You can use the steps in this topic to configure BOSH Director in VMware Tanzu Operations Manager on Google Cloud Platform (GCP).

You can also perform the procedures in this topic using the Tanzu Operations Manager API. For more information, see Using the Tanzu Operations Manager API.

Step 1: Log into Tanzu Operations Manager

To configure BOSH Director, you must first access your Tanzu Operations Manager installation and determine how your user database is maintained.

To access Tanzu Operations Manager:

  1. In a web browser, go to the fully qualified domain name (FQDN) of Tanzu Operations Manager that you set up in Deploying Tanzu Operations Manager on GCP.

    In order to set up Tanzu Operations Manager authentication correctly, VMware recommends using an FQDN to access Tanzu Operations Manager. Using an ephemeral IP address to access Tanzu Operations Manager can cause authentication errors upon subsequent access.

  2. Log in to Tanzu Operations Manager. For more information about logging in, see Log In to Tanzu Operations Manager For the First Time.

Step 2: Configure GCP tile

To configure your GCP tile:

  1. Click the BOSH Director tile in the Tanzu Operations Manager Installation Dashboard.

  2. Click Google Config and complete the following text boxes:

    • Project ID: Enter your GCP project ID in lowercase, such as: your-gcp-project-id.
    • Default Deployment Tag: Enter the prefix that you used when creating the GCP resources for this Tanzu Operations Manager installation.
    • Click AuthJSON. In the following text box, enter the contents of the JSON file that you downloaded in Set Up IAM Service Accounts in Preparing to Deploy Tanzu Operations Manager on GCP. As an alternative, you can click The Tanzu Ops Manager VM Service Account to use the service account that you set up in Set Up IAM Service Accounts in Preparing to Deploy Tanzu Operations Manager on GCP. To use this option, the service account must be assigned the Service Account Actor role.
    • VM Type Catalog. Click the VM catalog that you want to use for your BOSH-deployed VMs.
    • Google Disk Type. Click the Google Disk Type that you want to use for your BOSH-deployed VMs.

      Google Cloud Platform Config

  3. Click Save.

Step 3: Configure Director

To configure the Director Config pane in the BOSH Director tile, you must have the correct permissions. To configure these permissions, see Required permissions in the BOSH documentation and Creating storage buckets in the GCP documentation.

To configure the Director Config pane:

  1. Click Director Config.

    Director Config page

  2. In the NTP Servers (comma delimited) text box, enter 169.254.169.254 to designate the metadata.google.internal host as NTP server.

    • The NTP server configuration only updates after VM recreation. If you modify the value of this text box, select the Recreate VMs deployed by the BOSH Director check box to re-create your BOSH Director-deployed VMs and update the NTP server configuration. If you have any service tiles installed, ensure that the Recreate All Service Instances errand runs for each service tile.
  3. Leave the Bosh HM Forwarder IP Address text box blank. BOSH-reported component metrics are available in Loggregator Firehose by default. If you continue to use the BOSH HM Forwarder to consume these component metrics, you might receive duplicate data. To prevent this, leave the Bosh HM Forwarder IP Address text box blank.

  4. Select the Enable VM Resurrector Plugin check box to enable the BOSH Resurrector functionality and increase your runtime availability.

  5. If you want to collect detailed metrics from BOSH-managed VMs, activate the Enable System Metrics check box. For a list of metrics that the System Metrics Agent collects from BOSH-managed VMs, see System Metrics Agent on GitHub. When you activate this check box, ensure that the System Metrics Scraper is able to connect on port 53035 to all BOSH-managed VMs.

  6. Click Enable Post Deploy Scripts to run a post deployment script after deployment. This script allows the job to execute additional commands against a deployment.

    If you intend to install VMware Tanzu Kubernetes Grid Integrated Edition (TKGI), you must enable post-deploy scripts.

  7. To configure your VMs to use short lived NATS credentials during the bootstrap process, select the Enable Short Lived NATS Bootstrap Credentials check box. This increases the security of your Tanzu Operations Manager deployment by rotating the TLS certificate that the BOSH Agents in your VMs use to communicate with the BOSH Director through BOSH NATS.

    For more information, see Using Short-Lived NATS Bootstrap credentials.

    Important Configuring your VMs to use short-lived NATS bootstrap credentials restarts the BOSH Agent in all VMs as they are being created. As a result, VMs are created somewhat more slowly. This configuration affects all new deployments of Tanzu Operations Manager. If you want to configure VMs in existing Tanzu Operations Manager deployments to use short-lived bootstrap credentials, you must recreate them.

  8. Click Recreate VMs deployed by the BOSH Director to force BOSH to recreate BOSH-deployed VMs on the next deployment. This process does not recreate the BOSH Director VM or destroy any persistent disk data. This check box is cleared automatically after a successful redeployment.

  9. Click Recreate BOSH Director VM to force the BOSH Director VM to be recreated on the next deploy. This process does not destroy any persistent disk data. This check box is cleared automatically after a successful redeployment.

  10. Click Recreate All Persistent Disks to force BOSH to migrate and recreate persistent disks for the BOSH Director and all tiles. This process does not destroy any persistent disk data. This check box is cleared automatically after a successful redeployment.

  11. Click Enable bosh deploy retries to instruct Tanzu Operations Manager to retry failed BOSH operations up to five times.

  12. Click Skip Director Drain Lifecycle to prevent drain scripts from running when the BOSH Director is recreated.

  13. Click Store BOSH Job Credentials on tmpfs (beta) to store credentials for BOSH jobs on temporary file storage (tmpfs) memory, rather than on disk. You must re-create all BOSH-deployed VMs for this setting to take effect.

  14. Click Keep Unreachable Director VMs to preserve BOSH Director VMs after a failed deployment for troubleshooting purposes.

  15. (Optional) Click Enable automatic rotation of the BOSH DNS CA certificate (experimental) if you want Tanzu Operations Manager to automatically rotate the BOSH DNS CA certificate and associated leaf certificates when you Apply Changes. For more information about this feature, see Automatic rotation of BOSH DNS certificates.

  16. (Optional) Modify the Director Workers value, which sets the number of workers available to run BOSH Director tasks. By default, this text box defaults to 5.

  17. (Optional) Max Threads sets the maximum number of threads that the BOSH Director can run simultaneously. VMware recommends that you leave the text box blank to use the default value, unless doing so results in rate limiting or errors on your IaaS.

  18. (Optional) To add a custom URL for your BOSH Director, enter a valid hostname in Director Hostname text box. You can also use this text box to configure a load balancer in front of your BOSH Director. For more information, see How to set up a Load Balancer in front of Tanzu Operations Manager Director.

    There are five text boxes: Director Workers, Max Threads, Director Hostname, Custom SSH Banner, and Identification Tags.

  19. (Optional) To set a custom banner that users see when you log in to the BOSH Director using SSH, enter text in the Custom SSH Banner text box.

  20. (Optional) Enter your comma-separated custom Identification Tags. For example, iaas:foundation1, hello:world. You can use the tags to identify your foundation when viewing VMs or disks from your IaaS.

  21. For Certificate Duration Overrides, you can choose whether certificates generated within Tanzu Operations Manager and CredHub use the default duration specified for the certificate or a custom duration value that you specify.

    Three fields: the Off-On option for the feature, CA Certificate Duration (days) text field, and Leaf Certificate Duration (days).

    • Off: Use this option to use default duration for certificates created by all products.
    • On: Use this option to set a value to override the duration for certificates created by all products. If a product creates a certificate with a longer duration than the value you set, then the longer duration is used.

      1. CA Certificate Duration (days): Enter the number of days for which CA certificates are valid.
      2. Leaf Certificate Duration (days): Enter the number of days for which leaf certificates are valid. This value must be less than or equal to the CA certificate duration.

      After you set a certificate duration override, you must take additional steps to apply the setting to all certificates. For more information, see Overriding Duration for Certificates.

  22. Click HM Pager Duty Plugin to enable Health Monitor integration with PagerDuty.

    There is a selected check box, HM Pager Duty Plugin, and two text boxes, Service Key and HTTP Proxy.

    • Service Key: Enter your API service key from PagerDuty.
    • HTTP Proxy: Enter an HTTP proxy for use with PagerDuty.
  23. Click HM Email Plugin to enable Health Monitor integration with email.

    There is a selected check box, HM Email Plug-in, and seven text boxes: Host, Port, Domain, From, Recipients, Username, and Password.

    • Host: Enter your email hostname.
    • Port: Enter your email port number.
    • Domain: Enter your domain.
    • From: Enter the address for the sender.
    • Recipients: Enter comma-separated addresses of intended recipients.
    • Username: Enter the username for your email server.
    • Password: Enter the password for your email server.
    • Enable TLS: Select this check box to enable Transport Layer Security to the email host.
  24. For CredHub Encryption Provider, you can choose whether BOSH CredHub stores its encryption key internally on the BOSH Director and CredHub VM, or in an external hardware security module (HSM). The HSM option is more secure.

    Before configuring an HSM encryption provider in the Director Config pane, you must follow the procedures and collect information described in Preparing CredHub HSMs for configuration.

    After you deploy Tanzu Operations Manager with an HSM encryption provider, you cannot change BOSH CredHub to store encryption keys internally.

    CredHub Encryption Provider page

    • Internal: Use this option for internal CredHub key storage. This option is selected by default and requires no additional configuration.
    • Luna HSM: Use this option to use a SafeNet Luna HSM as your permanent CredHub encryption provider, and fill in the following fields:

      If you use multiple HSM hosts, you must use the Tanzu Operations Manager API to set or update the HSM configuration. For more information, see Updating director and Iaas properties (Experimental) in the Tanzu Operations Manager API documentation.

      1. Encryption Key Name: Any name to identify the key that the HSM uses to encrypt and decrypt the CredHub data. Changing this key name after you deploy Tanzu Operations Manager can cause service downtime.
      2. Provider Partition: The partition that stores your encryption key. Changing this partition after you deploy Tanzu Operations Manager could cause service downtime. For this value and the ones that follow, use values gathered in Preparing CredHub HSMs for configuration.
      3. Provider Partition Password
      4. Partition Serial Number
      5. Provider Client Certificate: The certificate that validates the identity of the HSM when CredHub connects as a client.
      6. Provider Client Certificate Private Key
      7. HSM Host Address
      8. HSM Port Address: If you do not know your port address, enter 1792.
      9. HSM Certificate: The certificate that the HSM presents to CredHub to establish a two-way mTLS connection.
  25. Click Blobstore Location to configure the blobstore as either an internal server or an external endpoint.

    After you deploy the BOSH Director, only Tanzu Operations Manager users in Advanced Mode can change the blobstore location. For more information, see Platform operator roles and permissions in Tanzu Operations Manager.

    • Internal: Use this option for an internal blobstore. No additional configuration is required.

    • S3 Compatible Blobstore: Use this option for an external S3-compatible endpoint. To create an S3 bucket, follow the procedures in Sign up for Amazon S3 and Creating a Bucket in the AWS documentation. When you have created an S3 bucket, configure the following fields:

      1. S3 Endpoint:

        1. If you are using a public S3 endpoint:
          1. Locate the endpoint for your region. To find the endpoint, see the Amazon Simple Storage Service (S3) table in Regions and Endpoints in the AWS documentation.
          2. Construct a URL using your region’s endpoint. For example, if you are using the us-west-2 region, the URL you create would be https://s3.us-west-2.amazonaws.com. Enter this URL into the S3 Endpoint field.
        2. If you are using a non-public S3-compatible endpoint:
          1. Enter the URL for the non-public endpoint.
          2. Add the custom public CA certificate you used to sign the S3 endpoint to the Trusted Certificates field on the Director Config page.
      2. Bucket Name: Enter the name of the S3 bucket.

      3. Access Key and Secret Key: Enter the keys you generated when creating your S3 bucket.
      4. Enable signed URLs: Select this check box to configure BOSH VMs to generate short lived, pre-signed URLs for communication between the BOSH Agent and blobstore. If you enable this feature, BOSH Agents do not use credentials to communicate with the blobstore, and VM disks do not store blobstore credentials. This feature is available only for BOSH VMs that use Xenial stemcell line 621 or later.
      5. Select V2 Signature or V4 Signature. If you select V4 Signature, enter your Region. AWS recommends using Signature Version 4. For more information about AWS S3 Signatures, see Authenticating Requests in the AWS documentation.
      6. S3 Backup Strategy: To configure whether and how to back up the BOSH Director’s S3 blobstore, select one of the following options:
        • No backups
        • Use a versioned bucket: This option uses blobstore bucket versioning to save backups. It requires an S3 blobstore that supports versioning.
        • Copy into an additional bucket: This option saves blobstore backups to a separate bucket, which is useful with blobstores that do not support versioning. This option requires you to configure the Backup Bucket Region and Backup Bucket Name fields.
    • GCS Blobstore: Use this option for an external Google Cloud Storage (GCS) endpoint.

      On the Blobstore Location page, select "GCS Blobstore.

      To create a GCS bucket, follow the procedures in Creating Storage Buckets in the GCS documentation. When you have created a GCS bucket, configure the following fields:

      1. Bucket Name: Enter the name of your GCS bucket.
      2. Storage Class: Use this storage class for your GCS bucket. For more information, see Storage Classes in the GCP documentation.
      3. Service Account Key: Enter the contents of the JSON file that you downloaded in Set up IAM Service Accounts in Preparing to Deploy Tanzu Operations Manager on GCP.
      4. GCS Backup Strategy: To configure whether and how to back up the BOSH Director’s GCS blobstore, click one of the following options:
        • No backups
        • Copy into an additional bucket: This option saves blobstore backups to a bucket separate from the blobstore itself, and requires you to configure the Backup Bucket Name text box.
  26. For Database Location, if you configured an external MySQL database such as Cloud SQL, click External MySQL Database and complete the following fields. Otherwise, clickt Internal. For more information about creating a Cloud SQL instance, see Quickstart for Cloud SQL for MySQL in the Google Cloud documentation.

    Use of an External MySQL Database only applies to the BOSH Director. UAA and CredHub do not use these settings and do continue to use the Postgres database colocated with the BOSH Director.

    After you deploy the BOSH Director, you cannot change the Database Location from an External MySQL Database to an Internal database or from an Internal database to an External MySQL Database.

    • Host: Enter the value of your host.
    • Port: Enter your port number. For example, 3306.
    • Username: Enter your username.
    • Password: Enter your password.
    • Database: Enter your database name.

    In addition, if you selected the Enable TLS check box, you can complete the following optional fields:

    • Enable TLS: Selecting this check box enables TLS communication between the BOSH Director and the database.
    • TLS CA: Enter the Certificate Authority for the TLS Certificate.
    • TLS Certificate: Enter the client certificate for mutual TLS connections to the database.
    • TLS Private Key: Enter the client private key for mutual TLS connections to the database.
    • Advanced DB Connection Options: This field accepts a JSON-formatted options string. It can be left blank unless directed by VMware Support.
  27. Click Save.

Step 4: Configure Create Availability Zones

VMware recommends at least three availability zones (AZs) for a highly available installation.

To configure the Create Availability Zones pane:

  1. Click Create Availability Zones.

  2. Click Add.

  3. For Google Availability Zone:

    • Enter one of the zones that you associated to the back end service instance groups of the HTTP(S) load balancer. For example, if you are using the us-central1 region and selected us-central1-a as one of the zones for your HTTP(S) load balancer instance groups, enter us-central1-a.
    • Click Add.
    • Repeat the preceding step for all the AZs that you associated to instance groups in Preparing to deploy Tanzu Operations Manager on GCP.

      Google Cloud Platform Config

    • Click Save.

  4. Repeat the preceding step for all the AZs you are using in your deployment. When you are done, click Save.

Step 5: Configure Create Networks

To configure the Create Networks pane:

  1. Click Create Networks.

  2. Verify that Enable ICMP checks is not selected. GCP routers do not respond to ICMP pings.

  3. Click Add Network. Create the three networks described in the following tables.

    To use a shared VPC network, enter the shared VPC host project name before the network name in the format VPC-PROJECT-NAME/NETWORK-NAME/SUBNET-NAME/REGION-NAME. For example, vpc-project/opsmgr/central/us-central1. For more information, see Configuring a Shared VPC on GCP.

    Infrastructure Network

    Network name infrastructure
    Google network name Enter the name of the infrastructure network that you created in Create a GCP Network with Subnets in Preparing to Deploy Tanzu Operations Manager on GCP.
    The format is: pcf-virt-net/pcf-infrastructure-subnet-MY-REGION/MY-GCP-REGION
    CIDR Enter the name of the CIDR ending in /26 that you used when you created the infrastructure subnet in GCP.
    Example: 192.168.101.0/26
    Reserved IP ranges Enter the first .1 through .9 addresses from the CIDR. For example, if the CIDR is 192.168.101.0/26, enter the range 192.168.101.1-192.168.101.9.
    DNS 169.254.169.254
    Gateway Enter the first .1 address from the CIDR. For example, if the CIDR is 192.168.101.0/26, enter 192.168.101.1.
    Availability zones Select all three AZs.

    Runtime Network

    Name Enter the name of the runtime that you intend to deploy in this environment. For example, pas or pks.
    Google network name Enter the name of the runtime network that you created when you prepared your GCP environment.
    The format is: pcf-virt-net/pcf-RUNTIME-subnet-MY-REGION/MY-GCP-REGION
    CIDR Enter the name of the CIDR ending in /22 that you used when you created the runtime subnet in GCP.
    Example: 192.168.16.0/22
    Reserved IP ranges Enter the first .1 through .9 addresses from the CIDR. For example, if the CIDR is 192.168.16.0/22, enter the range 192.168.16.1-192.168.16.9.
    DNS 169.254.169.254
    Gateway Enter the first .1 address from the CIDR. For example, if the CIDR is 192.168.16.0/22, enter 192.168.16.1.
    Availability zones Select all three AZs.

    Services network

    Network name services
    Google network Name Enter the name of the services network that you created when you prepared your GCP environment.
    The format is: pcf-virt-net/pcf-services-subnet-MY-REGION/MY-GCP-REGION
    CIDR Enter the name of the CIDR ending in /22 that you used when you created the services subnet in GCP.
    Example: 192.168.20.0/22
    Reserved IP ranges Enter the first .1 through .9 addresses from the CIDR. For example, if the CIDR is 192.168.20.0/22, enter the range 192.168.20.1-192.168.20.9.
    DNS 169.254.169.254
    Gateway Enter the first .1 address from the CIDR. For example, if the CIDR is 192.168.20.0/22, enter 192.168.20.1.
    Availability zones Select all three AZs.

    Note After you deploy Ops Manager, you add subnets with overlapping AZs to expand your network. For more information about configuring additional subnets, see Expanding Your Network with Additional Subnets.

    Ensure 169.254.169.254, the IP address of the metadata.google.internal metadata server, is always specified at the beginning of this step's DNS resolver lists.

Step 6: Configure Assign AZs and Networks

To configure the Assign AZs and Networks pane:

  1. Click Assign AZs and Networks.

    Assign AZs and Networks

  2. Use the drop-down menu to select a Singleton Availability Zone. The BOSH Director installs in this AZ.

  3. Under Network, click the infrastructure network for your BOSH Director.

  4. Click Save.

Step 7: Configure security

To configure the Security pane:

  1. Click Security. Trusted certificates

  2. In Trusted Certificates, enter your custom certificate authority (CA) certificates to insert into your organization’s certificate trust chain. This feature enables all BOSH-deployed components in your deployment to trust custom root certificates.

    To enter multiple certificates, paste your certificates one after the other. For example, format your certificates like the following example:

    -----BEGIN CERTIFICATE-----
    ABCDEFGH12345678ABCDEFGH12345678ABCDEFGH12345678AB
    EFGH12345678ABCDEFGH12345678ABCDEFGH12345678ABCDEF
    GH12345678ABCDEFGH12345678ABCDEFGH12345678...
    ------END CERTIFICATE------
    -----BEGIN CERTIFICATE-----
    BCDEFGH12345678ABCDEFGH12345678ABCDEFGH12345678ABB
    EFGH12345678ABCDEFGH12345678ABCDEFGH12345678ABCDEF
    GH12345678ABCDEFGH12345678ABCDEFGH12345678...
    ------END CERTIFICATE------
    -----BEGIN CERTIFICATE-----
    CDEFGH12345678ABCDEFGH12345678ABCDEFGH12345678ABBB
    EFGH12345678ABCDEFGH12345678ABCDEFGH12345678ABCDEF
    GH12345678ABCDEFGH12345678ABCDEFGH12345678...
    ------END CERTIFICATE------
    

    If you want to use Docker registries to run TAS for VMs app instances in Docker containers, enter the certificate for your private Docker registry in this text box. For more information about running app instances in TAS for VMs using Docker registries, see Using Docker Registries.

  3. To include the Tanzu Operations Manager root CA in the Trusted Certificates text box, select the Include Tanzu Ops Manager Root CA in Trusted Certs check box. BOSH Director includes this CA in the trust store of every VM that it deploys.

    If you are using Tanzu Operations Manager to generate certificates for either a load balancer or router, then you must select this check box.

  4. To clear the default trusted certificates from all BOSH-deployed Linux VMs, select the Clear the Default Trusted Certificates Store check box. You must provide your own trusted certificates when selecting this check box as all TLS communication fails without trusted certificates available.

  5. Choose Generate passwords or Use default BOSH password. VMware recommends that you use the Generate passwords option for greater security.

  6. Click Save. To view your saved BOSH Director password, click the Credentials tab.

Step 8: Configure BOSH DNS config

The BOSH DNS Config pane enables you to configure DNS for BOSH Director by adding excluded recursors, a recursor timeout, and handlers.

The text boxes in the BOSH DNS Config pane are:

  • Excluded Recursors: Exclude recursor addresses, which are URL redirects, so that they are not contacted by the BOSH DNS server. For more information about how the BOSH DNS release selects recursors, see Recursors in Native DNS Support in the BOSH documentation.

  • Recursor Timeout: Specify a timeout for the BOSH DNS server to contact any connected recursor addresses. The time limit includes dialing, writing, and reading from the recursor. If any of these actions exceeds the time limit, the action fails.

  • Handlers: Specify recursor addresses that apply to specific domains. For example, you can use handlers to forward all requests to a domain to a private DNS for resolution. For more information about using handlers, see Additional handlers in Native DNS Support in the BOSH documentation.

To add excluded recursors, a recursor timeout, or handlers to the BOSH DNS release:

  1. Click BOSH DNS Config.

    BOSH DNS Config page

  2. (Optional) In Excluded Recursors, enter a list of prohibited recursor addresses.

  3. (Optional) In Recursor Timeout, enter a time limit for contacting the connected recursors. This time limit must include one of the Go parse duration time units. For example, entering 5s sets the timeout limit to five seconds. For more information about supported time units, see func ParseDuration in the Go Programming Language documentation.

  4. (Optional) In Handlers, enter an array of custom domain handlers in JSON format. For example:

    [
      {
        "cache": {
          "enabled": true
        },
        "domain": "example.com",
        "source": {
          "type": "http",
          "url": "http://example.endpoint.local"
        }
      }
    ]
    
  5. Click Save.

Step 9: Configure Syslog

  1. Select Syslog.

  2. (Optional) Select Yes to send BOSH Director system logs to a remote server.

  3. Enter the IP address or DNS name for the remote server in Address.

  4. Enter the port number that the remote server listens on in Port.

  5. Select TCP or UDP from the Transport Protocol dropdown. This selection determines which transport protocol is used to send the logs to the remote server.

  6. (Optional) Select the Enable TLS checkbox to send encrypted logs to remote server with TLS. After you select the checkbox:

    1. Enter either the name or SHA1 fingerprint of the remote peer in Permitted Peer.
    2. Enter the SSL certificate for the remote server in SSL Certificate.

    Note: VMware strongly recommends that you enable TLS encryption when you are forwarding logs. Logs can contain sensitive information, such as cloud provider credentials.

  7. (Optional) Enter a string in Environment identifier. This is a human-readable identifier that is included in each log entry.

  8. (Optional) Enter an integer in Queue Size. This value specifies the number of log messages held in the buffer. The default value is 100,000.

  9. (Optional) Select the checkbox to Forward Debug Logs to an external source. This option is deselected by default. If you select it, you may generate a large amount of log data.

  10. (Optional) Enter configuration details for rsyslog in the Custom rsyslog Configuration field. This field requires the rainerscript syntax.

  11. Click Save.

Step 10: Configure resources

In the Resource Config pane, you must associate load balancers with the VMs in your deployment to enable traffic.

To configure the Resource Config pane:

  1. Click Resource Config.

    Resource Config

  2. To add a load balancer to the BOSH Director, click the icon next to the BOSH Director job name to see the Load Balancers text box and Internet Connected check box. Ensure that the Internet Connected check box is not selected for any job. The check box gives VMs a public IP address that enables outbound internet access. In Preparing to deploy Tanzu Operations Manager on GCP, you provisioned a Network Address Translation (NAT) box to provide internet connectivity to your VMs. For more information about using NAT in GCP, see VPC network overview in the GCP documentation.

    If you install VMware Tanzu Application Service for VMs [Windows] (TAS for VMs [Windows]), provision your Main Compilation Job with at least 100 GB of disk space.

Step 11: Add custom VM extensions (optional)

Use the Tanzu Operations Manager API to add custom properties to your VMs. For example, associated security groups and load balancers. For more information, see Managing custom VM extensions.

Step 12: Complete the BOSH Director installation

To complete your BOSH Director installation:

  1. Click the Tanzu Operations Manager Installation Dashboard link to return to the Installation Dashboard.

  2. Click Review Pending Changes, then Apply Changes.

    If you encounter an error message saying “Cannot reach gateway with IP [IP address] (ignorable if ICMP is disabled)”, return to the Network Config pane and ensure that you have deselected the Enable ICMP Checks check box. Click Review Pending Changes, then click Apply Changes again.

  3. BOSH Director installation begins. This might take a few moments. When the installation process is complete, the Changes Applied dialog box appears.

Next steps

After you followed this procedure, follow the instructions for the runtime you intend to install.

check-circle-line exclamation-circle-line close-line
Scroll to top icon