text:
Deploying PAS on AWS Using Terraform
- Step 1: Add PAS to Ops Manager
- Step 2: Assign Availability Zones and Networks
- Step 3: Configure Domains
- Step 4: Configure Networking
- Step 5: Configure Application Containers
- Step 6: Configure Application Developer Controls
- Step 7: Review Application Security Groups
- Step 8: Configure UAA
- Step 9: Configure CredHub
- Step 10: Configure Authentication and Enterprise SSO
- Step 11: Configure System Databases
- Step 13: (Optional) Configure Internal MySQL
- Step 14: Configure File Storage
- Step 15: (Optional) Configure System Logging
- Step 16: (Optional) Customize Apps
- Step 17: (Optional) Configure Email Notifications
- Step 18: (Optional) Configure App Autoscaler
- Step 19: Configure Cloud Controller
- Step 20: Configure Smoke Tests
- Step 21: (Optional) Enable Advanced Features
- Step 20: (Optional) Metric Registrar
- Step 22: Configure Errands
- Step 23: Register Router or HAProxy to Elastic Load Balancer
- Step 24: (Optional) Scale Down and Disable Resources
- Step 25: Download Stemcell
- Step 26: Complete the PAS Installation
Page last updated:
Warning: Pivotal Cloud Foundry (PCF) v2.4 is no longer supported because it has reached the End of General Support (EOGS) phase as defined by the Support Lifecycle Policy. To stay up to date with the latest software and security updates, upgrade to a supported version.
This topic describes how to install and configure Pivotal Application Service (PAS) on Amazon Web Services (AWS).
Before beginning this procedure, ensure that you have successfully completed the Configuring BOSH Director on AWS Using Terraform topic.
Note: If you plan to install the PCF IPsec add-on, you must do so before installing any other tiles. Pivotal recommends installing IPsec immediately after Ops Manager, and before installing the PAS tile.
Step 1: Add PAS to Ops Manager
If you have not already downloaded PAS, log in to Pivotal Network and click PAS.
From the Releases dropdown, select the release to install and choose one of the following:
- Click PAS to download the PAS
- Click PCF Small Footprint Runtime to download the Small Footprint Runtime
.pivotalfile. For more information, see Getting Started with Small Footprint Runtime.
- Click PAS to download the PAS
Navigate to the Pivotal Cloud Foundry Operations Manager Installation Dashboard.
Click Import a Product to add your tile to Ops Manager. For more information, refer to the Adding and Deleting Products topic.
Click the PAS tile in the Installation Dashboard.
Step 2: Assign Availability Zones and Networks
Select Assign AZ and Networks.
Select an Availability Zone under Place singleton jobs. Ops Manager runs any job with a single instance in this Availability Zone.
Select all three Availability Zones under Balance other jobs. Ops Manager balances instances of jobs with more than one instance across the Availability Zones that you specify.
From the Network dropdown, choose the
pasnetwork you created when configuring the BOSH Director tile.
Click Save.
Note: When you save this form, a verification error displays because the PCF security group blocks ICMP. You can ignore this error.
Step 3: Configure Domains
Select Domains.
Enter the system and application domains.
- For System Domain, enter the value of
sys_domainfrom the Terraform output. This defines your target when you push apps to PAS.
- For Apps Domain, enter the value of
apps_domainfrom the Terraform output. This defines where PAS should serve your apps.
Note: You configured a wildcard DNS record for these domains in an earlier step.
- For System Domain, enter the value of
Click Save.
Step 4: Configure Networking
Select Networking.
Leave the Router IPs, SSH Proxy IPs, HAProxy IPs, and TCP Router IPs fields blank. You do not need to complete these fields when deploying PCF to AWS with Elastic Load Balancers (ELBs).
Note: You specify load balancers in the Resource Config section of Pivotal Application Service (PAS) later in the installation process. See the Configure Router to Elastic Load Balancer section of this topic for more information.
Under Certificates and Private Key for HAProxy and Router, you must provide at least one Certificate and Private Key name and certificate key pair for HAProxy and Gorouter. The HAProxy and Gorouter are enabled to receive TLS communication by default. You can configure multiple certificates for HAProxy and Gorouter.
- Click the Add button to add a name for the certificate chain and its private key pair. This certificate is the default used by Gorouter and HAProxy.
You can either provide a certificate signed by a Certificate Authority (CA) or click on the Generate RSA Certificate link to generate a certificate in Ops Manager.
Note: If you configured Ops Manager Front End without a certificate, you can use this new certificate to complete Ops Manager configuration. To configure your Ops Manager Front End certificate, see Configure Front End in Preparing to Deploy Ops Manager on GCP Manually.
- If you want to configure multiple certificates for HAProxy and Gorouter, click the Add button and fill in the appropriate fields for each additional certificate key pair.
For details about generating certificates in Ops Manager for your wildcard system domains, see the Providing a Certificate for Your SSL/TLS Termination Point topic.
Note: Ensure that you add any certificates that you generate in this pane to your infrastructure load balancer.
- Click the Add button to add a name for the certificate chain and its private key pair. This certificate is the default used by Gorouter and HAProxy. You can either provide a certificate signed by a Certificate Authority (CA) or click on the Generate RSA Certificate link to generate a certificate in Ops Manager.
(Optional) When validating client requests using mutual TLS, the Gorouter trusts multiple certificate authorities (CAs) by default. To configure HAProxy to trust the same CAs as the Gorouter, enter your CA certificates under Certificate Authorities trusted by Router and HAProxy. All CA certificates should be appended together into a single collection of PEM-encoded entries.
In the Minimum version of TLS supported by HAProxy and Router field, select the minimum version of TLS to use in HAProxy and Gorouter communications. HAProxy and Gorouter use TLS v1.2 by default. If you need to accommodate clients that use an older version of TLS, select a lower minimum version. For a list of TLS ciphers supported by the Gorouter, see Securing Traffic into Cloud Foundry.
Configure Logging of Client IPs in CF Router. The Log client IPs option is set by default. To comply with the General Data Protection Regulation (GDPR), select one of the following options to disable logging of client IP addresses:
- If your load balancer exposes its own source IP address, disable logging of the
X-Forwarded-ForHTTP header only.
- If your load balancer exposes the source IP of the originating client, disable logging of both the source IP address and the
X-Forwarded-ForHTTP header.
- If your load balancer exposes its own source IP address, disable logging of the
Under Configure support for the X-Forwarded-Client-Cert header, configure PCF handles
x-forwarded-client-cert(XFCC) HTTP headers based on where TLS is terminated for the first time in your deployment. The following table indicates which option to choose based on your deployment layout.
If your deployment is configured as follows: Then select the following option: Additional notes:
- The Load Balancer is terminating TLS, and
- Load balancer is configured to put the client certificate from a mutual authentication TLS handshake into the X-Forwarded-Client-Cert HTTP header
TLS terminated for the first time at infrastructure load balancer (default). Both HAProxy and the Gorouter forward the XFCC header when included in the request.
- The Load Balancer is configured to pass through the TLS handshake via TCP to the instances of HAProxy, and
- HAProxy instance count is > 0
TLS terminated for the first time at HAProxy. HAProxy sets the XFCC header with the client certificate received in the TLS handshake. The Gorouter forwards the header.
Breaking Change: If you select the Router does not request client certificates option in the Router behavior for client certificate validation field, the XFCC header cannot be delivered to apps.
- The Load Balancer is configured to pass through the TLS handshake via TCP to instances of the Gorouter
TLS terminated for the first time at the Gorouter. The Gorouter strips the XFCC header if it is included in the request and forwards the client certificate received in the TLS handshake in a new XFCC header.
If you have deployed instances of HAProxy, app traffic bypasses those instances in this configuration. If you have also configured your load balancer to route requests for ssh directly to the Diego Brain, consider reducing HAProxy instances to 0.
Breaking Change: If you select the Router does not request client certificates option in the Router behavior for client certificate validation field, the XFCC header cannot be delivered to apps.
For a description of the behavior of each configuration option, see Forward Client Certificate to Applications.
To configure HAProxy to handle client certificates, select one of the following options in the HAProxy behavior for Client Certificate Validation field.
- HAProxy does not request client certificates. This option requires mutual authentication, which makes it incompatible with XFCC option TLS terminated for the first time at HAProxy. HAProxy does not request client certificates, so the client does not provide them and no validation occurs. This is the default configuration.
- HAProxy requests but does not require client certificates. The HAProxy requests client certificates in TLS handshakes, validates them when presented, but does not require them.
WARNING: Upon upgrade, PAS will fail to receive requests if your load balancer is configured to present a client certificate in the TLS handshake with HAProxy but HAProxy has not been configured with the certificate authority used to sign it. To mitigate this issue, select HAProxy does not request client certificates in the Networking pane or configure the HAProxy with the appropriate CA.
To configure Gorouter behavior for handling client certificates, select one of the following options in the Router behavior for Client Certificate Validation field:
- Router does not request client certificates: Client certificates are not requested, so the client does not provide them, and validation of client certificates does not occur. This option is incompatible with support for the XFCC header when the TLS termination point options HAProxy and Router are selected because these options require mutual authentication.
- Router requests but does not require client certificates: The Gorouter requests client certificates in TLS handshakes and validates them when presented, but does not require them. This is the default configuration.
- Router requires client certificates: The Gorouter validates that the client certificate is signed by a Certificate Authority that the Gorouter trusts. If the Gorouter cannot validate the client certificate, the TLS handshake fails.
Warning: Requests to the platform fail upon upgrade if your load balancer is configured with client certificates and the Gorouter does not have the CA. To mitigate this issue, select Router does not request client certificates.
In the TLS Cipher Suites for Router field, review the TLS cipher suites for TLS handshakes between Gorouter and front-end clients such as load balancers or HAProxy. The default value for this field is
Note: AWS Classic Load Balancers do not support PCF's default cipher suites. See TLS Cipher Suite Support by AWS Load Balancers for information about configuring your AWS load balancers and Gorouter.If you want to modify the default configuration, use an ordered, colon-delimited list of Golang-supported TLS cipher suites in the OpenSSL format.
Operators should verify that the ciphers are supported by any clients or front-end components that will initiate TLS handshakes with Gorouter. For a list of TLS ciphers supported by Gorouter, see Securing Traffic into Cloud Foundry. Verify that every client participating in TLS handshakes with Gorouter has at least one cipher suite in common with Gorouter.
Note: Specify cipher suites that are supported by the versions configured in the Minimum version of TLS supported by HAProxy and Router field.
In the TLS Cipher Suites for HAProxy field, review the TLS cipher suites for TLS handshakes between HAProxy and its clients such as load balancers and Gorouter. The default value for this field is the following:
DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384If you want to modify the default configuration, use an ordered, colon-delimited list of TLS cipher suites in the OpenSSL format.
Operators should verify that the ciphers are supported by any clients or front-end components that will initiate TLS handshakes with HAProxy. Verify that every client participating in TLS handshakes with HAProxy has at least one cipher suite in common with HAProxy.
Note: Specify cipher suites that are supported by the versions configured in the Minimum version of TLS supported by HAProxy and Router field.
Under HAProxy forwards requests to Router over TLS, select Enable or Disable based on your deployment layout.
- Enable HAProxy forwarding of requests to Router over TLS
If you want to: Encrypt communication between HAProxy and the Gorouter Then configure the following:
- Leave Enable selected.
- In the Certificate Authority for HAProxy Backend field, specify the Certificate Authority (CA) that signed the certificate you configured in the Certificate and Private Key for HAProxy and Router field.
Note: If you used the Generate RSA Certificate link to generate a certificate, then the CA to specify is the Ops Manager CA, which you can locate at the
/api/v0/certificate_authoritiesendpoint in the Ops Manager API.
- Make sure that Gorouter and HAProxy have TLS cipher suites in common in the TLS Cipher Suites for Router and TLS Cipher Suites for HAProxy fields.
See also:
- Disable HAProxy forwarding of requests to Router over TLS
If you want to: Use non-encrypted communication between HAProxy and Gorouter, or you are not using HAProxy Then configure the following:
- Select Disable.
- If you are not using HAProxy, set the number of HAProxy job instances to
0on the Resource Config page. See Disable Unused Resources.
See also:
If you want to force browsers to use HTTPS when making requests to HAProxy, select Enable in the HAProxy support for HSTS field, and complete the following optional configuration steps:
- (Optional) Enter a Max Age in Seconds for the HSTS request. By default, the age is set to one year. HAProxy will force HTTPS requests from browsers for the duration of this setting.
- (Optional) Select the Include Subdomains checkbox to force browsers to use HTTPS requests for all component subdomains.
- (Optional) Select the Enable Preload checkbox to force instances of Google Chrome, Firefox, and Safari that access your HAProxy to refer to their built-in lists of known hosts that require HTTPS, of which HAProxy is one. This ensures that the first contact a browser has with your HAProxy is an HTTPS request, even if the browser has not yet received an HSTS header from HAProxy.
If you are not using SSL encryption or if you are using self-signed certificates, select the Disable SSL certificate verification for this environment checkbox. Enabling this checkbox also disables SSL verification for route services and disables mutual TLS app identity verification.
Note: For production deployments, Pivotal does not recommend disabling SSL certificate verification.
(Optional) If you want HAProxy or the Gorouter to reject any HTTP (non-encrypted) traffic, select the Disable HTTP on HAProxy and Gorouter checkbox. When selected, HAProxy and Gorouter will not listen on port 80.
(Optional) Select the Disable insecure cookies on the Router checkbox to set the secure flag for cookies generated by the router.
(Optional) To disable the addition of Zipkin tracing headers on the Gorouter, deselect the Enable Zipkin tracing headers on the router checkbox. Zipkin tracing headers are enabled by default. For more information about using Zipkin trace logging headers, see Zipkin Tracing in HTTP Headers.
(Optional) To stop the Router from writing access logs to local disk, deselect the Enable Router to write access logs locally checkbox. You should consider disabling this checkbox for high traffic deployments since logs may not be rotated fast enough and can fill up the disk.
By default, the PAS routers handle traffic for applications deployed to an isolation segment created by the PCF Isolation Segment tile. To configure the PAS routers to reject requests for applications within isolation segments, select the Routers reject requests for Isolation Segments checkbox. Do not enable this option without deploying routers for each isolation segment. See the following topics for more information:
(Optional) By default, Gorouter support for the PROXY protocol is disabled. To enable the PROXY protocol, select Enable support for PROXY protocol in CF Router. When enabled, client-side load balancers that terminate TLS but do not support HTTP can pass along information from the originating client. Enabling this option may impact Gorouter performance. For more information about enabling the PROXY protocol in Gorouter, see the HTTP Header Forwarding sections in the Securing Traffic in Cloud Foundry topic.
In the Choose whether to enable route services section, choose either Enable route services or Disable route services. Route services are a class of marketplace services that perform filtering or content transformation on application requests and responses. See the Route Services topic for details.
- If you enabled route services, you can also configure the Bypass security checks for route service lookup field. Pivotal recommends that you do not enable this field because it has potential security concerns. However, you may need to enable it if your load balancer requires mutual TLS from clients. For more information, see Configuring Route Service Lookup.
(Optional) If you want to limit the number of app connections to the backend, enter a value in the Max Connections Per Backend field. You can use this field to prevent a poorly behaving app from all the connections and impacting other apps.
To choose a value for this field, review the peak concurrent connections received by instances of the most popular apps in your deployment. You can determine the number of concurrent connections for an app from the
httpStartStopevent metrics emitted for each app request.
If your deployment uses PCF Metrics, you can also obtain this peak concurrent connection information from Network Metrics. The default value is
Under Enable Keepalive Connections for Router, select Enable or Disable. Keep-alive connections are enabled by default. For more information, see Keepalive Connections in HTTP Routing.
(Optional) To accommodate larger uploads over connections with high latency, increase the number of seconds in the Router Timeout to Backends field.
(Optional) Use the Frontend Idle Timeout for Gorouter and HAProxy field to help prevent connections from your load balancer to Gorouter or HAProxy from being closed prematurely. The value you enter sets the duration, in seconds, that Gorouter or HAProxy maintains an idle open connection from a load balancer that supports keep-alive.
In general, set the value higher than your load balancer's backend idle timeout to avoid the race condition where the load balancer sends a request before it discovers that Gorouter or HAProxy has closed the connection.
See the following table for specific guidance and exceptions to this rule:
IaaS Guidance AWS AWS ELB has a default timeout of 60 seconds, so Pivotal recommends a value greater than
Azure By default, Azure load balancer times out at 240 seconds without sending a TCP RST to clients, so as an exception, Pivotal recommends a value lower than
240to force the load balancer to send the TCP RST.
GCP GCP has a default timeout of 600 seconds. For GCP HTTP load balancers, Pivotal recommends a value greater than
600. For GCP TCP load balancers, pivotal recommends a value less than
600to force the load balancer to send a TCP RST.
Other Set the timeout value to be greater than that of the load balancer's backend idle timeout.
Note: Do not set a frontend idle timeout lower than six seconds.
(Optional) Increase the value of Load Balancer Unhealthy Threshold to specify the amount of time, in seconds, that the router continues to accept connections before shutting down. During this period, healthchecks may report the router as unhealthy, which causes load balancers to failover to other routers. Set this value to an amount greater than or equal to the maximum time it takes your load balancer to consider a router instance unhealthy, given contiguous failed healthchecks.
(Optional) Modify the value of Load Balancer Healthy Threshold. This field specifies the amount of time, in seconds, to wait until declaring the Router instance started. This allows an external load balancer time to register the Router instance as healthy.
(Optional) If app developers in your organization want certain HTTP headers to appear in their app logs with information from the Gorouter, specify them in the HTTP Headers to Log field. For example, to support app developers that deploy Spring apps to PCF, you can enter Spring-specific HTTP headers.
If you expect requests larger than the default maximum of 16 Kbytes, enter a new value (in bytes) for HAProxy Request Max Buffer Size. You may need to do this, for example, to support apps that embed a large cookie or query string values in headers.
If your PCF deployment uses HAProxy and you want it to receive traffic only from specific sources, use the following fields:
- HAProxy Protected Domains: Enter a comma-separated list of domains to protect from unknown source requests.
- HAProxy Trusted CIDRs: Optionally, enter a space-separated list of CIDRs to limit which IP addresses from the Protected Domains can send traffic to PCF.
The Loggregator Port defaults to
443if left blank. For AWS environments that are not using an Application Load Balancer, enter
For Container Network Interface Plugin, ensure Silk is selected and review the following fields:
Note: The External option exists to support NSX-T integration for vSphere deployments.
(Optional) The default value for the Applications Network Maximum Transmission Unit (MTU) field is
1454. Some configurations, such as networks that use GRE tunnels, may require a smaller MTU value. To change this value, enter your desired MTU value in bytes.
(Optional) Enter an IP range for the overlay network in the Overlay Subnet box. If you do not set a custom range, Ops Manager uses
Warning: The overlay network IP range must not conflict with any other IP addresses in your network.
Enter a UDP port number in the VXLAN Tunnel Endpoint Port box. If you do not set a custom port, Ops Manager uses 4789.
- For Denied logging interval, set the per-second rate limit for packets blocked by either a container-specific networking policy or by Application Security Group rules applied across the space, org, or deployment. This field defaults to
- For UDP logging interval, set the per-second rate limit for UDP packets sent and received. This field defaults to
- To enable logging for app traffic, select Log traffic for all accepted/denied application packets. See Manage Logging for Container-to-Container Networking for more information.
For DNS Search Domains, enter DNS search domains as a comma-separated list. Your containers append these search domains to hostnames to resolve them into full domain names.
For Database Connection Timeout, set the connection timeout for clients of the policy server and silk databases. The default value is
120. You may need to increase this value if your deployment experiences timeout issues related to Container-to-Container Networking.
(Optional) TCP Routing is disabled by default. You should enable this feature if your DNS sends TCP traffic through a load balancer rather than directly to a TCP router. To enable TCP routing:
- Select Enable TCP Routing
- For TCP Routing Ports, enter a single port or a range of ports for the load balancer to forward to. If you configured AWS for PCF manually, enter
1024-1123which corresponds to the rules you created for
- To support multiple TCP routes, Pivotal recommends allocating multiple ports.
- To allocate a list of ports rather than a range:
- Enter a single port in the TCP Routing Ports field.
- After deploying PAS, follow the directions in Configuring a List of TCP Routing Ports to add TCP routing ports using the cf CLI.
- For AWS, you also need to specify the name of a TCP ELB in the LOAD BALANCER column of TCP Router job of the
Resource Configscreen. You configure this later on in PAS. For more information, see the Configure Router to Elastic Load Balancer topic.
(Optional) To disable TCP routing, click Select this option if you prefer to enable TCP Routing at a later time. For more information, see Configuring TCP Routing in PAS.
(Optional) To enable the creation of dynamic egress policies that allow apps to reach external services, select Enable Beta Dynamic Egress Enforcement. For more information about this feature, see Administering Dynamic Egress Policies (Beta).
(Optional) For additional security, enter headers that you want the router to remove from app responses in Remove Specified HTTP Response Headers.
Click Save.
Step 5: Configure Application Containers
In the Application Containers pane, you enable microservice frameworks, private Docker registries, and other services that support your apps at the container level.
To configure the Application Containers pane:
Select Application Containers.
The Enable Custom Buildpacks checkbox governs the ability to pass a custom buildpack URL to the
-boption of the
cf pushcommand. By default, this ability is enabled, letting developers use custom buildpacks when deploying apps. Disable this option by disabling the checkbox. For more information about custom buildpacks, see Buildpacks.
The Allow SSH access to app containers checkbox controls SSH access to app instances. Enable the checkbox to permit SSH access across your deployment, and disable it to prevent all SSH access. For more information about SSH access permissions at the space and app scope, see App SSH Overview.
If you want to enable SSH access for new apps by default in spaces that allow SSH, select the Enable SSH when an app is created checkbox. If you disable the checkbox, developers can still enable SSH after pushing their apps by running
cf enable-ssh APP-NAME.
Choose the method the Gorouter uses to verify app identity under Router application identity verification. To enable the Gorouter to verify app identity using TLS, select Router uses TLS to verify application identity. To enable the Gorouter and your apps to verify each other's identity using TLS, select Router and apps use mutual TLS to verify each other's identity.
Note: Mutual TLS (mTLS) app identity verification does not work for Windows containers.Verifying app identity using TLS or mTLS enables encryption between router and app containers and guards against misrouting during control plane failures. For more information about Gorouter route consistency modes, see the Preventing Misrouting section in the HTTP Routing topic.
Warning: TLS routing requires an additional 32 MB of RAM capacity on Diego Cells per app instance. It also requires additional CPU capacity on Diego Cells. If the total amount of Diego Cell memory available is less than 32 MB times the number of running app instances, scale your Diego Cells before configuring the Gorouter with TLS. For more information, see Configure Gorouter with TLS in the Upgrade Preparation Checklist for PCF v2.4 topic.
Warning: You may see an increase of memory and CPU usage for your Gorouters after enabling TLS routing. If the total amount of memory and CPU usage of the Gorouters in your environment are close to the size limit, scale your Gorouters before enabling TLS routing. For more information, see Configure Gorouter with TLS in the Upgrade Preparation Checklist for PCF v2.4 topic.
Note: To support mTLS app identity verification, you need v2.3 or later of both PAS and PCF Isolation Segment (IST). The Gorouter and Diego Cell components in PCF v2.2 and earlier do not support mTLS handshakes.
Note: This feature does not work if the Disable SSL certificate verification for this environment checkbox is enabled in the Networking pane.
To enable time-to-live (TTL) expiration for routes, select the Prune Routes on TTL Expiry for TLS Backends checkbox. You should only enable TTL expiration for TLS back ends if you are experiencing occasional misrouting of apps due to stale routes. For more information, see Preventing Misrouting in the HTTP Routing topic and Intermittent Misrouting of Apps in Large PCF Foundations in the Pivotal Application Service v2.4 Release Notes.
You can configure PAS to run app instances in Docker containers by providing a comma-separated list of their IP address ranges in the Private Docker Insecure Registry Whitelist textbox. For more information, see Using Docker Registries.
Select your preference for Docker Images Disk-Cleanup Scheduling on Cell VMs. If you choose Clean up disk-space once usage fills disk, enter a value in MB for Reserved amount of disk space for other jobs. For more information about the configuration options and how to configure a reserved amount, see Configuring Cell Disk Cleanup Scheduling.
Enter a number in the Max Inflight Container Starts field. This number configures the maximum number of started instances across the Diego cells in your deployment. Entering
0sets no limit. For more information, see the Setting a Maximum Number of Started Containers section of the Configuring PAS for Upgrades topic.
Under Enabling NFSv3 volume services, select Enable or Disable. NFS volume services allow app developers to bind existing NFS volumes to their apps for shared file access. For more information, see Enabling Volume Services.
Note: In a fresh install, NFSv3 volume services is enabled by default. In an upgrade, NFSv3 volume services is set to the same setting as it was in the previous deployment.
(Optional) To configure LDAP for NFSv3 volume services:
- For LDAP Service Account User, enter the username of the service account in LDAP that will manage volume services.
- For LDAP Service Account Password, enter the password for the service account.
- For LDAP Server Host, enter the hostname or IP address of the LDAP server.
- For LDAP Server Port, enter the LDAP server port number. If you do not specify a port number, Ops Manager uses 389.
- For LDAP User Search Base, enter the location in the LDAP directory tree from which any LDAP User search begins. The typical LDAP Search Base matches your domain name.
For example, a domain named
cloud.example.comtypically uses the following LDAP User Search Base:
- For LDAP Server CA Cert, you can optionally enter a certificate if your LDAP server supports TLS and you want to enable TLS connections from the NFS driver to your LDAP server. Paste in the root certificate from your CA certificate or your self-signed certificate.
Note: UAA can only parse one certificate entered into this field. If you enter multiple certificates, UAA only uses the first one you entered and ignores the rest. You only need to include one root certificate or self-signed certificate.
Select the Format of timestamps in Diego logs, either RFC3339 timestamps or Seconds since the Unix epoch.
(Optional) Modify the Default health check timeout. The value configured for this field is the amount of time allowed to elapse between starting up an app and the first healthy response from the app. If the health check does not receive a healthy response within the configured timeout, then the app is declared unhealthy. The default timeout is
60seconds and the maximum configurable timeout is
Warning: If you decrease the default health check timeout value below its current value, existing apps with startup times greater than the new value may fail to start up.
Click Save.
Step 6: Configure Application Developer Controls
In the Application Developer Controls pane, you configure restrictions and default settings for your apps.
To configure the Application Developer Controls pane:
Select Application Developer Controls.
Enter the Maximum File Upload Size (MB) in MB. This is the maximum size of an app upload.
Enter the Default App Memory (MB) in MB. This is the default amount of memory allocated to a newly-pushed app if no value is specified with
cf push.
Enter the Default App Memory Quota per Org in MB. This is the default memory limit for all apps in an org. The specified limit only applies to the first installation of PAS. After the initial installation, operators can use the cf CLI to change the default value.
Enter the Maximum Disk Quota per App (MB) in MB. This is the maximum amount of disk allowed per app.
Note: If you allow developers to push large apps, PAS may have trouble placing them on Diego Cells. Additionally, in the event of a system upgrade or an outage that causes a rolling deploy, larger apps may not successfully re-deploy if there is insufficient disk capacity. Monitor your deployment to ensure your Diego Cells have sufficient disk to run your apps.
Enter the Default Disk Quota per App (MB) in MB. This is the amount of disk allocated by default to a newly-pushed app if no value is specified with
cf push.
Enter the Default Service Instances Quota per Org. The specified limit only applies to the first installation of PAS. After the initial installation, operators can use the cf CLI to change the default value.
Enter the Staging Timeout (Seconds) in seconds. When you stage an app droplet with the Cloud Controller, the server times out after the number of seconds you specify in this field.
For Internal Domain, enter a domain that apps use for internal DNS service discovery. If you specify this domain using
cf push -d, other PAS apps can reach the pushed app at
APP-NAME.INTERNAL-DOMAIN. This value defaults to
Enable the Allow Space Developers to manage network policies checkbox to permit developers to manage their own network policies for their apps.
Click Save.
Step 7: Review Application Security Groups
Setting appropriate ASGs is critical for a secure deployment. Type
X in the box to acknowledge that once the PAS deployment completes, it is your responsibility to set the appropriate ASGs. For more information about ASGs, see App Security Groups. For more information about setting ASGs, see Restricting App Access to Internal PCF Components.
Step 8: Configure UAA
Select UAA.
Under Choose the location of your UAA database select one of the following:
- PAS database (configured on the Databases pane): Use the same database server that other PAS components use. This system database is configured in the Databases pane, and it can be either internal or external.
- Other external database - Use a separate, dedicated database server for UAA.
Warning: Protect whichever database you use in your deployment with a password.
(Optional) If you selected Other external database for the UAA database location, perform the following steps to create and configure the dedicated UAA database:
Note: The exact procedure to create databases depends on the database provider you select for your deployment. The following procedure uses AWS RDS as an example, but UAA also supports Azure SQL Server.
- Add the
ubuntuaccount key pair from your IaaS deployment to your local SSH profile so you can access the Ops Manager VM. This is the value of the
ops_manager_ssh_private_keyfrom the Terraform output.
$ ssh-add aws-keypair.pem
- SSH in to your Ops Manager using the Ops Manager FQDN and the username
$ ssh ubuntu@OPS-MANAGER-FQDN
- Log in to your MySQL database instance using the appropriate hostname and user login values configured in your IaaS account. For example, to log in to your AWS RDS instance, run the following MySQL command:
$ mysql --host=RDSHOSTNAME --user=RDSUSERNAME --password=RDSPASSWORD
- Run the following MySQL commands to create a database for UAA:
CREATE database uaa;
- Type
exitto quit the MySQL client, and
exitagain to close your connection to the Ops Manager VM.
- Reboot the RDS instance in the AWS console.
- Navigate back to the PAS tile > UAA pane.
- For Hostname, enter the hostname of the database server. This is the value from the
rds_addresskey in the Terraform output.
- For TCP Port, enter the port of the database server. This is the value from the
rds_portkey in the Terraform output.
- For Username, specify the username that can access this database on the database server. This is the value from the
rds_usernamekey in the Terraform output.
- For Password, specify a password for the provided username. This is the value from the
rds_passwordkey in the Terraform output.
- For CA Certificate, enter a certificate to use for encrypting traffic to and from the database.
Note: The CA Certificate field only works if your external database hostname matches a name specified in the certificate. This is not true with GCP CloudSQL.
- Add the
(Optional) Under JWT Issuer URI, enter the URI that UAA uses as the issuer when generating tokens.
Under SAML Service Provider Credentials, enter a certificate and private key to be used by UAA as a SAML Service Provider for signing outgoing SAML authentication requests. You can provide an existing certificate and private key from your trusted Certificate Authority or generate a certificate. The following domain must be associated with the certificate:
Note: The Pivotal Single Sign-On Service and Pivotal Spring Cloud Services tiles require the
If the private key specified under Service Provider Credentials is password-protected, enter the password under SAML Service Provider Key Password.
(Optional) To override the default value, enter a custom SAML Entity ID in the SAML Entity ID Override field. By default, the SAML Entity ID is
YOUR-SYSTEM-DOMAINis set in the Domains > System Domain field.
For Signature Algorithm, choose an algorithm from the dropdown to use for signed requests and assertions. The default value is
(Optional) In the Apps Manager Access Token Lifetime, Apps Manager Refresh Token Lifetime, Cloud Foundry CLI Access Token Lifetime, and Cloud Foundry CLI Refresh Token Lifetime fields, change the lifetimes of tokens granted for Apps Manager and Cloud Foundry Command Line Interface (cf CLI) login access and refresh. Most deployments use the defaults.
(Optional) In the Global Login Session Max Timeout and Global Login Session Idle Timeout fields, change the maximum number of seconds before a global login times out. These fields apply to the following:
- Default zone sessions: Sessions in Apps Manager, PCF Metrics, and other web UIs that use the UAA default zones
- Identity zone sessions: Sessions in apps that use a UAA identity zone, such as a Single Sign-On service plan
(Optional) Customize the text prompts used for username and password from the cf CLI and Apps Manager login popup by entering values for Customize Username Label (on login page) and Customize Password Label (on login page).
(Optional) The Proxy IPs Regular Expression field contains a pipe-delimited set of regular expressions that UAA considers to be reverse proxy IP addresses. UAA respects the
x-forwarded-protoheaders coming from IP addresses that match these regular expressions. To configure UAA to respond properly to Gorouter or HAProxy requests coming from a public IP address, append a regular expression or regular expressions to match the public IP address.
Click Save.
Step 9: Configure CredHub
In the CredHub pane, you configure the CredHub server.
Note: Enabling CredHub is not required. However, you cannot leave the fields under Encryption Keys blank. If you do not intend to use CredHub, enter any text in the Name and Key fields as placeholder values.
To configure the CredHub pane:
Select CredHub.
Choose the location of your CredHub database. PAS includes this CredHub database for services to store their service instance credentials. If you chose PAS database (configured on the Databases pane), CredHub uses the same database as other PAS components, whether the database is internal or external.
If you chose Other external database, configure the following fields:
- Hostname: This is the IP address of your database server. See the value from the
PcfRdsAddresskey in the AWS output.
- TCP Port: This is the port of your database server. See the value from the
PcfRdsPortkey in the AWS output.
- Username: This is the value from the
PcfRdsUsernamekey in the AWS output.
- Password: This is the value from the
PcfRdsPasswordkey in the AWS output.
- Database CA Certificate: This certificate is used when encrypting traffic to and from the database.
- TCP Port: This is the port of your database server. See the value from the
- Hostname: This is the IP address of your database server. See the value from the
Under Encryption Keys, specify one or more keys to use for encrypting and decrypting the values stored in the CredHub database.
- Name: This is the name of the encryption key.
- If you plan to use internal encryption, enter any key name.
- If you plan to use an HSM as your encryption provider, enter a key name that already exists on your HSM or a new key name. For each new key name, CredHub generates a key in HSM Provider Partition that you configure below.
- Provider: This is the provider of the encryption key. If you plan to configure an HSM provider and HSM servers below, select HSM. Otherwise, select Internal.
- Key. If you select internal encryption, this key is used for encrypting all data. The key must be at least 20 characters long.
- If you selected Internal above, enter a randomly generated value under Key.
- If you selected HSM above, enter a placeholder value under Key. CredHub does not use this key for encryption. However, you cannot leave the Key field blank.
- Primary: This checkbox is used for marking the key you specified above as the primary encryption key. You must mark one key as Primary. Do not mark more than one key as Primary.
Note: For information about using additional keys for key rotation, see Rotating Runtime CredHub Encryption Keys.
- Name: This is the name of the encryption key.
(Optional) To configure CredHub to use an HSM, configure the following fields:
- HSM Provider Partition: This is the name of the HSM provider partition.
- HSM Provider Partition Password: This password is used to access the HSM provider partition.
- HSM Provider Client Certificate: This is the client certificate for the HSM. For more information, see the Create and Register HSM Clients section of the Preparing CredHub HSMs for Configuration topic.
- In the HSM Provider Servers section, click Add to add an HSM server. You can add multiple HSM servers. For each HSM server, configure the following fields:
- Host Address: This is the host name or IP address of the HSM server.
- Port: This is the port of the HSM server. If you do not know your port address, enter
- Partition Serial Number: This is the serial number of the HSM partition.
- HSM Certificate: This is the certificate for the HSM server. The HSM presents this certificate to CredHub to establish a two-way TLS connection.
If your deployment uses any PCF services that support storing service instance credentials in CredHub and you want to enable this feature, enable the Secure Service Instance Credentials checkbox.
Click Save.
Select the Resource Config pane.
Under the Job column of the CredHub row, ensure that the number of instances is set to
2. This is the minimum instance count required for high availability.
Click Save.
For more information about using CredHub for securing service instance credentials, see Securing Service Instance Credentials with Runtime CredHub.
Step 10: Configure Authentication and Enterprise SSO
In the Authentication and Enterprise SSO pane, you configure your user store access.
To configure the Authentication and Enterprise SSO pane:
Select Authentication and Enterprise SSO.
To authenticate user sign-ons, your deployment can use one of three types of user database: the UAA server's internal user store, an external SAML identity provider, or an external LDAP server.
- To use the internal UAA, select the Internal option and follow the procedure in Configuring UAA Password Policy to configure your password policy.
- To connect to an external identity provider through SAML, select the SAML Identity Provider option and follow the instructions in the Configure PAS to Use a SAML Identity Provider section of the Configuring Authentication and Enterprise SSO for PAS topic.
- To connect to an external LDAP server, scroll down to select the LDAP Server option and follow the instructions in the Configure LDAP as an Identity Provider for PAS section of the Configuring Authentication and Enterprise SSO for PAS topic.
Click Save.
Step 11: Configure System Databases
You can configure PAS to use an internal MySQL database provided with PCF, or you can configure an external database provider for the databases required by PAS.
Note: If you are performing an upgrade, do not modify your existing internal database configuration or you may lose data. You must migrate your existing data first before changing the configuration. See Upgrading Pivotal Cloud Foundry for additional upgrade information.
Internal Database Configuration
If you want to use internal databases for your deployment, do the following:
Select Databases.
Select Internal Databases - MySQL - Percona XtraDB Cluster.
Click Save.
Then proceed to Step 13: (Optional) Configure Internal MySQL to configure high availability for your internal MySQL databases.
Create External System Databases
If you want to use an external database provider for your PAS databases, you must first create the databases on the RDS instance provided by the Terraform templates.
To create the required databases on an AWS RDS instance, perform the following steps.
Add the AWS-provided key pair to your SSH profile so that you can access the Ops Manager VM. This is the value of the
ops_manager_ssh_private_keyfrom the Terraform output.
ssh-add aws-keypair.pem
SSH in to your Ops Manager using the Ops Manager FQDN and the username
ssh ubuntu@OPS_MANAGER_FQDN
Run the following terminal command to log in to your RDS instance through the MySQL client, using values from the terraform output to fill in the following keys:
mysql --host=rds_address --user=rds_username --password=rds_password
Run the following MySQL commands to create databases for the seven PAS components that require a relational database:
CREATE database ccdb; CREATE database notifications; CREATE database autoscale; CREATE database app_usage_service; CREATE database routing; CREATE database diego; CREATE database account; CREATE database nfsvolume; CREATE database networkpolicyserver; CREATE database silk; CREATE database locket; CREATE database credhub;
exitto quit the MySQL client, and
exitagain to close your connection to the Ops Manager VM.
Reboot the RDS instance in the AWS console.
In PAS, select Databases.
Select the External Databases option.
For the Hostname and TCP Port fields, complete the following fields:
PAS Field terraform output Hostname
TCP Port
For each database username and database password field, complete the following fields:
PAS Field terraform output DATABASE-NAME database username
DATABASE-NAME database password
Note: Ensure that the networkpolicyserver database user has the
ALL PRIVILEGESpermission.
(Optional) If you want to enable TLS for your external databases, paste your Certificate Authority (CA) certificate in the Database CA Certificate field.
Click Save.
Step 13: (Optional) Configure Internal MySQL
Note: You only need to configure this section if you have selected one of the Internal Databases - MySQL options in the Databases section.
Select Internal MySQL.
In the Replication canary time period field, leave the default of 30 seconds or modify the value based on the needs of your deployment. Lower numbers cause the canary to run more frequently, which means that the canary reacts more quickly to replication failure but adds load to the database.
In the Replication canary read delay field, leave the default of 20 seconds or modify the value based on the needs of your deployment. This field configures how long the canary waits, in seconds, before verifying that data is replicating across each MySQL node. Clusters under heavy load can experience a small replication lag as write-sets are committed across the nodes.
(Required): In the E-mail address field, enter the email address where the MySQL service sends alerts when the cluster experiences a replication issue or when a node is not allowed to auto-rejoin the cluster.
To prohibit the creation of command line history files on the MySQL nodes, disable the Allow Command History checkbox.
To allow the admin and roadmin to connect from any remote host, enable the Allow Remote Admin Access checkbox. When the checkbox is disabled, admins must
bosh sshinto each MySQL VM to connect as the MySQL super user.
Note: Network configuration and Application Security Groups restrictions may still limit a client's ability to establish a connection with the databases.
For Cluster Probe Timeout, enter the maximum amount of time, in seconds, that a new node will search for existing cluster nodes. If left blank, the default value is 10 seconds.
For Max Connections, enter the maximum number of connections allowed to the database. If left blank, the default value is 1500.
If you want to log audit events for internal MySQL, select Enable server activity logging under Server Activity Logging.
In the Event types field, you can enter the events you want the MySQL service to log. By default, this field includes
query, which tracks who connects to the system and what queries are processed.
For more information about which events the Percona MySQL server can log, see Audit Log Plugin in the Percona documentation.
Note: Internal MySQL audit logs are not forwarded to the syslog server because they can contain personally identifying information (PII) and secrets.
You can use the download-logs script to retrieve the logs, which each MySQL cluster node VM stores in
Enter values for the following fields:
- Load Balancer Healthy Threshold: Specifies the amount of time, in seconds, to wait until declaring the MySQL Proxy instance started. This allows an external load balancer time to register the instance as healthy.
- Load Balancer Unhealthy Threshold: Specifies the amount of time, in seconds, that the MySQL Proxy continues to accept connections before shutting down. During this period, the Healthcheck reports as unhealthy to cause load balancers to fail over to other proxies. You must enter a value greater than or equal to the maximum time it takes your load balancer to consider a proxy instance unhealthy, given repeated failed healthchecks.
- Load Balancer Healthy Threshold: Specifies the amount of time, in seconds, to wait until declaring the MySQL Proxy instance started. This allows an external load balancer time to register the instance as healthy.
If you want to enable the MySQL interruptor feature, select the checkbox to Prevent node auto re-join. This feature stops all writes to the MySQL database if it notices an inconsistency in the dataset between the nodes. For more information, see the Interruptor section in the MySQL for PCF documentation.
Click Save.
For more information on how to monitor the node health of your MySQL Proxy instances, see Using the MySQL Proxy.
Step 14: Configure File Storage
- In the PAS tile, select File Storage.
- For Max Valid Packages per App, Pivotal recommends leaving the default value of
5. However, you may want to lower the value if you have strict storage requirements and want to use less disk space.
- For Max Staged Droplets per App, Pivotal recommends leaving the default value of
5. However, you may want to lower the value if you have strict storage requirements and want to use less disk space.
- For Configure your Cloud Controller's filesystem, see Select File Storage Location.
Select File Storage Location
To minimize system downtime, Pivotal recommends using highly resilient and redundant external filestores for your Pivotal Application Service (PAS) file storage.
When configuring file storage for the Cloud Controller in PAS, you can select one of the following:
- Internal WebDAV filestore
- External S3-compatible or Ceph-compatible filestore
- External Google Cloud Storage with Access Key and Secret Key
- External Google Cloud Storage with Service Account
- External Azure Cloud Storage
For production-level PCF deployments on AWS, Pivotal recommends selecting the External S3-Compatible File Store. For more information about production-level PCF deployments on AWS, see the Reference Architecture for Pivotal Cloud Foundry on AWS.
For additional factors to consider when selecting file storage, see the Considerations for Selecting File Storage in Pivotal Cloud Foundry topic.
Internal Filestore
Internal file storage is only appropriate for small, non-production deployments.
To use the PCF internal filestore, select Internal WebDAV, and click Save.
External S3 or Ceph Filestore
To use an external S3-compatible filestore for PAS file storage, perform the following steps:
Select the External S3-Compatible Filestore option and complete the following fields:
- Enter the
https://URL Endpoint for your region.
For example, in the us-west-2 region, enter
- If you use an AWS instance profile to manage role information for your filestore, select the S3 AWS with Instance Profile checkbox. For more information, see AWS Identity and Access Management in the AWS documentation.
- If your Application Service deployment is on AWS, you can alternatively enter the Access key and Secret key of the
-useryou created when configuring AWS for PCF. If you enable the S3 AWS with instance profile checkbox and also enter an Access key and Secret key, the instance profile will overrule the access key and secret key.
- From the S3 Signature Version dropdown, select V4 Signature. For more information about S4 signatures, see Signing AWS API Requests in the AWS documentation.
- For Region, enter the region in which your S3 buckets are located.
us-west-2is an example of an acceptable value for this field.
- Select Server-side Encryption to encrypt the contents of your S3 filestore. This option is only available for AWS S3.
- (Optional) If you selected Server-side Encryption, you can also specify a KMS Key ID. PAS uses the KMS key to encrypt files uploaded to the blobstore. If you do not provide a KMS Key ID, PAS uses the default AWS key. For more information, see Protecting Data Using Server-Side Encryption with AWS KMS–Managed Keys (SSE-KMS).
Enter names for your S3 buckets:
Ops Manager Field Value Description Buildpacks Bucket Name
This S3 bucket stores app buildpacks. Droplets Bucket Name
This S3 bucket stores app droplets. Pivotal recommends that you use a unique bucket name for droplets, but you can also use the same name as above. Packages Bucket Name
This S3 bucket stores app packages. Pivotal recommends that you use a unique bucket name for packages, but you can also use the same name as above. Resources Bucket Name
This S3 bucket stores app resources. Pivotal recommends that you use a unique bucket name for app resources, but you can also use the same name as above.
Configure the following depending on whether your S3 buckets have versioning enabled:
- Versioned S3 buckets: Enable the Use versioning for backup and restore checkbox to archive each bucket to a version.
- Unversioned S3 buckets: Disable the Use versioning for backup and restore checkbox, and enter a backup bucket name for each active bucket. The backup bucket name must be different from the name of the active bucket it backs up. For more information about setting up external S3 blobstores, see the Backup and Restore with External Blobstores topic in the Cloud Foundry documentation.
- Enter the
Click Save.
Note: For more information regarding AWS S3 Signatures, see the Authenticating Requests topic in the AWS documentation.
Other IaaS Storage Options
Google Cloud Storage and Azure Storage are also available as file storage options, but are not recommended for typical PCF on AWS installations.
Step 15: (Optional) Configure System Logging
In the System Logging pane, you can configure system logging in PAS to forward log messages from PAS component VMs to an external service. Pivotal recommends forwarding logs to an external service for use in troubleshooting. If you do not fill these fields, platform logs are not forwarded but remain available on the component VMs and for download through Ops Manager.
Note: The following instructions explain how to configure system logging for PAS component VMs. To forward logs from PCF tiles to an external service, you must also configure system logging in each tile. See the documentation for the given tiles for information about configuring system logging.
To configure the System Logging pane:
Select System Logging.
For Address, enter the hostname or IP address of the syslog server.
For Port, enter the port of the syslog server. The default port for a syslog server is 514.
Note: The host must be reachable from the PAS network and accept UDP or TCP connections. Ensure the syslog server listens on external interfaces.
For Transport Protocol, select a transport protocol for log forwarding.
For Encrypt syslog using TLS?, select Yes to use TLS encryption when forwarding logs to a remote server.
- For Permitted Peer, enter either the name or SHA1 fingerprint of the remote peer.
- For TLS CA Certificate, enter the TLS CA certificate for the remote server.
For Syslog Drain Buffer Size, enter the number of messages from the Loggregator Agent that the Doppler server can store before it begins to drop messages. See the Loggregator Guide for Cloud Foundry Operators topic for more details.
For Number of syslog drain addresses to retrieve, enter the number of apps with syslog drain addresses to retrieve from Cloud Controller per request.
Disable the Include container metrics in Syslog Drains checkbox to prevent the CF Drain CLI plugin from including app container metrics in syslog drains. This feature is enabled by default. For more information about the CF Drain CLI plugin, see the CF Drain CLI Plugin repository on GitHub.
Select the Enable Cloud Controller security event logging checkbox to include security events in the log stream. This feature logs all API requests, including the endpoint, user, source IP address, and request result, in the Common Event Format (CEF).
Enable the Use TCP for file forwarding local transport checkbox to transmit logs over TCP. This prevents log truncation, but may cause performance issues.
The Don't Forward Debug Logs checkbox is enabled by default. To forward
DEBUGsyslog messages to an external service, disable the checkbox.
Note: Some PAS components generate a high volume of
DEBUGsyslog messages. Enabling the Don't Forward Debug Logs checkbox prevents PAS components from forwarding the
DEBUGsyslog messages to external services. However, PAS still writes the messages to the local disk.
For Custom rsyslog Configuration, enter a custom syslog rule. For more information about adding custom syslog rules, see Customizing Platform Log Forwarding.
Click Save.
To configure Ops Manager for system logging, see the Settings section in the Using the Ops Manager Interface topic.
Step 16: (Optional) Customize Apps
In the Custom Branding pane, you can customize the appearance of the PCF login portal and Apps Manager. In the Apps Manager pane, you can configure the functionality of Apps Manager, as well as how it displays the pages for your apps in the Pivotal Services Marketplace.
To configure the Custom Branding and Apps Manager panes:
Select Custom Branding.
Configure the fields in the Custom Branding pane. For more information about the Custom Branding configuration settings, see Custom-Branding Apps Manager.
Click Save.
Select Apps Manager.
Select the Enable Invitations checkbox to enable invitations in Apps Manager. Space Managers can invite new users for a given space, Org Managers can invite new users for a given org, and Admins can invite new users across all orgs and spaces. For more information, see the Inviting New Users section of the Managing User Roles with Apps Manager topic.
Enable the Display Marketplace Service Plan Prices checkbox to display the prices for your services plans in the Marketplace.
Enter the Supported currencies as JSON to appear in the Marketplace. Use the format
{ "CURRENCY-CODE": "SYMBOL" }. This defaults to
{ "usd": "$", "eur": "€" }.
Use Product Name, Marketplace Name, and Customize Sidebar Links to configure page names and sidebar links in the Apps Manager and Marketplace pages. You may configure up to 10 links in the Apps Manager sidebar.
The Apps Manager Memory Usage (MB) field sets the memory limit with which to deploy the Apps Manager app. Use this field to increase the memory limit if the app fails to start with an
out of memoryerror. Enter the value in MB. To use the default value of 128 MB, leave this field blank.
The Invitations Memory Usage (MB) field sets the memory limit with which to deploy the Invitations app. Use this field to increase the memory limit if the app fails to start with an
out of memoryerror. Enter the value in MB. To use the default value of 256 MB, leave this field blank.
The Apps Manager Polling Interval field provides a temporary fix if Apps Manager usage degrades Cloud Controller response times. In this case, you can use this field to reduce the load on the Cloud Controller and ensure Apps Manager remains available while you troubleshoot the Cloud Controller. Pivotal recommends that you do not keep this field modified as a long-term fix because it can degrade Apps Manager performance. Optionally, you can:
- Increase the polling interval above the default of
30seconds. Enter the value in seconds.
Note: If you enter a value between
30, the field is automatically set to
- Disable polling by entering
0. This stops Apps Manager from refreshing data automatically, but users can update displayed data by reloading Apps Manager manually.
- Increase the polling interval above the default of
The App Details Polling Interval field provides an additional way to reduce the load on the Cloud Controller when the Apps Manager Polling Interval field is not sufficient. This field controls the rate at which Apps Manager polls for data when a user views the Overview page of an app. Pivotal recommends that you do not keep this field modified as a long-term fix because it can degrade Apps Manager performance. Optionally, you can:
- Increase the polling interval above the default of
10seconds. Enter the value in seconds.
Note: If you enter a value between
30, the field is automatically set to
- Disable polling by entering
0. This stops Apps Manager from refreshing data automatically, but users can update displayed data by reloading Apps Manager manually.
- Increase the polling interval above the default of
Click Save.
Step 17: (Optional) Configure Email Notifications
PAS uses SMTP to send invitations and confirmations to Apps Manager users. You must complete the Email Notifications page if you want to enable end-user self-registration.
Select Email Notifications.
Enter your reply-to and SMTP email information.
Note: For GCP, you must use port
2525. Ports
587are not allowed on GCP Compute Engine.
Verify your authentication requirements with your email administrator and use the SMTP Authentication Mechanism dropdown to select
Plain, or
CRAMMD5. If you have no SMTP authentication requirements, select
If you selected
CRAMMD5as your authentication mechanism, enter a secret in the SMTP CRAMMD5 secret field.
Click Save.
Note: If you do not configure the SMTP settings using this form, the administrator must create orgs and users using the cf CLI. See Creating and Managing Users with the cf CLI for more information.
Step 18: (Optional) Configure App Autoscaler
In the App Autoscaler pane, you configure the App Autoscaler service. To use App Autoscaler, you must create an instance of the service and bind it to an app. To create an instance of App Autoscaler and bind it to an app, see Set Up App Autoscaler in the Scaling an Application Using App Autoscaler topic.
To configure the App Autoscaler pane:
Click App Autoscaler.
For Autoscaler Instance Count, enter the number of instances of the App Autoscaler service you want to deploy. The default value is
3. For high availability, set this number to
3or higher. You should set the instance count to an odd number to avoid split-brain scenarios during leadership elections. Larger environments may require more instances than the default number.
For Autoscaler API Instance Count, enter the number of instances of the App Autoscaler API you want to deploy. The default value is
1. Larger environments may require more instances than the default number.
For Metric Collection Interval, enter how many seconds of data collection you want App Autoscaler to evaluate when making scaling decisions. The minimum interval is 60 seconds, and the maximum interval is 3600 seconds. The default value is
120. Increase this number if the metrics you use in your scaling rules are emitted less frequently than the existing metric collection interval.
For Scaling Interval, enter in seconds how frequently App Autoscaler evaluates an app for scaling. The minimum interval is 15 seconds, and the maximum interval is 120 seconds. The default value is
To enable verbose logging for App Autoscaler, enable the Verbose Logging checkbox. Verbose logging is disabled by default. Enable this checkbox to see more detailed logs. Verbose logs show specific reasons why App Autoscaler scaled the app, including information about minimum and maximum instance limits, App Autoscaler's status. For more information about App Autoscaler logs, see the App Autoscaler Events and Notifications section of the Scaling an App Using App Autoscaler topic.
If you do not want the Autoscaler API to reuse HTTP connections, enable the Disable API Connection Pooling checkbox. This may be necessary if your front end idle timeout for the Gorouter is set to a low value, such as 1 second. For more information, see Configuring Front End Idle Timeout for Gorouter and HAProxy.
To enable email notifications of Autoscaler events, enable the Enable Notifications checkbox. For more information about managing email notifications, see the App Autoscaler Events and Notifications section of the Scaling an App Using App Autoscaler topic.
Click Save.
Step 19: Configure Cloud Controller
In the Cloud Controller pane, you configure the Cloud Controller.
To configure the Cloud Controller pane:
Select Cloud Controller.
Enter your Cloud Controller DB Encryption Key if all of the following are true:
- You deployed PAS previously.
- You then stopped PAS or it crashed.
- You are re-deploying PAS with a backup of your Cloud Controller database.
See Backing Up and Restoring Pivotal Cloud Foundry for more information.
CF API Rate Limiting prevents API consumers from overwhelming the platform API servers. Limits are imposed on a per-user or per-client basis and reset on an hourly interval.
To disable Cloud Foundry API rate limiting, select Disable under Enable CF API Rate Limiting. To enable Cloud Foundry API rate limiting:
- Under Enable CF API Rate Limiting, select Enable.
- For General Limit, enter the number of requests a user or client is allowed to make over an hour-long interval for all endpoints that do not have a custom limit. The default value is
- For Unauthenticated Limit, enter the number of requests an unauthenticated client is allowed to make over an hour-long interval. The default value is
(Optional) Enter in seconds your Database Connection Validation Timeout. By default, the setting is
3600seconds or 60 minutes. You can enter
-1to cause Cloud Controller to make an additional query to the database whenever connections are checked out from the pool. Choosing
-1has performance implications.
(Optional) Enter in seconds your Database Read Timeout. By default, the setting is
3600seconds or 60 minutes.
(Optional) Select your default Linux stack. Apps pushed to Linux cells run on this stack unless you specify otherwise with the
cf push -s STACKNAMEoption. Existing apps continue to use their current stack when you change the default stack. For more information, see Restaging Applications on a New Stack. For a brief description of each option, see the following:
- Platform default (currently cflinuxfs3): Use the default stack for the current PCF version and migrate on upgrade if there is a new default stack.
- cflinuxfs3: Use
cflinuxfs3and do not change on upgrade.
- cflinuxfs2: Use
cflinuxfs2and do not change on upgrade.
(Optional) Enter the Age in days after which completed tasks will be pruned from the Cloud Controller Database.
Click Save.
Step 20: Configure Smoke Tests
In the Smoke Tests pane, you choose where to run smoke tests. The Smoke Tests errand runs basic functionality tests against your PAS deployment after an installation or update. In the Errands pane, you can choose whether or not to run the Smoke Tests errand.
To configure the Smoke Tests pane:
Select Smoke Tests.
If you have a shared apps domain, select Temporary space within the system organization, which creates a temporary space within the
systemorg for running smoke tests and deletes the space afterwards. Otherwise, select Specified org and space and complete the fields to specify where you want to run smoke tests:
- For Organization, enter the org you want PAS to use when running smoke tests.
- For Space, enter the space you want PAS to use when running smoke tests.
- For Domain, enter the domain you want PAS to use when running smoke tests.
Click Save.
Step 21: (Optional) Enable Advanced Features
The Advanced Features pane includes new functionality that may have certain constraints. Although these features are fully supported, Pivotal recommends caution when using them in production environments.
Diego Cell Memory and Disk Overcommit
If your apps do not use the full allocation of disk space and memory set in the Resource Config tab, you might want use this feature. These fields control the amount to overcommit disk and memory resources to each Diego Cell VM.
For example, you might want to use the overcommit if your apps use a small amount of disk and memory capacity compared to the amounts set in the Resource Config settings for Diego Cell.
Note: Due to the risk of app failure and the deployment-specific nature of disk and memory use, Pivotal has no recommendation about how much, if any, memory or disk space to overcommit.
To enable overcommit:
Select Advanced Features.
Enter in MB the total desired amount of Diego cell memory value in the Cell Memory Capacity (MB) field. Refer to the Diego Cell row in the Resource Config tab for the current Diego Cell memory capacity settings that this field overrides.
Enter in MB the total desired amount of Diego cell disk capacity value in the Cell Disk Capacity (MB) field. Refer to the Diego Cell row in the Resource Config tab for the current Diego Cell disk capacity settings that this field overrides.
Click Save.
Note: Entries made to each of these two fields set the total amount of resources allocated, not the overage.
Whitelist for Non-RFC-1918 Private Networks
Some private networks require extra configuration so that internal file storage (WebDAV) can communicate with other PCF processes.
The Whitelist for non-RFC-1918 Private Networks field is provided for deployments that use a non-RFC 1918 private network. This is typically a private network other than
172.16.0.0/12, or
Most PCF deployments do not require any modifications to this field.
To add your private network to the whitelist:
Select Advanced Features.
Append a new
allowrule to the existing contents of the Whitelist for non-RFC-1918 Private Networks field. Include the word
allow, the network CIDR range to allow, and a semi-colon (
;) at the end. For example:
allow 188.8.131.52/24;
Click Save.
CF CLI Connection Timeout
The CF CLI Connection Timeout field allows you to override the default five-second timeout of the Cloud Foundry Command Line Interface (cf CLI) used within your PCF deployment. This timeout affects the cf CLI command used to push PAS errand apps such as Notifications, Autoscaler, and Apps Manager.
Set the value of this field to a higher value, in seconds, if you are experiencing domain name resolution timeouts when pushing errands in PAS.
To modify the value of the CF CLI connection timeout:
Select Advanced Features.
Add a value, in seconds, to the CF CLI Connection Timeout field.
Click Save.
Metrics Deployment Name
For the value of
deployment, metrics use
cf-GUID, which corresponds to the BOSH deployment name of your PAS tile. In PAS v2.3 and earlier, this value is
cf only and not uniquely identified by tile.
If you have scripts that rely on the
cf value, you can re-enable the value. Pivotal does not recommend re-enabling the
cf value as a permanent solution. If you can resolve script dependencies, resolve them and leave the default setting.
To re-enable the
cf value:
Select Use "cf" as deployment name in emitted metrics instead of unique name.
Click Save.
If you have PCF Healthwatch installed, enable the PCF Healthwatch Push Monitoring Components Errand to ensure correct PCF Healthwatch configuration.
SMB Volume Services
You can optionally enable SMB volume services so developers can bind existing SMB shares to their apps. For more information, see the Enabling Volume Services topic.
To enable SMB volume services:
Select the Enable SMB volume services checkbox.
Click Save.
In the Errands pane, set the SMB Broker Errand to On.
Click Save.
Enable TLS for Internal System Database
To enable TLS for clients of the internal system database:
Select BETA: Enable TLS for internal system database.
Click Save.
Database Connection Limits
You can configure the maximum number of concurrent database connections that Diego and container networking components can have. Use the field beginning with Maximum number of open connections… for a given component. The placeholder values for each field are the default values.
When there are not enough connections available, such as during a time of heavy load, components may experience degraded performance and sometimes failure. To resolve or prevent this, you can increase and fine-tune database connection limits for the component.
Warning: Decreasing the value of this field for a component may affect the amount of time it takes for it to respond to requests.
Rolling App Deployments
You can optionally disable rolling app deployments. For more information, see Rolling App Deployments (Beta).
To disable rolling app deployments:
Select Disable Zero Downtime App Deployments.
Click Save.
Step 20: (Optional) Metric Registrar
Note: The Metric Registrar is bundled with PAS, and you configure it within the PAS tile. You do not install and configure Metric Registrar as a separate product tile.
You configure the Metric Registrar in the tile > Metric Registrar pane. Metric Registrar allows the conversion of structured logs into metrics. It also scrapes metrics endpoints and forwards the metrics to Loggregator. If enabled, Pivotal recommends also enabling the Metric Registrar Smoke Test errand.
You can configure the Metric Registrar from this pane in the following ways:
- Enable
- Edit default scraping interval
- Add blacklisted tags
Enable the Metric Registrar
The Metric Registrar is disabled by default.
To enable the Metric Registrar, do the following:
In the PAS tile, click Metric Registrar.
Select the Enable Metric Registrar checkbox.
Edit Default Scraping Interval
The scraping interval defines how often the Metric Registrar polls custom metric endpoints. The default is 35 seconds.
To edit the Metric Registrar scraping interval, do the following:
In the PAS tile, click Metric Registrar.
Edit the Endpoint Scraping Interval field.
Add Blacklisted Tags
To prevent the Metric Registrar from consuming the value of a metric or event tag, you can add the tag to the Blacklisted Tags field. For example, if you tag your metrics with a
customer_id, you may want to add
customer_id to the list of blacklisted tags. The field accepts a comma-separated list.
By default, the following tags are blacklisted to prevent interference with other products like PCF Metrics that use and rely on such tags.
To prevent the Metric Registrar from consuming the value of a metric or event tag, do the following:
In the PAS tile, click Metric Registrar.
Add the desired tag to the Blacklisted Tags field.
Step 22: Configure Errands
Errands are scripts that Ops Manager runs automatically when it installs or uninstalls a product, such as a new version of Pivotal Application Service (PAS). There are two types of errands: post-deploy errands run after the product is installed, and pre-delete errands run before the product in uninstalled.
By default, Ops Manager always runs all errands.
The PAS tile Errands pane lets you change these run rules. For each errand, you can select On to run it always or Off to never run it.
For more information about how Ops Manager manages errands, see the Managing Errands in Ops Manager topic.
Note: Several errands, such as App Autoscaler and Notifications, deploy apps that provide services for your deployment. When one of these apps is running, selecting Off for the corresponding errand on a subsequent installation does not stop the app.
Smoke Test Errand verifies that your deployment can do the following:
- Push, scale, and delete apps
- Create and delete orgs and spaces
Usage Service Errand deploys the Pivotal Usage Service application, which Apps Manager depends on.
Apps Manager Errand deploys Apps Manager, a dashboard for managing apps, services, orgs, users, and spaces. Until you deploy Apps Manager, you must perform these functions through the cf CLI. After Apps Manager has been deployed, Pivotal recommends setting this errand to Off for subsequent PAS deployments. For more information about Apps Manager, see the Getting Started with the Apps Manager topic.
Notifications Errand deploys an API for sending email notifications to your PCF platform users.
Note: The Notifications app requires that you configure SMTP with a username and password, even if you set the value of SMTP Authentication Mechanism to
Notifications UI Errand deploys a dashboard for users to manage notification subscriptions.
App Autoscaler Errand pushes the App Autoscaler app, which enables you to configure your apps to automatically scale in response to changes in their usage load. See the Scaling an Application Using Autoscaler topic for more information.
App Autoscaler Smoke Test Errand runs smoke tests against App Autoscaler.
NFS Broker Errand pushes the NFS Broker app, which supports NFS Volume Services for PAS. For more information, see Enabling NFS Volume Services.
Metric Registrar Smoke Test Errand verifies the Metric Registrar can access custom metrics emitted by an app and convert them into Loggregator metrics.
Note: The Metric Registrar Smoke Test errand runs only if the Metric Registrar is enabled. For more information about enabling and configuring the Metric Registrar, see Configuring the Metric Registrar.
SMB Broker Application Errand pushes the SMB Broker app, which supports SMB Volume Services for PAS. For more information, see Enabling SMB Volume Services.
Step 23: Register Router or HAProxy to Elastic Load Balancer
According to the patch version of PAS you are using, the Terraform config may deploy either Network Load Balancers or Classic Load Balancers. The entries in your Terraform output indicate which you have:
- Entries with the suffix
target_groupmean Network Load Balancers are deployed. This is the case for the most recent releases.
- Entries with the suffix
elb_namemean Classic Load Balancers are deployed. This was the case for previous releases.
The type of load balancer affects the configuration you need to do for each Load Balancer:
- Network Load Balancer: Register the VMs to the target group and security group using the
- Classic Load Balancer: Register VMs to the Load Balancer directly. The value in the Ops Manager config is the load balancer name.
Classic Load Balancers
To register the router or HAProxy to Classic load balancers, do the following:
In the PAS tile, click Resource Config.
To get the name of the SSH load balancer, record the value of
ssh_elb_namefrom the Terraform output.
Do one of the following, depending on the PAS release:
- Pivotal Application Service (PAS): In the Load Balancers field of the Diego Brain row, enter the value you recorded in the previous step.
- Small Footprint Runtime: In the Load Balancers field of the Control row, enter the value you recorded in the previous step.
To get the name of the web load balancer, record the value of
Do one of the following, depending on if you are using a router or HAProxy:
- Router: In the Load Balancers field of the Router row, enter the value you recorded in the previous step.
- HAProxy: In the Load Balancers field of the HAProxy row, enter the value you recorded in the previous step.
In the Load Balancers field of the TCP Router row, enter the value of
Click Save.
Network Load Balancers
To register the router or HAProxy to Network load balancers, do the following
Create a file named
vm_extensions_config.ymlwith the following content, depending on which release you are using:
- Pivotal Application Service (PAS):
--- product-name: cf resource-config: diego_brain: elb_names: - alb:SSH_TARGET_GROUP_1 - alb:SSH_TARGET_GROUP_2 additional_vm_extensions: - ssh-lb-security-groups router: elb_names: - alb:WEB_TARGET_GROUPS_1 - alb:WEB_TARGET_GROUPS_2 additional_vm_extensions: - web-lb-security-groups tcp_router: elb_names: - alb:TCP_TARGET_GROUP_1 - alb:TCP_TARGET_GROUP_2 additional_vm_extensions: - tcp-lb-security-groups
- Small Footprint Runtime:
--- product-name: cf resource-config: control: elb_names: - alb:SSH_TARGET_GROUP_1 - alb:SSH_TARGET_GROUP_2 additional_vm_extensions: - ssh-lb-security-groups router: elb_names: - alb:WEB_TARGET_GROUPS_1 - alb:WEB_TARGET_GROUPS_2 additional_vm_extensions: - web-lb-security-groups tcp_router: elb_names: - alb:TCP_TARGET_GROUP_1 - alb:TCP_TARGET_GROUP_2 additional_vm_extensions: - tcp-lb-security-groups
Replace values in the file as follows;
SSH_TARGET_GROUP_X: Enter your SSH target groups. You can find these values by running
terraform output ssh_target_groups.
WEB_TARGET_GROUPS_X: Enter your web target groups. You can find these values by running
terraform output web_target_groups.
TCP_TARGET_GROUP_X: Enter your TCP target groups. You can find these values by running
terraform output tcp_target_groups.
Apply the VM extension configuration using the
omCLI. For more information about
om, see pivotal-cf/om in GitHub.
om -k \ -t "YOUR-OPS-MANAGER-FQDN" \ -u "USERNAME" \ -p "PASSWORD" \ configure-product \ -c vm_extensions_config.yml
YOUR-OPS-MANAGER-FQDNis the URL at which you access your Ops Manager instance. This corresponds to
ops_manager_dnsin the Terraform output.
USERNAMEis the user name you entered when configuring internal authentication.
PASSWORDis the password you entered when configuring internal authentication.
Note: If you did not configure internal authentication, you must modify this command to use a client ID and secret instead of user name and password. See Authentication in the
Step 24: (Optional) Scale Down and Disable Resources
Note: The Resource Config pane has fewer VMs if you are installing the Small Footprint Runtime.
Note: The Small Footprint Runtime does not default to a highly available configuration. It defaults to the minimum configuration. If you want to make the Small Footprint Runtime highly available, scale the Compute, Router, and Database VMs to
3 instances and scale the Control VM to
2 instances.
Pivotal Application Service (PAS) defaults to a highly available resource configuration. However, you may need to perform additional procedures to make your deployment highly available. See the Zero Downtime Deployment and Scaling in CF and the Scaling Instances in PAS topics for more information.
If you do not want a highly available resource configuration, you must scale down your instances manually by navigating to the Resource Config section and using the dropdowns under Instances for each job.
By default, PAS also uses an internal filestore and internal databases. If you configure PAS to use external resources, you can disable the corresponding system-provided resources in Ops Manager to reduce costs and administrative overhead.
To disable specific VMs in Ops Manager, do the following:
Click Resource Config.
If you configured PAS to use an external S3-compatible filestore, enter
0in Instances in the File Storage field.
If you selected External when configuring the UAA, System, and CredHub databases, edit the following fields:
- MySQL Proxy: Enter
0in Instances.
- MySQL Server: Enter
0in Instances.
- MySQL Monitor: Enter
0in Instances.
- MySQL Proxy: Enter
If you disabled TCP routing, enter
0Instances in the TCP Router field.
If you are not using HAProxy, enter
0Instances in the HAProxy field.
Click Save.
Step 25: Download Stemcell
This step is only required if your Ops Manager does not already have the stemcell version required by PAS. For more information about importing stemcells, see Importing and Managing Stemcells.
Open the Stemcell product page in the Pivotal Network. Note, you may have to log in.
Download the appropriate stemcell version targeted for your IaaS.
Navigate to Stemcell Library in the Installation Dashboard.
Click Import Stemcell to import the downloaded stemcell
When prompted, enable the Ops Manager product checkbox to stage your stemcell.
Click Apply Stemcell to Products.
Step 26: Complete the PAS Installation
Click the Installation Dashboard link to return to the Installation Dashboard.
Click Review Pending Changes, then Apply Changes. If the following ICMP error message appears, click Ignore errors and start the install.
The install process generally requires a minimum of 90 minutes to complete. The image shows the Changes Applied window that displays when the installation process successfully completes.


text:
over and over
Outfit Details:
Chambray Rebecca Dress – c/o Fischer
Foley + Corinna Mid-City Tote – c/o Foley + Corinna
On a sheer day top – c/o ModCloth
platforms – Aldo
bracelets – Forever 21, Rebecca Minkoff, vintagerings – Forever 21, hand-me-down initial ringVersace frames – c/o LensCrafterslipstick: Urban Decay Super-Saturated High Gloss Lip Color in F-Bombnails: Estée Lauder Hot Coral
Those of you who follow me on twitter or facebook have already seen them (I'm bad at surprises) but here are the new frames I picked up at my appointment with LensCrafters! I went in there with a pretty open mind but was pretty sure I would leave with something very different than these. I tried on several pairs but ultimately decided to go with something bold and bright. Since I already have a pair of black frames and they graciously fitted my brown vintage frames with my prescription, I figured I might as well go with something different. I've been loving the variety. Glasses are fun! Unlike braces, which I also wished for and ended up not loving as much. I hated my retainer even more, which is why I have crooked teeth but I digress.
Naturally, the first time I wore my new glasses, I paired them with a bunch of matchy-matchy items from my wardrobe because that's exactly what you're not supposed to do. Oh, they're reddish coral? I'll see that and raise you a matching shirt, bag, lipstick, nails and bracelet. I'm also that girl who listens to songs on repeat, so don't expect me to practice moderation. You're lucky I'm not wearing 50+ bracelets right now, because five year old me wore so many bracelets I had to walk with my arms held out. I broke up the colors with that little chambray dress by Fischer – an independent and local label I love. The designer sent Bobby and me a beautiful package of her designs and I have been wearing both this dress and this shirt a lot. I love classics that I can wear over and over. I can't wait to see what's in store for them in the near future!

subset: commoncrawl


text:
Exclusive for our website players.
No multiple accounts or free bonuses in a row are allowed. If your last transaction was a free bonus please make a deposit before using this bonus.
Only players who opened their account at the casino through our website can receive our special bonuses for that casino.
Best of wishes!
Bonus valid till 31/03/2019
Wagering Requirements – 50xB
You can withdraw up to $80


text:
Birch Leaf Frame
Surround yourself with nature! It will be easy for you to find a home for this leaf, either outdoors or inside your home.
We create these leaves by bending an irregular steel frame out of 3/4" wide steel. The leaf is hand-cut and frames are individually formed, no two are exactly alike. We hammer the leaf slightly to give it a natural shape then weld it suspended within the frame. On the back a hidden saw tooth bracket makes mounting easy. A finishing touch, stainless steel pins are added to the frame. This holds the piece away from the wall, creating interesting visual depth as well as adding some protection to wall.
Once the welding is done, we let nature finish the job with a rust patina. That means this design can hang outdoors year around with no maintenance needed. If you prefer to install inside, we recommend sealing the surface with a clear finish designed for metal such as Tremclad or Rustoleum, to reduce scaling.
This design is available in in two sizes, approximate sizes to outer corners. Rust colouring will vary, but in an outdoor setting, will gradually darken the finish to a deep uniform tobacco colour.


text:
Associate Editor Marisa LaScala joined Westchester magazine in 2003, and ever since she's blown every paycheck at the Greenburgh Multiplex. She also staunchly defends Richard Kelly, doesn't mind spoiling the endings of trashy movies you're curious about but don't want to pay to see, wishes the Hold Steady would come back and rock out Westchester, misses Arrested Development more than anyone can imagine, and still watches cartoons and Saturday Night Live. You can find more of her cultural criticism at www.popmatters.com, where she is a staff writer.
Our free, totally awesome newsletter


text:
Toys playing with their own overly-engineered, brand-name, Apple gadgets is what could probably be called—quite accurately—the pinnacle of pretension. Still, anything made miniature is automatically cool. And these tiny iPods, iPads, iPhones, and MacBooks are no exception. Not even when Woody from Toy Story is posed with a doll-size iPhone to look like he's Instagramming his sushi dinner.
[CultofMac via Webstagram]


text:
Buenos Aires Provinceのアクティビティ
"An impressive modern building, the MALBA contains works by Argentine greats and other Latin American masters. It regularly hosts seminars and has a small cinema for cult and art-house retrospectives."
- 現地メンバー350人のおすすめ
"Housed in a hulk of a building (originally a pumping station) on the busy traffic artery of Avenida del Libertador, the National Museum of Fine Arts is a vast treasury of Argentinian and Latin American art and painting from the 19th and 20th centuries, as well as one of the most important in Latin America. In the dozens of rooms you'll find heavyweight Argentinian artists. Although the emphasis here is on Latin American art, you'll also find important collections of European art and a smattering of American and Asian art. From Tuesday to Friday, 12:30pm to 8:30pm Saturday & Sunday, 9:30am to 8:30pm"
- 現地メンバー290人のおすすめ
"Main shopping center in the neighborhood. It offers a wide range of shops, even travel agencies to purchase plane tickets or bus tickets to local towns. The green subway line 'D' has its entrance right in front of the mall."
- 現地メンバー281人のおすすめ
"If you think of cemeteries as depressingly dark, underground affairs, Buenos Aires' Recoleta Cemetery will turn that on its head. Considered the second most beautifuls cementery in the world (after the Pere Lechaise in Paris), the site was declared the city's first official public burial place in 1822. Aside from being the resting place of the deceased, it is completely unlike a normal cemetery. The place is full of elaborately carved scroll-work and stately pillars that only reach up to your shoulder because all the structures are weirdly mini; it's more magical than macabre. The burial site of Argentina's most famous figures, including Evita herself."
- 現地メンバー335人のおすすめ
"Walk or bike across the famous bridge and along the waterways with historic brick buildings. On weekends the area is packed with Portenos out for a walk and dining. There are many restaurants to enjoy. The Reserva Ecologica is accessible from the northern end."
- 現地メンバー308人のおすすめ
Botanical Garden
"The Botanical Gardens it's home to 5,500+ plant species, a botanic library, a museum, assorted monuments and five greenhouses."
- 現地メンバー191人のおすすめ
Opera House
"Take the guided tour of the Colon Theater, it is a beautiful theater. Hacer la visita guiada del Teatro Colon, es una belleza de teatro. "
- 現地メンバー247人のおすすめ
Opera House
"Beautiful Opera House in Buenos Aires. Considered to be one of the best in the world."
- 現地メンバー214人のおすすめ
"• The Obelisk (Monserrat): The "Obelisco" reminds in each of its faces a historical "porteño" fact: the first foundation, in 1536; the second and definitive, in 1580; the first time the National flag was raised in the city, in 1812 (in the church of San Nicolás, which was raised precisely where nowadays the "Obelisco" stands); and the constitution of Buenos Aires as the Argentine capital in 1880. "
- 現地メンバー180人のおすすめ
"San Telmo is the oldest barrio (neighborhood) of Buenos Aires. It is a well-preserved area of the Argentine metropolis and is characterized by its colonial buildings. Cafes, tango parlors and antique shops line the cobblestone streets, which are often filled with artists and dancers. A street named the "Illuminated Block" is where many of these important historical buildings can be found"
- 現地メンバー243人のおすすめ
"A place to relax amid the bustle of the city. The Japanese Gardens are one of the most relaxing places in Buenos Aires. Located beside Tres de Febrero park, the site was inaugurated in 1967 to coincide with a visit by the future emperor of Japan, Akihito, and his wife Michiko. The various elements of the gardens were designed to create balance and harmony. There is a wide variety of plants, a pond with carp (koi), an island with bridges, and sculptures based on Japanese culture. The park also has a cultural center, a Japanese restaurant, a craft shop and a nursery when visitors can buy bonsai trees and other plants."
- 現地メンバー147人のおすすめ
"Galerías Pacífico is one of the city's most opulent shopping centres, and many people visit just to see its installations and its dome, which is painted with murals by Argentine artists Antonio Berni, Lino Enea Spilimbergo, Demetrio Urruchúa and Juan Carlos Castagnino. The central downtown building, at the intersection of Florida and Córdoba, was constructed in 1889 to house Au Bon Marché department store but never served this purpose and instead was used as the site of the Museo de Bellas Artes until 1940. The building was converted into a shopping centre in 1990 and has been declared a national historic monument because of its architectural importance. It contains specialised leather stores as well as international names, and a food court. Personal shoppers are available with pre-booking, and the centre provides facilities for children, a bureau de change, ATMs and a premium taxi service. The centre is also home to the Centro Cultural Borges, the venue for a tango school as well as art exhibitions and workshops. Guided tours: Those interested in learning more about the building's history can reserve a 20-minute guided tour (phone 5555-5110), Monday to Friday at 11.30am and 4.30pm. The tour can also be completed independently using audioguides (Spanish, English, Portuguese and French) available at the information desk on the ground floor."
- 現地メンバー190人のおすすめ
Nature Preserve
"Located in the downtown area, the Ecological Reserve, Costanera Sur draws families, joggers and cyclists during the weekends, is part of the new Puerto Madero urbanization. It's a wonderful place to exercise and enjoy fresh air. "
- 現地メンバー212人のおすすめ
" Plaza de Mayo Square It is the oldest square in Buenos Aires . Its location was determined in the 2nd foundation of the city, in 1580. It is surrounded by historical and governmental buildings, such as the Cabildo, the Casa Rosada (National Government seat,) the Palace of the Government of Buenos Aires, banks, and ministries. "
- 現地メンバー167人のおすすめ
"Located within the Palermo neighbourhood's Parque Tres de Febrero - one of the most popular parks in the city, is this collection of more than 18,000 roses surrounded by a lake and acres of parkland. "
- 現地メンバー146人のおすすめ
Government Building
"National Government House located in city downtown. Recently renovated for tourist visits."
- 現地メンバー161人のおすすめ
"Famous place to eat meat. Make reservation or wait patiently because is always crowded."
- 現地メンバー168人のおすすめ
"Great place to have "ASADO" (BBQ). Try to get reservations, it get really crowded "
- 現地メンバー163人のおすすめ
"Traditional pizza store. This is the way Argentine people eat pizza. You may have a seat or stand at the bar and orden "muza con fainá". "
- 現地メンバー111人のおすすめ
"Iconic pizza place, located at recognised Corrientes Av, where theatres and lights stand out"
- 現地メンバー123人のおすすめ
"Healthy and tasty meals for every day. Just one block apart from Quartier Dorrego."
- 現地メンバー89人のおすすめ
"This is a San Telmo restaurant at its best: tightly packed tables, patrons knocking elbows, suited waiters, a sweaty asador and great meat. It started with one floor but now has three, including a rooftop terrace. Order your meat jugoso (rare) and the waiter might just cut it with a spoon. Like La Cabrera, it's a bit pricier but the whole experience is a good value."
- 現地メンバー68人のおすすめ
Burger Joint
"Want a great burger and not looking for a longer meal this is one of the many new great burger places that have popped up and are excellent. I think you will agree that the burgers in BA hold there own to many top burgers in the USA or anywhere else in the world!!"
- 現地メンバー46人のおすすめ
"A slightly smaller, more intimate version of its 'brother' El Federal. A varied menu, relaxed atmosphere and traditional/vintage decor. Great to while away the hours on a relaxing morning."
- 現地メンバー48人のおすすめ