For example, 10.0.12.1-10.0.12.9.
    DNS Enter 168.63.129.16.
    Gateway Enter the first IP address of the subnet. For example, 10.0.12.1.

    Runtime network pane, showing subnets

  3. Click Save.

Services network

To create the services network:

  1. Click Add Network and in the Name text box, enter services.

  2. In Subnets, create a subnet using the information in the following table:

    Name services
    Azure Network Name Enter pcf-virtual-network/pcf-services-subnet.
    You can use either the NETWORK-NAME/SUBNET-NAME format or the RESOURCE-GROUP/NETWORK-NAME/SUBNET-NAME format. If you specify a resource group, it must exist under the same subscription ID that you provided in the Azure Config Page.
    CIDR Enter 10.0.8.0/22.
    Reserved IP Ranges Enter the first nine IP addresses of the subnet. For example, 10.0.8.1-10.0.8.9.
    DNS Enter 168.63.129.16.
    Gateway Enter the first IP address of the subnet. For example, 10.0.8.1.

    Services network pane showing subnets

  3. Click Save.

Important You might see red warnings. You can ignore them only if Enable ICMP checks is not selected.

Step 5: Assign AZs and Networks

  1. Click Assign AZs and Networks.

    The appearance of this page changes based on whether you are using Availability Zones or Availability Sets. For more information, see Azure Config Page.

    • If you use Availability Zones, click one of the three available zones from the Singleton Availability Zone drop-down menu, then click a network from the Networks drop-down menu. The networks that appear in this list are networks that you created earlier in this procedure.
    • If you use Availability Sets, click a network from the Networks drop-down menu. The networks that appear in this list are networks that you created earlier in this procedure.
  2. Click Save.

Step 6: Security page

  1. Click Security. Trusted certificates

  2. In Trusted Certificates, paste in your custom certificate authority (CA) certificates to insert into your organization’s certificate trust chain. This feature enables all BOSH-deployed components in your deployment to trust custom root certificates. If you want to use Docker registries to run TAS for VMs app instances in Docker containers, enter the certificate for your private Docker registry in this text box. For more information about running app instances in TAS for VMs using Docker registries, see Using Docker Registries.

    To enter multiple certificates, paste in your certificates one after the other. For example, format your certificates as shown in the following example:

    -----BEGIN CERTIFICATE-----
ABCDEFGH12345678ABCDEFGH12345678ABCDEFGH12345678AB
EFGH12345678ABCDEFGH12345678ABCDEFGH12345678ABCDEF
GH12345678ABCDEFGH12345678ABCDEFGH12345678...
------END CERTIFICATE------
-----BEGIN CERTIFICATE-----
BCDEFGH12345678ABCDEFGH12345678ABCDEFGH12345678ABB
EFGH12345678ABCDEFGH12345678ABCDEFGH12345678ABCDEF
GH12345678ABCDEFGH12345678ABCDEFGH12345678...
------END CERTIFICATE------
-----BEGIN CERTIFICATE-----
CDEFGH12345678ABCDEFGH12345678ABCDEFGH12345678ABBB
EFGH12345678ABCDEFGH12345678ABCDEFGH12345678ABCDEF
GH12345678ABCDEFGH12345678ABCDEFGH12345678...
------END CERTIFICATE------

    If you want to use Docker registries to run TAS for VMs app instances in Docker containers, enter the certificate for your private Docker registry in this text box. For more information about running app instances in TAS for VMs using Docker registries, see Using Docker Registries.

  3. To include both the Tanzu Operations Manager root CA and the certificates pasted into Trusted Certificates in the trusted_certs field in the BOSH director manifest, select the Include Tanzu Ops Manager Root CA in Trusted Certs check box. BOSH Director includes this CA in the trust store of every VM that it deploys.
    If you are using Tanzu Operations Manager to generate certificates for either a load balancer or router, then you must select this check box.

  4. To clear the default trusted certificates from all BOSH-deployed Linux VMs, select the Clear the Default Trusted Certificates Store check box. You must provide your own trusted certificates when selecting this check box because all TLS communication fails if trusted certificates are not available.

    This option is available in Ops Manager v2.10.21 and higher.

  5. Select Generate passwords or Use default BOSH password. VMware recommends that you use the Generate passwords option for greater security.

  6. Click Save. To view your saved BOSH Director password, click the Credentials tab.

Step 7: BOSH DNS Config page

The BOSH DNS Config pane enables you to configure DNS for BOSH Director by adding excluded recursors, a recursor timeout, and handlers.

The text boxes in the BOSH DNS Config pane are:

  • Excluded Recursors: Exclude recursor addresses, which are URL redirects, so that they are not contacted by the BOSH DNS server. For more information about how the BOSH DNS release selects recursors, see Recursors in Native DNS Support in the BOSH documentation.

  • Recursor Timeout: Specify a timeout for the BOSH DNS server to contact any connected recursor addresses. The time limit includes dialing, writing, and reading from the recursor. If any of these actions exceeds the time limit, the action fails.

  • Handlers: Specify recursor addresses that apply to specific domains. For example, you can use handlers to forward all requests to a domain to a private DNS for resolution. For more information about using handlers, see Additional handlers in Native DNS Support in the BOSH documentation.

To add excluded recursors, a recursor timeout, or handlers to the BOSH DNS release:

  1. Click BOSH DNS Config.

    BOSH DNS Config page

  2. (Optional) In Excluded Recursors, enter a list of prohibited recursor addresses.

  3. (Optional) In Recursor Timeout, enter a time limit for contacting the connected recursors.

    This time limit must include one of the Go parse duration time units. For example, entering 5s sets the timeout limit to five seconds. For more information about supported time units, see func ParseDuration in the Go Programming Language documentation.

  4. (Optional) In Handlers, enter an array of custom domain handlers in JSON format. For example:

    [
  {
    "cache": {
      "enabled": true
    },
    "domain": "example.com",
    "source": {
      "type": "http",
      "url": "http://example.endpoint.local"
    }
  }
]

  5. Click Save.

Step 8: Syslog page

  1. Select Syslog.

  2. (Optional) To send BOSH Director system logs to a remote server, select Yes.

  3. In Address, enter the IP address or DNS name for the remote server.

  4. In Port, enter the port number that the remote server listens on.

  5. From the Transport Protocol drop-down menu, select TCP or UDP. This selection determines which transport protocol is used to send the logs to the remote server.

  6. (Optional) Select the Enable TLS check box to send encrypted logs to remote server with TLS. After you select the checkbox:

    1. In Permitted Peer, enter either the name or SHA1 fingerprint of the remote peer.

    2. In SSL Certificate, enter the SSL certificate for the remote server.

      Note VMware strongly recommends that you enable TLS encryption when you are forwarding logs. Logs can contain sensitive information, such as cloud provider credentials.

  7. (Optional) In Environment identifier, enter a string. This is a human-readable identifier that is included in each log entry.

  8. (Optional) In Queue Size, enter an integer. This value specifies the number of log messages held in the buffer. The default value is 100,000.

  9. (Optional) Select the Forward Debug Logs check box to forward the logs to an external source. This option is deselected by default. If you select it, you may generate a large amount of log data.

  10. (Optional) In the Custom rsyslog Configuration field, enter configuration details for rsyslog. This field requires the rainerscript syntax.

  11. Click Save.

Step 9: Resource Config page

  1. Click Resource Config.

  2. Under the Instances, VM Type, and Persistent Disk Type fields, click Automatic from the drop-down menu to allocate the recommended resources for the job. If the Persistent Disk Type field displays None, the job does not require persistent disk space. For the BOSH Director job, click a VM type with at least 8 GB memory. If you set a field to Automatic and the recommended resource allocation changes in a future version, Tanzu Operations Manager automatically uses the updated recommended allocation. If you install VMware Tanzu Application Service for VMs [Windows] (TAS for VMs [Windows]), provision your Main Compilation Job with at least 100 GB of disk space.

  3. (Optional) To add a load balancer to the BOSH Director:

    1. Click the icon next to the BOSH Director job name to see the Load Balancers field and Internet Connected check box.
    2. Ensure that the Internet Connected check box is not selected.
    3. For Load Balancers, enter your Azure application gateway name for each associated job. To create an application gateway, follow the procedures in Configure an application gateway for SSL offload by using Azure Resource Manager from the Azure documentation. When you create the application gateway, associate the gateway’s IP address with your system domain.

      This feature is not recommended for production use. The Azure load balancer does not support an override port in the healthcheck configuration.

  4. Click Save.

Step 10: Add custom VM extensions (optional)

Use the Tanzu Operations Manager API to add custom properties to your VMs; associated security groups and load balancers, for example. For more information, see Managing custom VM extensions.

Step 11: Complete the BOSH Director installation

  1. Click Review Pending Changes, and then Apply Changes. If a red ICMP error message appears and you have deactivated ICMP, click Ignore errors and start the install.

  2. BOSH Director installation begins. This might take a few moments. When the installation process completes successfully, the Changes Applied window appears.

  3. Click the Tanzu Operations Manager Installation Dashboard link to return to the Installation Dashboard.

Next steps

  • (Optional) When Tanzu Operations Manager finishes deploying, deploy BOSH Add-ons to your system. For more information, see Deploying BOSH Add-Ons.

  • Install one or more Tanzu Operations Manager runtime environments to complete your installation. For more information, see Tanzu Operations Manager Runtimes.

check-circle-line exclamation-circle-line close-line
Scroll to top icon