This topic describes how to configure the BOSH Director tile for VMware vSphere.
You can also perform the procedures in this topic using the Ops Manager API. For more information, see Using the Ops Manager API.
Caution: If you are installing VMware Tanzu Kubernetes Grid Integrated Edition (TKGI) on vSphere with NSX-T integration, follow the instructions in Configuring BOSH Director with NSX-T for TKGI instead of performing the procedure described in this topic.
After you complete this procedure, follow the configuration instructions for the runtime that you choose to install:
To install VMware Tanzu Application Service for VMs (TAS for VMs), see the TAS for VMs documentation.
To install TKGI, see the TKGI documentation.
For more information about VMware Tanzu Operations Manager (Ops Manager) runtimes, see Installing Runtimes.
Before you begin this procedure, you must complete all steps in Deploying Ops Manager to vSphere.
In a web browser, navigate to the fully qualified domain of your Ops Manager.
Log into Ops Manager. To log in, see Log In to Ops Manager For the First Time.
Click the BOSH Director for vSphere tile.
Select vCenter Config. Configure the one or more vCenters that host your Ops Manager foundation, as described in the following steps.
Complete the following fields on the vCenter Config pane:
Virtual Disk Type: The Virtual Disk Type to provision for all VMs. For guidance on selecting a virtual disk type, see vSphere Virtual Disk Types.
Note: Datastores do not support whitespace characters in their names. Including whitespace characters in datastore names causes an error.
Ephemeral Datastore Names (comma delimited): The names of the datastores that store ephemeral VM disks deployed by Ops Manager.
Persistent Datastore Cluster Names (comma delimited): The names of the datastore clusters that store persistent VM disks deployed by Ops Manager. If Datastore Names and Datastore Clusters are specified, both will be considered for disk placement. If you deactivate Storage DRS for a datastore cluster, the BOSH CPI ignores the cluster. For more information, see Activate and Deactivate Storage DRS.
Note: A datastore cluster is a collection of datastores with shared resources and a shared management interface.
To configure networking, complete the vCenter Config fields described below:
Standard vCenter Networking: This is the default option when upgrading Ops Manager. If you select this option, you do not need to configure the NSX-T Networking fields below.
Caution: If you intend to deploy TKGI using Flannel as the CNI, select this option to configure the BOSH Director. Do not choose NSX-T Networking. When you configure the TKGI tile later on, you configure Flannel as the container network interface (CNI).
If you intend to deploy TKGI with NSX-T, see the TKGI documentation.
Caution: When deploying on VMC (vSphere on AWS), you must select Standard vCenter Networking. NSX-T Networking does not work with VMC.
NSX-T Networking: Select this option to allow NSX-T network virtualization for non-TKGI products such as TAS for VMs. This virtualization allows you to configure component load balancing and security in the Resource Config pane of the BOSH Director tile. For more information, see Step 10: Resource Config Pane below.
Configure NSX networking by entering the following information:
Enterprise Administrator privileges.NSX CA Cert: A CA certificate in PEM format that establishes a secure connection to the NSX server before the BOSH Director authenticates to the NSX Manager. If the NSX Manager generated a self-signed certificate, use the following command to retrieve the CA certificate using OpenSSL:
openssl s_client -showcerts -connect NSX-MANAGER-ADDRESS:443 < /dev/null 2> /dev/null | openssl x509
Where NSX-MANAGER-ADDRESS is the address of the NSX manager.
Use NSX-T Policy API Migration Mode: This is a special mode to migrate an existing deployment from earlier NSX-T Manager API objects such as NS Groups to the newer NSX-T Policy API objects such as Groups, and should only be used with NSX-T migration scripts. Leave unchecked if unsure.
Configure the following folder names:
[YOUR-DEPLOYMENT]_vms where YOUR-DEPLOYMENT corresponds to a descriptive name for your deployment. For example, my_pcf_vms.[YOUR-DEPLOYMENT]_templates. For example, my_pcf_templates.[YOUR-DEPLOYMENT]_disk. For example, my_pcf_disk.Note: After initial deployment, you cannot edit folder names.
Click Save.
(Optional) Click Add vCenter Config toward the top of the form to configure additional vCenters. Once you click Save, your multiple vCenter Configs are listed in the vCenter Configs pane. For more information about multiple vCenter configs, see Managing Multiple Data Centers.
To configure the Director Config pane:
Select Director Config.
Enter one or more NTP servers in the NTP Servers (comma delimited) field. For example, us.pool.ntp.org.
Leave the Bosh HM Forwarder IP Address field blank.
Note: Starting in Pivotal Application Service (PAS) v2.0, BOSH-reported component metrics are available in Loggregator Firehose by default. If you continue to use the BOSH HM Forwarder to consume these component metrics, you might receive duplicate data. To prevent this, leave the Bosh HM Forwarder IP Address field blank.
Select the Enable VM Resurrector Plugin checkbox to enable the BOSH Resurrector functionality and increase your runtime availability. If you intend to install TAS for VMs, see Using the BOSH Resurrector for more information about the Resurrector plugin.
If you want to collect detailed metrics from BOSH-managed VMs, activate the Enable additional System Metrics checkbox. For a list of metrics that the System Metrics Agent collects from BOSH-managed VMs, see System Metrics Agent on GitHub.
Select Enable Post Deploy Scripts to run a post-deploy script after deployment. This script allows the job to execute additional commands against a deployment.
Note: If you intend to install VMware Tanzu Kubernetes Grid Integrated Edition (TKGI), you must enable post-deploy scripts.
To configure your VMs to use short-lived NATS credentials during the bootstrap process, activate the Enable Short Lived NATS Bootstrap Credentials checkbox. This increases the security of your Ops Manager deployment by rotating the TLS certificate that the BOSH Agents in your VMs use to communicate with the BOSH Director through BOSH NATS. For more information, see Using Short-Lived NATS Bootstrap Credentials.
Select Recreate VMs deployed by the BOSH Director to force BOSH to re-create BOSH-deployed VMs on the next deploy. This process does not re-create the BOSH Director VM or destroy any persistent disk data. This checkbox is cleared automatically after a successful re-deployment.
Select Recreate BOSH Director VMs to force the BOSH Director VM to be re-created on the next deploy. This process does not destroy any persistent disk data. This checkbox is cleared automatically after a successful re-deployment.
Select Recreate All Persistent Disks to force BOSH to migrate and re-create persistent disks for the BOSH Director and all tiles. This process does not destroy any persistent disk data. This checkbox is cleared automatically after a successful re-deployment.
Select Enable bosh deploy retries to instruct Ops Manager to retry failed BOSH operations up to five times.
Select Skip Director Drain Lifecycle to prevent drain scripts from running when the BOSH Director is re-created.
Select Store BOSH Job Credentials on tmpfs (beta) to store credentials for BOSH jobs on temporary file storage (tmpfs) memory, rather than on disk. You must re-create all BOSH-deployed VMs for this setting to take effect.
Select Keep Unreachable Director VMs to preserve BOSH Director VMs after a failed deployment for troubleshooting purposes.
(Optional) Modify the Director Workers value, which sets the number of workers available to execute BOSH Director tasks. This field defaults to 5.
(Optional) Max Threads sets the maximum number of threads that the BOSH Director can run simultaneously. VMware recommends that you leave the field blank to use the default value, unless doing so results in rate limiting or errors on your IaaS.
(Optional) To add a custom URL for your BOSH Director, enter a valid hostname in Director Hostname. You can also use this field to configure a load balancer in front of your BOSH Director. For more information, see How to Set Up a Load Balancer in Front of Operations Manager Director in the VMware Tanzu Support knowledge base.
(Optional) To set a custom banner that users see when logging in to the BOSH Director using SSH, enter text in the Custom SSH Banner field.
(Optional) Enter your comma-separated custom Identification Tags. For example, iaas:foundation1, hello:world. You can use the tags to identify your foundation when viewing VMs or disks from your IaaS.
For Certificate Duration Overrides, you can choose whether certificates generated within Ops Manager and CredHub use the default duration specified for the certificate or a custom duration value that you specify.
On: Select this option to set a value to override the duration for certificates created by all products. If a product creates a certificate with a longer duration than the value you set, then the longer duration is used.
Note: After you set a certificate duration override, you must take additional steps to apply the setting to all certificates. For more information, see Overriding Duration for Certificates.
Select HM Pager Duty Plugin to enable Health Monitor integration with PagerDuty.
Select HM Pager Duty Plugin to enable Health Monitor integration with PagerDuty.
Select HM Email Plugin to enable Health Monitor integration with email.
For CredHub Encryption Provider, you can choose whether BOSH CredHub stores its encryption key internally on the BOSH Director and CredHub VM, or in an external hardware security module (HSM). The HSM option is more secure.
Before configuring an HSM encryption provider in the Director Config pane, you must follow the procedures and collect information described in Preparing CredHub HSMs for Configuration.
Note: After you deploy Ops Manager with an HSM encryption provider, you cannot change BOSH CredHub to store encryption keys internally.
Luna HSM: Select this option to use a SafeNet Luna HSM as your permanent CredHub encryption provider, and fill in the following fields:
Note: If you use multiple HSM hosts, you must use the Ops Manager API to set or update the HSM configuration. For more information, see Updating director and Iaas properties (Experimental) in the Ops Manager API documentation.
1792.Select a Blobstore Location to either configure the blobstore as an internal server or an external endpoint. Because the internal server is unscalable and less secure, VMware recommends that you configure an external blobstore.
Note: After you deploy the BOSH Director, only Ops Manager users in Advanced Mode can change the blobstore location. For more information, see Ops Manager Fields That Lock On Deploy.
Internal: Select this option to use an internal blobstore. Ops Manager creates a new VM for blob storage. No additional configuration is required.
S3 Compatible Blobstore: Select this option to use an external S3-compatible endpoint. To create an S3 bucket, follow the procedures in Sign up for Amazon S3 and Creating a Bucket in the AWS documentation. When you have created an S3 bucket, configure the following fields:
S3 Endpoint:
us-west-2 region, the URL you create would be https://s3.us-west-2.amazonaws.com. Enter this URL into the S3 Endpoint field.Bucket Name: Enter the name of the S3 bucket.
Important: AWS ends support for path-style URLs for all S3 buckets created after September 30, 2020. For more information, see Support for Virtual-Hosted-Style URLs for AWS S3 Blobstores.
Note: This feature is only available for BOSH VMs that use Xenial stemcell line 621 or later.
Note: AWS recommends using Signature Version 4. For more information about AWS S3 Signatures, see Authenticating Requests in the AWS documentation.
GCS Blobstore: Select this option to use an external Google Cloud Storage (GCS) endpoint.
To create a GCS bucket, follow the procedures in Creating Storage Buckets in the GCS documentation. To create a GCS bucket, you must have a GCS account. When you have created a GCS bucket, configure the following fields:
Select a Database Location. By default, Ops Manager deploys and manages an Internal database for you. If you choose to use an External MySQL Database, complete the associated fields with information obtained from your external MySQL Database provider: Host, Port, Username, Password, and Database.
Note: Use of an External MySQL Database only applies to the BOSH Director. UAA and CredHub will not use these settings and will continue to use the Postgres database colocated with the BOSH Director.
Caution: After you deploy the BOSH Director, you cannot change the Database Location from an External MySQL Database to an Internal database or from an Internal database to an External MySQL Database.
In addition, if you selected the Enable TLS for Director Database checkbox, you can complete the following optional fields:
Click Save.
Ops Manager Availability Zones (AZs) correspond to your vCenter clusters, resource pools or host groups.
Multiple AZs allow you to provide high availability and load balancing to your applications. When you run more than one instance of an application, Ops Manager balances those instances across all of the AZs assigned to the application.
VMware recommends that you use at least three AZs for a highly available installation of your chosen runtime.
Note: For more information about AZs and high availability in vSphere, see Compute and HA Considerations in vSphere Reference Architecture.
Select Create Availability Zones.
Use the following steps to create the first AZ.
Cluster1.RP-MGMT. The jobs running in this AZ share the CPU and memory resources defined by the pool. You only need to specify this resource group in one AZ.Note: The value for VM-Host Affinity Rule only applies if you are using Host Groups. If you do not specify a Host Group for the cluster, then any changes you make to VM-Host Affinity Rule are ignored.
(Optional) Use the following steps to create additional AZs.
Click Save.
Select Create Networks.
Select Enable ICMP checks to enable ICMP on your networks. Ops Manager uses ICMP checks to confirm that components within your network are reachable.
Depending on the runtime that you are deploying, do one of the following:
For TAS for VMs, click Add Network and create the following networks:
infrastructure: This network is for Ops Manager and the BOSH Director.pas: This network is for all the TAS for VMs VMs including GoRouter, Diego cells, and Cloud Controller.services: This network is for any service tiles to be deployed alongside TAS for VMs.
Use the values from the following table as a guide when you create each network, replacing the IP addresses with ranges that are available in your vSphere environment:
| Infrastructure Network |
Field | Configuration Example |
|---|---|---|
| Name | infrastructure |
|
| vSphere Network Name * | pcf-virt-net/infrastructure |
|
| CIDR | 192.168.101.0/24 |
|
| Reserved IP Ranges † | 192.168.101.1-192.168.101.9 |
|
| DNS | 192.168.101.2 |
|
| Gateway | 192.168.101.1 |
|
| Deployment Network | Field | Configuration Example |
| Name | pas |
|
| vSphere Network Name * | pcf-virt-net/pcf-pas-subnet |
|
| CIDR | 192.168.16.0/24 |
|
| Reserved IP Ranges † | 192.168.16.1-192.168.16.9 |
|
| DNS | 192.168.16.2 |
|
| Gateway | 192.168.16.1 |
|
| Services Network | Field | Configuration Example |
| Name | services |
|
| vSphere Network Name * | pcf-virt-net/pcf-services-subnet |
|
| CIDR | 192.168.20.0/24 |
|
| Reserved IP Ranges † | 192.168.20.1-192.168.20.9 |
|
| DNS | 192.168.20.2 |
|
| Gateway | 192.168.20.1 |
* In vSphere Network Name, enter the full path of the network as it displays in vCenter. For example, enter YOUR-DIRECTORY-NAME/YOUR-NETWORK-NAME. If your vSphere Network Name contains a forward slash character, replace the forward slash with the URL-encoded forward slash character %2f.
† For Reserved IP Ranges, enter any IP addresses from the CIDR that you do not want BOSH to use in your installation. Ops Manager will not deploy VMs to any address in this range.
For TKGI, click Add Network and create the following networks:
infrastructure: This network is for Ops Manager, the BOSH Director, the TKGI broker, and the TKGI API.pks: If you have a large deployment with multiple tiles, you can choose to deploy the TKGI broker and TKGI API to a separate network named pks. For more information, see the table below for more information.services: Network for creating the master and worker VMs for Kubernetes clusters. The CIDR should not conflict with the pod overlay network 10.200.0.0/16 or the reserved Kubernetes services CIDR of 10.100.200.0/24.
Note: Multiple networks allow you to place vCenter on a private network and the rest of your deployment on a public network. Isolating vCenter in this manner denies access to it from outside sources and reduces possible security vulnerabilities.
Use the values from the following table as a guide when you create each network, replacing the IP addresses with ranges that are available in your vSphere environment:
| Infrastructure Network |
Field | Configuration Example |
|---|---|---|
| Name | infrastructure |
|
| vSphere Network Name * | pcf-virt-net/pks-infrastructure-subnet |
|
| CIDR | 192.168.101.0/26 |
|
| Reserved IP Ranges † | 192.168.101.1-192.168.101.9 |
|
| DNS | 192.168.101.2 |
|
| Gateway | 192.168.101.1 |
|
| Main Network (Optional) | Field | Configuration Example |
| Name | pks |
|
| vSphere Network Name * | pcf-virt-net/pks-subnet |
|
| CIDR | 192.168.16.0/26 |
|
| Reserved IP Ranges † | 192.168.16.1-192.168.16.9 |
|
| DNS | 192.168.16.2 |
|
| Gateway | 192.168.16.1 |
|
| Service Network | Field | Configuration Example |
| Name | services |
|
| vSphere Network Name * | pcf-virt-net/pks-service-subnet |
|
| CIDR | 192.168.20.0/22 |
|
| Reserved IP Ranges † | 192.168.20.1-192.168.20.9 |
|
| DNS | 192.168.20.2 |
|
| Gateway | 192.168.20.1 |
* In vSphere Network Name, enter the full path of the network as it displays in vCenter. For example, enter YOUR-DIRECTORY-NAME/YOUR-NETWORK-NAME. If your vSphere Network Name contains a forward slash character, replace the forward slash with the URL-encoded forward slash character %2f.
† For Reserved IP Ranges, enter any IP addresses from the CIDR that you do not want BOSH to use in your installation. Ops Manager will not deploy VMs to any address in this range.
For each network that you create, select the Availability Zones to use with the network. Assign as many AZs to your network as needed by your deployment. For more information, see Compute and HA Considerations and Scaling and Capacity Managment sections of the vSphere Reference Architecture.
Click Save.
Select Assign AZs and Networks.
Use the Singleton Availability Zone drop-down menu to select a singleton AZ. The BOSH Director is installed as a single instance in this Availability Zone.
Use the Network drop-down menu to select a network for your BOSH Director.
Click Save.
Select Security. 
In Trusted Certificates, enter your custom certificate authority (CA) certificates to insert into your organization’s certificate trust chain. This feature enables all BOSH-deployed components in your deployment to trust custom root certificates.
To enter multiple certificates, paste your certificates one after the other. For example, format your certificates like the example below:
-----BEGIN CERTIFICATE----- ABCDEFGH12345678ABCDEFGH12345678ABCDEFGH12345678AB EFGH12345678ABCDEFGH12345678ABCDEFGH12345678ABCDEF GH12345678ABCDEFGH12345678ABCDEFGH12345678... ------END CERTIFICATE------ -----BEGIN CERTIFICATE----- BCDEFGH12345678ABCDEFGH12345678ABCDEFGH12345678ABB EFGH12345678ABCDEFGH12345678ABCDEFGH12345678ABCDEF GH12345678ABCDEFGH12345678ABCDEFGH12345678... ------END CERTIFICATE------ -----BEGIN CERTIFICATE----- CDEFGH12345678ABCDEFGH12345678ABCDEFGH12345678ABBB EFGH12345678ABCDEFGH12345678ABCDEFGH12345678ABCDEF GH12345678ABCDEFGH12345678ABCDEFGH12345678... ------END CERTIFICATE------
Note: If you want to use Docker registries to run TAS for VMs app instances in Docker containers, enter the certificate for your private Docker registry in this field. For more information about running app instances in TAS for VMs using Docker registries, see Using Docker Registries.
To include the Ops Manager root CA in the Trusted Certificates field, select the Include OpsManager Root CA in Trusted Certs checkbox. BOSH Director includes this CA in the trust store of every VM that it deploys.
Important: If you are using Ops Manager to generate certificates for either a load balancer or router, then you must select this checkbox.
To clear the default trusted certificates from all BOSH-deployed Linux VMs, select the Clear the Default Trusted Certificates Store checkbox. You must provide your own trusted certificates when selecting this checkbox as all TLS communication fails without trusted certificates available.
Choose Generate passwords or Use default BOSH password. VMware recommends that you use the Generate passwords option for greater security.
Click Save. To view your saved BOSH Director password, click the Credentials tab.
The BOSH DNS Config pane allows you to configure DNS for BOSH Director by adding excluded recursors, a recursor timeout, and handlers.
The fields in the BOSH DNS Config pane are:
Excluded Recursors: Exclude recursor addresses, which are URL redirects, so that they are not contacted by the BOSH DNS server. For more information about how the BOSH DNS release selects recursors, see Recursors in Native DNS Support in the BOSH documentation.
Recursor Timeout: Specify a timeout for the BOSH DNS server to contact any connected recursor addresses. The time limit includes dialing, writing, and reading from the recursor. If any of these actions exceeds the time limit, the action fails.
Handlers: Specify recursor addresses that apply to specific domains. For example, you can use handlers to forward all requests to a domain to a private DNS for resolution. For more information about using handlers, see Additional Handlers in Native DNS Support in the BOSH documentation.
To add excluded recursors, a recursor timeout, or handlers to the BOSH DNS release:
Select BOSH DNS Config.
(Optional) In Excluded Recursors, enter a list of prohibited recursor addresses.
(Optional) In Recursor Timeout, enter a time limit for contacting the connected recursors.
Note: This time limit must include one of the Go parse duration time units. For example, entering 5s sets the timeout limit to five seconds. For more information about supported time units, see func ParseDuration in the Go Programming Language documentation.
(Optional) In Handlers, enter an array of custom domain handlers in JSON format. For example:
[
{
"cache": {
"enabled": true
},
"domain": "example.com",
"source": {
"type": "http",
"url": "http://example.endpoint.local"
}
}
]
Click Save.
Note: BOSH Director logs contain sensitive information that should be considered privileged. For example, these logs may contain cloud provider credentials. If you choose to forward logs to an external syslog endpoint, use TLS encryption to prevent information from being intercepted by a third party.
Select Syslog.
(Optional) Select Yes to send BOSH Director system logs to a remote server.
Enter the IP address or DNS name for the remote server in Address.
Enter the port number that the remote server listens on in Port.
Select TCP or UDP from the Transport Protocol dropdown. This selection determines which transport protocol is used to send the logs to the remote server.
(Optional) Select the Enable TLS checkbox to send encrypted logs to remote server with TLS. After you select the checkbox:
Note: VMware strongly recommends that you enable TLS encryption when you are forwarding logs. Logs can contain sensitive information, such as cloud provider credentials.
(Optional) Enter an integer in Queue Size. This value specifies the number of log messages held in the buffer. The default value is 100,000.
(Optional) Select the checkbox to Forward Debug Logs to an external source. This option is deselected by default. If you select it, you may generate a large amount of log data.
(Optional) Enter configuration details for rsyslog in the Custom rsyslog Configuration field. This field requires the rainerscript syntax.
Click Save.
Click Resource Config.
Under the Instances, VM Type, and Persistent Disk Type fields, choose Automatic from the drop-down menus to allocate the recommended resources for the job.
If the Persistent Disk Type field displays the value None, the job does not require persistent disk space.
Note: For the BOSH Director job, select a VM type with at least 8 GB memory.
Note: If you set a field to Automatic and the recommended resource allocation changes in a future version, Ops Manager automatically uses the updated recommended allocation.
Note: If you install VMware Tanzu Application Service for VMs [Windows] (TAS for VMs [Windows]), provision your Main Compilation Job with at least 100 GB of disk space.
(Optional) If you configured NSX-T networking in the vCenter Config pane, and you want to configure security and load balancing for the BOSH Director job:
Click Save.
Use the Ops Manager API to add custom properties to your VMs such as associated security groups and load balancers. For more information, see Managing Custom VM Extensions.
Click the Ops Manager Installation Dashboard link to return to the Installation Dashboard.
Click Review Pending Changes. Select the product that you intend to deploy and review the changes. For more information, see Reviewing Pending Product Changes.
After you complete this procedure, follow the instructions for the runtime that you intend to install:
To install TAS for VMs, see the TAS for VMs documentation.
To install TKGI, see the TKGI documentation.
For more information about Ops Manager runtimes, see Installing Runtimes.
