There’s not a lot of specific information out there for this configuration. There’s some guidance from Pivotal and some how-tos from VMware, so with a little additional detail, we should be able to figure this out.
Edit – 2/1/17 – Updated with OpenSSL configuration detail
Edit – 3/20/17 – Updated SubjectAltNames in config
Preparation
- SSL Certificate. You’ll need the signed public cert for your URL (certnew.cer), the associated private key (pcf.key) and the public cert of the signing CA (root64.cer).
- Download and install OpenSSL
- Create a config file for your request – paste this into a text file:
[ req ]
default_bits = 2048
default_keyfile = rui.key
distinguished_name = req_distinguished_name
encrypt_key = no
prompt = no
string_mask = nombstr
req_extensions = v3_req
[ v3_req ]
basicConstraints = CA:FALSE
keyUsage = digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth, clientAuth
subjectAltName = DNS: *.pcf.domain.com, DNS:ServerShortName, IP:ServerIPAddress, DNS: *.system.pcf.domain.com, DNS: *.apps.pcf.domain.com, DNS:*.login.system.pcf.domain.com, DNS: *.uaa.system.pcf.domain.com
[ req_distinguished_name ]
countryName = US
stateOrProvinceName = State
localityName = City
0.organizationName = Company Name
organizationalUnitName = PCF
commonName = *.pcf.domain.com
- Replace the values in red with those appropriate for your environment. Be sure to specify the server name and IP address as the Virtual IP and its associated DNS record. Save the file as pcf.cfg. You’ll want to use the wildcard “base” name as the common name and the server name, as well as the *.system, *.apps, *.login.system and *.uaa.system Subject Alt Names.
- Use OpenSSL to create the Certificate Site Request (CSR) for the wildcard PCF domain.
openssl req -new -newkey rsa:2048 -nodes -keyout pcf.key -out pcf.csr -config pcf.cfg
- Use OpenSSL to convert the key to RSA (required for NSX to accept it)
openssl rsa -in pcf.key -out pcfrsa.key
- Submit the CSR (pcf.csr) to your CA (Microsoft Certificate Services in my case), retrieve the certificate (certnew.cer) and certificate chain (certnew.p7b) base-64 encoded.
- Double-click certnew.p7b to open certmgr. Export the CA certificate as 64-bit encoded x509 to a file (root64.cer is the file name I use)
- Networks. You’ll need to know what layer 3 networks the PCF components will use. In my case, I set up a logical switch in NSX and assigned the gateway address to the DLR. Probably should make this a 24-bit network, so there’s room to grow, but not reserving a ridiculous number of addresses. We’re going to carve up the address space a little, so make a note of the following:
- Gateway and other addresses you typically reserve for network devices. (eg: first 9 addresses 1-9)
- Address that will be assigned to the NSX load balancer. Just need one (eg: 10)
- Addresses that will be used by the PCF Routers. At least two. These will be configured as members in the NSX Load Balancer Pool.
- DNS, IP addresses. PCF will use “system” and “apps” subdomains, plus whatever names you give any apps deployed. This takes some getting used to – not your typical application. Based on the certificate we created earlier, I recommend just creating a “pcf” subdomain. In my case, the network domain (using AD-DNS) is ragazzilab.com and I’ve created the following:
- pcf.ragazzilab.com subdomain
- *.pcf.ragazzilab.com A record for the IP address I’m going to assign to the NSX Load-Balancer
NSX
Assuming NSX is already installed and configured. Create or identify an existing NSX Edge that has an interface on the network where PCF will be / is deployed.
- Assign the address we noted above to the inteface under Settings|Interfaces
- Under Settings|Certificates, add the our SSL certificates
- Click the Green Plus and select “CA Certificate”. Paste the content of the signing CA public certificate (base64.cer) into the Certificate Contents box. Click OK.
- Click the Green Plus and select “Certificate”. Paste the content of the signed public cert (certnew.cer) into the Certificate Contents box and paste the content of the RSA private key (pcfrsa.key) into the Private Key box. Click OK.
- Under Load Balancer, create an Application Profile. We need to ensure that NSX inserts the x-forwarded-for HTTP headers. To do that, we need to be able to decrypt the request and therefore must provide the certificate information. I found that Pool Side SSL had to be enabled and using the same Service and CA Certificates.
Router Application Profile - Create the Service Monitor. What worked for me is a little different from what is described in the GoRouter project page. The key points are that we want to specify the useragent and look for a response of “ok” with a header of “200 OK”.
Service Monitor for PCF Router - Create the Pool. Set it to ROUND-ROBIN using the Service Monitor you just created. When adding the routers as members, be sure to set the port to 443, but the Monitor Port to 80.
Router Pool - Create the Virtual Server. Specify the Application Profile and default Pool we just created. Obviously, specify the correct IP Address.
Virtual Server Configuration
PCF – Ops Manager
Assuming you’ve already deployed the Ops Manager OVF, use the installation dashboard to edit the configuration for Ops Manager Director. I’m just going to highlight the relevant areas of the configuration here:
Networks. Under “Create Networks”, be sure that the Subnet specified has the correct values. Pay special attention to the reserved IP ranges. These should be the addresses of the network devices and the IP address assigned to the load-balancer. Do not include the addresses we intend to use for the routers though. Based on the example values above, we’ll reserve the first 10 addresses.
Ops Manager Director will probably use the first/lowest address in range that is not reserved.
PCF – Elastic Runtime
Next, we’ll install Elastic Runtime. Again, I’ll highlight the relevant sections of the configuration.
- Domains. In my case it’s System Domain = system.pcf.ragazzilab.com and Apps Domain = apps.pcf.ragazzilab.com
- Networking.
- Set the Router IPs to the addresses (comma-separated) you noted and added to as members to the NSX load-balancer earlier.
- Leave HAProxy IPs empty
- Select the point-of-entry option for “external load balancer, and it can forward encrypted traffic”
- Paste the content of the signed certificate (certnew.cer) into the Certificate PEM field. Paste the content of the CA public certificate (root64.cer) into the same field, directly under the certificate content.
- Paste the content of the private key (pcf.key) into the Private Key PEM field.
- Check “Disable SSL Certificate verification for this environment”.
- Resource Config. Be sure that the number of Routers is at least 2 and equal to the number of IP addresses you reserved for them.
Troubleshooting
Help! The Pool Status is down when the Service Monitor is enabled.
This could occur if your routers are behaving differently from mine. Test the response by sending a request to one of the routers through curl and specifying the user agent as HTTP-Monitor/1.1
curl -v -A “HTTP-Monitor/1.1” “http://{IP of router}”
The value in the yellow box should go into the “Expected” field of the Service Monitor and the value in the red box should go into the “Receive” field. Note that you should not get a 404 response, if you do, check that he user agent is set correctly.
Notes
This works for me and I hope it works for you. If you have trouble or disagree, please let me know.
Brian Ragazzi 