Tanzu Operations Manager fields that lock on deploy

This topic describes how locked fields work in VMware Tanzu Operations Manager, and lists the unlockable and permanently locked fields in installation tiles.

Types of configurable fields in Tanzu Operations Manager

Some fields in Tanzu Operations Manager lock during deployment. After deployment, you can no longer configure a locked field through the Tanzu Operations Manager UI or API endpoints. Product tile authors configure fields as locked to prevent irrevocable VM malfunction, deployment corruption, and data loss. Most users do not need to edit locked fields after initial deployment.

Because deployment requirements may evolve in unanticipated ways over time, some locked fields are unlockable, which means that an advanced Tanzu Operations Manager operator can unlock them to allow reconfiguration. Other fields are permanently locked, and their values cannot be changed. Unlocking the unlockable fields requires you to use Tanzu Operations Manager’s Advanced Mode. For more information about Advanced Mode, see Unlockable Fields.

In summary, there are three types of configurable fields in Tanzu Operations Manager:

• Standard, which can be reconfigured after deployment as many times as you need.

• Unlockable, which lock on deployment but can be unlocked and configured with Advanced Mode.

• Permanently locked, which lock on deployment and cannot be unlocked.

Important VMware recommends that only skilled operators use Tanzu Operations Manager's Advanced Mode. If you use Advanced Mode incorrectly, you can deactivate or destroy your deployment.

Unlockable fields

This section describes the fields that lock during deployment and can be unlocked and configured after deployment. To unlock these fields, you must use Tanzu Operations Manager’s Advanced Mode. For more information, see How to enable Advanced Mode in Tanzu Operations Manager.

After you have enabled Advanced Mode, you can use the API or Tanzu Operations Manager UI to reconfigure some fields that were locked previously. Those fields are listed in the sections below.

Important VMware recommends that only skilled operators use Tanzu Operations Manager's Advanced Mode. If you use Advanced Mode incorrectly, you can deactivate or destroy your deployment.

Unlockable fields in the BOSH Director tile

In the Director Config pane, you can unlock the following fields in Advanced Mode after deployment:

• In the CredHub Encryption Provider section:

  • Under Luna HSM:
    • HSM Host Address
    • HSM Port Address
    • Partition Serial Number

• In the Blobstore Location section:

  • Blobstore Location
  • Under S3 Compatible Blobstore:
    • S3 Endpoint
    • Bucket Name

• In the Database Location section:

  • Under External MySQL Database:
    • Host
    • Port
    • Database

In the Assign AZs and Networks pane, you can unlock the following fields after deployment:

• The Singleton Availability Zone dropdown

Unlockable fields in product tiles

Product tiles also have unlockable fields.

In the Assign AZs and Networks pane, you can unlock the following fields after deployment:

• Place singleton jobs in
• Balance other jobs

Permanently locked fields

This section describes the fields that lock during deployment and cannot be unlocked even in Advanced Mode. These fields cannot be updated after deployment, either through the Tanzu Operations Manager UI or through API endpoints.

Permanently locked fields in the BOSH Director tile

In the Director Config pane, the following fields lock permanently after deployment:

• In the CredHub Encryption Provider section:
  • CredHub Encryption Provider
  • Under Luna HSM:
    • Encryption Key Name
    • Provider Partition
    • Provider Partition Password
• Database Location: You cannot change the database location after deploying the BOSH Director.

In the Create Availability Zones pane, the following field locks permanently after deployment:

• You cannot delete an in-use Availability Zone (AZ).

Configurable fields in product tiles

No fields other than the ones listed above lock in third-party product tiles. However, tile authors can specify which additional fields should lock on deploy by passing the freeze-on-deploy flag.

For more information about this flag, see Common Property Blueprint Attributes in Property and Template References in the Tanzu Operations Manager Tile Developer Guide.