# mulesoft Anypoint Platform Private Cloud Edition - Full Documentation

<!-- document id=a6f328368cc6b8f1de301e5f1562ac82c95010b62d8a42df27bffa3f2bf20a46 url=/mulesoft/current/en-us/private-cloud/3.2/ops-center-update-lic.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 3.2
---

# Add a Product License Using Ops Center

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

When your product license expires, Ops Center displays a message stating that the system is under
maintenance. It continues to display this message until you add a valid license.

To add a new Anypoint Platform Private Cloud Edition license in Ops Center:

1.  Sign into Ops Center.

2.  Select the **Admin** tab.

3.  Under **License**, add your new license in the text area.

4.  Select **Update License**.

## See Also

- [Ops Center](https://docs.mulesoft.com/private-cloud/3.2/managing-via-the-ops-center)

<!-- document id=2ec97be37d38a742427ff13357ecf544ffe3384ccf10f163e72e0cdef2f51665 url=/mulesoft/current/en-us/private-cloud/4.0/adding-compatible-java-versions-using-the-maven-client.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.0
---

# Adding Compatible Java Versions for Assets Using the Maven Client

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Add the compatible Java versions of assets for Anypoint Platform Private Cloud Edition (Anypoint
Platform PCE) using the Maven Facade API (v1 and v2). The Java versions display in the Exchange UI,
Exchange API, and GraphQL console for Anypoint Platform PCE environments. Only Java 8, 11, and 17
are supported.

To add the Java version compatibility, in the POM file, add the properties section and set each Java
version to either true or false.

This example snippet shows the properties section:

```xml
<properties>
   <type>app</type>
   <tags>connector, mulesoft</tags>
   <isJava8Supported>false</isJava8Supported>
   <isJava11Supported>true</isJava11Supported>
   <isJava17Supported>true</isJava17Supported>
</properties>
```

In the example, Java 8 is set to `false`. Only version 11 and 17 appear for the asset version in the
Exchange UI, Exchange API, and the GraphQL console.

## See Also

- [Managing Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/4.0/operating-about)

<!-- document id=927582d3deeb7251ae97f3453b7c84b2e149515ba8fe52ce77a15465d49daa22 url=/mulesoft/current/en-us/private-cloud/4.1/adding-compatible-java-versions-using-the-maven-client.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.1
---

# Adding Compatible Java Versions for Assets Using the Maven Client

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Add the compatible Java versions of assets for Anypoint Platform Private Cloud Edition (Anypoint
Platform PCE) using the Maven Facade API (v1 and v2). The Java versions display in the Exchange UI,
Exchange API, and GraphQL console for Anypoint Platform PCE environments. Only Java 8, 11, and 17
are supported.

To add the Java version compatibility, in the POM file, add the properties section and set each Java
version to either true or false.

This example snippet shows the properties section:

```xml
<properties>
   <type>app</type>
   <tags>connector, mulesoft</tags>
   <isJava8Supported>false</isJava8Supported>
   <isJava11Supported>true</isJava11Supported>
   <isJava17Supported>true</isJava17Supported>
</properties>
```

In the example, Java 8 is set to `false`. Only version 11 and 17 appear for the asset version in the
Exchange UI, Exchange API, and the GraphQL console.

## See Also

- [Managing Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/4.1/operating-about)

<!-- document id=2ec74e6351fc8b98269ed0aa6a993cf74de6a22e3c2ba5ba6f3b3f04b6888d59 url=/mulesoft/current/en-us/private-cloud/4.2/adding-compatible-java-versions-using-the-maven-client.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.2
---

# Adding Compatible Java Versions for Assets Using the Maven Client

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Add the compatible Java versions of assets for Anypoint Platform Private Cloud Edition (Anypoint
Platform PCE) using the Maven Facade API (v1 and v2). The Java versions display in the Exchange UI,
Exchange API, and GraphQL console for Anypoint Platform PCE environments. Only Java 8, 11, and 17
are supported.

To add the Java version compatibility, in the POM file, add the properties section and set each Java
version to either true or false.

This example snippet shows the properties section:

```xml
<properties>
   <type>app</type>
   <tags>connector, mulesoft</tags>
   <isJava8Supported>false</isJava8Supported>
   <isJava11Supported>true</isJava11Supported>
   <isJava17Supported>true</isJava17Supported>
</properties>
```

In the example, Java 8 is set to `false`. Only version 11 and 17 appear for the asset version in the
Exchange UI, Exchange API, and the GraphQL console.

## See Also

- [Managing Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/4.2/operating-about)

<!-- document id=200de589db90612c75c169d00cd760bc3cc39cdae8141ca551a92931c5e5c7d2 url=/mulesoft/current/en-us/private-cloud/latest/adding-compatible-java-versions-using-the-maven-client.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.3
is-latest-version: true
---

# Adding Compatible Java Versions for Assets Using the Maven Client

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Add the compatible Java versions of assets for Anypoint Platform Private Cloud Edition (Anypoint
Platform PCE) using the Maven Facade API (v1 and v2). The Java versions display in the Exchange UI,
Exchange API, and GraphQL console for Anypoint Platform PCE environments. Only Java 8, 11, and 17
are supported.

To add the Java version compatibility, in the POM file, add the properties section and set each Java
version to either true or false.

This example snippet shows the properties section:

```xml
<properties>
   <type>app</type>
   <tags>connector, mulesoft</tags>
   <isJava8Supported>false</isJava8Supported>
   <isJava11Supported>true</isJava11Supported>
   <isJava17Supported>true</isJava17Supported>
</properties>
```

In the example, Java 8 is set to `false`. Only version 11 and 17 appear for the asset version in the
Exchange UI, Exchange API, and the GraphQL console.

## See Also

- [Managing Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/latest/operating-about)

<!-- document id=fdefce408063626317e3767154ea6a15e0238a7635a00ea3fd364b9a0da64fd7 url=/mulesoft/current/en-us/private-cloud/3.2/config-add-proxy-allowlist.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 3.2
---

# Allow Addresses for API Platform Proxies

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

By default, proxy requests are enabled for the domain name where the platform runs.

> [!NOTE] For versions 3.2.2 and later, refer to Trusted Domains.

To allow addresses in versions 3.2.0 and 3.2.1:

1.  Log in to Ops Center and select **Kubernetes** on the left side-bar.

2.  Select the `api-manager` namespace from the drop-down menu on the top, and then select
    **Configmaps**. Find the `api-platform-web-env` configmap and then click on `Edit Config Map`.

3.  Select the **APW\_FEATURES\_PROXYWHITELIST** tab and ensure that value is set to `true`. (You’ll
    have to hover your mouse over the tabs to get a tooltip with the full name to find the right
    tab)

    If not, set it to `true` and then select `Apply`.

4.  Select the **APW\_PROXYWHITELIST\_RULES** tab.

5.  Write your rules separated by commas.

    The following example defines regular expressions that allow requests to be made to the
    `**.somewhere.com/**` and `**.somewhereelse.com/**` domains, where `*` is any part of a DNS name
    or URL:

.\*\\.somewhere\\.com,.\*\\.somewhereelse\\.com

1.  Select **Apply** to save changes to the `api-platform-web-env` config map.

2.  Re-create the pods to ensure that each node in the cluster uses the most recent configuration:

    kubectl delete pod -n api-manager -l component=api-platform-web

## Trusted Domains

Every HTTP request you make to an external resource goes through the API Console Proxy. For security
reasons, you must register the domain as an allowed domain in Anypoint Platform.

By default, proxy requests are blocked for external domains on authenticated requests.

To add a new domain:

1.  Log in to Anypoint Platform using an account that has the Organization Administrator permission.

2.  In the navigation bar, click **Access Management**.

3.  Click **Trusted domains**.

4.  Click **Add domain**.

    The domain must not match an existing domain, must not be a domain or subdomain of MuleSoft or
    Anypoint Platform, and must be written in the format `exampledomain.com`. NOTE: Regular
    expressions are not supported.

5.  Type the domain name and click **Add domain**.

    The domain is added to your list of trusted domains. You are redirected to the trusted domains
    page, where you can edit or delete your domains. If you register a domain on a parent
    organization, the domain is allowlisted for all of your business groups.

## Authentication

When using the proxy, there are two authentication modes:

- Strict Authentication:

  (Default) All requests that reach the proxy must be authenticated, which means that user token
  credentials must be included in the `ms-authorization` header of the request.

  > [!WARNING] If requests to external domains from the Exchange Public Portals go through the API
  > Console Proxy, they fail because no Anypoint user is involved in the call.

- Non-Strict Authentication:

  API Console Proxy continues to be unauthenticated but it allows unauthenticated requests. The
  incoming request must provide either the user’s token or a reference to the Organization ID that
  the request belongs to. The Organization ID must be sent on the `ms-organization-id` header.

To change the authentication method from strict to non-strict, follow these steps:

1.  Log in to Ops Center and select **Kubernetes** on the left side-bar.

2.  Select the `api-console-proxy` namespace from the drop-down menu on the top, and select
    **Configmaps**.

3.  Locate the `service-env` configmap and then click on **Edit Config Map**.

4.  Select the **STRICT\_AUTHENTICATION\_FF** tab and ensure that the value is set to `false`. (To
    find the right tab, hover your mouse over the tabs to get a tooltip with the full name.)

5.  Click **Apply** to save changes to the `service-env` config map.

6.  Recreate the pods to ensure that each node in the cluster uses the most recent configuration:

    kubectl delete pod -n api-console-proxy -l component=service

<!-- document id=0792b4a0ae23e0bea50d693891c3b675b799d90813e94d78323edba036369820 url=/mulesoft/current/en-us/private-cloud/4.0/config-add-proxy-allowlist.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.0
---

# Allowing Addresses for API Platform Proxies

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

To allow addresses in Anypoint Platform Private Cloud Edition (Anypoint Platform PCE) version 4.0
and later, follow these steps:

1.  From the api-manager/api-platform-web-env configmap verify if `APW_FEATURES_PROXYWHITELIST` is
    set to `true` by running the following command:

`kubectl get cm -n api-manager api-platform-web-env -o jsonpath={.data.APW_FEATURES_PROXYWHITELIST} true`

2.  If the response is not `true`, then set the value to `true` running the following command:

`kubectl patch cm -n api-manager api-platform-web-env -p '{"data":{"APW_FEATURES_PROXYWHITELIST": "true" }}`

3.  Update the `APW_PROXYWHITELIST_RULES` in the same configmap by running the following command to
    patch the configmap with desired allow list rules:

`kubectl patch cm -n api-manager api-platform-web-env -p '{"data":{"APW_PROXYWHITELIST_RULES": ".**\\.somewhere\\.com,.**\\.somewhereelse\\.com" }}`

The previous example shows how to allow requests to `.somewhere.com/` and `.somewhereelse.com/`
domains, where `*` is any part of a DNS name or URL, then list the rules separated by commas.

4.  Verify the patch was applied correctly. After confirmed, re-create the pods to ensure each node
    in the cluster uses the most recent configuration by running this command:

`kubectl delete pod -n api-manager -l component=api-platform-web`

## See Also

- [Managing Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/4.0/operating-about)

<!-- document id=c706dcff83c3f02f76225e39574750e8b1473e8427ddf97eae51d126629fc60d url=/mulesoft/current/en-us/private-cloud/4.1/config-add-proxy-allowlist.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.1
---

# Allowing Addresses for API Platform Proxies

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

To allow addresses in Anypoint Platform Private Cloud Edition (Anypoint Platform PCE) version 4.0
and later, follow these steps:

1.  From the api-manager/api-platform-web-env configmap verify if `APW_FEATURES_PROXYWHITELIST` is
    set to `true` by running the following command:

`kubectl get cm -n api-manager api-platform-web-env -o jsonpath={.data.APW_FEATURES_PROXYWHITELIST} true`

2.  If the response is not `true`, then set the value to `true` running the following command:

`kubectl patch cm -n api-manager api-platform-web-env -p '{"data":{"APW_FEATURES_PROXYWHITELIST": "true" }}`

3.  Update the `APW_PROXYWHITELIST_RULES` in the same configmap by running the following command to
    patch the configmap with desired allow list rules:

`kubectl patch cm -n api-manager api-platform-web-env -p '{"data":{"APW_PROXYWHITELIST_RULES": ".**\\.somewhere\\.com,.**\\.somewhereelse\\.com" }}`

The previous example shows how to allow requests to `.somewhere.com/` and `.somewhereelse.com/`
domains, where `*` is any part of a DNS name or URL, then list the rules separated by commas.

4.  Verify the patch was applied correctly. After confirmed, re-create the pods to ensure each node
    in the cluster uses the most recent configuration by running this command:

`kubectl delete pod -n api-manager -l component=api-platform-web`

## See Also

- [Managing Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/4.1/operating-about)

<!-- document id=ac52f995a98ed9c9bdc996c9819645291eb16d8c3602460cb1d8665eb6eb081f url=/mulesoft/current/en-us/private-cloud/4.2/config-add-proxy-allowlist.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.2
---

# Allowing Addresses for API Platform Proxies

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

To allow addresses in Anypoint Platform Private Cloud Edition (Anypoint Platform PCE) version 4.0
and later, follow these steps:

1.  From the api-manager/api-platform-web-env configmap verify if `APW_FEATURES_PROXYWHITELIST` is
    set to `true` by running the following command:

`kubectl get cm -n api-manager api-platform-web-env -o jsonpath={.data.APW_FEATURES_PROXYWHITELIST} true`

2.  If the response is not `true`, then set the value to `true` running the following command:

`kubectl patch cm -n api-manager api-platform-web-env -p '{"data":{"APW_FEATURES_PROXYWHITELIST": "true" }}`

3.  Update the `APW_PROXYWHITELIST_RULES` in the same configmap by running the following command to
    patch the configmap with desired allow list rules:

`kubectl patch cm -n api-manager api-platform-web-env -p '{"data":{"APW_PROXYWHITELIST_RULES": ".**\\.somewhere\\.com,.**\\.somewhereelse\\.com" }}`

The previous example shows how to allow requests to `.somewhere.com/` and `.somewhereelse.com/`
domains, where `*` is any part of a DNS name or URL, then list the rules separated by commas.

4.  Verify the patch was applied correctly. After confirmed, re-create the pods to ensure each node
    in the cluster uses the most recent configuration by running this command:

`kubectl delete pod -n api-manager -l component=api-platform-web`

## See Also

- [Managing Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/4.2/operating-about)

<!-- document id=e3bfc40d721a7d7cd505d927fd39feb282ef7eb25ae7305a2e21d74a82325765 url=/mulesoft/current/en-us/private-cloud/latest/config-add-proxy-allowlist.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.3
is-latest-version: true
---

# Allowing Addresses for API Platform Proxies

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

To allow addresses in Anypoint Platform Private Cloud Edition (Anypoint Platform PCE) version 4.0
and later, follow these steps:

1.  From the api-manager/api-platform-web-env configmap verify if `APW_FEATURES_PROXYWHITELIST` is
    set to `true` by running the following command:

`kubectl get cm -n api-manager api-platform-web-env -o jsonpath={.data.APW_FEATURES_PROXYWHITELIST} true`

2.  If the response is not `true`, then set the value to `true` running the following command:

`kubectl patch cm -n api-manager api-platform-web-env -p '{"data":{"APW_FEATURES_PROXYWHITELIST": "true" }}`

3.  Update the `APW_PROXYWHITELIST_RULES` in the same configmap by running the following command to
    patch the configmap with desired allow list rules:

`kubectl patch cm -n api-manager api-platform-web-env -p '{"data":{"APW_PROXYWHITELIST_RULES": ".**\\.somewhere\\.com,.**\\.somewhereelse\\.com" }}`

The previous example shows how to allow requests to `.somewhere.com/` and `.somewhereelse.com/`
domains, where `*` is any part of a DNS name or URL, then list the rules separated by commas.

4.  Verify the patch was applied correctly. After confirmed, re-create the pods to ensure each node
    in the cluster uses the most recent configuration by running this command:

`kubectl delete pod -n api-manager -l component=api-platform-web`

## See Also

- [Managing Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/latest/operating-about)

<!-- document id=283f91dcc1f6cfe55a4d5b49318ac70ae957213b4c79decd0cdeb0f8e4e3608a url=/mulesoft/current/en-us/private-cloud/3.2/ext-analytics-elk.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 3.2
---

# Analyze Business and API Data Using ELK

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Use the Elastic Stack (ELK stack) to analyze the business data and API analytics generated by
Anypoint Platform Private Cloud Edition (Anypoint Platform PCE). You can use Filebeat to process
Anypoint Platform log files, insert them into an Elasticsearch database, and then analyze them with
Kibana.

The following example shows how API data appears in Kibana:

![kibana example](/mulesoft/current/en-us/private-cloud/3.2/_images/kibana-example.png)

## Prerequisites

- Required software

  To export external analytics data to ELK, you must have the following software:

  - Mule runtime engine (Mule), version 3.8.4 or later

  - Anypoint Runtime Manager agent, version 1.7.0 or later

  - Elasticsearch, version 7.6.2

  - Filebeat, version 7.6.2

  - Kibana, version 7.6.2

- Ensure that you have installed and configured your Mule runtime engine instances.

- Ensure that you have registered your Mule runtime engine instances with Runtime Manager.

## Edit the wrapper.conf Properties File

In your Mule runtime installation, edit the following properties in the `conf/wrapper.conf` file:

1.  Set the `analytics_enabled` property to `true`:

    wrapper.java.additional.<n>=-Danypoint.platform.analytics\_enabled=true

2.  Remove the URI value from the `analytics_base_uri` property:

    wrapper.java.additional.<n>=-Danypoint.platform.analytics\_base\_uri=

3.  Set the `on_prem` property to `true`:

    wrapper.java.additional.<n>=-Danypoint.platform.on\_prem=true

## Enable Event Tracking

To export business and event tracking data, you must enable event tracking in Runtime Manager:

1.  From Anypoint Platform, select **Runtime Manager**.

2.  Select **Servers**.

3.  Select the row containing the server on which you want to configure ELK.

4.  Select **Manager Server** and then select the **Plugins** tab.

5.  In **Event Tracking**, select **Business Events** from the **Levels** drop-down menu.

6.  Select the switch to enable event tracking on ELK.

    Runtime Manager displays the **ELK Integration** dialog.

7.  Configure the log files as necessary.

8.  Select **Apply**.

## Enable API Analytics

To export API analytics, you must enable API analytics in Runtime Manager.

1.  From Anypoint Platform, select **Runtime Manager**.

2.  Select **Servers**.

3.  Select the row containing the server on which you want to configure ELK.

4.  Select the switch to enable API analytics and then select the switch next to **ELK**.

5.  Configure the log files as necessary.

6.  Select **Apply**.

## Install and Configure the Filebeat Agent

On each server with Mule runtime instances, download and install Filebeat for your operating system.

## Configure the Mule Filebeat Module

On each server with Mule runtime instances, download and expand the Filebeat Module archive from the
following URL:

https://s3.us-east-2.amazonaws.com/elk-integration/elk-integration-06-08-20/elk-integration.tar.gz

1.  Add the absolute paths of each log file to the `manifest.yml` files:

    - Inside the `businessevents` folder, set the event log paths to the `var` variable of your
      operating system (OS):

      var:
      - name: paths default:
        - /var/mule/logs/events.log os.darwin:
        - /var/mule/logs/events.log os.windows:
        - /var/mule/logs/events.log

    - Inside the `apianalytics` folder, set the API analytics log paths to the `var` variable of
      your OS:

      var:
      - name: paths default:
        - /var/mule/logs/api-analytics-elk.log\* os.darwin:
        - /var/mule/logs/api-analytics-elk.log\* os.windows:
        - c:/programdata/mule/logs/api-analytics-elk.log\*

2.  Copy the `mule` module folder to the `module` folder of your Filebeat installation.

3.  Copy the `mule.yml` file to the `modules.d` folder of your Filebeat installation.

4.  Start Elasticsearch and then Kibana.

5.  Set up Filebeat and provision dashboards to Kibana.

    Inside your Filebeat installation folder, execute the following command. Replace the
    `${filebeat-installation-folder}` with the path to your Filebeat installation root folder, and
    change the Elasticsearch host if needed.

    ***

    /filebeat setup -e \\

    -E output.elasticsearch.hosts="\['localhost:9200'\]" \\ -E
    output.elasticsearch.index="mule-%{+yyyy.MM.dd}" \\ -E setup.dashboards.enabled=true \\ -E
    setup.dashboards.directory=${filebeat-installation-folder}/module/mule/\_meta/kibana \\ -E
    setup.ilm.enabled=false \\ -E setup.template.name="mule" \\ -E setup.template.pattern="mule-\*"
    \\ -E setup.template.overwrite=true
    ---

6.  Start Filebeat.

    Inside your Filebeat installation folder, execute the following command. Replace the
    `${filebeat-installation-folder}` with the path to your Filebeat installation root folder, and
    change the Elasticsearch host if needed.

    ./filebeat -e \\ -E output.elasticsearch.hosts="\['localhost:9200'\]" \\ -E
    output.elasticsearch.index="mule-%{+yyyy.MM.dd}" \\ -E setup.dashboards.enabled=true \\ -E
    setup.dashboards.directory=${filebeat-installation-folder}/module/mule/\_meta/kibana \\ -E
    setup.ilm.enabled=false \\ -E setup.template.name="mule" \\ -E setup.template.pattern="mule-\*"
    \\ -E setup.template.overwrite=true

## Configure Kibana to Load an Index

After installing Filebeat and Elasticsearch, you must configure Kibana to consume data from Anypoint
Platform.

MuleSoft provides a default Kibana configuration that you can use to analyze business and API data.
This configuration includes dashboards, searches, and visualizations.

1.  Configure an index pattern

    You must create an Elasticsearch index for Anypoint Platform data:

    1.  Generate an initial set of data.

        This is required for Kibana to be able to recognize the index to be created. To send a
        request to a test API to generate an initial set of data:

        1.  In the Kibana management console, create an index pattern with `mule-*` as the value.

        2.  Select **@timestamp** in **Time Filter field name**.

        3.  In **Show advanced options**, set **mule-index** as the value in the **Custom index
            pattern ID** field.

    2.  Create the index.

        You can now access all the Mule dashboards in the **Dashboard** tab.

<!-- document id=27ec17e79bf8e84c36ae0c4b953957554903c7d9ddfc3241a044f36cada8fbb1 url=/mulesoft/current/en-us/private-cloud/3.2/anypoint-monitoring.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 3.2
---

# Anypoint Monitoring on Anypoint Platform PCE

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Anypoint Platform Private Cloud Edition (Anypoint Platform PCE) includes support for Anypoint
Monitoring. Anypoint Monitoring is a suite of tools that provides feedback from Mule flows and
components in your application network.

Anypoint Monitoring is an add-on to Anypoint Platform PCE. To use Anypoint Monitoring with Anypoint
Platform PCE, contact MuleSoft Professional Services.

Using Anypoint Monitoring with Anypoint Platform PCE requires the "Monitoring for On-Premises
Management" subscription. This subscription entitles you to use two monitoring instances. A
monitoring instance is an implementation of the 3-node Anypoint Monitoring configuration described
in [Supported Configurations for Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/3.2/supported-cluster-config). Each monitoring
instance is dedicated to a single Anypoint Platform PCE installation.

To use Anypoint Monitoring with more than two Anypoint Platform PCE installations, you must purchase
additional monitoring subscriptions. Contact MuleSoft Professional Services for more information.

## Supported Anypoint Monitoring Features

<table><colgroup><col> <col> <col> <col></colgroup><thead><tr><th>Feature</th><th>Gold and Platinum Subscription Features</th><th>Titanium Subscription Features</th><th>Anypoint Platform PCE Features</th></tr></thead><tbody><tr><td><p>Dedicated infrastructure for data processing and storage</p></td><td><p>No</p></td><td><p>Yes</p></td><td><p>Yes</p></td></tr><tr><td><p>Custom metrics</p></td><td><p>No</p></td><td><p>Yes</p></td><td><p>Yes</p></td></tr><tr><td colspan="4"><p><strong>Built-in Application Dashboards</strong></p></td></tr><tr><td><p>More than 80 out-of-the-box charts covering metrics in the following categories: Overview, Inbound, Outbound, Performance, Failures, JVM, and Infrastructure</p></td><td><p>Yes</p></td><td><p>Yes</p></td><td><p>Yes</p></td></tr><tr><td><p>Advanced metrics for Inbound and Outbound charts</p></td><td><p>No</p></td><td><p>Yes</p></td><td><p>Yes</p></td></tr><tr><td><p>Flows charts</p></td><td><p>No</p></td><td><p>Yes</p></td><td><p>Yes</p></td></tr><tr><td><p>Connectors charts</p></td><td><p>No</p></td><td><p>Yes</p></td><td><p>Yes</p></td></tr><tr><td><p>Anypoint Visualizer application network integration</p></td><td><p>No</p></td><td><p>Yes</p></td><td><p>Yes</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/monitoring/am-faq#data-retention-and-aggregation">Data retention</a> for more than 30 days</p></td><td><p>No</p></td><td><p>Yes</p></td><td><p>Yes</p></td></tr><tr><td colspan="4"><p><strong>Built-in API Dashboards</strong></p></td></tr><tr><td><p>16 out-of-the-box charts covering metrics in the following categories: Overview, Requests, Failures, Performance, and Client Application</p></td><td><p>Yes</p></td><td><p>Yes</p></td><td><p>Yes</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/monitoring/am-faq#data-retention-and-aggregation">Data retention</a> for more than 30 days</p></td><td><p>No</p></td><td><p>Yes</p></td><td><p>Yes</p></td></tr><tr><td colspan="4"><p><strong>Custom Dashboards</strong></p></td></tr><tr><td><p>Basic mode</p></td><td><p>Yes</p></td><td><p>Yes</p></td><td><p>Yes</p></td></tr><tr><td><p>Advanced mode</p></td><td><p>Yes, with limited functionality</p></td><td><p>Yes</p></td><td><p>Yes</p></td></tr><tr><td><p>Advanced mode with additional features</p></td><td><p>No</p></td><td><p>Yes</p></td><td><p>Yes</p></td></tr><tr><td colspan="4"><p><strong>Alerts</strong></p></td></tr><tr><td><p>Basic alerts</p></td><td><p>Yes</p></td><td><p>Yes, with <a href="https://docs.mulesoft.com/monitoring/am-faq#data-retention-and-aggregation">higher limits</a></p></td><td><p>Yes (Applications)</p></td></tr><tr><td><p>Advanced alerts</p></td><td><p>No</p></td><td><p>Yes</p></td><td><p>Yes (Applications and API)</p></td></tr><tr><td colspan="4"><p><strong>Log Management</strong></p></td></tr><tr><td><p>Log search</p></td><td><p>No</p></td><td><p>Yes</p></td><td><p>No</p></td></tr><tr><td><p>Log points</p></td><td><p>No</p></td><td><p>Yes</p></td><td><p>No</p></td></tr><tr><td><p>Raw data</p></td><td><p>No</p></td><td><p>Yes</p></td><td><p>No</p></td></tr><tr><td colspan="4"><p><strong>Additional Anypoint Monitoring features</strong></p></td></tr><tr><td><p>Anypoint Monitoring Archive API</p></td><td><p>No</p></td><td><p>Yes</p></td><td><p>No</p></td></tr><tr><td><p><a href="https://docs.mulesoft.com/api-functional-monitoring/">API Functional Monitoring</a><br></p></td><td><p>No</p></td><td><p>No</p></td><td><p>No</p></td></tr><tr><td><p>Reports</p></td><td><p>No</p></td><td><p>Yes</p></td><td><p>Yes</p></td></tr><tr><td colspan="4"><p><strong>Enhanced Support</strong></p></td></tr><tr><td><p>Enhanced Support</p></td><td><p>No</p></td><td><p>Yes</p></td><td><p>No</p></td></tr></tbody></table>

### Unsupported Anypoint Monitoring Features

Anypoint Platform PCE does not the support the following Anypoint Monitoring features:

- Support for Mule 3.8.x

- Log management

  As an alternative, use your server’s logging capabilties or a third-party vendor like Splunk.

- Increased storage capacity

  This capacity is not required because the Archive API is not supported.

- Archive API

  This API is not applicable because log management is not supported.

- API Functional Monitoring

  As an alternative, use a third-party vendor, such as Pingdom.

- The **Tools** option in the left-hand menu is not available.

## Requirements

Anypoint Monitoring has disk and network port requirements in addition to the Anypoint Platform PCE
requirements.

For information, see [Hardware Prerequisites](https://docs.mulesoft.com/private-cloud/3.2/prereq-hardware).

## Backup and Restore

Anypoint Monitoring backup and restore are outside the normal gravity backup and restore mechanism,
and require the additional procedures. For information, see
[Configure Backup and Restore for Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/3.2/backup-and-disaster-recovery).

## Uninstall Anypoint Monitoring

If you want to uninstall the Anypoint Monitoring add-on, contact MuleSoft services.

## See Also

- [Hardware Prerequisites](https://docs.mulesoft.com/private-cloud/3.2/prereq-hardware)

- [Configure Backup and Restore for Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/3.2/backup-and-disaster-recovery)

- [Anypoint Monitoring Overview](https://docs.mulesoft.com/monitoring/)

<!-- document id=2a8fdc26d23e6a274c3eaa1981fac60fc573d48138d1faff4e4269b007262e6d url=/mulesoft/current/en-us/private-cloud/3.2/index.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 3.2
---

# Anypoint Platform PCE Overview

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

With Anypoint Platform Private Cloud Edition (Anypoint Platform PCE), you run and manage Mule
applications on your local servers using your required security policies. With Anypoint Platform
PCE, the control plane functionality is locally available and does not require interaction with
external systems or public internet connectivity. You configure and run Anypoint Platform software
and maintain all data storage, processing, and transmission. Refer to the following table for
components included in Anypoint Platform PCE.

Anypoint Platform PCE uses Docker and Kubernetes to provide built-in high availability and
scalability. You can install the platform without understanding Docker or Kubernetes, but you must
understand how they work to manage and troubleshoot the platform.

For information about a previous version of Anypoint Platform PCE, select the version in the
documentation sidebar.

## Anypoint Platform PCE Components

The following table provides component information for Anypoint Platform PCE:

<table><colgroup><col> <col> <col> <col></colgroup><thead><tr><th>Component</th><th>Included</th><th>Not Included</th><th>Description</th></tr></thead><tbody><tr><td><p>Anypoint Code Builder</p></td><td></td><td><p>X</p></td><td><p>Enables you to create API specifications, implementations, and integration projects.</p></td></tr><tr><td><p>Anypoint Runtime Manager</p></td><td><p>X</p></td><td></td><td><p>Enables you to track and manage your deployed Mule applications.</p></td></tr><tr><td><p>Runtime Fabric Management (including Security Edge and Tokenization)</p></td><td></td><td><p>X</p></td><td><p>Automates the deployment and orchestration of customer-hosted Mule applications and API gateways.</p></td></tr><tr><td><p>Anypoint API Manager</p></td><td><p>X</p></td><td></td><td><p>Enables you to manage your registered APIs.</p></td></tr><tr><td><p>Secrets Manager</p></td><td></td><td><p>X</p></td><td><p>Stores and manages secrets for supported Anypoint Platform services.</p></td></tr><tr><td><p>Anypoint Exchange</p></td><td><p>X</p></td><td></td><td><p>Enables your organization to share various assets for reuse across integration projects.</p></td></tr><tr><td><p>Access Management</p></td><td><p>X</p></td><td></td><td><p>Enables you to create your Anypoint Platform account or configure external federated identity.</p></td></tr><tr><td><p>Anypoint Analytics - Insights</p></td><td></td><td><p>X</p></td><td><p>Provides in-depth visibility into business transactions and events on your Mule apps deployed to CloudHub and on-premises servers.</p></td></tr><tr><td><p>Anypoint Analytics - Anypoint Visualizer</p></td><td></td><td><p>X</p></td><td><p>Enables you to explore your application network via an application network graph.</p></td></tr><tr><td><p>Anypoint Analytics - API</p></td><td></td><td><p>X</p></td><td><p>Provides insight into how your APIs are being used and how they are performing.</p></td></tr><tr><td><p>Anypoint Monitoring</p></td><td><p>X</p></td><td></td><td><p>Provides visibility into integrations, Mule flows, and components in your application network.</p></td></tr><tr><td><p>Object Store</p></td><td></td><td><p>X</p></td><td><p>Object Store v2 allows CloudHub applications to store data and states across batch processes, Mule components, and applications, either from within an application or by using the Object Store REST API.</p></td></tr><tr><td><p>Anypoint MQ</p></td><td></td><td><p>X</p></td><td><p>A multi-tenant cloud messaging service that enables you to perform advanced asynchronous messaging scenarios between tenant applications.</p></td></tr><tr><td><p>API Testing</p></td><td></td><td><p>X</p></td><td><p>Provides a testing framework that enables you to easily build automated tests for your integrations and APIs.</p></td></tr></tbody></table>

For Anypoint Platform PCE version 3.2, the following policies are included with API Manager:

<table><colgroup><col> <col></colgroup><thead><tr><th>Policy</th><th>Version</th></tr></thead><tbody><tr><td><p>Basic authentication: Simple</p></td><td><p>1.2.2</p></td></tr><tr><td><p>Basic Authentication - LDAP</p></td><td><p>1.3.1</p></td></tr><tr><td><p>Client ID Enforcement</p></td><td><p>1.2.4</p></td></tr><tr><td><p>Cross-Origin Resource Sharing</p></td><td><p>1.2.1</p></td></tr><tr><td><p>Detokenization</p></td><td><p>1.1.2</p></td></tr><tr><td><p>Tokenization</p></td><td><p>1.1.2</p></td></tr><tr><td><p>Header Injection</p></td><td><p>1.2.1</p></td></tr><tr><td><p>Header Removal</p></td><td><p>1.0.3</p></td></tr><tr><td><p>HTTP Caching</p></td><td><p>1.0.5</p></td></tr><tr><td><p>IP Blocklist</p></td><td><p>1.0.0</p></td></tr><tr><td><p>IP Allowlist</p></td><td><p>1.0.0</p></td></tr><tr><td><p>JSON Threat Protection</p></td><td><p>1.1.5</p></td></tr><tr><td><p>JWT Validation</p></td><td><p>1.3.0</p></td></tr><tr><td><p>Message Logging</p></td><td><p>1.0.0</p></td></tr><tr><td><p>Mule OAuth 2.0 Access Token</p></td><td><p>1.5.1</p></td></tr><tr><td><p>OpenAM OAuth 2.0 Token Enforcement</p></td><td><p>1.5.1</p></td></tr><tr><td><p>OpenID Connect OAuth 2.0 Token Enforcement</p></td><td><p>1.5.1</p></td></tr><tr><td><p>PingFederate Access Token Enforcement</p></td><td><p>1.5.1</p></td></tr><tr><td><p>Rate Limiting</p></td><td><p>1.3.6</p></td></tr><tr><td><p>Rate Limiting - SLA based</p></td><td><p>1.2.8</p></td></tr><tr><td><p>Spike Control</p></td><td><p>1.1.5</p></td></tr><tr><td><p>XML Threat Protection</p></td><td><p>1.1.4</p></td></tr></tbody></table>

For additional information about policies, refer to
[Policies](https://docs.mulesoft.com/gateway/latest/gateway-secure-apis).

## Mule Runtime Version Compatibility

- Anypoint Platform PCE is compatible with Mule runtime engine v3.9 and later.

- Anypoint Platform PCE supports the Mule runtime engine LTS and Edge release channels. The
  recommended customer profile is LTS. For more information, visit
  [Edge and LTS Releases for Mule](https://docs.mulesoft.com/release-notes/mule-runtime/lts-edge-release-cadence).

## Features Shipped with Anypoint Platform PCE Version 3.2

Refer to
[Anypoint Platform Private Cloud Release Notes](https://docs.mulesoft.com/release-notes/pce/anypoint-private-cloud-release-notes)
for detailed release information.

Anypoint Platform PCE version 3.2 contains the following features:

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Component</th><th>Feature Description</th><th>Feature Version</th></tr></thead><tbody><tr><td rowspan="15"><p>Exchange</p></td><td><p>API Metadata Service</p></td><td><p>v0.7.636</p></td></tr><tr><td><p>Asset Manager Service</p></td><td><p>v1.0.504</p></td></tr><tr><td><p>Asset Portal Service</p></td><td><p>v0.6.1192</p></td></tr><tr><td><p>Assets Reviews Service</p></td><td><p>v0.8.71</p></td></tr><tr><td><p>Custom Assets Facade Service</p></td><td><p>v0.9.246</p></td></tr><tr><td><p>Customization Service</p></td><td><p>v0.6.214</p></td></tr><tr><td><p>Dependency Resolver Service</p></td><td><p>v0.6.469</p></td></tr><tr><td><p>File Service</p></td><td><p>v1.1.47</p></td></tr><tr><td><p>File Upload Service</p></td><td><p>v0.6.86</p></td></tr><tr><td><p>Graph Node Service</p></td><td><p>v0.2.172</p></td></tr><tr><td><p>Graph Service</p></td><td><p>v0.8.584</p></td></tr><tr><td><p>Maven Facade Service</p></td><td><p>v0.7.757</p></td></tr><tr><td><p>Search Service</p></td><td><p>v0.8.250</p></td></tr><tr><td><p>Exchange UI</p></td><td><p>v0.8.4803</p></td></tr><tr><td><p>XAPI Service</p></td><td><p>v0.8.2127</p></td></tr><tr><td><p>Connectivity</p></td><td><p>REST Connect Service</p></td><td><p>v1.12.40</p></td></tr><tr><td rowspan="7"><p>API Platform</p></td><td><p>API Platform API</p></td><td><p>v2.7.792</p></td></tr><tr><td><p>API Platform Web</p></td><td><p>v1.15.117</p></td></tr><tr><td><p>API Manager Web</p></td><td><p>v1.5.1031</p></td></tr><tr><td><p>Contract Caching Service</p></td><td><p>v1.1.158</p></td></tr><tr><td><p>API Proxy Builder Service</p></td><td><p>v1.2.123</p></td></tr><tr><td><p>RAML Parser Service</p></td><td><p>v0.3.102</p></td></tr><tr><td><p>Proxies XAPI Service</p></td><td><p>v1.2.206</p></td></tr><tr><td rowspan="2"><p>API Designer</p></td><td><p>API Designer XAPI</p></td><td><p>v3.41.0</p></td></tr><tr><td><p>API Designer UI</p></td><td><p>v2.44.0</p></td></tr><tr><td><p>Mocking Service</p></td><td><p>Mocking Service</p></td><td><p>v2.41.0</p></td></tr><tr><td rowspan="3"><p>Mozart</p></td><td><p>Design Center UI</p></td><td><p>v2.0.143</p></td></tr><tr><td><p>Mozart XAPI</p></td><td><p>v2.0.232</p></td></tr><tr><td><p>Mozart Project Manager Service</p></td><td><p>v3.0.45</p></td></tr><tr><td rowspan="8"><p>Runtime Manager</p></td><td><p>Cloudhub MCM</p></td><td><p>v2.17.155</p></td></tr><tr><td><p>Cloudhub UI</p></td><td><p>1.100</p></td></tr><tr><td><p>AMC UI REST Facade</p></td><td><p>v2.12.75</p></td></tr><tr><td><p>Hybrid REST</p></td><td><p>v2.31.269</p></td></tr><tr><td><p>Metadata Manager</p></td><td><p>1.9.49</p></td></tr><tr><td><p>Platform Alerts</p></td><td><p>1.10.59</p></td></tr><tr><td><p>Mule Message Processor</p></td><td><p>v2.0.37</p></td></tr><tr><td><p>Platform Messages</p></td><td><p>1.7.58</p></td></tr><tr><td rowspan="6"><p>Access Management</p></td><td><p>Authentication Server</p></td><td><p>v1.2.48</p></td></tr><tr><td><p>Core Services UI</p></td><td><p>v0.81.x</p></td></tr><tr><td><p>Anypoint Sign In</p></td><td><p>v0.81.x</p></td></tr><tr><td><p>Audit Log</p></td><td><p>v0.81.x</p></td></tr><tr><td><p>Landing Page UI</p></td><td><p>v0.81.x</p></td></tr><tr><td><p>Navbar</p></td><td><p>v0.81.x</p></td></tr><tr><td><p>Anypoint Platform PCE</p></td><td><p>Anypoint Platform PCE Packaging</p></td><td><p>v3.2.0</p></td></tr><tr><td><p>API Modeling Framework (AMF)</p></td><td><p>AMF Service</p></td><td><p>v1.2.49</p></td></tr><tr><td rowspan="2"><p>VCS</p></td><td><p>VCS</p></td><td><p>v0.24+</p></td></tr><tr><td><p>VCS Git Proxy</p></td><td><p>v0.2.132+</p></td></tr><tr><td><p>Anypoint Studio</p></td><td><p>Studio</p></td><td><p>v7.15.0</p></td></tr></tbody></table>

## Add-On Features Supported by Anypoint Platform PCE Version 3.2

<table><colgroup><col> <col></colgroup><thead><tr><th>Feature</th><th>Version</th></tr></thead><tbody><tr><td><p>Anypoint Monitoring</p></td><td><p>v0.6.2.0</p></td></tr></tbody></table>

## See Also

- [Supported Configurations](https://docs.mulesoft.com/private-cloud/3.2/supported-cluster-config)

- [Product Prerequisites](https://docs.mulesoft.com/private-cloud/3.2/install-checklist)

- [Runtime Manager](https://docs.mulesoft.com/runtime-manager/)

- [Anypoint Exchange](https://docs.mulesoft.com/exchange/)

- [API Manager](https://docs.mulesoft.com/api-manager/latest/)

- [Docker](https://www.docker.com/)

- [Kubernetes](https://kubernetes.io/)

<!-- document id=8cbcae5d2745abfbf08725c4bd86370838f9a1dd803ea6c52fedd1c0c8d1660c url=/mulesoft/current/en-us/private-cloud/4.0/index.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.0
---

# Anypoint Platform PCE Overview

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Run and manage Mule apps on your local servers following your security policies by using Anypoint
Platform Private Cloud Edition (Anypoint Platform PCE). Anypoint Platform PCE offers local MuleSoft
control plane functionality, with no external system interactions or internet connectivity required,
maintaining all data storage, processing, and transmission. Anypoint Platform PCE uses Kubernetes
for built-in high availability and scalability. While you can install it without deep Kubernetes
knowledge, understanding these tools is essential for management and troubleshooting.

Anypoint Platform PCE version 4.0 runs on enterprise-ready Kubernetes Red Hat OpenShift, Amazon EKS
Anywhere (EKS-A), and Rancher Kubernetes Engine (RKE2). Additionally, it supports Java 17, in
addition to Java 8 and 11.

For information about a previous version of Anypoint Platform PCE, select the version in the
documentation sidebar.

## Before You Begin

### Upgrade to Anypoint Platform PCE version 4.0

If you are upgrading from version 3.2.3 of Anypoint Platform PCE to version 4.0, see
[Upgrading Anypoint Platform PCE 3.2.3 to 4.0](https://docs.mulesoft.com/private-cloud/4.0/upgrade).

> [!NOTE] If you’re using a version of Anypoint Platform PCE earlier than 3.2.3, upgrade to version
> 3.2.3 first. Then proceed with upgrading to version 4.0.

### Install Anypoint Platform PCE 4.0

If you are installing Anypoint Platform PCE version 4.0 for the first time, see
[Installing Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/4.0/install-workflow).

To install Anypoint Platform PCE on OpenShift, see
[Installing Anypoint Platform PCE on OpenShift](https://docs.mulesoft.com/private-cloud/4.0/install-openshift).

## Anypoint Platform PCE Components

The following table provides component information for Anypoint Platform PCE:

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Component</th><th>Included</th><th>Description</th></tr></thead><tbody><tr><td><p>Access Management</p></td><td><p>Yes</p></td><td><p>Enables you to create your Anypoint Platform account or configure external federated identity.</p></td></tr><tr><td><p>Anypoint API Manager</p></td><td><p>Yes</p></td><td><p>Enables you to manage your registered APIs.</p></td></tr><tr><td><p>Anypoint Analytics - API</p></td><td><p>No</p></td><td><p>Provides insight into how your APIs are being used and how they are performing.</p></td></tr><tr><td><p>Anypoint Analytics - Anypoint Visualizer</p></td><td><p>No</p></td><td><p>Enables you to explore your application network via an application network graph.</p></td></tr><tr><td><p>Anypoint Analytics - Insights</p></td><td><p>No</p></td><td><p>Provides in-depth visibility into business transactions and events on your Mule apps deployed to CloudHub and on-premises servers.</p></td></tr><tr><td><p>Anypoint Code Builder</p></td><td><p>No</p></td><td><p>Enables you to create API specifications, implementations, and integration projects.</p></td></tr><tr><td><p>Anypoint Exchange</p></td><td><p>Yes</p></td><td><p>Enables your organization to share various assets for reuse across integration projects.</p></td></tr><tr><td><p>Anypoint Monitoring</p></td><td><p>No</p></td><td><p>Provides visibility into integrations, Mule flows, and components in your application network.</p></td></tr><tr><td><p>Anypoint MQ</p></td><td><p>No</p></td><td><p>A multi-tenant cloud messaging service that enables you to perform advanced asynchronous messaging scenarios between tenant applications.</p></td></tr><tr><td><p>Anypoint Runtime Fabric Management</p></td><td><p>No</p></td><td><p>Automates the deployment and orchestration of customer-hosted Mule applications and API gateways.</p></td></tr><tr><td><p>Anypoint Runtime Manager</p></td><td><p>Yes</p></td><td><p>Enables you to track and manage your deployed Mule applications.</p></td></tr><tr><td><p>API Testing</p></td><td><p>No</p></td><td><p>Provides a testing framework that enables you to easily build automated tests for your integrations and APIs.</p></td></tr><tr><td><p>Object Store</p></td><td><p>No</p></td><td><p>Object Store v2 allows CloudHub applications to store data and states across batch processes, Mule components, and applications, either from within an application or by using the Object Store REST API.</p></td></tr><tr><td><p>Secrets Manager</p></td><td><p>No</p></td><td><p>Stores and manages secrets for supported Anypoint Platform services.</p></td></tr></tbody></table>

## Mule Runtime Version Compatibility

- Anypoint Platform PCE is compatible with Mule runtime engine versions 4.3 - 4.6. Use version 4.6
  LTS to get the best performance from all Anypoint Platform connectors.

- Anypoint Platform PCE supports the Mule runtime engine LTS and Edge release channels. The
  recommended customer profile is LTS. For more information, visit
  [Edge and LTS Releases for Mule](https://docs.mulesoft.com/release-notes/mule-runtime/lts-edge-release-cadence).

## Java Version Compatibility

Anypoint Platform PCE is compatible with Java 17, 11, and 8.

## Features Shipped with Anypoint Platform PCE Version 4.0

Refer to
[Anypoint Platform Private Cloud Release Notes](https://docs.mulesoft.com/release-notes/pce/anypoint-private-cloud-release-notes)
for detailed release information.

Anypoint Platform PCE version 4.0 contains the following features:

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Component</th><th>Feature Description</th><th>Feature Version</th></tr></thead><tbody><tr><td rowspan="6"><p>Access Management</p></td><td><p>Audit Log</p></td><td><p>v5.1.45</p></td></tr><tr><td><p>Authentication Server</p></td><td><p>v1.2.460</p></td></tr><tr><td><p>Authentication Server UI</p></td><td><p>v2.1.240-56.develop</p></td></tr><tr><td><p>Anypoint Sign In</p></td><td><p>v3.2.143</p></td></tr><tr><td><p>Anypoint Roles Client</p></td><td><p>v8.1.1573</p></td></tr><tr><td><p>ARC Informer</p></td><td><p>v1.0.374</p></td></tr><tr><td rowspan="3"><p>API Designer</p></td><td><p>API Designer DC Projects Service</p></td><td><p>v3.13.1</p></td></tr><tr><td><p>API Designer DC XAPI Service</p></td><td><p>v2.11.2</p></td></tr><tr><td><p>API Designer DC UI</p></td><td><p>v2.10.5</p></td></tr><tr><td rowspan="9"><p>API Manager</p></td><td><p>API Manager API DB Migrations</p></td><td><p>v1.0.451</p></td></tr><tr><td><p>API Manager API Platform Web</p></td><td><p>v1.15.204</p></td></tr><tr><td><p>API Manager API Proxy Builder Service</p></td><td><p>v1.3.69</p></td></tr><tr><td><p>API Manager API</p></td><td><p>v2.31.5</p></td></tr><tr><td><p>API Manager Contract Caching DB Migrations</p></td><td><p>v1.0.238</p></td></tr><tr><td><p>API Manager Contract Caching Service</p></td><td><p>v1.1.418</p></td></tr><tr><td><p>API Manager Proxies XAPI Service</p></td><td><p>v1.24.0</p></td></tr><tr><td><p>API Manager RAML Parser Service</p></td><td><p>v0.3.159</p></td></tr><tr><td><p>API Manager Web</p></td><td><p>v1.29.1</p></td></tr><tr><td><p>API Modeling Framework (AMF)</p></td><td><p>AMF Service</p></td><td><p>v1.4.61</p></td></tr><tr><td><p>Connectivity</p></td><td><p>REST Connect Service</p></td><td><p>v1.14.53</p></td></tr><tr><td rowspan="24"><p>Exchange</p></td><td><p>Asset Manager DB Migrations</p></td><td><p>v2.0.20</p></td></tr><tr><td><p>Asset Manager Service</p></td><td><p>v1.0.808</p></td></tr><tr><td><p>Asset Portals DB Migrations</p></td><td><p>v2.0.25</p></td></tr><tr><td><p>Asset Portals Service</p></td><td><p>v0.6.1503</p></td></tr><tr><td><p>Content Provider</p></td><td><p>v1.0.12</p></td></tr><tr><td><p>Custom Assets Facade Service</p></td><td><p>v0.9.436</p></td></tr><tr><td><p>Customization Service</p></td><td><p>v0.6.214</p></td></tr><tr><td><p>Dependency Resolver Service</p></td><td><p>v0.8.27</p></td></tr><tr><td><p>File Service</p></td><td><p>v1.1.47</p></td></tr><tr><td><p>File Upload Service</p></td><td><p>v1.1.226</p></td></tr><tr><td><p>Maven Facade Service</p></td><td><p>v0.8.47</p></td></tr><tr><td><p>Region Synchronizer Service</p></td><td><p>v0.2.147</p></td></tr><tr><td><p>Exchange API Metadata DB Migrations</p></td><td><p>v1.7.324</p></td></tr><tr><td><p>Exchange API Metadata Service</p></td><td><p>v0.7.954</p></td></tr><tr><td><p>Exchange Asset Reviews DB Migrations</p></td><td><p>v1.6.359</p></td></tr><tr><td><p>Exchange Asset Reviews Service</p></td><td><p>v0.8.353</p></td></tr><tr><td><p>Exchange Customization DB Migrations</p></td><td><p>v1.0.264</p></td></tr><tr><td><p>Exchange Customization Service</p></td><td><p>v0.6.576</p></td></tr><tr><td><p>Exchange Customization Service</p></td><td><p>v0.6.576</p></td></tr><tr><td><p>Exchange Graph Node Service</p></td><td><p>v0.2.563</p></td></tr><tr><td><p>Exchange Search DB Migrations</p></td><td><p>v1.7.283</p></td></tr><tr><td><p>Exchange Search Service</p></td><td><p>v1.0.90</p></td></tr><tr><td><p>Exchange UI</p></td><td><p>v1.0.126</p></td></tr><tr><td><p>Exchange XAPI Service</p></td><td><p>v0.8.2717</p></td></tr><tr><td><p>Mocking Service</p></td><td><p>Mocking Service</p></td><td><p>v2.68.6</p></td></tr><tr><td rowspan="5"><p>Runtime Manager</p></td><td><p>Application Manager DB Migration</p></td><td><p>v1.0.92</p></td></tr><tr><td><p>Application Manager Service</p></td><td><p>v2.33.0</p></td></tr><tr><td><p>Atlas Service</p></td><td><p>v1.9.109</p></td></tr><tr><td><p>Mule Agent</p></td><td><p>v2.6.6</p></td></tr><tr><td><p>MCM Service</p></td><td><p>v2.17.322</p></td></tr><tr><td rowspan="3"><p>Runtime Services</p></td><td><p>Anypoint Flash Platform Messages DB Migrations</p></td><td><p>v1.1.31</p></td></tr><tr><td><p>Platform Messages</p></td><td><p>v2.2.21</p></td></tr><tr><td><p>Mule Message Processor</p></td><td><p>v3.2.17</p></td></tr></tbody></table>

## See Also

- [Anypoint Platform PCE Prerequisites](https://docs.mulesoft.com/private-cloud/4.0/install-checklist)

- [Installing Anypoint Platform Private Cloud Edition (Anypoint Platform PCE)](https://docs.mulesoft.com/private-cloud/4.0/install-workflow)

- [Upgrading Anypoint Platform PCE v3.2.3 to v4.0.0](https://docs.mulesoft.com/private-cloud/4.0/upgrade)

<!-- document id=dd625fddced463e84c13c04335559c0a7d312739806478cbcc79622cd0b0c853 url=/mulesoft/current/en-us/private-cloud/4.1/index.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.1
---

# Anypoint Platform PCE Overview

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Run and manage Mule apps on your local servers following your security policies by using Anypoint
Platform Private Cloud Edition (Anypoint Platform PCE). Anypoint Platform PCE offers local MuleSoft
control plane functionality, with no external system interactions or internet connectivity required,
maintaining all data storage, processing, and transmission. Anypoint Platform PCE uses Kubernetes
for built-in high availability and scalability. While you can install it without deep Kubernetes
knowledge, understanding these tools is essential for management and troubleshooting.

Anypoint Platform PCE version 4.x runs on enterprise-ready Kubernetes Red Hat OpenShift, Amazon EKS
Anywhere (EKS-A), and Rancher Kubernetes Engine (RKE2). Additionally, it supports Java 17, in
addition to Java 8 and 11.

For information about a previous version of Anypoint Platform PCE, select the version in the
documentation sidebar.

## Before You Begin

### Upgrade to Anypoint Platform PCE version 4.X

If you are upgrading from version 3.2.3 of Anypoint Platform PCE to version 4.X, see
[Upgrading Anypoint Platform PCE 3.2.3 to 4.x](https://docs.mulesoft.com/private-cloud/4.1/upgrade).

> [!NOTE] If you’re using a version of Anypoint Platform PCE earlier than 3.2.3, upgrade to version
> 3.2.3 first. Then proceed with upgrading to version 4.x.

### Install Anypoint Platform PCE 4.X

If you are installing Anypoint Platform PCE version 4.x for the first time, see
[Installing Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/4.1/install-workflow).

To install Anypoint Platform PCE on OpenShift, see
[Installing Anypoint Platform PCE on OpenShift](https://docs.mulesoft.com/private-cloud/4.1/install-openshift).

## Anypoint Platform PCE Components

This table provides component information for Anypoint Platform PCE:

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Component</th><th>Included</th><th>Description</th></tr></thead><tbody><tr><td><p>Access Management</p></td><td><p>Yes</p></td><td><p>Enables you to create your Anypoint Platform account or configure external federated identity.</p></td></tr><tr><td><p>Anypoint API Manager</p></td><td><p>Yes</p></td><td><p>Enables you to manage your registered APIs.</p></td></tr><tr><td><p>Anypoint Analytics - API</p></td><td><p>No</p></td><td><p>Provides insight into how your APIs are being used and how they are performing.</p></td></tr><tr><td><p>Anypoint Analytics - Anypoint Visualizer</p></td><td><p>Yes</p></td><td><p>Enables you to explore your application network via an application network graph.</p></td></tr><tr><td><p>Anypoint Analytics - Insights</p></td><td><p>No</p></td><td><p>Provides in-depth visibility into business transactions and events on your Mule apps deployed to CloudHub and on-premises servers.</p></td></tr><tr><td><p>Anypoint Code Builder</p></td><td><p>No</p></td><td><p>Enables you to create API specifications, implementations, and integration projects.</p></td></tr><tr><td><p>Anypoint Exchange</p></td><td><p>Yes</p></td><td><p>Enables your organization to share various assets for reuse across integration projects.</p></td></tr><tr><td><p>Anypoint Monitoring</p></td><td><p>No</p></td><td><p>Provides visibility into integrations, Mule flows, and components in your application network.</p></td></tr><tr><td><p>Anypoint MQ</p></td><td><p>No</p></td><td><p>A multi-tenant cloud messaging service that enables you to perform advanced asynchronous messaging scenarios between tenant applications.</p></td></tr><tr><td><p>Anypoint Runtime Fabric Management</p></td><td><p>No</p></td><td><p>Automates the deployment and orchestration of customer-hosted Mule applications and API gateways.</p></td></tr><tr><td><p>Anypoint Runtime Manager</p></td><td><p>Yes</p></td><td><p>Enables you to track and manage your deployed Mule applications.</p></td></tr><tr><td><p>API Testing</p></td><td><p>No</p></td><td><p>Provides a testing framework that enables you to easily build automated tests for your integrations and APIs.</p></td></tr><tr><td><p>Object Store</p></td><td><p>No</p></td><td><p>Object Store v2 allows CloudHub applications to store data and states across batch processes, Mule components, and applications, either from within an application or by using the Object Store REST API.</p></td></tr><tr><td><p>Secrets Manager</p></td><td><p>No</p></td><td><p>Stores and manages secrets for supported Anypoint Platform services.</p></td></tr></tbody></table>

## Mule Runtime Version Compatibility

- Anypoint Platform PCE is compatible with Mule runtime engine versions 4.3 - 4.6. Use version 4.6
  LTS to get the best performance from all Anypoint Platform connectors.

- Anypoint Platform PCE supports the Mule runtime engine LTS and Edge release channels. The
  recommended customer profile is LTS. For more information, visit
  [Edge and LTS Releases for Mule](https://docs.mulesoft.com/release-notes/mule-runtime/lts-edge-release-cadence).

## Java Version Compatibility

Anypoint Platform PCE is compatible with Java 17, 11, and 8.

## Features Shipped with Anypoint Platform PCE Version 4.X

Refer to
[Anypoint Platform Private Cloud Release Notes](https://docs.mulesoft.com/release-notes/pce/anypoint-private-cloud-release-notes)
for detailed release information.

Anypoint Platform PCE version 4.1 contains these features:

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Component</th><th>Feature Description</th><th>Feature Version</th></tr></thead><tbody><tr><td rowspan="6"><p>Access Management</p></td><td><p>Audit Log</p></td><td><p>v5.1.67</p></td></tr><tr><td><p>Authentication Server</p></td><td><p>v1.2.548</p></td></tr><tr><td><p>Authentication Server UI</p></td><td><p>v2.1.269-8.develop</p></td></tr><tr><td><p>Anypoint Sign In</p></td><td><p>v3.2.161</p></td></tr><tr><td><p>Anypoint Roles Client</p></td><td><p>v8.1.1573</p></td></tr><tr><td><p>ARC Informer</p></td><td><p>1.0.374</p></td></tr><tr><td rowspan="3"><p>API Designer</p></td><td><p>API Designer DC Projects Service</p></td><td><p>v3.18.10</p></td></tr><tr><td><p>API Designer DC XAPI Service</p></td><td><p>v2.15.7</p></td></tr><tr><td><p>API Designer DC UI</p></td><td><p>v2.75.8</p></td></tr><tr><td rowspan="9"><p>API Manager</p></td><td><p>API Manager API DB Migrations</p></td><td><p>v1.0.500</p></td></tr><tr><td><p>API Manager API Platform Web</p></td><td><p>v1.15.226</p></td></tr><tr><td><p>API Manager API Proxy Builder Service</p></td><td><p>v1.3.92</p></td></tr><tr><td><p>API Manager API</p></td><td><p>v2.31.26</p></td></tr><tr><td><p>API Manager Contract Caching DB Migrations</p></td><td><p>v1.0.259</p></td></tr><tr><td><p>API Manager Contract Caching Service</p></td><td><p>v1.1.459</p></td></tr><tr><td><p>API Manager Proxies XAPI Service</p></td><td><p>v1.24.11</p></td></tr><tr><td><p>API Manager RAML Parser Service</p></td><td><p>v0.3.173</p></td></tr><tr><td><p>API Manager Web</p></td><td><p>v1.29.13</p></td></tr><tr><td><p>API Modeling Framework (AMF)</p></td><td><p>AMF Service</p></td><td><p>v1.4.66</p></td></tr><tr><td><p>Connectivity</p></td><td><p>REST Connect Service</p></td><td><p>v1.14.57</p></td></tr><tr><td rowspan="24"><p>Exchange</p></td><td><p>Asset Manager DB Migrations</p></td><td><p>v2.0.51</p></td></tr><tr><td><p>Asset Manager Service</p></td><td><p>v1.0.885</p></td></tr><tr><td><p>Asset Portals DB Migrations</p></td><td><p>v2.0.57</p></td></tr><tr><td><p>Asset Portals Service</p></td><td><p>v0.6.1576</p></td></tr><tr><td><p>Content Provider</p></td><td><p>v1.0.29</p></td></tr><tr><td><p>Custom Assets Facade Service</p></td><td><p>v1.0.7</p></td></tr><tr><td><p>Customization Service</p></td><td><p>v0.6.658</p></td></tr><tr><td><p>Dependency Resolver Service</p></td><td><p>v0.8.77</p></td></tr><tr><td><p>File Service</p></td><td><p>v1.1.288</p></td></tr><tr><td><p>File Upload Service</p></td><td><p>v1.1.226</p></td></tr><tr><td><p>Maven Facade Service</p></td><td><p>v0.8.109</p></td></tr><tr><td><p>Region Synchronizer Service</p></td><td><p>v0.2.163</p></td></tr><tr><td><p>Exchange API Metadata DB Migrations</p></td><td><p>v2.0.40</p></td></tr><tr><td><p>Exchange API Metadata Service</p></td><td><p>v1.1.1</p></td></tr><tr><td><p>Exchange Asset Reviews DB Migrations</p></td><td><p>v2.0.36</p></td></tr><tr><td><p>Exchange Asset Reviews Service</p></td><td><p>v0.8.435</p></td></tr><tr><td><p>Exchange Customization DB Migrations</p></td><td><p>2.0.31</p></td></tr><tr><td><p>Exchange Customization Service</p></td><td><p>0.6.658</p></td></tr><tr><td><p>Exchange Graph Node Service</p></td><td><p>0.2.664</p></td></tr><tr><td><p>Exchange Search DB Migrations</p></td><td><p>2.0.38</p></td></tr><tr><td><p>Exchange Search Service</p></td><td><p>v1.0.215</p></td></tr><tr><td><p>Exchange UI</p></td><td><p>v1.0.265</p></td></tr><tr><td><p>Exchange XAPI Service</p></td><td><p>v0.8.2848</p></td></tr><tr><td><p>Mocking Service</p></td><td><p>v2.77.0-17.pce</p></td></tr><tr><td rowspan="6"><p>Runtime Manager</p></td><td><p>Application Manager DB Migration</p></td><td><p>v1.2.11</p></td></tr><tr><td><p>Application Manager Service</p></td><td><p>v2.33.51</p></td></tr><tr><td><p>Atlas Service</p></td><td><p>v1.9.121</p></td></tr><tr><td><p>Mule Agent</p></td><td><p>v2.6.6</p></td></tr><tr><td><p>Jafar Service</p></td><td><p>0.3.167</p></td></tr><tr><td><p>MCM Service</p></td><td><p>v2.17.347</p></td></tr><tr><td rowspan="3"><p>Runtime Services</p></td><td><p>Anypoint Flash Platform Messages DB Migrations</p></td><td><p>1.1.43</p></td></tr><tr><td><p>Platform Messages</p></td><td><p>v2.2.43</p></td></tr><tr><td><p>Mule Message Processor</p></td><td><p>v3.2.40</p></td></tr></tbody></table>

## See Also

- [Anypoint Platform PCE Prerequisites](https://docs.mulesoft.com/private-cloud/4.1/install-checklist)

- [Installing Anypoint Platform Private Cloud Edition (Anypoint Platform PCE)](https://docs.mulesoft.com/private-cloud/4.1/install-workflow)

- [Upgrading Anypoint Platform PCE v3.2.5 to v4.1.x](https://docs.mulesoft.com/private-cloud/4.1/upgrade)

<!-- document id=844c73988f7e02705f559e8a37b226cba6780d69b9ef149d716ad512150d9bb7 url=/mulesoft/current/en-us/private-cloud/4.2/index.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.2
---

# Anypoint Platform PCE Overview

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Run and manage Mule apps on your local servers following your security policies by using Anypoint
Platform Private Cloud Edition (Anypoint Platform PCE). Anypoint Platform PCE offers local MuleSoft
control plane functionality, with no external system interactions or internet connectivity required,
maintaining all data storage, processing, and transmission. Anypoint Platform PCE uses Kubernetes
for built-in high availability and scalability. While you can install it without deep Kubernetes
knowledge, understanding these tools is essential for management and troubleshooting.

Anypoint Platform PCE version 4.x runs on enterprise-ready Kubernetes Red Hat OpenShift and Rancher
Kubernetes Engine (RKE2). Additionally, it supports Java 17, in addition to Java 8 and 11.

For information about a previous version of Anypoint Platform PCE, select the version in the
documentation sidebar.

## Before You Begin

### Upgrade to Anypoint Platform PCE version 4.X

If you are upgrading from version 3.2.3 of Anypoint Platform PCE to version 4.X, see
[Upgrading Anypoint Platform PCE 3.2.3 to 4.x](https://docs.mulesoft.com/private-cloud/4.2/upgrade).

> [!NOTE] If you’re using a version of Anypoint Platform PCE earlier than 3.2.3, upgrade to version
> 3.2.3 first. Then proceed with upgrading to version 4.x.

### Install Anypoint Platform PCE 4.X

If you are installing Anypoint Platform PCE version 4.x for the first time, see
[Installing Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/4.2/install-workflow).

To install Anypoint Platform PCE on OpenShift, see
[Installing Anypoint Platform PCE on OpenShift](https://docs.mulesoft.com/private-cloud/4.2/install-openshift).

## Anypoint Platform PCE Components

This table provides component information for Anypoint Platform PCE:

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Component</th><th>Included</th><th>Description</th></tr></thead><tbody><tr><td><p>Access Management</p></td><td><p>Yes</p></td><td><p>Enables you to create your Anypoint Platform account or configure external federated identity.</p></td></tr><tr><td><p>Anypoint API Manager</p></td><td><p>Yes</p></td><td><p>Enables you to manage your registered APIs.</p></td></tr><tr><td><p>Anypoint Analytics - API</p></td><td><p>No</p></td><td><p>Provides insight into how your APIs are being used and how they are performing.</p></td></tr><tr><td><p>Anypoint Analytics - Anypoint Visualizer</p></td><td><p>Yes</p></td><td><p>Enables you to explore your application network via an application network graph.</p></td></tr><tr><td><p>Anypoint Analytics - Insights</p></td><td><p>No</p></td><td><p>Provides in-depth visibility into business transactions and events on your Mule apps deployed to CloudHub and on-premises servers.</p></td></tr><tr><td><p>Anypoint Code Builder</p></td><td><p>Yes</p></td><td><p>Enables you to create API specifications, implementations, and integration projects.</p></td></tr><tr><td><p>Anypoint Exchange</p></td><td><p>Yes</p></td><td><p>Enables your organization to share various assets for reuse across integration projects.</p></td></tr><tr><td><p>Anypoint Monitoring</p></td><td><p>No</p></td><td><p>Provides visibility into integrations, Mule flows, and components in your application network.</p></td></tr><tr><td><p>Anypoint MQ</p></td><td><p>No</p></td><td><p>A multi-tenant cloud messaging service that enables you to perform advanced asynchronous messaging scenarios between tenant applications.</p></td></tr><tr><td><p>Anypoint Runtime Fabric Management</p></td><td><p>No</p></td><td><p>Automates the deployment and orchestration of customer-hosted Mule applications and API gateways.</p></td></tr><tr><td><p>Anypoint Runtime Manager</p></td><td><p>Yes</p></td><td><p>Enables you to track and manage your deployed Mule applications.</p></td></tr><tr><td><p>API Testing</p></td><td><p>No</p></td><td><p>Provides a testing framework that enables you to easily build automated tests for your integrations and APIs.</p></td></tr><tr><td><p>Object Store</p></td><td><p>No</p></td><td><p>Object Store v2 allows CloudHub applications to store data and states across batch processes, Mule components, and applications, either from within an application or by using the Object Store REST API.</p></td></tr><tr><td><p>Secrets Manager</p></td><td><p>No</p></td><td><p>Stores and manages secrets for supported Anypoint Platform services.</p></td></tr></tbody></table>

## Mule Runtime Version Compatibility

- Anypoint Platform PCE is compatible with Mule runtime engine versions 4.3 - 4.6. Use version 4.6
  LTS to get the best performance from all Anypoint Platform connectors.

- Anypoint Platform PCE supports the Mule runtime engine LTS and Edge release channels. The
  recommended customer profile is LTS. For more information, visit
  [Edge and LTS Releases for Mule](https://docs.mulesoft.com/release-notes/mule-runtime/lts-edge-release-cadence).

## Java Version Compatibility

Anypoint Platform PCE is compatible with Java 17, 11, and 8.

## Features Shipped with Anypoint Platform PCE Version 4.X

Refer to
[Anypoint Platform Private Cloud Release Notes](https://docs.mulesoft.com/release-notes/pce/anypoint-private-cloud-release-notes)
for detailed release information.

Anypoint Platform PCE version 4.2 contains these features:

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Component</th><th>Feature Description</th><th>Feature Version</th></tr></thead><tbody><tr><td rowspan="6"><p>Access Management</p></td><td><p>Audit Log</p></td><td><p>v5.1.67</p></td></tr><tr><td><p>Authentication Server</p></td><td><p>v1.2.548</p></td></tr><tr><td><p>Authentication Server UI</p></td><td><p>v2.1.269-8.develop</p></td></tr><tr><td><p>Anypoint Sign In</p></td><td><p>v3.2.161</p></td></tr><tr><td><p>Anypoint Roles Client</p></td><td><p>v8.1.1573</p></td></tr><tr><td><p>ARC Informer</p></td><td><p>1.0.374</p></td></tr><tr><td rowspan="3"><p>API Designer</p></td><td><p>API Designer DC Projects Service</p></td><td><p>v3.18.10</p></td></tr><tr><td><p>API Designer DC XAPI Service</p></td><td><p>v2.15.7</p></td></tr><tr><td><p>API Designer DC UI</p></td><td><p>v2.75.8</p></td></tr><tr><td rowspan="9"><p>API Manager</p></td><td><p>API Manager API DB Migrations</p></td><td><p>v1.0.500</p></td></tr><tr><td><p>API Manager API Platform Web</p></td><td><p>v1.15.226</p></td></tr><tr><td><p>API Manager API Proxy Builder Service</p></td><td><p>v1.3.92</p></td></tr><tr><td><p>API Manager API</p></td><td><p>v2.31.26</p></td></tr><tr><td><p>API Manager Contract Caching DB Migrations</p></td><td><p>v1.0.259</p></td></tr><tr><td><p>API Manager Contract Caching Service</p></td><td><p>v1.1.459</p></td></tr><tr><td><p>API Manager Proxies XAPI Service</p></td><td><p>v1.24.11</p></td></tr><tr><td><p>API Manager RAML Parser Service</p></td><td><p>v0.3.173</p></td></tr><tr><td><p>API Manager Web</p></td><td><p>v1.29.13</p></td></tr><tr><td><p>API Modeling Framework (AMF)</p></td><td><p>AMF Service</p></td><td><p>v1.4.66</p></td></tr><tr><td><p>Connectivity</p></td><td><p>REST Connect Service</p></td><td><p>v1.14.57</p></td></tr><tr><td rowspan="24"><p>Exchange</p></td><td><p>Asset Manager DB Migrations</p></td><td><p>v2.0.51</p></td></tr><tr><td><p>Asset Manager Service</p></td><td><p>v1.0.885</p></td></tr><tr><td><p>Asset Portals DB Migrations</p></td><td><p>v2.0.57</p></td></tr><tr><td><p>Asset Portals Service</p></td><td><p>v0.6.1576</p></td></tr><tr><td><p>Content Provider</p></td><td><p>v1.0.29</p></td></tr><tr><td><p>Custom Assets Facade Service</p></td><td><p>v1.0.7</p></td></tr><tr><td><p>Customization Service</p></td><td><p>v0.6.658</p></td></tr><tr><td><p>Dependency Resolver Service</p></td><td><p>v0.8.77</p></td></tr><tr><td><p>File Service</p></td><td><p>v1.1.288</p></td></tr><tr><td><p>File Upload Service</p></td><td><p>v1.1.226</p></td></tr><tr><td><p>Maven Facade Service</p></td><td><p>v0.8.109</p></td></tr><tr><td><p>Region Synchronizer Service</p></td><td><p>v0.2.163</p></td></tr><tr><td><p>Exchange API Metadata DB Migrations</p></td><td><p>v2.0.40</p></td></tr><tr><td><p>Exchange API Metadata Service</p></td><td><p>v1.1.1</p></td></tr><tr><td><p>Exchange Asset Reviews DB Migrations</p></td><td><p>v2.0.36</p></td></tr><tr><td><p>Exchange Asset Reviews Service</p></td><td><p>v0.8.435</p></td></tr><tr><td><p>Exchange Customization DB Migrations</p></td><td><p>2.0.31</p></td></tr><tr><td><p>Exchange Customization Service</p></td><td><p>0.6.658</p></td></tr><tr><td><p>Exchange Graph Node Service</p></td><td><p>0.2.664</p></td></tr><tr><td><p>Exchange Search DB Migrations</p></td><td><p>2.0.38</p></td></tr><tr><td><p>Exchange Search Service</p></td><td><p>v1.0.215</p></td></tr><tr><td><p>Exchange UI</p></td><td><p>v1.0.265</p></td></tr><tr><td><p>Exchange XAPI Service</p></td><td><p>v0.8.2848</p></td></tr><tr><td><p>Mocking Service</p></td><td><p>v2.77.0-17.pce</p></td></tr><tr><td rowspan="6"><p>Runtime Manager</p></td><td><p>Application Manager DB Migration</p></td><td><p>v1.2.11</p></td></tr><tr><td><p>Application Manager Service</p></td><td><p>v2.33.51</p></td></tr><tr><td><p>Atlas Service</p></td><td><p>v1.9.121</p></td></tr><tr><td><p>Mule Agent</p></td><td><p>v2.6.6</p></td></tr><tr><td><p>Jafar Service</p></td><td><p>0.3.167</p></td></tr><tr><td><p>MCM Service</p></td><td><p>v2.17.347</p></td></tr><tr><td rowspan="3"><p>Runtime Services</p></td><td><p>Anypoint Flash Platform Messages DB Migrations</p></td><td><p>1.1.43</p></td></tr><tr><td><p>Platform Messages</p></td><td><p>v2.2.43</p></td></tr><tr><td><p>Mule Message Processor</p></td><td><p>v3.2.40</p></td></tr></tbody></table>

## See Also

- [Anypoint Platform PCE Prerequisites](https://docs.mulesoft.com/private-cloud/4.2/install-checklist)

- [Installing or Upgrading Anypoint Platform Private Cloud Edition (Anypoint Platform PCE)](https://docs.mulesoft.com/private-cloud/4.2/install-workflow)

- [Migrating Anypoint Platform PCE v3.X to v4.X](https://docs.mulesoft.com/private-cloud/4.2/upgrade)

<!-- document id=7b1106032fce0260ffb38810bd3c89f62399b31d1bcd7ca768bc5ae3856b82a8 url=/mulesoft/current/en-us/private-cloud/latest/index.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.3
is-latest-version: true
---

# Anypoint Platform PCE Overview

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Run and manage Mule apps on your local servers following your security policies by using Anypoint
Platform Private Cloud Edition (Anypoint Platform PCE). Anypoint Platform PCE offers local MuleSoft
control plane functionality, with no external system interactions or internet connectivity required,
maintaining all data storage, processing, and transmission. Anypoint Platform PCE uses Kubernetes
for built-in high availability and scalability. While you can install it without deep Kubernetes
knowledge, understanding these tools is essential for management and troubleshooting.

Anypoint Platform PCE version 4.x runs on enterprise-ready Kubernetes Red Hat OpenShift and Rancher
Kubernetes Engine (RKE2). Additionally, it supports Java 17, in addition to Java 8 and 11.

For information about a previous version of Anypoint Platform PCE, select the version in the
documentation sidebar.

## Before You Begin

### Upgrade to Anypoint Platform PCE version 4.X

If you are upgrading from version 3.2.3 of Anypoint Platform PCE to version 4.X, see
[Upgrading Anypoint Platform PCE 3.2.3 to 4.x](https://docs.mulesoft.com/private-cloud/latest/upgrade).

> [!NOTE] If you’re using a version of Anypoint Platform PCE earlier than 3.2.3, upgrade to version
> 3.2.3 first. Then proceed with upgrading to version 4.x.

### Install Anypoint Platform PCE 4.X

If you are installing Anypoint Platform PCE version 4.x for the first time, see
[Installing Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/latest/install-workflow).

To install Anypoint Platform PCE on OpenShift, see
[Installing Anypoint Platform PCE on OpenShift](https://docs.mulesoft.com/private-cloud/latest/install-openshift).

## Anypoint Platform PCE Components

This table provides component information for Anypoint Platform PCE:

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Component</th><th>Included</th><th>Description</th></tr></thead><tbody><tr><td><p>Access Management</p></td><td><p>Yes</p></td><td><p>Enables you to create your Anypoint Platform account or configure external federated identity.</p></td></tr><tr><td><p>Anypoint API Manager</p></td><td><p>Yes</p></td><td><p>Enables you to manage your registered APIs.</p></td></tr><tr><td><p>Anypoint Analytics - API</p></td><td><p>No</p></td><td><p>Provides insight into how your APIs are being used and how they are performing.</p></td></tr><tr><td><p>Anypoint Analytics - Anypoint Visualizer</p></td><td><p>Yes</p></td><td><p>Enables you to explore your application network via an application network graph.</p></td></tr><tr><td><p>Anypoint Analytics - Insights</p></td><td><p>No</p></td><td><p>Provides in-depth visibility into business transactions and events on your Mule apps deployed to CloudHub and on-premises servers.</p></td></tr><tr><td><p>Anypoint Code Builder</p></td><td><p>Yes</p></td><td><p>Enables you to create API specifications, implementations, and integration projects.</p></td></tr><tr><td><p>Anypoint Exchange</p></td><td><p>Yes</p></td><td><p>Enables your organization to share various assets for reuse across integration projects.</p></td></tr><tr><td><p>Anypoint Monitoring</p></td><td><p>No</p></td><td><p>Provides visibility into integrations, Mule flows, and components in your application network.</p></td></tr><tr><td><p>Anypoint MQ</p></td><td><p>No</p></td><td><p>A multi-tenant cloud messaging service that enables you to perform advanced asynchronous messaging scenarios between tenant applications.</p></td></tr><tr><td><p>Anypoint Runtime Fabric Management</p></td><td><p>No</p></td><td><p>Automates the deployment and orchestration of customer-hosted Mule applications and API gateways.</p></td></tr><tr><td><p>Anypoint Runtime Manager</p></td><td><p>Yes</p></td><td><p>Enables you to track and manage your deployed Mule applications.</p></td></tr><tr><td><p>API Testing</p></td><td><p>No</p></td><td><p>Provides a testing framework that enables you to easily build automated tests for your integrations and APIs.</p></td></tr><tr><td><p>Object Store</p></td><td><p>No</p></td><td><p>Object Store v2 allows CloudHub applications to store data and states across batch processes, Mule components, and applications, either from within an application or by using the Object Store REST API.</p></td></tr><tr><td><p>Secrets Manager</p></td><td><p>No</p></td><td><p>Stores and manages secrets for supported Anypoint Platform services.</p></td></tr></tbody></table>

## Mule Runtime Version Compatibility

- Anypoint Platform PCE is compatible with Mule runtime engine versions 4.3 - 4.6. Use version 4.6
  LTS to get the best performance from all Anypoint Platform connectors.

- Anypoint Platform PCE supports the Mule runtime engine LTS and Edge release channels. The
  recommended customer profile is LTS. For more information, visit
  [Edge and LTS Releases for Mule](https://docs.mulesoft.com/release-notes/mule-runtime/lts-edge-release-cadence).

## Java Version Compatibility

Anypoint Platform PCE is compatible with Java 17, 11, and 8.

## Features Shipped with Anypoint Platform PCE Version 4.X

Refer to
[Anypoint Platform Private Cloud Release Notes](https://docs.mulesoft.com/release-notes/pce/anypoint-private-cloud-release-notes)
for detailed release information.

Anypoint Platform PCE version 4.2 contains these features:

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Component</th><th>Feature Description</th><th>Feature Version</th></tr></thead><tbody><tr><td rowspan="6"><p>Access Management</p></td><td><p>Audit Log</p></td><td><p>v5.1.67</p></td></tr><tr><td><p>Authentication Server</p></td><td><p>v1.2.548</p></td></tr><tr><td><p>Authentication Server UI</p></td><td><p>v2.1.269-8.develop</p></td></tr><tr><td><p>Anypoint Sign In</p></td><td><p>v3.2.161</p></td></tr><tr><td><p>Anypoint Roles Client</p></td><td><p>v8.1.1573</p></td></tr><tr><td><p>ARC Informer</p></td><td><p>1.0.374</p></td></tr><tr><td rowspan="3"><p>API Designer</p></td><td><p>API Designer DC Projects Service</p></td><td><p>v3.18.10</p></td></tr><tr><td><p>API Designer DC XAPI Service</p></td><td><p>v2.15.7</p></td></tr><tr><td><p>API Designer DC UI</p></td><td><p>v2.75.8</p></td></tr><tr><td rowspan="9"><p>API Manager</p></td><td><p>API Manager API DB Migrations</p></td><td><p>v1.0.500</p></td></tr><tr><td><p>API Manager API Platform Web</p></td><td><p>v1.15.226</p></td></tr><tr><td><p>API Manager API Proxy Builder Service</p></td><td><p>v1.3.92</p></td></tr><tr><td><p>API Manager API</p></td><td><p>v2.31.26</p></td></tr><tr><td><p>API Manager Contract Caching DB Migrations</p></td><td><p>v1.0.259</p></td></tr><tr><td><p>API Manager Contract Caching Service</p></td><td><p>v1.1.459</p></td></tr><tr><td><p>API Manager Proxies XAPI Service</p></td><td><p>v1.24.11</p></td></tr><tr><td><p>API Manager RAML Parser Service</p></td><td><p>v0.3.173</p></td></tr><tr><td><p>API Manager Web</p></td><td><p>v1.29.13</p></td></tr><tr><td><p>API Modeling Framework (AMF)</p></td><td><p>AMF Service</p></td><td><p>v1.4.66</p></td></tr><tr><td><p>Connectivity</p></td><td><p>REST Connect Service</p></td><td><p>v1.14.57</p></td></tr><tr><td rowspan="24"><p>Exchange</p></td><td><p>Asset Manager DB Migrations</p></td><td><p>v2.0.51</p></td></tr><tr><td><p>Asset Manager Service</p></td><td><p>v1.0.885</p></td></tr><tr><td><p>Asset Portals DB Migrations</p></td><td><p>v2.0.57</p></td></tr><tr><td><p>Asset Portals Service</p></td><td><p>v0.6.1576</p></td></tr><tr><td><p>Content Provider</p></td><td><p>v1.0.29</p></td></tr><tr><td><p>Custom Assets Facade Service</p></td><td><p>v1.0.7</p></td></tr><tr><td><p>Customization Service</p></td><td><p>v0.6.658</p></td></tr><tr><td><p>Dependency Resolver Service</p></td><td><p>v0.8.77</p></td></tr><tr><td><p>File Service</p></td><td><p>v1.1.288</p></td></tr><tr><td><p>File Upload Service</p></td><td><p>v1.1.226</p></td></tr><tr><td><p>Maven Facade Service</p></td><td><p>v0.8.109</p></td></tr><tr><td><p>Region Synchronizer Service</p></td><td><p>v0.2.163</p></td></tr><tr><td><p>Exchange API Metadata DB Migrations</p></td><td><p>v2.0.40</p></td></tr><tr><td><p>Exchange API Metadata Service</p></td><td><p>v1.1.1</p></td></tr><tr><td><p>Exchange Asset Reviews DB Migrations</p></td><td><p>v2.0.36</p></td></tr><tr><td><p>Exchange Asset Reviews Service</p></td><td><p>v0.8.435</p></td></tr><tr><td><p>Exchange Customization DB Migrations</p></td><td><p>2.0.31</p></td></tr><tr><td><p>Exchange Customization Service</p></td><td><p>0.6.658</p></td></tr><tr><td><p>Exchange Graph Node Service</p></td><td><p>0.2.664</p></td></tr><tr><td><p>Exchange Search DB Migrations</p></td><td><p>2.0.38</p></td></tr><tr><td><p>Exchange Search Service</p></td><td><p>v1.0.215</p></td></tr><tr><td><p>Exchange UI</p></td><td><p>v1.0.265</p></td></tr><tr><td><p>Exchange XAPI Service</p></td><td><p>v0.8.2848</p></td></tr><tr><td><p>Mocking Service</p></td><td><p>v2.77.0-17.pce</p></td></tr><tr><td rowspan="6"><p>Runtime Manager</p></td><td><p>Application Manager DB Migration</p></td><td><p>v1.2.11</p></td></tr><tr><td><p>Application Manager Service</p></td><td><p>v2.33.51</p></td></tr><tr><td><p>Atlas Service</p></td><td><p>v1.9.121</p></td></tr><tr><td><p>Mule Agent</p></td><td><p>v2.6.6</p></td></tr><tr><td><p>Jafar Service</p></td><td><p>0.3.167</p></td></tr><tr><td><p>MCM Service</p></td><td><p>v2.17.347</p></td></tr><tr><td rowspan="3"><p>Runtime Services</p></td><td><p>Anypoint Flash Platform Messages DB Migrations</p></td><td><p>1.1.43</p></td></tr><tr><td><p>Platform Messages</p></td><td><p>v2.2.43</p></td></tr><tr><td><p>Mule Message Processor</p></td><td><p>v3.2.40</p></td></tr></tbody></table>

## See Also

- [Anypoint Platform PCE Prerequisites](https://docs.mulesoft.com/private-cloud/latest/install-checklist)

- [Installing or Upgrading Anypoint Platform Private Cloud Edition (Anypoint Platform PCE)](https://docs.mulesoft.com/private-cloud/latest/install-workflow)

- [Migrating Anypoint Platform PCE v3.X to v4.X](https://docs.mulesoft.com/private-cloud/latest/upgrade)

<!-- document id=2d192e1c33b06e132107fc5ef5a1e6534f296f2c1fe5104cf93393214134bc68 url=/mulesoft/current/en-us/private-cloud/3.2/install-checklist.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 3.2
---

# Anypoint Platform PCE Prerequisites

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Before you install Anypoint Platform Private Cloud Edition (Anypoint Platform PCE):

- Your organization’s operations, networking, and security teams must review the listed
  infrastructure prerequisites, including Amazon Web Services (if applicable), hardware, software,
  network, and NFS, and verify successful completion of all prerequisites listed in this topic. If
  needed, contact your MuleSoft representative for assistance.

  All prerequisites apply to all [Supported Environments](https://docs.mulesoft.com/private-cloud/3.2/prereq-platform#supported-environments).

- Knowledge in the following areas is required:

  - Linux system commands.

  - Working in Linux with root access. Installation requires root access (permission to run the
    `sudo` command) on all servers in your environment.

  - Working with Terraform. This is only required if your environment includes AWS.

  - Remote connection mechanisms, such as SSL and SSH.

> [!WARNING] You must contact MuleSoft Professional Services prior to installation. MuleSoft
> professional services must be involved with your installation.
>
> Installing Anypoint Platform PCE requires specific versions of operating systems, NFS, and other
> software. Most issues experienced with Anypoint Platform PCE occur because the required
> environment was not set up prior to installing or upgrading. For example, the following situations
> cause known problems:
>
> - Using your own AWS images when using AWS.
>
> - Using existing provisioning processes that install specific versions of RHEL, Docker, or other
>   software that Anypoint Platform PCE does not support.

## Environment Prerequisites

<table><caption>Table 1. Prerequisite Environment-Related Tasks</caption> <colgroup><col></colgroup><thead><tr><th>Task Description</th></tr></thead><tbody><tr><td><div><div><p><a href="https://docs.mulesoft.com/private-cloud/3.2/prereq-platform">Verify Your Environment Is Supported</a></p></div></div></td></tr><tr><td><div><div><p>If you are using AWS, <a href="https://docs.mulesoft.com/private-cloud/3.2/prereq-aws-terraform">Provision Amazon Web Services (AWS) Prerequisites</a>.</p></div></div></td></tr></tbody></table>

## Hardware Prerequisites

Refer to [Hardware Prerequisites](https://docs.mulesoft.com/private-cloud/3.2/prereq-hardware) for additional details and instructions for the
following tasks:

<table><caption>Table 2. Prerequisite Hardware-Related Tasks</caption> <colgroup><col></colgroup><thead><tr><th>Task Description</th></tr></thead><tbody><tr><td><div><div><p><a href="https://docs.mulesoft.com/private-cloud/3.2/prereq-hardware#memory-and-cpu-requirements">Verify Memory and CPU Requirements</a></p></div></div></td></tr><tr><td><div><div><p><a href="https://docs.mulesoft.com/private-cloud/3.2/prereq-hardware#device-requirements">Verify Device Requirements</a></p></div></div></td></tr><tr><td><div><div><p><a href="https://docs.mulesoft.com/private-cloud/3.2/prereq-hardware#device-requirements">Verify Disk IOPS</a></p></div></div></td></tr><tr><td><div><div><p><a href="https://docs.mulesoft.com/private-cloud/3.2/prereq-hardware#load-balancer-requirements">Configure Load Balancer</a></p></div></div></td></tr></tbody></table>

## Software Prerequisites

Refer to [Software Prerequisites](https://docs.mulesoft.com/private-cloud/3.2/prereq-software) for additional details and instructions for the
following tasks:

<table><caption>Table 3. Prerequisite Software-Related Tasks</caption> <colgroup><col></colgroup><thead><tr><th>Task Description</th></tr></thead><tbody><tr><td><div><div><p>Operating system prerequisites</p></div></div></td></tr><tr><td><div><div><ul><li><p><a href="https://docs.mulesoft.com/private-cloud/3.2/prereq-software#verify-linux-distribution">Verify Linux Distribution</a></p></li><li><p><a href="https://docs.mulesoft.com/private-cloud/3.2/prereq-software#selinux">Check for SELinux Custom Profiles</a></p></li><li><p><a href="https://docs.mulesoft.com/private-cloud/3.2/prereq-software#enable-and-load-kernel-modules">Enable and Load Kernel Modules</a></p></li><li><p><a href="https://docs.mulesoft.com/private-cloud/3.2/prereq-software#verify-kernel-settings">Verify Kernel Settings</a></p></li></ul></div></div></td></tr><tr><td><div><div><p>Third party software prerequisites</p></div></div></td></tr><tr><td><div><div><ul><li><p><a href="https://docs.mulesoft.com/private-cloud/3.2/prereq-software#install-logical-volume-manager-2-lvm2">Install Logical Volume Manager 2 (LVM2)</a></p></li><li><p><a href="https://docs.mulesoft.com/private-cloud/3.2/prereq-software#determine-if-you-are-using-firewalld">Determine if You Are Using firewalld</a></p></li><li><p><a href="https://docs.mulesoft.com/private-cloud/3.2/prereq-software#remove-local-dns-servers">Remove Local DNS Servers</a></p></li><li><p><a href="https://docs.mulesoft.com/private-cloud/3.2/prereq-software#download-and-install-required-tools">Install Required Tools</a></p></li><li><p><a href="https://docs.mulesoft.com/private-cloud/3.2/prereq-software#remove-server-configuration-management-software">Remove Server Configuration Management Software</a></p></li></ul></div></div></td></tr><tr><td><div><div><p>MuleSoft software prerequisites</p></div></div></td></tr><tr><td><div><div><ul><li><p><a href="https://docs.mulesoft.com/private-cloud/3.2/prereq-software#obtain-install-archive-and-license-key">Obtain Install Archive and License Key</a></p></li><li><p><a href="https://docs.mulesoft.com/private-cloud/3.2/prereq-software#verify-ip-forwarding-and-bridging">Verify IP Forwarding and Bridging</a></p></li><li><p><a href="https://docs.mulesoft.com/private-cloud/3.2/prereq-software#enable-forwarding-on-docker-device">Enable Forwarding on Docker device</a></p></li><li><p><a href="https://docs.mulesoft.com/private-cloud/3.2/prereq-software#verify-ssl-certificate-requirements">Verify SSL Certificate Requirements</a></p></li><li><p><a href="https://docs.mulesoft.com/private-cloud/3.2/prereq-software#uninstall-unsupported-software">Uninstall Unsupported Software</a></p></li></ul></div></div></td></tr></tbody></table>

## Network Prerequisites

Refer to [Network Prerequisites](https://docs.mulesoft.com/private-cloud/3.2/prereq-network) for additional details and instructions for the
following tasks:

<table><caption>Table 4. Prerequisite Network-Related Tasks</caption> <colgroup><col></colgroup><thead><tr><th>Task Description</th></tr></thead><tbody><tr><td><div><div><p><a href="https://docs.mulesoft.com/private-cloud/3.2/prereq-network#verify-static-ips">Verify Static IPs</a></p></div></div></td></tr><tr><td><div><div><p><a href="https://docs.mulesoft.com/private-cloud/3.2/prereq-network#verify-vxlan">Verify VXLAN</a></p></div></div></td></tr><tr><td><div><div><p><a href="https://docs.mulesoft.com/private-cloud/3.2/prereq-network#enable-required-ports">Enable Required Ports</a></p></div></div></td></tr><tr><td><div><div><p><a href="https://docs.mulesoft.com/private-cloud/3.2/prereq-network#verify-nat-traffic-requirements">Verify NAT Traffic Requirements</a></p></div></div></td></tr><tr><td><div><div><p><a href="https://docs.mulesoft.com/private-cloud/3.2/prereq-network#verify-smtp-server-requirements">Verify SMTP Server Requirements</a></p></div></div></td></tr><tr><td><div><div><p><a href="https://docs.mulesoft.com/private-cloud/3.2/prereq-network#verify-external-identity-provider-configuration-and-client-management">Verify External Identity Provider Configuration and Client Management</a></p></div></div></td></tr><tr><td><div><div><p><a href="https://docs.mulesoft.com/private-cloud/3.2/prereq-network#synchronize-clocks">Synchronize Clocks</a></p></div></div></td></tr></tbody></table>

## NFS Prerequisites

Refer to [NFS Server Prerequisites](https://docs.mulesoft.com/private-cloud/3.2/verify-nfs) for additional details and instructions for the
following tasks:

<table><caption>Table 5. Prerequisite NFS-Related Tasks</caption> <colgroup><col></colgroup><thead><tr><th>Task Description</th></tr></thead><tbody><tr><td><div><div><p><a href="https://docs.mulesoft.com/private-cloud/3.2/verify-nfs#verify-nfs-server-setup">Verify NFS Server Setup</a></p></div></div></td></tr><tr><td><div><div><p><a href="https://docs.mulesoft.com/private-cloud/3.2/verify-nfs#verify-required-ports-are-open">Verify Required Ports are Open</a></p></div></div></td></tr><tr><td><div><div><p><a href="https://docs.mulesoft.com/private-cloud/3.2/verify-nfs#verify-nfs-server-is-mounted">Verify NFS Server is Mounted</a></p></div></div></td></tr><tr><td><div><div><p><a href="https://docs.mulesoft.com/private-cloud/3.2/verify-nfs#verify-nfs-performance">Verify NFS Performance</a></p></div></div></td></tr></tbody></table>

## Verify Environment

Perform the steps in [Verify Environment](https://docs.mulesoft.com/private-cloud/3.2/prereq-gravity-check) to ensure that your infrastructure
meets Anypoint Platform PCE requirements.

<!-- document id=2cad10ac009f41044e601306b3f351f06ffef99a18307b9362244de3bc6dc28e url=/mulesoft/current/en-us/private-cloud/4.0/install-checklist.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.0
---

# Anypoint Platform PCE Prerequisites

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

You can install Anypoint Platform Private Cloud Edition (Anypoint Platform PCE) version 4.0 and
later in the Kubernetes (K8s) cluster that you provision and manage.

MuleSoft performed installations on popular K8s providers, which are listed in the following
sections. The hardware and software requirements for installing Anypoint Platform PCE on your chosen
provider are dictated by that provider, unless otherwise specified in this document.

Before you begin, ensure your organization’s operations, networking, and security teams review the
listed infrastructure prerequisites. These include the K8s cluster, hardware, software, networking,
NFS storage, container registry, installer node, and storage requirements.

> [!NOTE] You must contact MuleSoft Professional Services prior to installing Anypoint Platform PCE,
> as they are involved with your installation.
>
> Installing Anypoint Platform PCE requires specific versions of operating systems, NFS, and other
> software. Most issues experienced with Anypoint Platform PCE occur because the required
> environment was not set up prior to installing or upgrading.

## Kubernetes Cluster Requirements

These are the requirements:

- Kubernetes (K8s) version 1.29 or 1.30.

- Kubernetes providers:

  - Rancher Kubernetes Engine (RKE2) versions 1.29 and 1.30.

  - Red Hat OpenShift versions 4.15 and 4.16.

  - Amazon EKS Anywhere (EKS-A) 0.20 (K8s version 1.29, 1.30)

- Cluster configurations:

  - Have a dedicated control plane node within the K8s cluster. Preferably, allocate 3 or 5 nodes
    for the K8s control planes. For example, only K8s management workload run on these nodes.

  - Have cluster worker nodes exclusively dedicated to Anypoint Platform PCE workloads. No Anypoint
    Platform PCE pods can run on the K8s control plane nodes.

  - A large cluster can have:

    - 3 K8s control plane nodes

    - 7 K8s worker nodes

  - A small cluster can have:

    - 3 K8s control plane nodes

    - 4 K8s worker nodes

If you have Anypoint Platform PCE 3.2.x or earlier installed, ensure you disable SWAP on all
Anypoint Platform PCE nodes. Anypoint Platform PCE relies heavily on Kubernetes, which doesn’t
support the use of SWAP space. When SWAP is enabled, Kubernetes and the SWAP daemon attempt to
manage the same memory space, leading to CPU overload as they compete. To avoid this issue, don’t
use SWAP space on machines running Anypoint Platform PCE.

> [!NOTE] Running Anypoint Platform PCE workloads on K8s control plane nodes can degrade both
> Anypoint Platform PCE and cluster performance.

## Hardware Requirements

These are the minimum requirements for the cluster nodes:

- Dedicated control plane nodes:

  - Architecture x86\_64

  - 4 vCPUS

  - Memory 8 GiB

  - Root volume 50GB

- Worker nodes:

  - Architecture x86\_64

  - 8 vCPUS

  - Memory 32 GiB

  - Root volume 50GB

For more information, see the provider specific requirements:

- [Rancher Kubernetes Engine (RKE2) - Hardware](https://docs.rke2.io/install/requirements#hardware)

- [Red Hat OpenShift](https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/installation_overview/ocp-installation-overview)

- [Amazon EKS Anywhere (EKS-A)](https://anywhere.eks.amazonaws.com/docs/getting-started/baremetal/bare-prereq/)

## Software Requirements

These are the requirements:

- Operating system: RHEL 8.10

For more information, see the provider specific requirements:

- [Rancher Kubernetes Engine (RKE2) - Software](https://docs.rke2.io/install/requirements#operating-systems)

- [Red Hat OpenShift](https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/installation_overview/ocp-installation-overview)

- [Amazon EKS Anywhere (EKS-A)](https://anywhere.eks.amazonaws.com/docs/getting-started/baremetal/bare-prereq/)

## Networking Requirements

Use the following ports to communicate with Anypoint Platform PCE:

<table><colgroup><col> <col> <col> <col> <col></colgroup><thead><tr><th>Protocol</th><th>Port / Range</th><th>Purpose</th><th>Source</th><th>Destination</th></tr></thead><tbody><tr><td><p>TCP/UDP</p></td><td><p>53</p></td><td><p>Internal cluster DNS</p></td><td><p>localhost</p></td><td><p>localhost</p></td></tr><tr><td><p>TCP</p></td><td><p>2379, 2380, 4001, 7001</p></td><td><p>etcd distributed database</p></td><td><p>Anypoint Platform PCE nodes</p></td><td><p>Anypoint Platform PCE nodes</p></td></tr><tr><td><p>TCP</p></td><td><p>4242</p></td><td><p>Installer</p></td><td><p>Anypoint Platform PCE nodes</p></td><td><p>Anypoint Platform PCE nodes</p></td></tr><tr><td><p>TCP</p></td><td><p>6443</p></td><td><p>Kubernetes API Server</p></td><td><p>Anypoint Platform PCE nodes</p></td><td><p>Anypoint Platform PCE nodes</p></td></tr><tr><td><p>TCP</p></td><td><p>9443</p></td><td><p>HAProxy to load balance Kubernetes API Server</p></td><td><p>Anypoint Platform PCE nodes</p></td><td><p>Anypoint Platform PCE nodes</p></td></tr><tr><td><p>TCP</p></td><td><p>9100</p></td><td><p>Prometheus node-exporter</p></td><td><p>Anypoint Platform PCE nodes</p></td><td><p>Anypoint Platform PCE nodes</p></td></tr><tr><td><p>TCP</p></td><td><p>10248, 10250</p></td><td><p>Kubernetes Kubelet</p></td><td><p>Anypoint Platform PCE nodes</p></td><td><p>Anypoint Platform PCE nodes</p></td></tr><tr><td><p>TCP</p></td><td><p>10249</p></td><td><p>Kubernetes kube-proxy</p></td><td><p>localhost</p></td><td><p>localhost</p></td></tr><tr><td><p>TCP</p></td><td><p>10251-10252</p></td><td><p>Kubernetes controller-manager and scheduler</p></td><td><p>Anypoint Platform PCE nodes</p></td><td><p>Anypoint Platform PCE nodes</p></td></tr><tr><td><p>TCP</p></td><td><p>10257-10259</p></td><td><p>Kubernetes controller-manager and scheduler (secure)</p></td><td><p>Anypoint Platform PCE nodes</p></td><td><p>Anypoint Platform PCE nodes</p></td></tr><tr><td><p>TCP</p></td><td><p>30000-32767</p></td><td><p>Internal services port range</p></td><td><p>Anypoint Platform PCE nodes</p></td><td><p>Anypoint Platform PCE nodes</p></td></tr><tr><td><p>TCP</p></td><td><p>8472</p></td><td><p>Overlay VXLAN network</p></td><td><p>Anypoint Platform PCE nodes</p></td><td><p>Anypoint Platform PCE nodes</p></td></tr><tr><td><p>TCP</p></td><td><p>30080</p></td><td><p>HTTP public access</p></td><td><p>Load balancer</p></td><td><p>Anypoint Platform PCE nodes</p></td></tr><tr><td><p>TCP</p></td><td><p>30443</p></td><td><p>HTTPS public access</p></td><td><p>Load balancer</p></td><td><p>Anypoint Platform PCE nodes</p></td></tr><tr><td><p>TCP</p></td><td><p>30889</p></td><td><p>Mule Runtime Websocket</p></td><td><p>Load balancer</p></td><td><p>Anypoint Platform PCE nodes</p></td></tr><tr><td><p>TCP</p></td><td><p>30883</p></td><td><p>Mule Runtime Authentication Service (for certificate renewals)</p></td><td><p>Load balancer</p></td><td><p>Anypoint Platform PCE nodes</p></td></tr></tbody></table>

Anypoint Platform PCE nodes need to hit the platform API address on the load balancer via HTTPS.

For more information, see the provider specific requirements:

- [Rancher Kubernetes Engine (RKE2) - Networking](https://docs.rke2.io/install/requirements#operating-systems)

- [Red Hat OpenShift - Networking](https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/networking/understanding-networking)

- [Amazon EKS Anywhere (EKS-A) - Networking](https://anywhere.eks.amazonaws.com/docs/clustermgmt/networking/networking-and-security/)

## NFS Storage Requirements

See [NFS Server Prerequisites](https://docs.mulesoft.com/private-cloud/4.0/verify-nfs)

## Container Registry Requirements

These are the requirements:

- Must be secured over TLS.

- Must be accessible from installer nodes and Kubernetes clusters.

- Must be secured with either a username and password or Certificate based authentication. Ensure
  that the new or updated certificates are distributed to all nodes to facilitate uninterrupted TLS
  communication.

## Installer Node Requirements

These are the requirements:

- Operating system: RHEL, Ubuntu or any Linux based systems.

- Storage required a minimum 100GB.

- Access to Kubernetes cluster using kubeconfig.yaml

  - The cluster needs `cluster:admin` access, as Anypoint Platform PCE installer needs to create
    resources of different types.

  - The cluster needs `read/write` access in the default namespace to run Anypoint Platform PCE
    installer jobs and other supporting services.

- Access and connectivity to private container registry

- For OpenShift use SecurityContextConstraints for installing Anypoint Platform PCE.

## Storage Requirements

These are the requirements:

In Anypoint Platform PCE version 4.0 and later, all the persistent data is stored in the Persistent
Volume Claims (PVCs). Kubernetes Storage Class commands the PVCs. Currently, there are two services
that require PVCs:

- SeaweedFS - S3 object store service

- Stolon - PostgreSQL HA database

The storage class for the previous services can be the same. Depending on the type of underlying
infrastructure or storage solution you choose, the storage class configuration can vary.

## Platform Configuration

To make Anypoint Platform PCE accessible, configure these specifications in the input config file
before installing Anypoint Platform PCE:

- Platform DNS

- File System DNS

- First User Account details

  - Org Name

  - Username

  - Email

  - Password

- Platform certificate and certificate key with the Subject Alternative Name (SAN) of the platform
  DNS.

## See Also

- [Installing Anypoint Platform Private Cloud Edition (Anypoint Platform PCE)](https://docs.mulesoft.com/private-cloud/4.0/install-workflow)

<!-- document id=fc6dedd4a0b5d7e23d017e624dee16f4ecfcf182bb7601b735a60f5ed2e51905 url=/mulesoft/current/en-us/private-cloud/4.1/install-checklist.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.1
---

# Anypoint Platform PCE Prerequisites

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

You can install Anypoint Platform Private Cloud Edition (Anypoint Platform PCE) version 4.x and
later in the Kubernetes (K8s) cluster that you provision and manage.

MuleSoft performed installations on popular K8s providers, which are listed in the following
sections. The hardware and software requirements for installing Anypoint Platform PCE on your chosen
provider are dictated by that provider, unless otherwise specified in this document.

Before you begin, make sure that your organization’s operations, networking, and security teams
review the listed infrastructure prerequisites. These include the K8s cluster, hardware, software,
networking, NFS storage, container registry, installer node, and storage requirements.

> [!NOTE] Contact MuleSoft Professional Services prior to installing Anypoint Platform PCE, as they
> are involved with your installation.
>
> Installing Anypoint Platform PCE requires specific versions of operating systems, NFS, and other
> software. Most issues experienced with Anypoint Platform PCE occur because the required
> environment was not set up prior to installing or upgrading.

## Kubernetes Cluster Requirements

- Supported Kubernetes providers:

  - Amazon EKS Anywhere

  - Amazon EKS

  - Rancher Kubernetes Engine (RKE2)

  - Red Hat OpenShift

  - vSphere Kubernetes Service (VKS)

- Cluster configurations:

  - Run Kubernetes control plane components on dedicated nodes. Preferably, allocate three nodes for
    the Kubernetes control plane.

  - Have cluster worker nodes exclusively dedicated to Anypoint Platform PCE workloads. Don’t run
    any Anypoint Platform PCE pods on the K8s control plane nodes. Check the prerequisites to make
    sure that PCE workloads can be scheduled and run on worker nodes.

> [!NOTE] Running Anypoint Platform PCE workloads on K8s control plane nodes can degrade both
> Anypoint Platform PCE and cluster performance.

## Hardware Requirements

Anypoint Platform PCE runs as a Kubernetes application and these are the minimum required hardware
for all services to be scheduled and running:

- 32 vCPUs

- 128 GiB Memory

- x86\_64 Architecture

You can provision and distribute these resources across a minimum of four worker nodes. PCE requires
at least three worker nodes as hosts for data services that are deployed and configured in a cluster
setup with three replicas. Make sure these three replicas run on three separate nodes to honor the
anti-affinity rules.

### Sample Worker Node Configurations

Anypoint Platform PCE offers flexibility in how you configure your Kubernetes worker nodes. You can
use different numbers of worker nodes (for example, 4, 5, 8, or 10 nodes) with varying resource
allocations per node. The key requirement is that your cluster’s total resources meet or exceed the
minimum requirements of 32 vCPUs and 128 GiB memory.

This table shows sample worker node configurations that MuleSoft’s performance teams tested and
validated:

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Number of Worker Nodes</th><th>Node Composition</th><th>Total Resources</th></tr></thead><tbody><tr><td><p>4</p></td><td><p>8 vCPU and 32 GiB memory</p></td><td><p>32 vCPU and 128 GiB memory</p></td></tr><tr><td><p>10</p></td><td><p>4 vCPU and 16 GiB memory</p></td><td><p>40 vCPU and 160 GiB memory</p></td></tr></tbody></table>

> [!NOTE] These configurations are reference examples to help you understand how Anypoint Platform
> PCE can work with different worker node configurations. They are not strict requirements. You can
> customize your cluster configuration based on your infrastructure and operational needs, as long
> as the total resource requirements are met.

### Load Balancer Configuration

You can configure your load balancer to use any method for distributing client requests. Use a a
round robin strategy for better results in most contexts. Make sure the load balancer is accessible
through an IP address that is available to all machines on your network.

Make sure your load balancer routes these TCP ports:

<table><caption>Table 1. TCP Port Routing Requirements</caption> <colgroup><col> <col> <col></colgroup><thead><tr><th>Load Balancer Port</th><th>Instance Port</th><th>Internal Usage</th></tr></thead><tbody><tr><td><p><code>80</code></p></td><td><p><code>30080</code></p></td><td><p>HTTP redirects to HTTPs</p></td></tr><tr><td><p><code>443</code></p></td><td><p><code>30443</code></p></td><td><p>HTTPS port</p></td></tr><tr><td><p><code>8083</code></p></td><td><p><code>30883</code></p></td><td><p>HTTPS port for Mule runtimes to authenticate and renew certificates</p></td></tr><tr><td><p><code>8889</code></p></td><td><p><code>30889</code></p></td><td><p>WebSocket port for Mule runtimes to connect</p></td></tr></tbody></table>

In each case, configure your load balancer to listen on the load balancer port and redirect incoming
requests to the instance port. Your Anypoint Platform PCE installation includes an internal NGINX
server that listens on each of the configured instance ports, and then performs the action listed in
the Internal Usage column.

Make sure your load balancer polls the address `HTTP:10256/healthz` to run a health check on your
platform servers and confirm that they are accessible.

> [!NOTE] Don’t configure SSL certificates in your load balancer. The platform handles the TLS
> termination with the certificates configured using Access Management. See
> [Configure Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/4.1/config-workflow).

For more information, see the provider specific requirements:

- [Amazon EKS](https://docs.aws.amazon.com/eks/latest/userguide/create-cluster.html)

  AWS EKS is only tested with default networking add-ons.

- [Amazon EKS Anywhere (EKS-A)](https://anywhere.eks.amazonaws.com/docs/getting-started/baremetal/bare-prereq/)

- [Rancher Kubernetes Engine (RKE2) - Hardware](https://docs.rke2.io/install/requirements#hardware)

- [Red Hat OpenShift](https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/installation_overview/ocp-installation-overview)

- [vSphere Kubernetes Service (VKS)](https://techdocs.broadcom.com/us/en/vmware-cis/vcf/vsphere-supervisor-services-and-standalone-components/latest/managing-vsphere-kubernetes-service/running-tkg-service-clusters/tkg-service-components.html)

## Software Requirements

These are the requirements:

- Operating system: RHEL 8.10, 9.4, 9.6

For more information, see the provider specific requirements:

- [Amazon EKS](https://docs.aws.amazon.com/eks/latest/userguide/create-cluster.html)

- [Amazon EKS Anywhere (EKS-A)](https://anywhere.eks.amazonaws.com/docs/getting-started/baremetal/bare-prereq/)

- [Rancher Kubernetes Engine (RKE2) - Software](https://docs.rke2.io/install/requirements#operating-systems)

- [Red Hat OpenShift](https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/installation_overview/ocp-installation-overview)

## Networking Requirements

Use the following ports to communicate with Anypoint Platform PCE:

<table><colgroup><col> <col> <col> <col> <col></colgroup><thead><tr><th>Protocol</th><th>Port / Range</th><th>Purpose</th><th>Source</th><th>Destination</th></tr></thead><tbody><tr><td><p>TCP/UDP</p></td><td><p>53</p></td><td><p>Internal cluster DNS</p></td><td><p>localhost</p></td><td><p>localhost</p></td></tr><tr><td><p>TCP</p></td><td><p>2379, 2380, 4001, 7001</p></td><td><p>etcd distributed database</p></td><td><p>Anypoint Platform PCE nodes</p></td><td><p>Anypoint Platform PCE nodes</p></td></tr><tr><td><p>TCP</p></td><td><p>4242</p></td><td><p>Installer</p></td><td><p>Anypoint Platform PCE nodes</p></td><td><p>Anypoint Platform PCE nodes</p></td></tr><tr><td><p>TCP</p></td><td><p>6443</p></td><td><p>Kubernetes API Server</p></td><td><p>Anypoint Platform PCE nodes</p></td><td><p>Anypoint Platform PCE nodes</p></td></tr><tr><td><p>TCP</p></td><td><p>9443</p></td><td><p>HAProxy to load balance Kubernetes API Server</p></td><td><p>Anypoint Platform PCE nodes</p></td><td><p>Anypoint Platform PCE nodes</p></td></tr><tr><td><p>TCP</p></td><td><p>9100</p></td><td><p>Prometheus node-exporter</p></td><td><p>Anypoint Platform PCE nodes</p></td><td><p>Anypoint Platform PCE nodes</p></td></tr><tr><td><p>TCP</p></td><td><p>10248, 10250</p></td><td><p>Kubernetes Kubelet</p></td><td><p>Anypoint Platform PCE nodes</p></td><td><p>Anypoint Platform PCE nodes</p></td></tr><tr><td><p>TCP</p></td><td><p>10249</p></td><td><p>Kubernetes kube-proxy</p></td><td><p>localhost</p></td><td><p>localhost</p></td></tr><tr><td><p>TCP</p></td><td><p>10251-10252</p></td><td><p>Kubernetes controller-manager and scheduler</p></td><td><p>Anypoint Platform PCE nodes</p></td><td><p>Anypoint Platform PCE nodes</p></td></tr><tr><td><p>TCP</p></td><td><p>10257-10259</p></td><td><p>Kubernetes controller-manager and scheduler (secure)</p></td><td><p>Anypoint Platform PCE nodes</p></td><td><p>Anypoint Platform PCE nodes</p></td></tr><tr><td><p>TCP</p></td><td><p>30000-32767</p></td><td><p>Internal services port range</p></td><td><p>Anypoint Platform PCE nodes</p></td><td><p>Anypoint Platform PCE nodes</p></td></tr><tr><td><p>TCP</p></td><td><p>8472</p></td><td><p>Overlay VXLAN network</p></td><td><p>Anypoint Platform PCE nodes</p></td><td><p>Anypoint Platform PCE nodes</p></td></tr><tr><td><p>TCP</p></td><td><p>30080</p></td><td><p>HTTP public access</p></td><td><p>Load balancer</p></td><td><p>Anypoint Platform PCE nodes</p></td></tr><tr><td><p>TCP</p></td><td><p>30443</p></td><td><p>HTTPS public access</p></td><td><p>Load balancer</p></td><td><p>Anypoint Platform PCE nodes</p></td></tr><tr><td><p>TCP</p></td><td><p>30889</p></td><td><p>Mule Runtime Websocket</p></td><td><p>Load balancer</p></td><td><p>Anypoint Platform PCE nodes</p></td></tr><tr><td><p>TCP</p></td><td><p>30883</p></td><td><p>Mule Runtime Authentication Service (for certificate renewals)</p></td><td><p>Load balancer</p></td><td><p>Anypoint Platform PCE nodes</p></td></tr></tbody></table>

Anypoint Platform PCE nodes need to hit the platform API address on the load balancer via HTTPS.

For more information, see the provider specific requirements:

- [Amazon EKS - Networking](https://docs.aws.amazon.com/eks/latest/userguide/eks-networking.html)

- [Amazon EKS Anywhere (EKS-A) - Networking](https://anywhere.eks.amazonaws.com/docs/clustermgmt/networking/networking-and-security/)

- [Rancher Kubernetes Engine (RKE2) - Networking](https://docs.rke2.io/install/requirements#operating-systems)

- [Red Hat OpenShift - Networking](https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/networking/understanding-networking)

## NFS Storage Requirements

See [NFS Server Prerequisites](https://docs.mulesoft.com/private-cloud/4.1/verify-nfs)

## Container Registry Requirements

These are the requirements:

- Must be secured over TLS.

- Must be accessible from installer nodes and Kubernetes clusters.

- Must be secured with either a username and password, or Certificate-based authentication. Make
  sure that the new or updated certificates are distributed to all nodes to facilitate uninterrupted
  TLS communication.

## Installer Node Requirements

These are the requirements:

- Operating system: RHEL, Ubuntu, or any Linux-based systems.

- Storage required a minimum 100GB.

- Access to Kubernetes cluster using kubeconfig.yaml

  - The cluster needs `cluster:admin` access, as Anypoint Platform PCE installer needs to create
    resources of different types.

  - The cluster needs `read/write` access in the pce-core namespace to run Anypoint Platform PCE
    installer jobs and other supporting services.

- Access and connectivity to private container registry

- For OpenShift use SecurityContextConstraints for installing Anypoint Platform PCE.

Before executing the `pcectl` binary for Anypoint Platform PCE 4.1, make sure that you follow these
requirements:

- Use a Linux based operating system

- Use glibc (GNU C library) version 2.28 or higher  
  To check the glibc version, run this command:

  ldd --version

- Use Python version 3.12 or newer  
  To check your Python version, run this command:

  python --version

- Use gpg (GnuPG) version 2.1 or higher  
  To check your gpg version, run this command:

  gpg --version

## Storage Requirements

These are the requirements:

In Anypoint Platform PCE version 4.1 and later, all the persistent data is stored in the Persistent
Volume Claims (PVCs). Kubernetes Storage Class commands the PVCs.

These services use PVCs with minimum and default storage size:

- SeaweedFS - S3 Object Store service - Total 120Gi

- Stolon - PostgreSQL HA database - Total 100 Gi

- Prometheus - TSDB for k8s metrics (optional) - Default 50Gi

The storage class for the previous services can be the same. Depending on the type of underlying
infrastructure or storage solution you select, the storage class configuration can vary.

You can update the PVC storage size during the installation by updating the `input.yaml` file. See
these sections to update the storage size:

```json
# Storage class configuration for persistent data services
storageConfiguration:
 pceobjectstore:
   type: "persistentVolumeClaim"
   storageClass: "<storage-class-name>"
   controlPlaneSize: "20Gi" # Optional. Defaults to 10Gi
   volumeSize: "200Gi" # Optional. Defaults to 100Gi
   volumeIndexSize: "20Gi" # Optional. Defaults to 10Gi
 stolon:
   type: "persistentVolumeClaim"
   storageClass: "<storage-class-name>"
   size: "300Gi" # Optional. Defaults to 100Gi
```

In the previous example, you can see the storage for SeaweedFS that is Object Store has increased to
240GiB and stolon has increased to 300 Gi.

Similarly, to set the storage size for monitoring stack, use this configuration:

```json
# Configuration options for monitoring stack
monitoringAppConfiguration:
 monitoringStack:
   enabled:  True # Defaults to True. Must be set to False for Openshift clusters.
   values: | # Optional. If not provided, the default values will be used.
      prometheus:
        prometheusSpec:
          storageSpec:
            volumeClaimTemplate:
              spec:
                storageClassName: 'local-path',
                accessModes: ["ReadWriteOnce"]
                resources:
                  requests:
                    storage: 50Gi
```

## Platform Configuration

To make Anypoint Platform PCE accessible, configure these specifications in the input configuration
file before installing Anypoint Platform PCE:

- Platform DNS

- File System DNS

- First User Account details

  - Org Name

  - Username

  - Email

  - Password

- Platform certificate and certificate key with the Subject Alternative Name (SAN) of the platform
  DNS.

## See Also

- [Installing Anypoint Platform Private Cloud Edition (Anypoint Platform PCE)](https://docs.mulesoft.com/private-cloud/4.1/install-workflow)

<!-- document id=a58d94bbc13526f0b92e580fd9846ba562165aff472b001f4adb59e127a9cf16 url=/mulesoft/current/en-us/private-cloud/4.2/install-checklist.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.2
---

# Anypoint Platform PCE Prerequisites

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

You can install Anypoint Platform Private Cloud Edition (Anypoint Platform PCE) version 4.x and
later in the Kubernetes (K8s) cluster that you provision and manage.

MuleSoft performed installations on popular K8s providers, which are listed in the following
sections. The hardware and software requirements for installing Anypoint Platform PCE on your chosen
provider are dictated by that provider, unless otherwise specified in this document.

Before you begin, make sure that your organization’s operations, networking, and security teams
review the listed infrastructure prerequisites. These include the K8s cluster, hardware, software,
networking, NFS storage, container registry, installer node, and storage requirements.

> [!NOTE] Contact MuleSoft Professional Services prior to installing Anypoint Platform PCE, as they
> are involved with your installation.
>
> Installing Anypoint Platform PCE requires specific versions of operating systems, NFS, and other
> software. Most issues experienced with Anypoint Platform PCE occur because the required
> environment was not set up prior to installing or upgrading.

## Kubernetes Cluster Requirements

- Supported Kubernetes providers:

  - Amazon EKS

  - Rancher Kubernetes Engine (RKE2)

  - Red Hat OpenShift

  - vSphere Kubernetes Service (VKS)

- Cluster configurations:

  - Run Kubernetes control plane components on dedicated nodes. Preferably, allocate three nodes for
    the Kubernetes control plane.

  - Have cluster worker nodes exclusively dedicated to Anypoint Platform PCE workloads. Don’t run
    any Anypoint Platform PCE pods on the K8s control plane nodes. Check the prerequisites to make
    sure that PCE workloads can be scheduled and run on worker nodes.

> [!NOTE] Running Anypoint Platform PCE workloads on K8s control plane nodes can degrade both
> Anypoint Platform PCE and cluster performance.

## Hardware Requirements

Anypoint Platform PCE runs as a Kubernetes application and these are the minimum required hardware
for all services to be scheduled and running:

- 32 vCPUs

- 128 GiB Memory

- x86\_64 Architecture

You can provision and distribute these resources across a minimum of four worker nodes. PCE requires
at least three worker nodes as hosts for data services that are deployed and configured in a cluster
setup with three replicas. Make sure these three replicas run on three separate nodes to honor the
anti-affinity rules.

### Sample Worker Node Configurations

Anypoint Platform PCE offers flexibility in how you configure your Kubernetes worker nodes. You can
use different numbers of worker nodes (for example, 4, 5, 8, or 10 nodes) with varying resource
allocations per node. The key requirement is that your cluster’s total resources meet or exceed the
minimum requirements of 32 vCPUs and 128 GiB memory.

This table shows sample worker node configurations that MuleSoft’s performance teams tested and
validated:

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Number of Worker Nodes</th><th>Node Composition</th><th>Total Resources</th></tr></thead><tbody><tr><td><p>4</p></td><td><p>8 vCPU and 32 GiB memory</p></td><td><p>32 vCPU and 128 GiB memory</p></td></tr><tr><td><p>10</p></td><td><p>4 vCPU and 16 GiB memory</p></td><td><p>40 vCPU and 160 GiB memory</p></td></tr></tbody></table>

> [!NOTE] These configurations are reference examples to help you understand how Anypoint Platform
> PCE can work with different worker node configurations. They are not strict requirements. You can
> customize your cluster configuration based on your infrastructure and operational needs, as long
> as the total resource requirements are met.

### Load Balancer Configuration

You can configure your load balancer to use any method for distributing client requests. Use a a
round robin strategy for better results in most contexts. Make sure the load balancer is accessible
through an IP address that is available to all machines on your network.

Make sure your load balancer routes these TCP ports:

<table><caption>Table 1. TCP Port Routing Requirements</caption> <colgroup><col> <col> <col></colgroup><thead><tr><th>Load Balancer Port</th><th>Instance Port</th><th>Internal Usage</th></tr></thead><tbody><tr><td><p><code>80</code></p></td><td><p><code>30080</code></p></td><td><p>HTTP redirects to HTTPs</p></td></tr><tr><td><p><code>443</code></p></td><td><p><code>30443</code></p></td><td><p>HTTPS port</p></td></tr><tr><td><p><code>8083</code></p></td><td><p><code>30883</code></p></td><td><p>HTTPS port for Mule runtimes to authenticate and renew certificates</p></td></tr><tr><td><p><code>8889</code></p></td><td><p><code>30889</code></p></td><td><p>WebSocket port for Mule runtimes to connect</p></td></tr></tbody></table>

In each case, configure your load balancer to listen on the load balancer port and redirect incoming
requests to the instance port. Your Anypoint Platform PCE installation includes an internal NGINX
server that listens on each of the configured instance ports, and then performs the action listed in
the Internal Usage column.

Make sure your load balancer polls the address `HTTP:10256/healthz` to run a health check on your
platform servers and confirm that they are accessible.

> [!NOTE] Don’t configure SSL certificates in your load balancer. The platform handles the TLS
> termination with the certificates configured using Access Management. See
> [Configure Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/4.2/config-workflow).

For more information, see the provider specific requirements:

- [Amazon EKS](https://docs.aws.amazon.com/eks/latest/userguide/create-cluster.html)

  AWS EKS is only tested with default networking add-ons.

- [Rancher Kubernetes Engine (RKE2) - Hardware](https://docs.rke2.io/install/requirements#hardware)

- [Red Hat OpenShift](https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/installation_overview/ocp-installation-overview)

- [vSphere Kubernetes Service (VKS)](https://techdocs.broadcom.com/us/en/vmware-cis/vcf/vsphere-supervisor-services-and-standalone-components/latest/managing-vsphere-kubernetes-service/running-tkg-service-clusters/tkg-service-components.html)

## Software Requirements

These are the requirements:

- Operating system: RHEL 8.10, 9.4, 9.6

For more information, see the provider specific requirements:

- [Amazon EKS](https://docs.aws.amazon.com/eks/latest/userguide/create-cluster.html)

- [Rancher Kubernetes Engine (RKE2) - Software](https://docs.rke2.io/install/requirements#operating-systems)

- [Red Hat OpenShift](https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/installation_overview/ocp-installation-overview)

## Networking Requirements

Use these ports to communicate with Anypoint Platform PCE:

<table><colgroup><col> <col> <col> <col> <col></colgroup><thead><tr><th>Protocol</th><th>Port / Range</th><th>Purpose</th><th>Source</th><th>Destination</th></tr></thead><tbody><tr><td><p>TCP/UDP</p></td><td><p>53</p></td><td><p>Internal cluster DNS</p></td><td><p>localhost</p></td><td><p>localhost</p></td></tr><tr><td><p>TCP</p></td><td><p>2379, 2380, 4001, 7001</p></td><td><p>etcd distributed database</p></td><td><p>Anypoint Platform PCE nodes</p></td><td><p>Anypoint Platform PCE nodes</p></td></tr><tr><td><p>TCP</p></td><td><p>4242</p></td><td><p>Installer</p></td><td><p>Anypoint Platform PCE nodes</p></td><td><p>Anypoint Platform PCE nodes</p></td></tr><tr><td><p>TCP</p></td><td><p>6443</p></td><td><p>Kubernetes API Server</p></td><td><p>Anypoint Platform PCE nodes</p></td><td><p>Anypoint Platform PCE nodes</p></td></tr><tr><td><p>TCP</p></td><td><p>9443</p></td><td><p>HAProxy to load balance Kubernetes API Server</p></td><td><p>Anypoint Platform PCE nodes</p></td><td><p>Anypoint Platform PCE nodes</p></td></tr><tr><td><p>TCP</p></td><td><p>9100</p></td><td><p>Prometheus node-exporter</p></td><td><p>Anypoint Platform PCE nodes</p></td><td><p>Anypoint Platform PCE nodes</p></td></tr><tr><td><p>TCP</p></td><td><p>10248, 10250</p></td><td><p>Kubernetes Kubelet</p></td><td><p>Anypoint Platform PCE nodes</p></td><td><p>Anypoint Platform PCE nodes</p></td></tr><tr><td><p>TCP</p></td><td><p>10249</p></td><td><p>Kubernetes kube-proxy</p></td><td><p>localhost</p></td><td><p>localhost</p></td></tr><tr><td><p>TCP</p></td><td><p>10251-10252</p></td><td><p>Kubernetes controller-manager and scheduler</p></td><td><p>Anypoint Platform PCE nodes</p></td><td><p>Anypoint Platform PCE nodes</p></td></tr><tr><td><p>TCP</p></td><td><p>10257-10259</p></td><td><p>Kubernetes controller-manager and scheduler (secure)</p></td><td><p>Anypoint Platform PCE nodes</p></td><td><p>Anypoint Platform PCE nodes</p></td></tr><tr><td><p>TCP</p></td><td><p>30000-32767</p></td><td><p>Internal services port range</p></td><td><p>Anypoint Platform PCE nodes</p></td><td><p>Anypoint Platform PCE nodes</p></td></tr><tr><td><p>TCP</p></td><td><p>8472</p></td><td><p>Overlay VXLAN network</p></td><td><p>Anypoint Platform PCE nodes</p></td><td><p>Anypoint Platform PCE nodes</p></td></tr><tr><td><p>TCP</p></td><td><p>30080</p></td><td><p>HTTP public access</p></td><td><p>Load balancer</p></td><td><p>Anypoint Platform PCE nodes</p></td></tr><tr><td><p>TCP</p></td><td><p>30443</p></td><td><p>HTTPS public access</p></td><td><p>Load balancer</p></td><td><p>Anypoint Platform PCE nodes</p></td></tr><tr><td><p>TCP</p></td><td><p>30889</p></td><td><p>Mule Runtime Websocket</p></td><td><p>Load balancer</p></td><td><p>Anypoint Platform PCE nodes</p></td></tr><tr><td><p>TCP</p></td><td><p>30883</p></td><td><p>Mule Runtime Authentication Service (for certificate renewals)</p></td><td><p>Load balancer</p></td><td><p>Anypoint Platform PCE nodes</p></td></tr></tbody></table>

Anypoint Platform PCE nodes need to hit the platform API address on the load balancer via HTTPS.

For more information, see the provider specific requirements:

- [Amazon EKS - Networking](https://docs.aws.amazon.com/eks/latest/userguide/eks-networking.html)

- [Rancher Kubernetes Engine (RKE2) - Networking](https://docs.rke2.io/install/requirements#operating-systems)

- [Red Hat OpenShift - Networking](https://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/networking/understanding-networking)

## NFS Storage Requirements

A pre-installed Container Storage Interface (CSI) driver in the Kubernetes cluster is a mandatory
requirement for Anypoint Platform PCE 4.2.0. Anypoint Platform PCE uses the CSI driver to mount NFS
volumes into pods.

For detailed configuration instructions, including EFS-specific volume handle setup and NFS mount
option overrides, see [NFS Server Prerequisites](https://docs.mulesoft.com/private-cloud/4.2/verify-nfs).

## Container Registry Requirements

These are the requirements:

- Must be secured over TLS.

- Must be accessible from installer nodes and Kubernetes clusters.

- Must be secured with either a username and password, or Certificate-based authentication. Make
  sure that the new or updated certificates are distributed to all nodes to facilitate uninterrupted
  TLS communication.

## Installer Node Requirements

These are the requirements:

- Operating system: RHEL, Ubuntu, or any Linux-based systems.

- Storage required a minimum 100GB.

- Access to Kubernetes cluster using kubeconfig.yaml

  - The cluster needs `cluster:admin` access, as Anypoint Platform PCE installer needs to create
    resources of different types.

  - The cluster needs `read/write` access in the pce-core namespace to run Anypoint Platform PCE
    installer jobs and other supporting services.

- Access and connectivity to private container registry

- For OpenShift use SecurityContextConstraints for installing Anypoint Platform PCE.

Before executing the `pcectl` binary for Anypoint Platform PCE 4.2, make sure that you follow these
requirements:

- Use a Linux based operating system

- Use glibc (GNU C library) version 2.28 or higher  
  To check the glibc version, run this command:

  ldd --version

- Use Python version 3.12 or newer  
  To check your Python version, run this command:

  python --version

- Use gpg (GnuPG) version 2.1 or higher  
  To check your gpg version, run this command:

  gpg --version

## Storage Requirements

These are the requirements:

In Anypoint Platform PCE version 4.2 and later, all the persistent data is stored in the Persistent
Volume Claims (PVCs). Kubernetes Storage Class commands the PVCs.

These services use PVCs with minimum and default storage size:

- SeaweedFS - S3 Object Store service - Total 120Gi

- Stolon - PostgreSQL HA database - Total 100 Gi

- Prometheus - TSDB for k8s metrics (optional) - Default 50Gi

The storage class for the previous services can be the same. Depending on the type of underlying
infrastructure or storage solution you select, the storage class configuration can vary.

You can update the PVC storage size during the installation by updating the `input.yaml` file. See
these sections to update the storage size:

```json
# Storage class configuration for persistent data services
storageConfiguration:
 pceobjectstore:
   type: "persistentVolumeClaim"
   storageClass: "<storage-class-name>"
   controlPlaneSize: "20Gi" # Optional. Defaults to 10Gi
   volumeSize: "200Gi" # Optional. Defaults to 100Gi
   volumeIndexSize: "20Gi" # Optional. Defaults to 10Gi
 stolon:
   type: "persistentVolumeClaim"
   storageClass: "<storage-class-name>"
   size: "300Gi" # Optional. Defaults to 100Gi
```

In the previous example, you can see the storage for SeaweedFS that is Object Store has increased to
240GiB and stolon has increased to 300 Gi.

Similarly, to set the storage size for monitoring stack, use this configuration:

```json
# Configuration options for monitoring stack
monitoringAppConfiguration:
 monitoringStack:
   enabled:  True # Defaults to True. Must be set to False for Openshift clusters.
   values: | # Optional. If not provided, the default values will be used.
      prometheus:
        prometheusSpec:
          storageSpec:
            volumeClaimTemplate:
              spec:
                storageClassName: 'local-path',
                accessModes: ["ReadWriteOnce"]
                resources:
                  requests:
                    storage: 50Gi
```

## Platform Configuration

To make Anypoint Platform PCE accessible, configure these specifications in the input configuration
file before installing Anypoint Platform PCE:

- Platform DNS

- File System DNS

- First User Account details

  - Org Name

  - Username

  - Email

  - Password

- Platform certificate and certificate key with the Subject Alternative Name (SAN) of the platform
  DNS.

## See Also

- [Installing or Upgrading Anypoint Platform Private Cloud Edition (Anypoint Platform PCE)](https://docs.mulesoft.com/private-cloud/4.2/install-workflow)

<!-- document id=cc7ffc60ae80a618784aa638d6ee20455208ce94586521bc136457c9e3995d1c url=/mulesoft/current/en-us/private-cloud/latest/install-checklist.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.3
is-latest-version: true
---

# Anypoint Platform PCE Prerequisites

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

You can install Anypoint Platform Private Cloud Edition (Anypoint Platform PCE) version 4.x and
later in the Kubernetes (K8s) cluster that you provision and manage.

MuleSoft performed installations on popular K8s providers, which are listed in the following
sections. The hardware and software requirements for installing Anypoint Platform PCE on your chosen
provider are dictated by that provider, unless otherwise specified in this document.

Before you begin, make sure that your organization’s operations, networking, and security teams
review the listed infrastructure prerequisites. These include the K8s cluster, hardware, software,
networking, shared filesystem, container registry, installer node, and storage requirements.

> [!NOTE] Contact MuleSoft Professional Services prior to installing Anypoint Platform PCE, as they
> are involved with your installation.
>
> Installing Anypoint Platform PCE requires specific versions of operating systems, shared
> filesystem components, and other software. Most issues experienced with Anypoint Platform PCE
> occur because the required environment was not set up prior to installing or upgrading.

## Kubernetes Cluster Requirements

- Supported Kubernetes providers:

  - Amazon EKS

  - Rancher Kubernetes Engine (RKE2)

  - Red Hat OpenShift

  - vSphere Kubernetes Service (VKS)

- Cluster configurations:

  - Run Kubernetes control plane components on dedicated nodes. Preferably, allocate three nodes for
    the Kubernetes control plane.

  - Have cluster worker nodes exclusively dedicated to Anypoint Platform PCE workloads. Don’t run
    any Anypoint Platform PCE pods on the K8s control plane nodes. Check the prerequisites to make
    sure that PCE workloads can be scheduled and run on worker nodes.

> [!NOTE] Running Anypoint Platform PCE workloads on K8s control plane nodes can degrade both
> Anypoint Platform PCE and cluster performance.

## Hardware Requirements

Anypoint Platform PCE runs as a Kubernetes application and these are the minimum required hardware
for all services to be scheduled and running:

- 32 vCPUs

- 128 GiB Memory

- x86\_64 Architecture

You can provision and distribute these resources across a minimum of four worker nodes. PCE requires
at least three worker nodes as hosts for data services that are deployed and configured in a cluster
setup with three replicas. Make sure these three replicas run on three separate nodes to honor the
anti-affinity rules.

### Sample Worker Node Configurations

Anypoint Platform PCE offers flexibility in how you configure your Kubernetes worker nodes. You can
use different numbers of worker nodes (for example, 4, 5, 8, or 10 nodes) with varying resource
allocations per node. The key requirement is that your cluster’s total resources meet or exceed the
minimum requirements of 32 vCPUs and 128 GiB memory.

This table shows sample worker node configurations that MuleSoft’s performance teams tested and
validated:

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Number of Worker Nodes</th><th>Node Composition</th><th>Total Resources</th></tr></thead><tbody><tr><td><p>4</p></td><td><p>8 vCPU and 32 GiB memory</p></td><td><p>32 vCPU and 128 GiB memory</p></td></tr><tr><td><p>10</p></td><td><p>4 vCPU and 16 GiB memory</p></td><td><p>40 vCPU and 160 GiB memory</p></td></tr></tbody></table>

> [!NOTE] These configurations are reference examples to help you understand how Anypoint Platform
> PCE can work with different worker node configurations. They are not strict requirements. You can
> customize your cluster configuration based on your infrastructure and operational needs, as long
> as the total resource requirements are met.

### Load Balancer Configuration

You can configure your load balancer to use any method for distributing client requests. Use a a
round robin strategy for better results in most contexts. Make sure the load balancer is accessible
through an IP address that is available to all machines on your network.

Make sure your load balancer routes these TCP ports:

<table><caption>Table 1. TCP Port Routing Requirements</caption> <colgroup><col> <col> <col></colgroup><thead><tr><th>Load Balancer Port</th><th>Instance Port</th><th>Internal Usage</th></tr></thead><tbody><tr><td><p><code>80</code></p></td><td><p><code>30080</code></p></td><td><p>HTTP redirects to HTTPs</p></td></tr><tr><td><p><code>443</code></p></td><td><p><code>30443</code></p></td><td><p>HTTPS port</p></td></tr><tr><td><p><code>8083</code></p></td><td><p><code>30883</code></p></td><td><p>HTTPS port for Mule runtimes to authenticate and renew certificates</p></td></tr><tr><td><p><code>8889</code></p></td><td><p><code>30889</code></p></td><td><p>WebSocket port for Mule runtimes to connect</p></td></tr></tbody></table>

In each case, configure your load balancer to listen on the load balancer port and redirect incoming
requests to the instance port. Your Anypoint Platform PCE installation includes an internal NGINX
server that listens on each of the configured instance ports, and then performs the action listed in
the Internal Usage column.

Make sure your load balancer polls the address `HTTP:10256/healthz` to run a health check on your
platform servers and confirm that they are accessible.

> [!NOTE] Don’t configure SSL certificates in your load balancer. The platform handles the TLS
> termination with the certificates configured using Access Management. See
> [Configure Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/latest/config-workflow).

For more information, see the provider specific requirements:

- [Amazon EKS](https://docs.aws.amazon.com/eks/latest/userguide/create-cluster.html)

  AWS EKS is only tested with default networking add-ons.

- [Rancher Kubernetes Engine (RKE2) - Hardware](https://docs.rke2.io/install/requirements#hardware)

- [Red Hat OpenShift](https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html/installation_overview/ocp-installation-overview)

- [vSphere Kubernetes Service (VKS)](https://techdocs.broadcom.com/us/en/vmware-cis/vcf/vsphere-supervisor-services-and-standalone-components/latest/managing-vsphere-kubernetes-service/running-tkg-service-clusters/tkg-service-components.html)

## Software Requirements

Provider specific node OS requirements:

- [Amazon EKS](https://docs.aws.amazon.com/eks/latest/userguide/create-cluster.html)

- [Rancher Kubernetes Engine (RKE2) - Software](https://docs.rke2.io/install/requirements#operating-systems)

  Validated against RHEL 9.6 and Kubernetes 1.34.

- [Red Hat OpenShift](https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html/installation_overview/ocp-installation-overview)

  Validated against Red Hat Enterprise Linux CoreOS (RHCOS) 9.6 and OpenShift 4.21.

## Networking Requirements

Use these ports to communicate with Anypoint Platform PCE:

<table><colgroup><col> <col> <col> <col> <col></colgroup><thead><tr><th>Protocol</th><th>Port / Range</th><th>Purpose</th><th>Source</th><th>Destination</th></tr></thead><tbody><tr><td><p>TCP</p></td><td><p>30080</p></td><td><p>HTTP public access</p></td><td><p>Load balancer</p></td><td><p>Anypoint Platform PCE nodes</p></td></tr><tr><td><p>TCP</p></td><td><p>30443</p></td><td><p>HTTPS public access</p></td><td><p>Load balancer</p></td><td><p>Anypoint Platform PCE nodes</p></td></tr><tr><td><p>TCP</p></td><td><p>30889</p></td><td><p>Mule Runtime Websocket</p></td><td><p>Load balancer</p></td><td><p>Anypoint Platform PCE nodes</p></td></tr><tr><td><p>TCP</p></td><td><p>30883</p></td><td><p>Mule Runtime Authentication Service (for certificate renewals)</p></td><td><p>Load balancer</p></td><td><p>Anypoint Platform PCE nodes</p></td></tr></tbody></table>

Anypoint Platform PCE nodes need to hit the platform API address on the load balancer via HTTPS.

For more information, see the provider specific requirements:

- [Amazon EKS - Networking](https://docs.aws.amazon.com/eks/latest/userguide/eks-networking.html)

- [Rancher Kubernetes Engine (RKE2) - Networking](https://docs.rke2.io/install/requirements#operating-systems)

- [Red Hat OpenShift - Networking](https://docs.redhat.com/en/documentation/openshift_container_platform/4.21/html/networking_overview/understanding-networking)

## Shared Filesystem Requirements

Anypoint Platform PCE requires a `ReadWriteMany` (RWX) shared filesystem. Starting with Anypoint
Platform PCE 4.3.0, you can provide this filesystem using either of the following storage modes:

- **NFS mode** — Bind the platform to an existing NFS server through a pre-installed Container
  Storage Interface (CSI) driver in the Kubernetes cluster. This is the only supported mode in
  versions before 4.3.0.

- **StorageClass mode** — Provide a single RWX-capable Kubernetes `StorageClass` (for example,
  backed by CephFS) and let Anypoint Platform PCE dynamically provision the shared volumes. This
  mode removes the requirement to operate an external NFS server.

In StorageClass mode, Anypoint Platform PCE requests these persistent volumes:

- Design Center: 2 PVCs, 300 GiB each

- Backup and restore: 1 PVC, 1 TiB

The two modes are mutually exclusive. You cannot change the storage mode on an existing cluster. The
installer rejects an in-place upgrade from NFS mode to StorageClass mode so that data on the
previous volumes is not orphaned. Switching the NFS CSI driver during an upgrade does not require
additional storage changes.

For detailed configuration instructions, including CSI driver setup, EFS-specific volume handle
setup, NFS mount option overrides, and `StorageClass` requirements, see
[Shared Filesystem Prerequisites](https://docs.mulesoft.com/private-cloud/latest/verify-nfs).

## Container Registry Requirements

These are the requirements:

- Must be secured over TLS.

- Must be accessible from installer nodes and Kubernetes clusters.

- Must be secured with either a username and password, or Certificate-based authentication. Make
  sure that the new or updated certificates are distributed to all nodes to facilitate uninterrupted
  TLS communication.

## Installer Node Requirements

These are the requirements:

- Operating system: RHEL, Ubuntu, or any Linux-based systems.

- Storage required a minimum 100GB.

- Access to Kubernetes cluster using kubeconfig.yaml

  - The cluster needs `cluster:admin` access, as Anypoint Platform PCE installer needs to create
    resources of different types.

  - The cluster needs `read/write` access in the pce-core namespace to run Anypoint Platform PCE
    installer jobs and other supporting services.

- Access and connectivity to private container registry

- For OpenShift use SecurityContextConstraints for installing Anypoint Platform PCE.

Before executing the `pcectl` binary for Anypoint Platform PCE 4.2, make sure that you follow these
requirements:

- Use a Linux based operating system

- Use glibc (GNU C library) version 2.28 or higher  
  To check the glibc version, run this command:

  ldd --version

- Use Python version 3.12 or newer  
  To check your Python version, run this command:

  python --version

- Use gpg (GnuPG) version 2.1 or higher  
  To check your gpg version, run this command:

  gpg --version

## Storage Requirements

These are the requirements:

In Anypoint Platform PCE version 4.2 and later, all the persistent data is stored in the Persistent
Volume Claims (PVCs). Kubernetes Storage Class commands the PVCs.

These services use PVCs with minimum and default storage size:

- SeaweedFS - S3 Object Store service - Total 120Gi

- Stolon - PostgreSQL HA database - Total 100 Gi

- Prometheus - TSDB for k8s metrics (optional) - Default 50Gi

The storage class for the previous services can be the same. Depending on the type of underlying
infrastructure or storage solution you select, the storage class configuration can vary.

You can update the PVC storage size during the installation by updating the `input.yaml` file. See
these sections to update the storage size:

```json
# Storage class configuration for persistent data services
storageConfiguration:
 pceobjectstore:
   type: "persistentVolumeClaim"
   storageClass: "<storage-class-name>"
   controlPlaneSize: "20Gi" # Optional. Defaults to 10Gi
   volumeSize: "200Gi" # Optional. Defaults to 100Gi
   volumeIndexSize: "20Gi" # Optional. Defaults to 10Gi
 stolon:
   type: "persistentVolumeClaim"
   storageClass: "<storage-class-name>"
   size: "300Gi" # Optional. Defaults to 100Gi
```

In the previous example, you can see the storage for SeaweedFS that is Object Store has increased to
240GiB and stolon has increased to 300 Gi.

Similarly, to set the storage size for monitoring stack, use this configuration:

```json
# Configuration options for monitoring stack
monitoringAppConfiguration:
 monitoringStack:
   enabled:  True # Defaults to True. Must be set to False for Openshift clusters.
   values: | # Optional. If not provided, the default values will be used.
      prometheus:
        prometheusSpec:
          storageSpec:
            volumeClaimTemplate:
              spec:
                storageClassName: 'local-path',
                accessModes: ["ReadWriteOnce"]
                resources:
                  requests:
                    storage: 50Gi
```

## Platform Configuration

To make Anypoint Platform PCE accessible, configure these specifications in the input configuration
file before installing Anypoint Platform PCE:

- Platform DNS

- File System DNS

- First User Account details

  - Org Name

  - Username

  - Email

  - Password

- Platform certificate and certificate key with the Subject Alternative Name (SAN) of the platform
  DNS.

## See Also

- [Installing or Upgrading Anypoint Platform Private Cloud Edition (Anypoint Platform PCE)](https://docs.mulesoft.com/private-cloud/latest/install-workflow)

<!-- document id=6639b637410257d147003aab903336db0ecb6cfe7e9f4649c7b8f77e929ff197 url=/mulesoft/current/en-us/private-cloud/3.2/pce-release-notes.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 3.2
---

# Anypoint Platform Private Cloud Edition Release Notes

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

- [Anypoint Platform Private Cloud Edition 4.3.0 Release Notes](https://docs.mulesoft.com/release-notes/pce/anypoint-private-cloud-4.3.0-release-notes)

- [Anypoint Platform Private Cloud Edition 4.2.1 Release Notes](https://docs.mulesoft.com/release-notes/pce/anypoint-private-cloud-4.2.1-release-notes)

- [Anypoint Platform Private Cloud Edition 4.2.0 Release Notes](https://docs.mulesoft.com/release-notes/pce/anypoint-private-cloud-4.2.0-release-notes)

- [Anypoint Platform Private Cloud Edition 4.1.3 Release Notes](https://docs.mulesoft.com/release-notes/pce/anypoint-private-cloud-4.1.3-release-notes)

- [Anypoint Platform Private Cloud Edition 4.1.2 Release Notes](https://docs.mulesoft.com/release-notes/pce/anypoint-private-cloud-4.1.2-release-notes)

- [Anypoint Platform Private Cloud Edition 4.1.0 Release Notes](https://docs.mulesoft.com/release-notes/pce/anypoint-private-cloud-4.1.0-release-notes)

- [Anypoint Platform Private Cloud Edition 4.0.0 Release Notes](https://docs.mulesoft.com/release-notes/pce/anypoint-private-cloud-4.0.0-release-notes)

- [Anypoint Platform Private Cloud Edition 3.2.5 Release Notes](https://docs.mulesoft.com/release-notes/pce/anypoint-private-cloud-3.2.5-release-notes)

- [Anypoint Platform Private Cloud Edition 3.2.4 Release Notes](https://docs.mulesoft.com/release-notes/pce/anypoint-private-cloud-3.2.4-release-notes)

- [Anypoint Platform Private Cloud Edition 3.2.3 Release Notes](https://docs.mulesoft.com/release-notes/pce/anypoint-private-cloud-3.2.3-release-notes)

- [Anypoint Platform Private Cloud Edition 3.2.2 Release Notes](https://docs.mulesoft.com/release-notes/pce/anypoint-private-cloud-3.2.2-release-notes)

- [Anypoint Platform Private Cloud Edition 3.2.1 Release Notes](https://docs.mulesoft.com/release-notes/pce/anypoint-private-cloud-3.2.1-release-notes)

- [Anypoint Platform Private Cloud Edition 3.2.0 Release Notes](https://docs.mulesoft.com/release-notes/pce/anypoint-private-cloud-3.2.0-release-notes)

## See Also

- [Known Issues](https://help.salesforce.com/s/issues)

<!-- document id=b4d8bcdc76fade680c4b1f7438dd22ff95f231b930748547d13c1d3c73685438 url=/mulesoft/current/en-us/private-cloud/4.0/pce-release-notes.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.0
---

# Anypoint Platform Private Cloud Edition Release Notes

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

- [Anypoint Platform Private Cloud Edition 4.3.0 Release Notes](https://docs.mulesoft.com/release-notes/pce/anypoint-private-cloud-4.3.0-release-notes)

- [Anypoint Platform Private Cloud Edition 4.2.1 Release Notes](https://docs.mulesoft.com/release-notes/pce/anypoint-private-cloud-4.2.1-release-notes)

- [Anypoint Platform Private Cloud Edition 4.2.0 Release Notes](https://docs.mulesoft.com/release-notes/pce/anypoint-private-cloud-4.2.0-release-notes)

- [Anypoint Platform Private Cloud Edition 4.1.3 Release Notes](https://docs.mulesoft.com/release-notes/pce/anypoint-private-cloud-4.1.3-release-notes)

- [Anypoint Platform Private Cloud Edition 4.1.2 Release Notes](https://docs.mulesoft.com/release-notes/pce/anypoint-private-cloud-4.1.2-release-notes)

- [Anypoint Platform Private Cloud Edition 4.1.0 Release Notes](https://docs.mulesoft.com/release-notes/pce/anypoint-private-cloud-4.1.0-release-notes)

- [Anypoint Platform Private Cloud Edition 4.0.0 Release Notes](https://docs.mulesoft.com/release-notes/pce/anypoint-private-cloud-4.0.0-release-notes)

- [Anypoint Platform Private Cloud Edition 3.2.5 Release Notes](https://docs.mulesoft.com/release-notes/pce/anypoint-private-cloud-3.2.5-release-notes)

- [Anypoint Platform Private Cloud Edition 3.2.4 Release Notes](https://docs.mulesoft.com/release-notes/pce/anypoint-private-cloud-3.2.4-release-notes)

- [Anypoint Platform Private Cloud Edition 3.2.3 Release Notes](https://docs.mulesoft.com/release-notes/pce/anypoint-private-cloud-3.2.3-release-notes)

- [Anypoint Platform Private Cloud Edition 3.2.2 Release Notes](https://docs.mulesoft.com/release-notes/pce/anypoint-private-cloud-3.2.2-release-notes)

- [Anypoint Platform Private Cloud Edition 3.2.1 Release Notes](https://docs.mulesoft.com/release-notes/pce/anypoint-private-cloud-3.2.1-release-notes)

- [Anypoint Platform Private Cloud Edition 3.2.0 Release Notes](https://docs.mulesoft.com/release-notes/pce/anypoint-private-cloud-3.2.0-release-notes)

## See Also

- [Known Issues](https://help.salesforce.com/s/issues)

<!-- document id=7f21cf10038e2379564494a97885f46ddc26312980700a1cb8dd075a2b312b57 url=/mulesoft/current/en-us/private-cloud/4.1/pce-release-notes.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.1
---

# Anypoint Platform Private Cloud Edition Release Notes

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

- [Anypoint Platform Private Cloud Edition 4.3.0 Release Notes](https://docs.mulesoft.com/release-notes/pce/anypoint-private-cloud-4.3.0-release-notes)

- [Anypoint Platform Private Cloud Edition 4.2.1 Release Notes](https://docs.mulesoft.com/release-notes/pce/anypoint-private-cloud-4.2.1-release-notes)

- [Anypoint Platform Private Cloud Edition 4.2.0 Release Notes](https://docs.mulesoft.com/release-notes/pce/anypoint-private-cloud-4.2.0-release-notes)

- [Anypoint Platform Private Cloud Edition 4.1.3 Release Notes](https://docs.mulesoft.com/release-notes/pce/anypoint-private-cloud-4.1.3-release-notes)

- [Anypoint Platform Private Cloud Edition 4.1.2 Release Notes](https://docs.mulesoft.com/release-notes/pce/anypoint-private-cloud-4.1.2-release-notes)

- [Anypoint Platform Private Cloud Edition 4.1.0 Release Notes](https://docs.mulesoft.com/release-notes/pce/anypoint-private-cloud-4.1.0-release-notes)

- [Anypoint Platform Private Cloud Edition 4.0.0 Release Notes](https://docs.mulesoft.com/release-notes/pce/anypoint-private-cloud-4.0.0-release-notes)

- [Anypoint Platform Private Cloud Edition 3.2.5 Release Notes](https://docs.mulesoft.com/release-notes/pce/anypoint-private-cloud-3.2.5-release-notes)

- [Anypoint Platform Private Cloud Edition 3.2.4 Release Notes](https://docs.mulesoft.com/release-notes/pce/anypoint-private-cloud-3.2.4-release-notes)

- [Anypoint Platform Private Cloud Edition 3.2.3 Release Notes](https://docs.mulesoft.com/release-notes/pce/anypoint-private-cloud-3.2.3-release-notes)

- [Anypoint Platform Private Cloud Edition 3.2.2 Release Notes](https://docs.mulesoft.com/release-notes/pce/anypoint-private-cloud-3.2.2-release-notes)

- [Anypoint Platform Private Cloud Edition 3.2.1 Release Notes](https://docs.mulesoft.com/release-notes/pce/anypoint-private-cloud-3.2.1-release-notes)

- [Anypoint Platform Private Cloud Edition 3.2.0 Release Notes](https://docs.mulesoft.com/release-notes/pce/anypoint-private-cloud-3.2.0-release-notes)

## See Also

- [Known Issues](https://help.salesforce.com/s/issues)

<!-- document id=93a37afa02d03b8be59a6b85953fbb81e486407ec6c7df16fe3d5a2cd8bfbd73 url=/mulesoft/current/en-us/private-cloud/4.2/pce-release-notes.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.2
---

# Anypoint Platform Private Cloud Edition Release Notes

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

- [Anypoint Platform Private Cloud Edition 4.3.0 Release Notes](https://docs.mulesoft.com/release-notes/pce/anypoint-private-cloud-4.3.0-release-notes)

- [Anypoint Platform Private Cloud Edition 4.2.1 Release Notes](https://docs.mulesoft.com/release-notes/pce/anypoint-private-cloud-4.2.1-release-notes)

- [Anypoint Platform Private Cloud Edition 4.2.0 Release Notes](https://docs.mulesoft.com/release-notes/pce/anypoint-private-cloud-4.2.0-release-notes)

- [Anypoint Platform Private Cloud Edition 4.1.3 Release Notes](https://docs.mulesoft.com/release-notes/pce/anypoint-private-cloud-4.1.3-release-notes)

- [Anypoint Platform Private Cloud Edition 4.1.2 Release Notes](https://docs.mulesoft.com/release-notes/pce/anypoint-private-cloud-4.1.2-release-notes)

- [Anypoint Platform Private Cloud Edition 4.1.0 Release Notes](https://docs.mulesoft.com/release-notes/pce/anypoint-private-cloud-4.1.0-release-notes)

- [Anypoint Platform Private Cloud Edition 4.0.0 Release Notes](https://docs.mulesoft.com/release-notes/pce/anypoint-private-cloud-4.0.0-release-notes)

- [Anypoint Platform Private Cloud Edition 3.2.5 Release Notes](https://docs.mulesoft.com/release-notes/pce/anypoint-private-cloud-3.2.5-release-notes)

- [Anypoint Platform Private Cloud Edition 3.2.4 Release Notes](https://docs.mulesoft.com/release-notes/pce/anypoint-private-cloud-3.2.4-release-notes)

- [Anypoint Platform Private Cloud Edition 3.2.3 Release Notes](https://docs.mulesoft.com/release-notes/pce/anypoint-private-cloud-3.2.3-release-notes)

- [Anypoint Platform Private Cloud Edition 3.2.2 Release Notes](https://docs.mulesoft.com/release-notes/pce/anypoint-private-cloud-3.2.2-release-notes)

- [Anypoint Platform Private Cloud Edition 3.2.1 Release Notes](https://docs.mulesoft.com/release-notes/pce/anypoint-private-cloud-3.2.1-release-notes)

- [Anypoint Platform Private Cloud Edition 3.2.0 Release Notes](https://docs.mulesoft.com/release-notes/pce/anypoint-private-cloud-3.2.0-release-notes)

## See Also

- [Known Issues](https://help.salesforce.com/s/issues)

<!-- document id=8aa2a0a550ba50e0ba43911fa5d7a9e6e9b931da09140994a8ce81cd5a5cf85c url=/mulesoft/current/en-us/private-cloud/latest/pce-release-notes.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.3
is-latest-version: true
---

# Anypoint Platform Private Cloud Edition Release Notes

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

- [Anypoint Platform Private Cloud Edition 4.3.0 Release Notes](https://docs.mulesoft.com/release-notes/pce/anypoint-private-cloud-4.3.0-release-notes)

- [Anypoint Platform Private Cloud Edition 4.2.1 Release Notes](https://docs.mulesoft.com/release-notes/pce/anypoint-private-cloud-4.2.1-release-notes)

- [Anypoint Platform Private Cloud Edition 4.2.0 Release Notes](https://docs.mulesoft.com/release-notes/pce/anypoint-private-cloud-4.2.0-release-notes)

- [Anypoint Platform Private Cloud Edition 4.1.3 Release Notes](https://docs.mulesoft.com/release-notes/pce/anypoint-private-cloud-4.1.3-release-notes)

- [Anypoint Platform Private Cloud Edition 4.1.2 Release Notes](https://docs.mulesoft.com/release-notes/pce/anypoint-private-cloud-4.1.2-release-notes)

- [Anypoint Platform Private Cloud Edition 4.1.0 Release Notes](https://docs.mulesoft.com/release-notes/pce/anypoint-private-cloud-4.1.0-release-notes)

- [Anypoint Platform Private Cloud Edition 4.0.0 Release Notes](https://docs.mulesoft.com/release-notes/pce/anypoint-private-cloud-4.0.0-release-notes)

- [Anypoint Platform Private Cloud Edition 3.2.5 Release Notes](https://docs.mulesoft.com/release-notes/pce/anypoint-private-cloud-3.2.5-release-notes)

- [Anypoint Platform Private Cloud Edition 3.2.4 Release Notes](https://docs.mulesoft.com/release-notes/pce/anypoint-private-cloud-3.2.4-release-notes)

- [Anypoint Platform Private Cloud Edition 3.2.3 Release Notes](https://docs.mulesoft.com/release-notes/pce/anypoint-private-cloud-3.2.3-release-notes)

- [Anypoint Platform Private Cloud Edition 3.2.2 Release Notes](https://docs.mulesoft.com/release-notes/pce/anypoint-private-cloud-3.2.2-release-notes)

- [Anypoint Platform Private Cloud Edition 3.2.1 Release Notes](https://docs.mulesoft.com/release-notes/pce/anypoint-private-cloud-3.2.1-release-notes)

- [Anypoint Platform Private Cloud Edition 3.2.0 Release Notes](https://docs.mulesoft.com/release-notes/pce/anypoint-private-cloud-3.2.0-release-notes)

## See Also

- [Known Issues](https://help.salesforce.com/s/issues)

<!-- document id=546edeaf907cd7c02eeac454d517398ac8bfa3fbcf4150396d271c3c8b793865 url=/mulesoft/current/en-us/private-cloud/3.2/prereq-aws-terraform.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 3.2
---

# AWS Prerequisites

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

If you are using Amazon Web Services (AWS), you must create the resources required to install
Anypoint Platform Private Cloud Edition (Anypoint Platform PCE) on AWS. Anypoint Platform PCE
supports 4-node and 7-node configurations in a production environment on AWS.

You do not need this information if you are starting from bare metal servers.

> [!IMPORTANT] Your infrastructure team, or someone with AWS administrator level knowledge, must
> perform the following tasks. If needed, contact your MuleSoft representative for help.

## AWS Account Permissions and Resources

To install Anypoint Platform PCE on AWS:

- Your AWS account must have AWS keys with `EC2FullAccess` and `S3FullAccess` permissions.

- When you create your AWS environment, the following resources are created:

  <table><caption>Table 1. AWS-Created Resources</caption> <colgroup><col> <col> <col> <col></colgroup><thead><tr><th>AWS Resource</th><th>Number Required (4-node)</th><th>Number Required (7-node)</th><th>Anypoint Monitoring (Optional)</th></tr></thead><tbody><tr><td><p>m5.8xlarge</p></td><td><p>0</p></td><td><p>0</p></td><td><p>3</p></td></tr><tr><td><p>m5.2xlarge</p></td><td><p>4</p></td><td><p>7</p></td><td><p>0</p></td></tr><tr><td><p>root disk @ 500 iops</p></td><td><p>4</p></td><td><p>7</p></td><td><p>3</p></td></tr><tr><td><p>EBS volumes @ 1500 iops</p></td><td><p>8</p></td><td><p>14</p></td><td><p>12</p></td></tr><tr><td><p>EBS volume @ 3000 iops</p></td><td><p>8</p></td><td><p>14</p></td><td><p>0</p></td></tr><tr><td><p>Amazon ELB</p></td><td><p>1</p></td><td><p>1</p></td><td><p>0</p></td></tr><tr><td><p>t2.medium</p></td><td><p>1</p></td><td><p>1</p></td><td><p>0</p></td></tr></tbody></table>

## Run the AWS Provisioner

MuleSoft provides a Docker image that you can use to provision the resources for your AWS account.
You can also run additional custom shell scripts on the provisioned instances as shown in the Custom
provisioning scripts section.

1.  Create an initial instance (t2.small) on your AWS account on any VPC with internet access.

    This instance runs the actual provisioning of the cluster. You must use an AMI that has Docker
    installed by default or you must manually install Docker after creating the AWS instance.

    You can also run provisioner remotely from any other machine with Docker and internet access.

2.  Download the Private Cloud Provisioner (PCP) Docker image from:

    `[https://anypoint-anywhere.s3.amazonaws.com/pcp/private-cloud-provisioner-3.1.14.tar.gz?Signature=jB4UiQgzsSSE3iyaPWYNJ67dCyM%3D&AWSAccessKeyId=AKIAI6LBJNQFR2V3CQWQ&Expires=1801445392](https://anypoint-anywhere.s3.amazonaws.com/pcp/private-cloud-provisioner-3.1.14.tar.gz?Signature=jB4UiQgzsSSE3iyaPWYNJ67dCyM%3D&AWSAccessKeyId=AKIAI6LBJNQFR2V3CQWQ&Expires=1801445392)`

3.  Copy the provisioner Docker image to the instance via SCP:

    scp -i <guest>.pem ~/Downloads/private-cloud-provisioner-3.1.14.tar.gz
    ec2-user@W.X.Y.Z:/home/ec2-user

4.  SSH into the instance:

    ssh -i 'anypoint.pem' ec2-user@W.X.Y.Z

5.  Create the variable file (pce.env) with the environment details using the following values:

    <table><caption>Table 2. Required Environment Variables</caption> <colgroup><col> <col></colgroup><thead><tr><th>Name</th><th>Description</th></tr></thead><tbody><tr><td><p>AWS_ACCESS_KEY_ID</p></td><td><p>Specifies the AWS access ID Terraform uses to connect to your AWS account.</p></td></tr><tr><td><p>AWS_SECRET_ACCESS_KEY</p></td><td><p>Specifies the AWS access key Terraform uses to connect to your AWS account.</p></td></tr><tr><td><p>AWS_SESSION_TOKEN</p></td><td><p>Specifies the AWS temporary session token, if one exists.</p></td></tr><tr><td><p>AWS_KEY_NAME</p></td><td><p>Specifies the AWS SSH key. Do not include the <code>.pem</code> extension.</p></td></tr><tr><td><p>AWS_REGION</p></td><td><p>Specifies the AWS region where Terraform creates the cluster, for example, <code>us-east-2</code>.</p></td></tr><tr><td><p>TF_VAR_ssh_user=&lt;SSH_USER&gt;</p></td><td><p>Specifies the ssh user, for example, <code>ec2-user</code>, <code>centos</code>, etc.</p></td></tr><tr><td><p>TF_VAR_trusted_cidrs_list</p></td><td><p>List of trusted CIDRs that can be accessed from the environment. Use <code>[0.0.0.0/0]</code> to open the cluster to the internet.</p></td></tr><tr><td><p>TELEKUBE_CLUSTER_NAME</p></td><td><p>Specifies the name of the cluster and the corresponding AWS resources.</p></td></tr><tr><td><p>TELEKUBE_NODE_PROFILES</p></td><td><p>Must be set to <code>node</code>.</p></td></tr><tr><td><p>TELEKUBE_NODE_PROFILE_COUNT_node</p></td><td><p>Specifies the number of nodes in your cluster. Possible values are <code>4</code> and <code>7</code>.</p></td></tr><tr><td><p>TELEKUBE_NODE_PROFILE_INSTANCE_TYPE_node</p></td><td><p>Must be <code>m5.2xlarge</code>.</p></td></tr><tr><td><p>TELEKUBE_NODE_PROFILE_COUNT_node_amv</p></td><td><p>Specifies the number of nodes for the AMV addon in your cluster. Must be <code>3</code> if planning to install the AMV addon. Omit otherwise.</p></td></tr><tr><td><p>TELEKUBE_NODE_PROFILE_INSTANCE_TYPE_node_amv</p></td><td><p>Must be <code>m5.8xlarge</code> if planning to install the AMV addon. Omit otherwise.</p></td></tr><tr><td><p>TF_VAR_high_performance_disks</p></td><td><p>Must be set to <code>true</code> for production environments.</p></td></tr></tbody></table>

    You can also include the following set of optional environment variables:

    <table><caption>Table 3. Optional Environment Variables</caption> <colgroup><col> <col></colgroup><thead><tr><th>Name</th><th>Description</th></tr></thead><tbody><tr><td><p>TF_VAR_ami_name</p></td><td><p>Specifies the AMI name to be used for the instances. Use the AMI name, <strong>NOT</strong> the AMI ID. <strong>Ensure that the AMI does not provision any additional volumes</strong>. If you do not set this variable, the provisioner uses the following AMI by default: <code>RHEL-8.3.0_HVM-20201031-x86_64-0-Hourly2-GP2</code></p></td></tr><tr><td><p>TF_VAR_monitoring=&lt;true or false&gt;</p></td><td><p>If true, creates basic instance alarms in Cloudwatch.</p></td></tr><tr><td><p>TF_VAR_use_bastion=&lt;true or false&gt;</p></td><td><p>If true, creates a small instance (using an ASG) in a public subnet as a jumpbox and associates a public IP address, and launches the cluster instances in the private subnets.</p></td></tr><tr><td><p>TF_VAR_internal=&lt;true or false&gt;</p></td><td><p>If true, the cluster instances are launched in private subnets and do not have public IPs associated with them. Also, the provisioned load balancer is internal only.</p></td></tr><tr><td><p>AWS_VPC_ID=&lt;VPC_ID&gt;</p></td><td><p>Specifies an existing VPC that should already have an internet gateway attached to it. Subnets are still provisioned within the existing VPC.</p></td></tr><tr><td><p>AWS_VPC_CIDR=&lt;VPC_CIDR&gt;</p></td><td><p>Enables you to pass a preferred CIDR for the new VPC to be provisioned. (Requires you to not pass a AWS_VPC_ID).</p></td></tr><tr><td><p>TF_VAR_aws_selected_subnets_ids=&lt;SUBNETS_IDS&gt;</p></td><td><p>Enables you to pass a list of subnets IDs on which the instances are launched. If you reuse your own subnets, you need to set up Route Tables, NAT Gateways, and an Internet Gateway, for example, <code>["subnet-0a17317984065f98f", "subnet-0600b4befb27c7949", "subnet-02103e0c935eff75a"]</code>.</p></td></tr><tr><td><p>TF_VAR_subnets=&lt;PRIVATE_SUBNETS_CIDRs&gt;</p></td><td><p>Enables you to optionally pass the preferred CIDRs blocks for the NEW subnets to be provisioned. You must pass the exact minimum number between the number of AZs of the region and the number of nodes you selected for your cluster, for example, <code>'["10.1.0.0/24", "10.1.1.0/24", "10.1.2.0/24"]'</code>.</p></td></tr><tr><td><p>TF_VAR_public_subnets=&lt;PUBLIC_SUBNETS_CIDRs&gt;</p></td><td><p>Enables you to optionally pass the preferred CIDRs blocks for the NEW subnets to be provisioned. You must pass the exact minimum number between the number of AZs of the region and the number of nodes you selected for your cluster, for example, <code>'["10.1.3.0/24", "10.1.4.0/24", "10.1.5.0/24"]'</code>.</p></td></tr><tr><td><p>TF_VAR_role_tag_value=&lt;AWS_TAG_VALUE_FOR_ROLE_LABEL&gt;</p></td><td><p>Enables you to specify a ROLE tag value to be applied to all AWS resources.</p></td></tr></tbody></table>

6.  Load the provisioner Docker image into the local Docker registry:

    docker load -i private-cloud-provisioner-4.0.13.tar.gz

7.  Perform a dry-run test:

    docker run --rm --env-file pce.env
    artifacts.msap.io/mulesoft/core-paas-private-cloud-provisioner:v4.0.13 dry-run

8.  Run the provisioner:

    docker run --rm --env-file pce.env
    artifacts.msap.io/mulesoft/core-paas-private-cloud-provisioner:v4.0.13 cluster-provision

    After the provisioner runs successfully, it displays information about your environment
    including IP addresses and DNS name of the load balancer.

9.  Verify that the provisioning script ran successfully by checking the existence of
    /var/lib/bootstrap\_complete on the instances

## Custom Provisioning Scripts (Optional)

You can have your own shell scripts to run on the provisioned instances before and/or after the PCE
provisioner scripts. To do so, place your shell scripts with .sh extension inside a folder named
`pre-user-data` and/or `post-user-data`. Include the following volume mounts on the docker run
command:

docker run --rm -v
$(pwd)/pre-user-data:/usr/local/bin/provisioner/terraform/external/pre-user-data -v $(pwd)/post-user-data:/usr/local/bin/provisioner/terraform/external/post-user-data
--env-file pce.env artifacts.msap.io/mulesoft/core-paas-private-cloud-provisioner:v4.0.13
cluster-provision

## Open Port 61009 Before Installation

If you are installing Anypoint Platform PCE using the GUI-based installer, you must enable this port
before running the installer. You must open this port in the cluster’s security group before running
the installer using AWS Web Console.

## Destroy Resources

You can destroy all resources that were created using the provisioner by running the
`cluster-deprovision` command, as shown in the following example. Ensure the `TELEKUBE_CLUSTER_NAME`
environment variable in your environment file has the correct value for the target cluster you want
to destroy:

docker run --rm --env-file pce.env
artifacts.msap.io/mulesoft/core-paas-private-cloud-provisioner:v4.0.13 cluster-deprovision

## Troubleshooting

Review the following information in the event you experience problems when creating AWS resources.

- 403 Forbidden

Check that your keys policies are not denying access to any EC2 or S3 resource. You should be able
to run the following basic command using AWS CLI with your keys:

aws sts get-caller-identity

- Limit exceeded

The AWS account might have some limits set on the amount of resources you can create. Delete some
unused resources or request a limit increase on AWS.

- AMI not found

Make sure you are using the AMI name as the value for the environment variable and not the ID.

## See Also

- [Hardware Prerequisites](https://docs.mulesoft.com/private-cloud/3.2/prereq-hardware)

- [Software Prerequisites](https://docs.mulesoft.com/private-cloud/3.2/prereq-software)

- [Network Prerequisites](https://docs.mulesoft.com/private-cloud/3.2/prereq-network)

- [NFS Server Prerequisites](https://docs.mulesoft.com/private-cloud/3.2/verify-nfs)

- [Preinstallation Verification](https://docs.mulesoft.com/private-cloud/3.2/prereq-gravity-check)

- [Install Terraform](https://developer.hashicorp.com/terraform/tutorials/aws-get-started/install-cli)

- [Linux Bastion Hosts on the AWS Cloud: Quick Start Reference Deployment](https://docs.aws.amazon.com/quickstart/latest/linux-bastion/welcome.html)

<!-- document id=ca68abd3bc83917f467b462fbe25775b4bcdeb54778c4c95a4c94f3081ddc81e url=/mulesoft/current/en-us/private-cloud/3.2/access-management-disclaimer.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 3.2
---

# Configure a Disclaimer for Anypoint Platform PCE

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

You can add a custom message to your login page that users in your organization see every time they
log in:

1.  From Anypoint Platform, select **Access Management** > **Disclaimer**.

2.  Enter your disclaimer text.

3.  Select **Save**.

![on prem features d22af](/mulesoft/current/en-us/private-cloud/3.2/_images/on-prem-features-d22af.png)

You can also set up a custom HTML message.

<!-- document id=00bfb681c7c7ac2391c51372010b82f04b88a84cef7e43d3a3bd8edfe705fdff url=/mulesoft/current/en-us/private-cloud/3.2/config-alerts.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 3.2
---

# Configure Alerts for Anypoint Platform PCE

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Anypoint Platform Private Cloud Edition (Anypoint Platform PCE) provides built-in alerts that are
triggered when a condition specified in any alert definition is detected.

Measurements are stored in [Prometheus](https://prometheus.io/docs/introduction/overview/) and read
by [Alertmanager](https://prometheus.io/docs/alerting/latest/alertmanager/). Alertmanager sends
emails when an alert is triggered.

## Alert Definitions

Default alerts are listed in the following table:

<table><caption>Table 1. Alert Definitions</caption> <colgroup><col> <col> <col></colgroup><thead><tr><th>Component</th><th>Alert</th><th>Description</th></tr></thead><tbody><tr><td><p>CPU</p></td><td><p>High CPU usage</p></td><td><p>Triggers a warning when &gt; 75% used; triggers a critical error when &gt; 90% used</p></td></tr><tr><td><p>Memory</p></td><td><p>High memory usage</p></td><td><p>Triggers a warning when &gt; 80% used; triggers a critical error when &gt; 90% used</p></td></tr><tr><td><p>Systemd</p></td><td><p>Overall systemd health</p></td><td><p>Triggers an error when systemd detects a failed service</p></td></tr><tr><td><p>Systemd</p></td><td><p>Individual systemd unit health</p></td><td><p>Triggers an error when a systemd unit is not loaded or active</p></td></tr><tr><td><p>Filesystem</p></td><td><p>High disk space usage</p></td><td><p>Triggers a warning when &gt; 80% used; triggers a critical error when &gt; 90% used</p></td></tr><tr><td><p>Filesystem</p></td><td><p>High inode usage</p></td><td><p>Triggers a warning when &gt; 90% used; triggers a critical error when &gt; 95% used</p></td></tr><tr><td><p>System</p></td><td><p>Uptime</p></td><td><p>Triggers a warning when the uptime for a node is less than five minutes</p></td></tr><tr><td><p>System</p></td><td><p>Kernel parameters</p></td><td><p>Triggers an error if a parameter is not set. See <a href="https://github.com/gravitational/gravity/blob/master/docs/8.x/requirements.md#kernel-module-matrix" target="_blank" rel="noopener">value matrix</a> for details.</p></td></tr><tr><td><p>Etcd</p></td><td><p>Etcd instance health</p></td><td><p>Triggers an error when an etcd leader is down longer than five minutes</p></td></tr><tr><td><p>Etcd</p></td><td><p>Etcd latency check</p></td><td><p>Triggers a warning when follower &lt;→ leader latency exceeds 500 ms; triggers an error when it exceeds one second over a period of one minute</p></td></tr><tr><td><p>Docker</p></td><td><p>Docker daemon health</p></td><td><p>Triggers an error when the Docker daemon is down</p></td></tr><tr><td><p>Kubernetes</p></td><td><p>Kubernetes node readiness</p></td><td><p>Triggers an error when the node is not ready</p></td></tr></tbody></table>

## Configure Alert Definitions

You define new alerts using a gravity resource called `alert`, as shown in the following example:

```copy
kind: alert
version: v2
metadata:
name: cpu-alert
spec:
# the alert name
alert_name: CPUAlert
# the rule group the alert belongs to
group_name: test-group
# the alert expression
formula: |
    node:cluster_cpu_utilization:ratio * 100 > 80
# the alert labels
labels:
    severity: info
# the alert annotations
annotations:
    description: |
    Cluster CPU usage exceeds 80%.
```

See the [Alerting Rules](https://prometheus.io/docs/prometheus/latest/configuration/alerting_rules/)
documentation for more details about Prometheus alerts.

- To create an alert, run:

  gravity resource create alert.yaml

- To view existing alerts, run:

  gravity resource get alerts

- To remove an alert, run:

  gravity resource rm alert cpu-alert

## Configure Alerts Delivery

To configure Alertmanager to send email alerts, create the following gravity resources:

1.  Using the following spec, create a file named `smtp-config.yaml` inside gravity, and replace the
    placeholder values with those of your SMTP configuration:

    ```copy
    kind: smtp
    version: v2
    metadata:
        name: smtp
    spec:
       host: <SMTP_HOST>
       port: <SMTP_PORT>
       username: <SMTP_USERNAME>
       password: <SMTP_PASSWORD>
    ---
    kind: alerttarget
    version: v2
    metadata:
        name: email-alerts
    spec:
        # email address of the alerts recipient
        email: <RECIPIENT_EMAIL>
    ```

2.  Run `gravity resource create smtp-config.yaml`. You should see the following output:

    Created cluster SMTP configuration Created monitoring alert target "email-alerts"

3.  Add a default router to the Alertmanager configuration inside gravity:

    kubectl get secret -n monitoring alertmanager-monitoring-kube-prometheus-alertmanager -o json |
    jq --arg foo
    "$(kubectl get secret -n monitoring alertmanager-monitoring-kube-prometheus-alertmanager -o json | jq -r '.data\["alertmanager.yaml"\]' | base64 -d | yq r - --tojson | jq -r '.route.routes\[1\] |= . + {"match":{"alertname": "Watchdog", "receiver": "default", "continue": true}}' | jq -r '.route.routes\[0\].match += {"continue":true}' | yq r - -P | base64 | tr -d '\\n')" '.data\["alertmanager.yaml"\]=$foo'
    | kubectl apply -f -

4.  Configure the FROM email address by replacing the <SMTP\_FROM> value:

    kubectl get secret -n monitoring alertmanager-monitoring-kube-prometheus-alertmanager -o json |
    jq --arg foo
    "$(kubectl get secret -n monitoring alertmanager-monitoring-kube-prometheus-alertmanager -o json | jq -r '.data\["alertmanager.yaml"\]' | base64 -d | yq w - 'global.smtp\_from' <SMTP\_FROM> | base64 | tr -d '\\n')" '.data\["alertmanager.yaml"\]=$foo'
    | kubectl apply -f -

5.  Restart Alertmanager pods:

    kubectl delete pod -n monitoring -l app=alertmanager

6.  Test Alertmanager by running the following command inside gravity:

    curl -H 'Content-Type: application/json' -d
    '\[{"labels":{"alertname":"test-alert","state":"firing"}}\]'
    http://monitoring-kube-prometheus-alertmanager.monitoring.svc.cluster.local:9093/api/v1/alerts

## Troubleshooting Alerts

Common troubleshooting tasks include the following:

- Verify that your SMTP server can send and receive emails using the addresses you defined as the
  `FROM` and `TO` addresses when you configured alerts delivery.

- Verify that your cluster nodes can communicate with your SMTP server.

  For example, use `telnet` to connect to your SMTP server from one of your cluster nodes:

  telnet my.smtp.server.com 587 Trying XXX.XXX.XXX.XXX... Connected to my.smtp.server.com. Escape
  character is '^\]'. 220 my.smtp.server.com ESMTP ^\[^\] telnet> quit Connection closed.

## See Also

- [Ops Center](https://docs.mulesoft.com/private-cloud/3.2/managing-via-the-ops-center)

<!-- document id=43ae8a4bd0cbf3df506a370ce919964393e6ad3911569e7f499a56c64bb67cdd url=/mulesoft/current/en-us/private-cloud/3.2/install-config-ldap-pce.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 3.2
---

# Configure an External Identity Provider in Anypoint Platform PCE

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Anypoint Platform Private Cloud Edition (Anypoint Platform PCE) requires an external identity
provider. All users must be registered via external identity except the admin you register in the
installation wizard. The following external identity providers are supported:

- [Configure LDAP in Anypoint Platform Private Cloud](https://docs.mulesoft.com/access-management/conf-ldap-private-cloud-task)

- [Configure Ping Federate](https://docs.mulesoft.com/access-management/conf-client-mgmt-pf-task)

- [Configure SAML](https://docs.mulesoft.com/access-management/conf-saml-sso)

- [Configure OpenID Connect](https://docs.mulesoft.com/access-management/conf-openid-connect-task)

  For troubleshooting information, see
  [Anypoint Platform Single Sign-On (SSO) using OpenID Connect (OIDC) Troubleshooting Guide](https://help.salesforce.com/s/articleView?id=001114931&type=1).

<!-- document id=9918bb8ec5e8cd7635f50829ad23529589f33f70f453e36de91991eb600f509a url=/mulesoft/current/en-us/private-cloud/3.2/config-workflow.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 3.2
---

# Configure Anypoint Platform PCE

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

After you complete Anypoint Platform Private Cloud Edition (Anypoint Platform PCE) installation,
review the following tasks, many of which are required before you can successfully deploy and manage
applications, register APIs, and use API Exchange on an Anypoint Platform PCE environment running on
your own local network.

- Optional:
  [Delete the Local User after Installing Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/3.2/install-disable-local-user)

- [Configure an External Identity Provider in Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/3.2/install-config-ldap-pce)

- [Configure SMTP in Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/3.2/access-management-SMTP)

- [Configure DNS in Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/3.2/access-management-dns)

- [Configure Security in Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/3.2/access-management-security)

- [Configure a Disclaimer in Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/3.2/access-management-disclaimer)

> [!NOTE] At the time of this writing, some Docker containers must run as root. Processes running as
> root do not expose functionality outside the cluster. Processes that serve external traffic do not
> run as root, to maximize security.

## See Also

- [About Servers, Server Groups, and Clusters](https://docs.mulesoft.com/runtime-manager/managing-servers)

- [Uploading Custom Policies](https://docs.mulesoft.com/mule-gateway/policies-custom-upload-to-exchange)

- [Maven facade API](https://anypoint.mulesoft.com/exchange/portals/anypoint-platform/f1e97bc6-315a-4490-82a7-23abe036327a.anypoint-platform/exchange-maven-facade-api-http/)

<!-- document id=1280964a897928df1949f4283bf99dcd8b2b95e29b620cdbc3b7778b0ee0c6f0 url=/mulesoft/current/en-us/private-cloud/3.2/config-studio.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 3.2
---

# Configure Anypoint Studio for Anypoint Platform PCE

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

To configure Anypoint Studio 7.15 for Anypoint Platform Private Cloud Edition 3.2, follow the steps
in [Configure Anypoint PCE in Studio](https://docs.mulesoft.com/studio/pce-configuration).

<!-- document id=86af5d888975401e38a53b09f2fa7b317c5ca6b0dea579b69e2f07ffad32a129 url=/mulesoft/current/en-us/private-cloud/3.2/backup-and-disaster-recovery.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 3.2
---

# Configure Backup and Restore for Anypoint Platform PCE

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

To preserve your data in case of system failure or problems with other operations, such as patching
or performing upgrades, ensure that your system is automatically backed up. Regular backups are
extremely important for disaster recovery procedures. Configure your backup to run at least once per
day; or more often depending on your requirements. Store your backup archive on external storage
outside the Anypoint Platform cluster.

Anypoint Platform Private Cloud Edition (Anypoint Platform PCE) requires you to install, configure,
and manage an NFS server. Ensure that you configure and perform frequent backups of this server.

> [!IMPORTANT] Backup and restore for Anypoint Monitoring and Anypoint Visualizer are perfored
> outside the normal Gravity backup and restore mechanism, and require a separate procedure.

## Create a Backup

To create a backup, run the following command on any node in the cluster:

gravity backup /var/lib/gravity/planet/share/backup.tar.gz

This command creates an archive of the current system state in:
`/var/lib/gravity/planet/share/backup.tar.gz`. You can pass the following optional parameters to the
gravity backup command:

- `--follow`

  Outputs the backup job logs to stdout. In the following example, `tee` enables you to output to
  stdout and file at the same time:

gravity backup /var/lib/gravity/planet/share/backup.tar.gz --follow | tee -a
/var/lib/gravity/planet/share/backup.log

- `--timeout`

  Specifies the deadline for the backup job, for example, 30s or 5m. Default is 20m.

Backup contents:

<table><caption>Table 1. Backup Contents</caption> <colgroup><col> <col></colgroup><thead><tr><th>Information</th><th>Included in PCE Backup</th></tr></thead><tbody><tr><td><p>Databases</p></td><td><p>Y</p></td></tr><tr><td><p>Configurations</p></td><td><p>Y</p></td></tr><tr><td><p>Secrets</p></td><td><p>Y</p></td></tr><tr><td><p>Object Store</p></td><td><p>Y</p></td></tr><tr><td><p>Disclaimer settings</p></td><td><p>Y</p></td></tr><tr><td><p>SMTP settings</p></td><td><p>Y</p></td></tr><tr><td><p>DNS settings</p></td><td><p>N</p></td></tr><tr><td><p>Platform certificate</p></td><td><p>N</p></td></tr><tr><td><p>Ops Center certificate</p></td><td><p>N</p></td></tr><tr><td><p>NFS settings</p></td><td><p>N</p></td></tr><tr><td><p>NFS files</p></td><td><p>N</p></td></tr><tr><td><p>Drives</p></td><td><p>N</p></td></tr><tr><td><p>Runtimes*</p></td><td><p>N</p></td></tr><tr><td><p>Anypoint Monitoring metrics</p></td><td><p>N</p></td></tr></tbody></table>

\*Anypoint Platform PCE has information only about runtimes, such as their names and status.

## Perform a System Restore

To restore a system from your backup archive, use the original cluster or create a new cluster.

> [!WARNING] Some settings, including NFS, certificates, and DNS, are not backed up and must be
> configured for the environment in which the restore will be performed before running the restore.

> [!WARNING] You cannot perform a backup between different versions of Anypoint Platform PCE. The
> new installation you create must use the same version of Anypoint Platform PCE as your backup.

1.  Log in to one of the nodes in your cluster.

2.  Move the compressed backup archive file to a folder on any main node in the environment to be
    restored. You can transfer this file securely by using the following command:

    scp /backup-path/to-restore.tar.gz your\_username@remotehost.edu:/var/lib/gravity/planet/share

3.  Restore the cluster from the backup archive:

    sudo gravity restore /var/lib/gravity/planet/share/to-restore.tar.gz

    You can pass the following optional parameters:

    - `--follow`

      Outputs the restore job logs to stdout.

    - `--timeout`

      Specifies the maximum time allowed for the restore operation, for example, 30s, 5m, and so on.
      The default value is `80m`. If you have a very large number of applications and files, use a
      minimum of `160m` as the `--timeout` value.

4.  Wait for the operation to complete, which is typically 40 to 60 minutes.

5.  Manually restore the NFS files if you are not reusing the original NFS.

## Anypoint Monitoring and Anypoint Visualizer

If Anypoint Monitoring and Anypoint Visualizer are enabled, follow these procedures to back up and
restore them.

Anypoint Monitoring and Anypoint Visualizer backup and restore are outside the normal Gravity backup
and restore mechanism, and require additional procedures. These components store metrics and other
information, but they do not store platform configuration. Platform configuration information is
handled by the system backup and restore procedures.

Anypoint Monitoring and Anypoint Visualizer must back up the data of the component InfluxDB
(`dias-prov-k8s-am-influxdb-comp`). Anypoint Monitoring and Anypoint Visualizer both store their
configuration data in a Postgres database. The default Gravity mechanism backs up and restores this
database.

Anypoint Monitoring and Anypoint Visualizer requires 4 TB volumes for `amv` nodes. A full InfluxDB
backup can be up to 8 TB of data. (Only two data nodes are operative.) You must provide enough free
space on the target directory for the entire backup.

Restore time is proportional to the size of the backup. During restore, existing data on the target
cluster will be backed up and erased upon user approval.

The backup and restore script must be run on a main node and must have `sudo` access because it uses
`kubectl`. The script validates the restore disk size, databases, measurements, retention policies,
and series cardinality for all measurements in each database.

### Procedure

The InfluxDB backup and restore script is in the Anypoint Platform PCE environment:
`/var/lib/gravity/site/packages/unpacked/gravitational.io/anypoint/3.2.0*/resources/kubernetes/amv-backup-restore/amv-backup-restore.sh`

The script has these parameters:

-a : (Required) action to perform : backup or restore. \[string\]. Default NO DEFAULT ACTION. -va :
(optional) verbose output. Default non-verbose. -f : (Required) name of the tar file. Default for
backup : dias-prov-k8s-am-influxdb-comp\_YYYYMMD. \[string\]. Default for restore :
/var/lib/data/influxdb/backup/dias-prov-k8s-am-influxdb-comp\_YYYYMMDD.tar.gz. \[Full Path\]. -d :
(Required for backup) full path to location where backup tar file is stored. Default for backup :
/var/lib/data/influxdb/backup. \[Full Path\]. Default for restore : same as tar file path. \[Full
Path\]. -s : (optional) Optional sub-component filter, use only for backup of only meta or only
data. -h : Print HELP.

### Examples

Verbose backup:
`sudo bash amv-backup-restore.sh -va backup -f 2020-01-01-influxdb-backup -d path/to/backup/dir`

Non-verbose restore:
`sudo bash amv-backup-restore.sh -a restore -f /var/lib/data/influxdb/backup/dias-prov-k8s-am-influxdb-comp_YYYYMMDD.tar.gz`

## See Also

- [Install Anypoint Platform Private Cloud](https://docs.mulesoft.com/private-cloud/3.2/install-workflow)

- [Upgrade Anypoint Platform Private Cloud](https://docs.mulesoft.com/private-cloud/3.2/upgrade)

<!-- document id=95a1213d28b8641534b1d90131042566fc48c0ec8456bffef2bbb78f650353c5 url=/mulesoft/current/en-us/private-cloud/3.2/access-management-dns.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 3.2
---

# Configure DNS on Anypoint Platform PCE

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

If you did not perform this step before installation, you must provide the DNS or IP address where
your Anypoint Platform Private Cloud Edition installation is exposed to the local network. This is
required for Mule to communicate with Anypoint Platform.

1.  From Anypoint Platform, click Access Management.

2.  Click the **DNS/IP** tab.

3.  In the **Platform DNS/IP** field, enter the address where you are hosting the platform.

4.  Click **Save**.

> [!NOTE] \== If you perform a DNS update that changes the endpoints that Mule instances use to
> connect to Runtime Manager, you must restart the Mule instances before they can connect to the new
> endpoints. ==

<!-- document id=78b7d77bf483706b99ccd01cc3972b227c24331edd2ccffeadcab9610db5087b url=/mulesoft/current/en-us/private-cloud/3.2/access-management-security.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 3.2
---

# Configure Security for Anypoint Platform PCE

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

To use Anypoint Platform, you must provide TLS credentials. You can upload a certificate through the
Anypoint Platform UI using access management, and configure Anypoint Platform to use this
certificate to ensure secure communication within the platform. This certificate must be trusted by
every machine connected to the platform, including Mule runtime engines. You can also provide a
custom cipher and DH groups for the key exchange method, if required.

When you replace or change the certificate, Anypoint Platform restarts the nginx server.

![on prem features 5f98d](/mulesoft/current/en-us/private-cloud/3.2/_images/on-prem-features-5f98d.png)

1.  Create a certificate.

    You can use a tool like OpenSSL to create your certificate. To work with Anypoint Platform, your
    certificate must be in an `nginx` compatible format. The certificate must contain the domain
    name of your installation as the CN (Common Name) and as the SAN (Subject Alternative Name).

2.  From Anypoint Platform, select Access Management.

3.  In the left navigation bar, select Security.

4.  In the Certificate field, select Browse to select the certificate on your local system.

5.  In the Key field, select Browse to select the private key for your certificate.

6.  For additional security, you can upload your own cipher and Diffie-Hellman group file.

    Note that this step is optional.

    1.  Deselect **Use default ciphers and DH Group**.

    2.  Enter a set of ciphers from the list of valid NGINX ciphers. If you are using Open SSL, you
        can view this list by running the `openssl ciphers` command. The cipher you enter must be in
        an `nginx` compatible format as shown in the following example:

        ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384

    3.  Generate `dhparam.pem` (the Diffie-Hellman group file) using the following `openssl`
        command:

        openssl dhparam 2048 -out dhparam.pem

    4.  Upload the `dhparam.pem` file from your system.

<!-- document id=0cbee35bcefbec4927f1ece7be5759670a7e6606e49f2dd14cd26b63aa1a2d5d url=/mulesoft/current/en-us/private-cloud/3.2/access-management-SMTP.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 3.2
---

# Configure SMTP in Anypoint Platform PCE

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Because Anypoint Platform Private Cloud Edition (Anypoint Platform PCE) does not provide an SMTP
server, you must set up your own SMTP email server to deliver email alerts generated by API Manager
and Runtime Manager. The SMTP email server also sends email messages for platform infrastructure
alerts, including CPU, memory, and disk alerts.

You must direct your local installation of Anypoint Platform PCE to this server from the Access
Management panel.

> [!NOTE] Only SMTP servers with Authentication are supported (anonymous SMTP relay servers are not
> supported).  
> SMTPS is not supported.

## Connect to an Existing SMTP Server

1.  From Anypoint Platform, select **Access Management**.

2.  Select **SMTP**.

3.  Provide the following information for your SMTP server:

    ![on premises features 2c60a](/mulesoft/current/en-us/private-cloud/3.2/_images/on-premises-features-2c60a.png)

    <table><caption>Table 1. SMTP Server Parameters</caption> <colgroup><col> <col> <col></colgroup><thead><tr><th>Field</th><th>Description</th><th>Example</th></tr></thead><tbody><tr><td><div><div><p>Host</p></div></div></td><td><div><div><p>The host name of your SMTP server</p></div></div></td><td><div><div><p><code>smtp.gmail.com</code></p></div></div></td></tr><tr><td><div><div><p>Port</p></div></div></td><td><div><div><p>The port used to communicate to your SMTP server</p></div></div></td><td><div><div><p><code>587</code></p></div></div></td></tr><tr><td><div><div><p>Username</p></div></div></td><td><div><div><p>The username to authenticate to your SMTP server</p></div></div></td><td><div><div><p><code>mulesoft.onprem.smtp@gmail.com</code></p></div></div></td></tr><tr><td><div><div><p>Password</p></div></div></td><td><div><div><p>Your SMTP password</p></div></div></td><td><div><div><p><code>examplepassphrase</code></p></div></div></td></tr></tbody></table>

    > [!NOTE] To use anonymous logins for your SMTP server, leave the **Username** and **Password**
    > fields empty.

4.  After entering your configuration, select **Save**.

<!-- document id=a0084126b39537a2d7babeb7534ed0ee9ec5b867056124a54fde6814728b052f url=/mulesoft/current/en-us/private-cloud/4.0/access-management-disclaimer.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.0
---

# Configuring a Disclaimer for Anypoint Platform PCE

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

To configure a disclaimer for your Anypoint Platform Private Cloud Edition (Anypoint Platform PCE),
add a custom message to your login page that users in your organization see every time they log in:

1.  From Anypoint Platform, select **Access Management** > **Disclaimer**.

2.  Enter your disclaimer text (you can also set up a custom HTML message).

3.  Select **Save**.

![Disclaimer window to enter text under the Access Mananagemet UI](/mulesoft/current/en-us/private-cloud/4.0/_images/on-prem-features-d22af.png)

## See Also

- [Configuring Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/4.0/config-workflow)

<!-- document id=9782084929960706597feb91ee6a50c32d24026c8529ad77c11c6e6cc7d3a144 url=/mulesoft/current/en-us/private-cloud/4.1/access-management-disclaimer.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.1
---

# Configuring a Disclaimer for Anypoint Platform PCE

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

To configure a disclaimer for your Anypoint Platform Private Cloud Edition (Anypoint Platform PCE),
add a custom message to your login page that users in your organization see every time they log in:

1.  From Anypoint Platform, select **Access Management** > **Disclaimer**.

2.  Enter your disclaimer text (you can also set up a custom HTML message).

3.  Select **Save**.

![Disclaimer window to enter text under the Access Mananagemet UI](/mulesoft/current/en-us/private-cloud/4.1/_images/on-prem-features-d22af.png)

## See Also

- [Configuring Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/4.1/config-workflow)

<!-- document id=ed6c182db521ab30a8b0aa1a5af29aa6e1e30e0a0eb0648d5663fd3d75c7606a url=/mulesoft/current/en-us/private-cloud/4.2/access-management-disclaimer.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.2
---

# Configuring a Disclaimer for Anypoint Platform PCE

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

To configure a disclaimer for your Anypoint Platform Private Cloud Edition (Anypoint Platform PCE),
add a custom message to your login page that users in your organization see every time they log in:

1.  From Anypoint Platform, select **Access Management** > **Disclaimer**.

2.  Enter your disclaimer text (you can also set up a custom HTML message).

3.  Select **Save**.

![Disclaimer window to enter text under the Access Mananagemet UI](/mulesoft/current/en-us/private-cloud/4.2/_images/on-prem-features-d22af.png)

## See Also

- [Configuring Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/4.2/config-workflow)

<!-- document id=e803c0720a55dc1e7b33b79928c057acc9815651a5a5a5c3bd2e47f95b933ec0 url=/mulesoft/current/en-us/private-cloud/latest/access-management-disclaimer.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.3
is-latest-version: true
---

# Configuring a Disclaimer for Anypoint Platform PCE

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

To configure a disclaimer for your Anypoint Platform Private Cloud Edition (Anypoint Platform PCE),
add a custom message to your login page that users in your organization see every time they log in:

1.  From Anypoint Platform, select **Access Management** > **Disclaimer**.

2.  Enter your disclaimer text (you can also set up a custom HTML message).

3.  Select **Save**.

![Disclaimer window to enter text under the Access Mananagemet UI](/mulesoft/current/en-us/private-cloud/latest/_images/on-prem-features-d22af.png)

## See Also

- [Configuring Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/latest/config-workflow)

<!-- document id=de4eb897c9da59d9f70725e8465b7829f4891614bed0a51cc5540f69c3cc8d49 url=/mulesoft/current/en-us/private-cloud/4.0/install-config-ldap-pce.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.0
---

# Configuring an External Identity Provider in Anypoint Platform PCE

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Anypoint Platform Private Cloud Edition (Anypoint Platform PCE) requires an external identity
provider. All users must be registered via external identity except the admin you register in the
installation wizard. The following external identity providers are supported:

- [Configuring LDAP in Anypoint Platform PCE](https://docs.mulesoft.com/access-management/conf-ldap-private-cloud-task)

- [Configuring Ping Federate](https://docs.mulesoft.com/access-management/conf-client-mgmt-pf-task)

- [Configuring SAML](https://docs.mulesoft.com/access-management/conf-saml-sso)

- [Configuring OpenID Connect](https://docs.mulesoft.com/access-management/conf-openid-connect-task)

For troubleshooting information, see
[Anypoint Platform Single Sign-On (SSO) using OpenID Connect (OIDC) Troubleshooting Guide](https://help.salesforce.com/s/articleView?id=001114931&type=1).

## See Also

- [Configuring Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/4.0/config-workflow)

<!-- document id=c10f0f9d012430415edaba0865f51cf9c77ee20f7c42f1eefd079f22fbfbe702 url=/mulesoft/current/en-us/private-cloud/4.1/install-config-ldap-pce.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.1
---

# Configuring an External Identity Provider in Anypoint Platform PCE

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Anypoint Platform Private Cloud Edition (Anypoint Platform PCE) requires an external identity
provider. All users must be registered via external identity except the admin you register in the
installation wizard. The following external identity providers are supported:

- [Configuring LDAP in Anypoint Platform PCE](https://docs.mulesoft.com/access-management/conf-ldap-private-cloud-task)

- [Configuring Ping Federate](https://docs.mulesoft.com/access-management/conf-client-mgmt-pf-task)

- [Configuring SAML](https://docs.mulesoft.com/access-management/conf-saml-sso)

- [Configuring OpenID Connect](https://docs.mulesoft.com/access-management/conf-openid-connect-task)

For troubleshooting information, see
[Anypoint Platform Single Sign-On (SSO) using OpenID Connect (OIDC) Troubleshooting Guide](https://help.salesforce.com/s/articleView?id=001114931&type=1).

## See Also

- [Configuring Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/4.1/config-workflow)

<!-- document id=6227887a3e6c780af032de3ca30e1482d943684bf6716cd91ba9b75e3956305a url=/mulesoft/current/en-us/private-cloud/4.2/install-config-ldap-pce.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.2
---

# Configuring an External Identity Provider in Anypoint Platform PCE

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Anypoint Platform Private Cloud Edition (Anypoint Platform PCE) requires an external identity
provider. All users must be registered via external identity except the admin you register in the
installation wizard. The following external identity providers are supported:

- [Configuring LDAP in Anypoint Platform PCE](https://docs.mulesoft.com/access-management/conf-ldap-private-cloud-task)

- [Configuring Ping Federate](https://docs.mulesoft.com/access-management/conf-client-mgmt-pf-task)

- [Configuring SAML](https://docs.mulesoft.com/access-management/conf-saml-sso)

- [Configuring OpenID Connect](https://docs.mulesoft.com/access-management/conf-openid-connect-task)

For troubleshooting information, see
[Anypoint Platform Single Sign-On (SSO) using OpenID Connect (OIDC) Troubleshooting Guide](https://help.salesforce.com/s/articleView?id=001114931&type=1).

## See Also

- [Configuring Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/4.2/config-workflow)

<!-- document id=808bf6bb0bc6aa49b451165fd1bb8f9c0c19fb7f21cb2a50c4885972b2e4cb4c url=/mulesoft/current/en-us/private-cloud/latest/install-config-ldap-pce.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.3
is-latest-version: true
---

# Configuring an External Identity Provider in Anypoint Platform PCE

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Anypoint Platform Private Cloud Edition (Anypoint Platform PCE) requires an external identity
provider. All users must be registered via external identity except the admin you register in the
installation wizard. The following external identity providers are supported:

- [Configuring LDAP in Anypoint Platform PCE](https://docs.mulesoft.com/access-management/conf-ldap-private-cloud-task)

- [Configuring Ping Federate](https://docs.mulesoft.com/access-management/conf-client-mgmt-pf-task)

- [Configuring SAML](https://docs.mulesoft.com/access-management/conf-saml-sso)

- [Configuring OpenID Connect](https://docs.mulesoft.com/access-management/conf-openid-connect-task)

For troubleshooting information, see
[Anypoint Platform Single Sign-On (SSO) using OpenID Connect (OIDC) Troubleshooting Guide](https://help.salesforce.com/s/articleView?id=001114931&type=1).

## See Also

- [Configuring Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/latest/config-workflow)

<!-- document id=e24eae3c3c8ed266ded93be52b8d9d1e76b7f6e6cf5b8c82fe7406fb66fef26f url=/mulesoft/current/en-us/private-cloud/latest/config-code-builder.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.3
is-latest-version: true
---

# Configuring Anypoint Code Builder for Anypoint Platform PCE

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Use [Anypoint Code Builder](https://docs.mulesoft.com/anypoint-code-builder/start-acb-desktop) in VS Code to design,
develop, and deploy applications to your Anypoint Platform Private Cloud Edition (Anypoint Platform
PCE) environment. You can use Anypoint Code Builder without MuleSoft Vibes by following the standard
Anypoint Code Builder documentation. MuleSoft Vibes is optional.

## Before You Begin

Before you start developing with Anypoint Code Builder, ensure that you have:

- An Anypoint Platform PCE 4.3 environment

- Access to an [Anypoint Platform](https://anypoint.mulesoft.com) account on anypoint.mulesoft.com

  This access is separate from your Anypoint Platform PCE license. Anypoint Code Builder uses it to
  retrieve assets and export the application artifact.

- Mule runtime engine 4.9 LTS or 4.12 Edge support.

- Microsoft Visual Studio Code (VS Code) installed on your local machine

- Anypoint CLI installed and configured for your Anypoint Platform PCE instance

  For installation instructions, see
  [Installing Anypoint CLI](https://docs.mulesoft.com/anypoint-cli/latest/install).

- These Anypoint CLI plugins installed by running the following command once for each plugin:

  anypoint-cli-v4 plugins:install <plugin-name>

  Replace `<plugin-name>` with each of the following:

  - [anypoint-cli-account-plugin](https://docs.mulesoft.com/anypoint-cli/latest/account)

  - [anypoint-cli-api-manager-plugin](https://docs.mulesoft.com/anypoint-cli/latest/api-mgr)

  - [anypoint-cli-exchange-plugin](https://docs.mulesoft.com/anypoint-cli/latest/exchange-assets)

  - [mulesoft-anypoint-cli-designcenter-plugin](https://docs.mulesoft.com/anypoint-cli/latest/design-center)

MuleSoft Vibes is optional. If you use it, install
[MuleSoft Vibes Skills](https://docs.mulesoft.com/anypoint-code-builder/vibes-skills) on your local machine, in Claude,
Copilot, or another supported developer agent.

> [!NOTE] Contact your MuleSoft representative for details on how to configure MuleSoft Vibes within
> your environment.
>
> For installation instructions, see
> [Using Skills with MuleSoft Vibes](https://docs.mulesoft.com/anypoint-code-builder/vibes-skills#install-mulesoft-skills-in-claude-code).

## Connect Anypoint Platform PCE with Anypoint Code Builder

To configure Anypoint Platform PCE with Anypoint Code Builder, connect your local VS Code
environment to your Anypoint Platform account:

1.  In VS Code, navigate to **Settings** > **Extensions** > **Anypoint Code Builder (Platform)**.

2.  Set the **Mule Control Plane** dropdown to **Private Cloud Edition**, and enter your PCE URL
    under **Mule: Control Plane PCE Url**.

    For example:
    `[https://pce-instance.elb.us-east-2.amazonaws.com/](https://pce-instance.elb.us-east-2.amazonaws.com/)`

3.  Optional: Install and configure
    [MuleSoft Vibes Skills](https://docs.mulesoft.com/anypoint-code-builder/vibes-skills#install-mulesoft-skills-in-claude-code).

4.  Open the **Command Palette**, run **MuleSoft: Login to Anypoint Platform**, and complete
    authentication in your browser.

5.  If you use SSO or MFA, set the `ANYPOINT_BEARER_TOKEN` environment variable in your terminal to
    an access token from your authenticated Anypoint Platform session.

After you complete this setup, you can [deploy Mule applications](https://docs.mulesoft.com/private-cloud/latest/deploy-apps-code-builder) to
Anypoint Platform PCE.

## See Also

- [Deploying Mule Applications to Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/latest/deploy-apps)

- [Deploying Mule Applications Using Anypoint Code Builder](https://docs.mulesoft.com/private-cloud/latest/deploy-apps-code-builder)

- [Developing Integrations](https://docs.mulesoft.com/anypoint-code-builder/int-developing-integrations)

- [Designing API Specs and Fragments](https://docs.mulesoft.com/anypoint-code-builder/des-designing-api-specs)

- [Configuring Anypoint Studio for Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/latest/config-studio)

- [Managing Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/latest/operating-about)

<!-- document id=c7f46f5e039b5eccaf8db41c0e1bf179ddeff4b713ddd059e75b4ec2257c31a6 url=/mulesoft/current/en-us/private-cloud/4.0/config-workflow.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.0
---

# Configuring Anypoint Platform PCE

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

After you complete the Anypoint Platform Private Cloud Edition (Anypoint Platform PCE) installation,
review the following task to deploy and manage applications, register APIs, and use API Exchange on
an Anypoint Platform PCE environment running on your own local network.

- [Deleting the Local User after Installing Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/4.0/install-disable-local-user)

- [Configuring an External Identity Provider in Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/4.0/install-config-ldap-pce)

- [Configuring SMTP in Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/4.0/access-management-SMTP)

- [Configuring DNS in Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/4.0/access-management-dns)

- [Configuring Security in Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/4.0/access-management-security)

- [Configuring a Disclaimer in Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/4.0/access-management-disclaimer)

## See Also

- [About Servers, Server Groups, and Clusters](https://docs.mulesoft.com/runtime-manager/managing-servers)

- [Uploading Custom Policies](https://docs.mulesoft.com/mule-gateway/policies-custom-upload-to-exchange)

- [Maven facade API](https://anypoint.mulesoft.com/exchange/portals/anypoint-platform/f1e97bc6-315a-4490-82a7-23abe036327a.anypoint-platform/exchange-maven-facade-api-http/)

<!-- document id=72b5f1e447cfe5a3f9b9508c81be09f9f120893dac0a4fe0fda91903c655b17c url=/mulesoft/current/en-us/private-cloud/4.1/config-workflow.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.1
---

# Configuring Anypoint Platform PCE

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

After you complete the Anypoint Platform Private Cloud Edition (Anypoint Platform PCE) installation,
review the following task to deploy and manage applications, register APIs, and use API Exchange on
an Anypoint Platform PCE environment running on your own local network.

- [Deleting the Local User after Installing Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/4.1/install-disable-local-user)

- [Configuring an External Identity Provider in Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/4.1/install-config-ldap-pce)

- [Configuring SMTP in Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/4.1/access-management-SMTP)

- [Configuring DNS in Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/4.1/access-management-dns)

- [Configuring Security in Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/4.1/access-management-security)

- [Configuring a Disclaimer in Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/4.1/access-management-disclaimer)

- [Limiting Concurrent Login in Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/4.1/access-management-concurrent-login)

## See Also

- [About Servers, Server Groups, and Clusters](https://docs.mulesoft.com/runtime-manager/managing-servers)

- [Uploading Custom Policies](https://docs.mulesoft.com/mule-gateway/policies-custom-upload-to-exchange)

- [Maven facade API](https://anypoint.mulesoft.com/exchange/portals/anypoint-platform/f1e97bc6-315a-4490-82a7-23abe036327a.anypoint-platform/exchange-maven-facade-api-http/)

<!-- document id=c5ff2012b725dd0f9dea588e614f160569e67c3e7639cf0be30ba7b605740f3e url=/mulesoft/current/en-us/private-cloud/4.2/config-workflow.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.2
---

# Configuring Anypoint Platform PCE

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

After you complete the Anypoint Platform Private Cloud Edition (Anypoint Platform PCE) installation,
review the following task to deploy and manage applications, register APIs, and use API Exchange on
an Anypoint Platform PCE environment running on your own local network.

- [Deleting the Local User after Installing Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/4.2/install-disable-local-user)

- [Configuring an External Identity Provider in Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/4.2/install-config-ldap-pce)

- [Configuring SMTP in Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/4.2/access-management-SMTP)

- [Configuring DNS in Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/4.2/access-management-dns)

- [Configuring Security in Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/4.2/access-management-security)

- [Configuring a Disclaimer in Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/4.2/access-management-disclaimer)

- [Limiting Concurrent Login in Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/4.2/access-management-concurrent-login)

## See Also

- [About Servers, Server Groups, and Clusters](https://docs.mulesoft.com/runtime-manager/managing-servers)

- [Uploading Custom Policies](https://docs.mulesoft.com/mule-gateway/policies-custom-upload-to-exchange)

- [Maven facade API](https://anypoint.mulesoft.com/exchange/portals/anypoint-platform/f1e97bc6-315a-4490-82a7-23abe036327a.anypoint-platform/exchange-maven-facade-api-http/)

<!-- document id=3dbc995fd1096f72e48e3a958ebed8b6361a47fb73677561ee56f0139b6c5c8d url=/mulesoft/current/en-us/private-cloud/latest/config-workflow.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.3
is-latest-version: true
---

# Configuring Anypoint Platform PCE

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

After you complete the Anypoint Platform Private Cloud Edition (Anypoint Platform PCE) installation,
review the following task to deploy and manage applications, register APIs, and use API Exchange on
an Anypoint Platform PCE environment running on your own local network.

- [Deleting the Local User after Installing Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/latest/install-disable-local-user)

- [Configuring an External Identity Provider in Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/latest/install-config-ldap-pce)

- [Configuring SMTP in Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/latest/access-management-SMTP)

- [Configuring DNS in Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/latest/access-management-dns)

- [Configuring Security in Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/latest/access-management-security)

- [Configuring a Disclaimer in Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/latest/access-management-disclaimer)

- [Limiting Concurrent Login in Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/latest/access-management-concurrent-login)

## See Also

- [About Servers, Server Groups, and Clusters](https://docs.mulesoft.com/runtime-manager/managing-servers)

- [Uploading Custom Policies](https://docs.mulesoft.com/mule-gateway/policies-custom-upload-to-exchange)

- [Maven facade API](https://anypoint.mulesoft.com/exchange/portals/anypoint-platform/f1e97bc6-315a-4490-82a7-23abe036327a.anypoint-platform/exchange-maven-facade-api-http/)

<!-- document id=33dc5673e15346f767776d2a442b1e011ce519e7f767c51e904ebe98c16a14c0 url=/mulesoft/current/en-us/private-cloud/4.0/config-studio.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.0
---

# Configuring Anypoint Studio for Anypoint Platform PCE

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Anypoint Studio 7.19 and later adds support for Anypoint Platform Private Cloud Edition (Anypoint
Platform PCE) version 4.0.0.

## Configure Your PCE Certificates into Studio

Integrate your Studio installation with the Anypoint Platform components in an Anypoint Platform PCE
deployment.

### Determine the Java Version and Location

1.  In Studio, go to **Anypoint Studio** > **Settings**.

2.  Select **Java** > **Installed JRES**.

3.  Check the location of the JRE you use: Java 8 or Java 17.

![JRE location in Anypoint Studio](/mulesoft/current/en-us/studio/_images/pce4-jre-location.png)

### Export the Certificate Using the Platform DNS

Run the following command by replacing `<ANYPOINT_DNS>` with your actual server URL:

`keytool -printcert -sslserver <ANYPOINT_DNS>:443 -rfc > /tmp/PCE_Certificate.cer`

For example:

```xml
keytool -printcert -sslserver $ANYPOINT_DNS:443 -rfc > /tmp/PCE_Certificate.cer
```

Starting with Anypoint Studio 7.17, the default JDK version for Studio is Java 17. To ensure proper
functionality, add the certificate to the default JDK version that Studio supports.

- If you use an external JDK, add the certificate to the external JDK that you use with Studio.

- If you use the default JDK Studio provides, add the certificate to the default JDK, regardless of
  the JDK version you use in your project. After installing the certificate, if you have Studio
  open, restart it.

### Import the Certificate

Run the following command by replacing `<JAVA_HOME>` with the path to your embedded Java in Studio:

`sudo keytool -import -trustcacerts -keystore <JAVA_HOME>/lib/security/cacerts -storepass changeit -file /tmp/PCE_Certificate.cer`

For example, if you’re using the embedded Java 17 on macOS:

```xml
sudo keytool -import -trustcacerts -keystore /Applications/AnypointStudio.app/Contents/Eclipse/plugins/org.mule.tooling.jdk.macosx.x86_64_1.3.0/Contents/Home/jre/lib/security/cacerts -storepass changeit -file /tmp/PCE_Certificate.cer`
```

For example, if you’re using the embedded Java 17 on Windows:

```xml
keytool -import -trustcacerts -keystore C:[...]\AnypointStudio\plugins\org.mule.tooling.jdk.win32.x86_64_1.3.3\lib\security\cacerts -storepass changeit -file /tmp/PCE_Certificate.cer (1)
```

<table><tbody><tr><td><i data-value="1"></i><b>1</b></td><td>The path changes with each Studio version because the JDK plugin version is included in the Windows path, and Studio includes a different JDK plugin version with each release.</td></tr></tbody></table>

### Set a Private Cloud Instance URL

1.  In Studio, go to **Anypoint Studio** > **Settings**.

2.  Select **Anypoint Studio** > **Anypoint Platform**.

    ![Anypoint Studio highlighted in the navigation bar.](/mulesoft/current/en-us/reuse/_images/studio-anypoint-platform-settings.png)

3.  Select the **Use a Private Cloud Instance URL**.

4.  Type the URL of your PCE installation in **Private Cloud Instance URL**.

    ![\*Private Cloud Instance URL\* field highlighted in the in the \*PCE Settings\* section.](/mulesoft/current/en-us/studio/_images/pce-properties.png)

5.  Click **Apply and Close**.

6.  Restart Studio.

## Configure your PCE User Login

The first time you configure your user’s login, Studio asks you to confirm your PCE certificate:

1.  Open the preferences view.  
    Either navigate to **Anypoint Studio** > **Preferences…​** or press `cmd + ,`.

2.  Expand **Anypoint Studio** in the left navigation bar, select **Authentication** > **Add**.

    ![\*Authentication\* option and \*Add\* button highlighted in the \*Preference\* window.](/mulesoft/current/en-us/studio/_images/preferences-authentication-add.png)

3.  Select **Yes** in the **Invalid Certificate** message that appears.

    ![\*Yes\* button highlighted in the \*Invalid Certificate\* message window.](/mulesoft/current/en-us/studio/_images/invalid-certificate-pce.png)

4.  Add your PCE credentials and sign-in.

5.  Select **Apply and Close**.

6.  Restart Studio.

## See Also

- [Managing Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/4.0/operating-about)

<!-- document id=ff8835356d0fa177a3a425e08527297eee1307cb401a75e99a48b33a84c81e00 url=/mulesoft/current/en-us/private-cloud/4.1/config-studio.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.1
---

# Configuring Anypoint Studio for Anypoint Platform PCE

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Anypoint Studio 7.19 and later adds support for Anypoint Platform Private Cloud Edition (Anypoint
Platform PCE) version 4.0.0.

## Configure Your PCE Certificates into Studio

Integrate your Studio installation with the Anypoint Platform components in an Anypoint Platform PCE
deployment.

### Determine the Java Version and Location

1.  In Studio, go to **Anypoint Studio** > **Settings**.

2.  Select **Java** > **Installed JRES**.

3.  Check the location of the JRE you use: Java 8 or Java 17.

![JRE location in Anypoint Studio](/mulesoft/current/en-us/studio/_images/pce4-jre-location.png)

### Export the Certificate Using the Platform DNS

Run the following command by replacing `<ANYPOINT_DNS>` with your actual server URL:

`keytool -printcert -sslserver <ANYPOINT_DNS>:443 -rfc > /tmp/PCE_Certificate.cer`

For example:

```xml
keytool -printcert -sslserver $ANYPOINT_DNS:443 -rfc > /tmp/PCE_Certificate.cer
```

Starting with Anypoint Studio 7.17, the default JDK version for Studio is Java 17. To ensure proper
functionality, add the certificate to the default JDK version that Studio supports.

- If you use an external JDK, add the certificate to the external JDK that you use with Studio.

- If you use the default JDK Studio provides, add the certificate to the default JDK, regardless of
  the JDK version you use in your project. After installing the certificate, if you have Studio
  open, restart it.

### Import the Certificate

Run the following command by replacing `<JAVA_HOME>` with the path to your embedded Java in Studio:

`sudo keytool -import -trustcacerts -keystore <JAVA_HOME>/lib/security/cacerts -storepass changeit -file /tmp/PCE_Certificate.cer`

For example, if you’re using the embedded Java 17 on macOS:

```xml
sudo keytool -import -trustcacerts -keystore /Applications/AnypointStudio.app/Contents/Eclipse/plugins/org.mule.tooling.jdk.macosx.x86_64_1.3.0/Contents/Home/jre/lib/security/cacerts -storepass changeit -file /tmp/PCE_Certificate.cer`
```

For example, if you’re using the embedded Java 17 on Windows:

```xml
keytool -import -trustcacerts -keystore C:[...]\AnypointStudio\plugins\org.mule.tooling.jdk.win32.x86_64_1.3.3\lib\security\cacerts -storepass changeit -file /tmp/PCE_Certificate.cer (1)
```

<table><tbody><tr><td><i data-value="1"></i><b>1</b></td><td>The path changes with each Studio version because the JDK plugin version is included in the Windows path, and Studio includes a different JDK plugin version with each release.</td></tr></tbody></table>

### Set a Private Cloud Instance URL

1.  In Studio, go to **Anypoint Studio** > **Settings**.

2.  Select **Anypoint Studio** > **Anypoint Platform**.

    ![Anypoint Studio highlighted in the navigation bar.](/mulesoft/current/en-us/reuse/_images/studio-anypoint-platform-settings.png)

3.  Select the **Use a Private Cloud Instance URL**.

4.  Type the URL of your PCE installation in **Private Cloud Instance URL**.

    ![\*Private Cloud Instance URL\* field highlighted in the in the \*PCE Settings\* section.](/mulesoft/current/en-us/studio/_images/pce-properties.png)

5.  Click **Apply and Close**.

6.  Restart Studio.

## Configure your PCE User Login

The first time you configure your user’s login, Studio asks you to confirm your PCE certificate:

1.  Open the preferences view.  
    Either navigate to **Anypoint Studio** > **Preferences…​** or press `cmd + ,`.

2.  Expand **Anypoint Studio** in the left navigation bar, select **Authentication** > **Add**.

    ![\*Authentication\* option and \*Add\* button highlighted in the \*Preference\* window.](/mulesoft/current/en-us/studio/_images/preferences-authentication-add.png)

3.  Select **Yes** in the **Invalid Certificate** message that appears.

    ![\*Yes\* button highlighted in the \*Invalid Certificate\* message window.](/mulesoft/current/en-us/studio/_images/invalid-certificate-pce.png)

4.  Add your PCE credentials and sign-in.

5.  Select **Apply and Close**.

6.  Restart Studio.

## See Also

- [Managing Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/4.1/operating-about)

<!-- document id=90c2cc1671844bde2fc5daa8f8d309bd76b4606f1059e69a56c5ea5e776a93e9 url=/mulesoft/current/en-us/private-cloud/4.2/config-studio.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.2
---

# Configuring Anypoint Studio for Anypoint Platform PCE

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Anypoint Studio 7.19 and later adds support for Anypoint Platform Private Cloud Edition (Anypoint
Platform PCE) version 4.0.0.

## Configure Your PCE Certificates into Studio

Integrate your Studio installation with the Anypoint Platform components in an Anypoint Platform PCE
deployment.

### Determine the Java Version and Location

1.  In Studio, go to **Anypoint Studio** > **Settings**.

2.  Select **Java** > **Installed JRES**.

3.  Check the location of the JRE you use: Java 8 or Java 17.

![JRE location in Anypoint Studio](/mulesoft/current/en-us/studio/_images/pce4-jre-location.png)

### Export the Certificate Using the Platform DNS

Run the following command by replacing `<ANYPOINT_DNS>` with your actual server URL:

`keytool -printcert -sslserver <ANYPOINT_DNS>:443 -rfc > /tmp/PCE_Certificate.cer`

For example:

```xml
keytool -printcert -sslserver $ANYPOINT_DNS:443 -rfc > /tmp/PCE_Certificate.cer
```

Starting with Anypoint Studio 7.17, the default JDK version for Studio is Java 17. To ensure proper
functionality, add the certificate to the default JDK version that Studio supports.

- If you use an external JDK, add the certificate to the external JDK that you use with Studio.

- If you use the default JDK Studio provides, add the certificate to the default JDK, regardless of
  the JDK version you use in your project. After installing the certificate, if you have Studio
  open, restart it.

### Import the Certificate

Run the following command by replacing `<JAVA_HOME>` with the path to your embedded Java in Studio:

`sudo keytool -import -trustcacerts -keystore <JAVA_HOME>/lib/security/cacerts -storepass changeit -file /tmp/PCE_Certificate.cer`

For example, if you’re using the embedded Java 17 on macOS:

```xml
sudo keytool -import -trustcacerts -keystore /Applications/AnypointStudio.app/Contents/Eclipse/plugins/org.mule.tooling.jdk.macosx.x86_64_1.3.0/Contents/Home/jre/lib/security/cacerts -storepass changeit -file /tmp/PCE_Certificate.cer`
```

For example, if you’re using the embedded Java 17 on Windows:

```xml
keytool -import -trustcacerts -keystore C:[...]\AnypointStudio\plugins\org.mule.tooling.jdk.win32.x86_64_1.3.3\lib\security\cacerts -storepass changeit -file /tmp/PCE_Certificate.cer (1)
```

<table><tbody><tr><td><i data-value="1"></i><b>1</b></td><td>The path changes with each Studio version because the JDK plugin version is included in the Windows path, and Studio includes a different JDK plugin version with each release.</td></tr></tbody></table>

### Set a Private Cloud Instance URL

1.  In Studio, go to **Anypoint Studio** > **Settings**.

2.  Select **Anypoint Studio** > **Anypoint Platform**.

    ![Anypoint Studio highlighted in the navigation bar.](/mulesoft/current/en-us/reuse/_images/studio-anypoint-platform-settings.png)

3.  Select the **Use a Private Cloud Instance URL**.

4.  Type the URL of your PCE installation in **Private Cloud Instance URL**.

    ![\*Private Cloud Instance URL\* field highlighted in the in the \*PCE Settings\* section.](/mulesoft/current/en-us/studio/_images/pce-properties.png)

5.  Click **Apply and Close**.

6.  Restart Studio.

## Configure your PCE User Login

The first time you configure your user’s login, Studio asks you to confirm your PCE certificate:

1.  Open the preferences view.  
    Either navigate to **Anypoint Studio** > **Preferences…​** or press `cmd + ,`.

2.  Expand **Anypoint Studio** in the left navigation bar, select **Authentication** > **Add**.

    ![\*Authentication\* option and \*Add\* button highlighted in the \*Preference\* window.](/mulesoft/current/en-us/studio/_images/preferences-authentication-add.png)

3.  Select **Yes** in the **Invalid Certificate** message that appears.

    ![\*Yes\* button highlighted in the \*Invalid Certificate\* message window.](/mulesoft/current/en-us/studio/_images/invalid-certificate-pce.png)

4.  Add your PCE credentials and sign-in.

5.  Select **Apply and Close**.

6.  Restart Studio.

## See Also

- [Managing Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/4.2/operating-about)

<!-- document id=35dd11ea9c2486b55ed3089e20975114a76507a733c96f821858c46a829bfcaa url=/mulesoft/current/en-us/private-cloud/latest/config-studio.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.3
is-latest-version: true
---

# Configuring Anypoint Studio for Anypoint Platform PCE

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Anypoint Studio 7.19 and later adds support for Anypoint Platform Private Cloud Edition (Anypoint
Platform PCE) version 4.0.0.

## Configure Your PCE Certificates into Studio

Integrate your Studio installation with the Anypoint Platform components in an Anypoint Platform PCE
deployment.

### Determine the Java Version and Location

1.  In Studio, go to **Anypoint Studio** > **Settings**.

2.  Select **Java** > **Installed JRES**.

3.  Check the location of the JRE you use: Java 8 or Java 17.

![JRE location in Anypoint Studio](/mulesoft/current/en-us/studio/_images/pce4-jre-location.png)

### Export the Certificate Using the Platform DNS

Run the following command by replacing `<ANYPOINT_DNS>` with your actual server URL:

`keytool -printcert -sslserver <ANYPOINT_DNS>:443 -rfc > /tmp/PCE_Certificate.cer`

For example:

```xml
keytool -printcert -sslserver $ANYPOINT_DNS:443 -rfc > /tmp/PCE_Certificate.cer
```

Starting with Anypoint Studio 7.17, the default JDK version for Studio is Java 17. To ensure proper
functionality, add the certificate to the default JDK version that Studio supports.

- If you use an external JDK, add the certificate to the external JDK that you use with Studio.

- If you use the default JDK Studio provides, add the certificate to the default JDK, regardless of
  the JDK version you use in your project. After installing the certificate, if you have Studio
  open, restart it.

### Import the Certificate

Run the following command by replacing `<JAVA_HOME>` with the path to your embedded Java in Studio:

`sudo keytool -import -trustcacerts -keystore <JAVA_HOME>/lib/security/cacerts -storepass changeit -file /tmp/PCE_Certificate.cer`

For example, if you’re using the embedded Java 17 on macOS:

```xml
sudo keytool -import -trustcacerts -keystore /Applications/AnypointStudio.app/Contents/Eclipse/plugins/org.mule.tooling.jdk.macosx.x86_64_1.3.0/Contents/Home/jre/lib/security/cacerts -storepass changeit -file /tmp/PCE_Certificate.cer`
```

For example, if you’re using the embedded Java 17 on Windows:

```xml
keytool -import -trustcacerts -keystore C:[...]\AnypointStudio\plugins\org.mule.tooling.jdk.win32.x86_64_1.3.3\lib\security\cacerts -storepass changeit -file /tmp/PCE_Certificate.cer (1)
```

<table><tbody><tr><td><i data-value="1"></i><b>1</b></td><td>The path changes with each Studio version because the JDK plugin version is included in the Windows path, and Studio includes a different JDK plugin version with each release.</td></tr></tbody></table>

### Set a Private Cloud Instance URL

1.  In Studio, go to **Anypoint Studio** > **Settings**.

2.  Select **Anypoint Studio** > **Anypoint Platform**.

    ![Anypoint Studio highlighted in the navigation bar.](/mulesoft/current/en-us/reuse/_images/studio-anypoint-platform-settings.png)

3.  Select the **Use a Private Cloud Instance URL**.

4.  Type the URL of your PCE installation in **Private Cloud Instance URL**.

    ![\*Private Cloud Instance URL\* field highlighted in the in the \*PCE Settings\* section.](/mulesoft/current/en-us/studio/_images/pce-properties.png)

5.  Click **Apply and Close**.

6.  Restart Studio.

## Configure your PCE User Login

The first time you configure your user’s login, Studio asks you to confirm your PCE certificate:

1.  Open the preferences view.  
    Either navigate to **Anypoint Studio** > **Preferences…​** or press `cmd + ,`.

2.  Expand **Anypoint Studio** in the left navigation bar, select **Authentication** > **Add**.

    ![\*Authentication\* option and \*Add\* button highlighted in the \*Preference\* window.](/mulesoft/current/en-us/studio/_images/preferences-authentication-add.png)

3.  Select **Yes** in the **Invalid Certificate** message that appears.

    ![\*Yes\* button highlighted in the \*Invalid Certificate\* message window.](/mulesoft/current/en-us/studio/_images/invalid-certificate-pce.png)

4.  Add your PCE credentials and sign-in.

5.  Select **Apply and Close**.

6.  Restart Studio.

## See Also

- [Managing Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/latest/operating-about)

<!-- document id=2650c4a4386a3b6b1fb2aeb474a42c3200dec71702faafdf6561e9feaf1bce09 url=/mulesoft/current/en-us/private-cloud/4.0/backup-and-disaster-recovery.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.0
---

# Configuring Backup and Restore for Anypoint Platform PCE

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Anypoint Platform Private Cloud Edition (Anypoint Platform PCE) requires you to install, configure,
and manage an NFS server, ensuring frequent backups are configured and performed.

To preserve your data:

- Enable automatic backups to protect against system failures or operational issues.

- Schedule backups at least daily, or more frequently based on your needs.

- Store backups externally, outside the Anypoint Platform cluster.

The backup and restore process is controlled via Anypoint Platform PCE APIs.

## Create a Backup

To create a backup, run the following command:

`curl -k <platform-dns>/platform/backup-X POST -H 'Authorization: Bearer ${token}' -H 'Content-Type: application/json' -d '{"backup-file-name": "${backupFileName}.tar.gz", "nfs-server": "${fileSystemDns}", "nfs-path": "/"}'`

### Backup Content

<table><colgroup><col> <col></colgroup><thead><tr><th>Information</th><th>Included in Anypoint Platform PCE Backup</th></tr></thead><tbody><tr><td><p>Databases</p></td><td><p>Yes</p></td></tr><tr><td><p>Configurations</p></td><td><p>Yes</p></td></tr><tr><td><p>Secrets</p></td><td><p>Yes</p></td></tr><tr><td><p>Object Store</p></td><td><p>Yes</p></td></tr><tr><td><p>Disclaimer settings</p></td><td><p>Yes</p></td></tr><tr><td><p>SMTP settings</p></td><td><p>Yes</p></td></tr><tr><td><p>DNS settings</p></td><td><p>No</p></td></tr><tr><td><p>Platform certificate</p></td><td><p>No</p></td></tr><tr><td><p>Ops Center certificate</p></td><td><p>No</p></td></tr><tr><td><p>NFS settings</p></td><td><p>No</p></td></tr><tr><td><p>NFS files</p></td><td><p>No</p></td></tr><tr><td><p>Drives</p></td><td><p>No</p></td></tr><tr><td><p>Runtimes*</p></td><td><p>No</p></td></tr><tr><td><p>Anypoint Monitoring metrics</p></td><td><p>No</p></td></tr></tbody></table>

\*Anypoint Platform PCE has information only about runtimes, such as their names and status.

## Perform a System Restore

Consider the following before you perform a system restore:

- Before running a restore, configure certain settings, such as NFS, certificates, and DNS because
  they are not included in the backup.

- Backups cannot be transferred between different versions of Anypoint Platform PCE; therefore, your
  new installation must match the version of your backup.

To perform the restore, run the following command:

`curl -k <platform-dns>/platform/restore-X POST -H 'Authorization: Bearer ${token}' -H 'Content-Type: application/json' -d '{"backup-file-name": "${backupFileName}.tar.gz", "nfs-server": "${fileSystemDns}", "nfs-path": "/"}`

The backup file is stored on the NFS storage.

## See Also

- [Managing Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/4.0/operating-about)

- [Installing Anypoint Platform Private Cloud](https://docs.mulesoft.com/private-cloud/4.0/install-workflow)

- [Upgrade Anypoint Platform Private Cloud](https://docs.mulesoft.com/private-cloud/4.0/upgrade)

<!-- document id=407142558401dc592c5f5a2b3398faa1ada21e3cf6cd501b6eecc248a5e112a1 url=/mulesoft/current/en-us/private-cloud/4.1/backup-and-disaster-recovery.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.1
---

# Configuring Backup and Restore for Anypoint Platform PCE

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Anypoint Platform Private Cloud Edition (Anypoint Platform PCE) requires you to install, configure,
and manage an NFS server, ensuring frequent backups are configured and performed.

To preserve your data:

- Enable automatic backups to protect against system failures or operational issues.

- Schedule backups at least daily, or more frequently based on your needs.

- Store backups externally, outside the Anypoint Platform cluster.

The backup and restore process is controlled via Anypoint Platform PCE APIs.

## Create a Backup

To create a backup, run the following command:

`curl -k <platform-dns>/platform/backup-X POST -H 'Authorization: Bearer ${token}' -H 'Content-Type: application/json' -d '{"backup-file-name": "${backupFileName}.tar.gz", "nfs-server": "${fileSystemDns}", "nfs-path": "/"}'`

### Backup Content

<table><colgroup><col> <col></colgroup><thead><tr><th>Information</th><th>Included in Anypoint Platform PCE Backup</th></tr></thead><tbody><tr><td><p>Databases</p></td><td><p>Yes</p></td></tr><tr><td><p>Configurations</p></td><td><p>Yes</p></td></tr><tr><td><p>Secrets</p></td><td><p>Yes</p></td></tr><tr><td><p>Object Store</p></td><td><p>Yes</p></td></tr><tr><td><p>Disclaimer settings</p></td><td><p>Yes</p></td></tr><tr><td><p>SMTP settings</p></td><td><p>Yes</p></td></tr><tr><td><p>DNS settings</p></td><td><p>No</p></td></tr><tr><td><p>Platform certificate</p></td><td><p>No</p></td></tr><tr><td><p>NFS settings</p></td><td><p>No</p></td></tr><tr><td><p>NFS files</p></td><td><p>No</p></td></tr><tr><td><p>Drives</p></td><td><p>No</p></td></tr><tr><td><p>Runtimes*</p></td><td><p>No</p></td></tr><tr><td><p>Anypoint Monitoring metrics</p></td><td><p>No</p></td></tr></tbody></table>

\*Anypoint Platform PCE has information only about runtimes, such as their names and status.

## Perform a System Restore

Consider the following before you perform a system restore:

- Before running a restore, configure certain settings, such as NFS, certificates, and DNS because
  they are not included in the backup.

- Backups cannot be transferred between different versions of Anypoint Platform PCE; therefore, your
  new installation must match the version of your backup.

To perform the restore, run the following command:

`curl -k <platform-dns>/platform/restore-X POST -H 'Authorization: Bearer ${token}' -H 'Content-Type: application/json' -d '{"backup-file-name": "${backupFileName}.tar.gz", "nfs-server": "${fileSystemDns}", "nfs-path": "/"}`

The backup file is stored on the NFS storage.

## Create an InfluxDB Backup

To create an InfluxDB backup, run the this command:

`curl -k <platform-dns>/platform/amv/backup-X POST -H 'Authorization: Bearer ${token}' -H 'Content-Type: application/json' -d '{"backup-file-name": "${backupFileName}.tar.gz", "nfs-server": "${fileSystemDns}", "nfs-path": "/"}'`

## Perform an InfluxDB Restore

To perform an InfluxDB restore, run this command:

`curl -k <platform-dns>/platform/amv/restore-X POST -H 'Authorization: Bearer ${token}' -H 'Content-Type: application/json' -d '{"backup-file-name": "${backupFileName}.tar.gz", "nfs-server": "${fileSystemDns}", "nfs-path": "/"}'`

The backup file is stored on the NFS storage.

## See Also

- [Managing Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/4.1/operating-about)

- [Installing Anypoint Platform Private Cloud](https://docs.mulesoft.com/private-cloud/4.1/install-workflow)

- [Upgrade Anypoint Platform Private Cloud](https://docs.mulesoft.com/private-cloud/4.1/upgrade)

<!-- document id=084b974d730a7ae2bfc09a494b9f0fd2347bc6b195d8c4a9b6f9af87cea337df url=/mulesoft/current/en-us/private-cloud/4.2/backup-and-disaster-recovery.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.2
---

# Configuring Backup and Restore for Anypoint Platform PCE

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Anypoint Platform Private Cloud Edition (Anypoint Platform PCE) requires you to install, configure,
and manage an NFS server, ensuring frequent backups are configured and performed.

To preserve your data:

- Enable automatic backups to protect against system failures or operational issues.

- Schedule backups at least daily, or more frequently based on your needs.

- Store backups externally, outside the Anypoint Platform cluster.

The backup and restore process is controlled via Anypoint Platform PCE APIs.

## Create a Backup

To create a backup, run the following command:

`curl -k <platform-dns>/platform/backup-X POST -H 'Authorization: Bearer ${token}' -H 'Content-Type: application/json' -d '{"backup-file-name": "${backupFileName}.tar.gz"}'`

### Backup Content

<table><colgroup><col> <col></colgroup><thead><tr><th>Information</th><th>Included in Anypoint Platform PCE Backup</th></tr></thead><tbody><tr><td><p>Databases</p></td><td><p>Yes</p></td></tr><tr><td><p>Configurations</p></td><td><p>Yes</p></td></tr><tr><td><p>Secrets</p></td><td><p>Yes</p></td></tr><tr><td><p>Object Store</p></td><td><p>Yes</p></td></tr><tr><td><p>Disclaimer settings</p></td><td><p>Yes</p></td></tr><tr><td><p>SMTP settings</p></td><td><p>Yes</p></td></tr><tr><td><p>DNS settings</p></td><td><p>No</p></td></tr><tr><td><p>Platform certificate</p></td><td><p>No</p></td></tr><tr><td><p>NFS settings</p></td><td><p>No</p></td></tr><tr><td><p>NFS files</p></td><td><p>No</p></td></tr><tr><td><p>Drives</p></td><td><p>No</p></td></tr><tr><td><p>Runtimes*</p></td><td><p>No</p></td></tr><tr><td><p>Anypoint Monitoring metrics</p></td><td><p>No</p></td></tr></tbody></table>

\*Anypoint Platform PCE has information only about runtimes, such as their names and status.

## Perform a System Restore

Consider the following before you perform a system restore:

- Before running a restore, configure certain settings, such as NFS, certificates, and DNS because
  they are not included in the backup.

- Backups cannot be transferred between different versions of Anypoint Platform PCE; therefore, your
  new installation must match the version of your backup.

To perform the restore, run the following command:

`curl -k <platform-dns>/platform/restore-X POST -H 'Authorization: Bearer ${token}' -H 'Content-Type: application/json' -d '{"backup-file-name": "${backupFileName}.tar.gz"}`

The backup file is stored on the NFS storage.

## Create an InfluxDB Backup

To create an InfluxDB backup, run the this command:

`curl -k <platform-dns>/platform/amv/backup-X POST -H 'Authorization: Bearer ${token}' -H 'Content-Type: application/json' -d '{"backup-file-name": "${backupFileName}.tar.gz"}'`

## Perform an InfluxDB Restore

To perform an InfluxDB restore, run this command:

`curl -k <platform-dns>/platform/amv/restore-X POST -H 'Authorization: Bearer ${token}' -H 'Content-Type: application/json' -d '{"backup-file-name": "${backupFileName}.tar.gz"}'`

The backup file is stored on the NFS storage.

## See Also

- [Managing Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/4.2/operating-about)

- [Installing Anypoint Platform Private Cloud](https://docs.mulesoft.com/private-cloud/4.2/install-workflow)

- [Upgrade Anypoint Platform Private Cloud](https://docs.mulesoft.com/private-cloud/4.2/upgrade)

<!-- document id=027c8ae4a982cf030efe42810285b7a7e0a7d8d908e0970136f0c8e36763620a url=/mulesoft/current/en-us/private-cloud/latest/backup-and-disaster-recovery.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.3
is-latest-version: true
---

# Configuring Backup and Restore for Anypoint Platform PCE

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Anypoint Platform Private Cloud Edition (Anypoint Platform PCE) stores backup archives on the
platform shared filesystem. Depending on the storage mode you selected at installation, this is
either an NFS server (NFS mode) or a dynamically provisioned volume from your RWX-capable
`StorageClass` (StorageClass mode, Anypoint Platform PCE 4.3.0 and later). Make sure that the
storage backing your shared filesystem is highly available and that frequent backups are configured
and performed.

> [!IMPORTANT] In StorageClass mode, use a `StorageClass` with `reclaimPolicy: Retain` for the
> backup-restore volume so that deleting the `PersistentVolumeClaim` does not destroy historical
> data.

To preserve your data:

- Enable automatic backups to protect against system failures or operational issues.

- Schedule backups at least daily, or more frequently based on your needs.

- Store backups externally, outside the Anypoint Platform cluster.

The backup and restore process is controlled via Anypoint Platform PCE APIs.

## Create a Backup

To create a backup, run the following command:

`curl -k <platform-dns>/platform/backup-X POST -H 'Authorization: Bearer ${token}' -H 'Content-Type: application/json' -d '{"backup-file-name": "${backupFileName}.tar.gz"}'`

### Backup Content

<table><colgroup><col> <col></colgroup><thead><tr><th>Information</th><th>Included in Anypoint Platform PCE Backup</th></tr></thead><tbody><tr><td><p>Databases</p></td><td><p>Yes</p></td></tr><tr><td><p>Configurations</p></td><td><p>Yes</p></td></tr><tr><td><p>Secrets</p></td><td><p>Yes</p></td></tr><tr><td><p>Object Store</p></td><td><p>Yes</p></td></tr><tr><td><p>Disclaimer settings</p></td><td><p>Yes</p></td></tr><tr><td><p>SMTP settings</p></td><td><p>Yes</p></td></tr><tr><td><p>DNS settings</p></td><td><p>No</p></td></tr><tr><td><p>Platform certificate</p></td><td><p>No</p></td></tr><tr><td><p>Shared filesystem settings (NFS or StorageClass)</p></td><td><p>No</p></td></tr><tr><td><p>Shared filesystem contents</p></td><td><p>No</p></td></tr><tr><td><p>Drives</p></td><td><p>No</p></td></tr><tr><td><p>Runtimes*</p></td><td><p>No</p></td></tr><tr><td><p>Anypoint Monitoring metrics</p></td><td><p>No</p></td></tr></tbody></table>

\*Anypoint Platform PCE has information only about runtimes, such as their names and status.

## Perform a System Restore

Consider the following before you perform a system restore:

- Before running a restore, configure certain settings, such as the shared filesystem (NFS or
  StorageClass), certificates, and DNS because they are not included in the backup.

- Backups cannot be transferred between different versions of Anypoint Platform PCE; therefore, your
  new installation must match the version of your backup.

- The new installation must use the same storage mode (NFS or StorageClass) as the source
  installation. The installer rejects changes to the storage mode on an existing cluster.

To perform the restore, run the following command:

`curl -k <platform-dns>/platform/restore-X POST -H 'Authorization: Bearer ${token}' -H 'Content-Type: application/json' -d '{"backup-file-name": "${backupFileName}.tar.gz"}`

The backup file is stored on the platform shared filesystem.

## Create an InfluxDB Backup

To create an InfluxDB backup, run the this command:

`curl -k <platform-dns>/platform/amv/backup-X POST -H 'Authorization: Bearer ${token}' -H 'Content-Type: application/json' -d '{"backup-file-name": "${backupFileName}.tar.gz"}'`

## Perform an InfluxDB Restore

To perform an InfluxDB restore, run this command:

`curl -k <platform-dns>/platform/amv/restore-X POST -H 'Authorization: Bearer ${token}' -H 'Content-Type: application/json' -d '{"backup-file-name": "${backupFileName}.tar.gz"}'`

The backup file is stored on the platform shared filesystem.

## See Also

- [Managing Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/latest/operating-about)

- [Installing Anypoint Platform Private Cloud](https://docs.mulesoft.com/private-cloud/latest/install-workflow)

- [Upgrade Anypoint Platform Private Cloud](https://docs.mulesoft.com/private-cloud/latest/upgrade)

<!-- document id=c055d122c2cf137176e9216b9dc87771f40f12e42d40b2052ec15e5b86d40c8d url=/mulesoft/current/en-us/private-cloud/4.0/access-management-dns.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.0
---

# Configuring DNS on Anypoint Platform PCE

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

For Mule runtime engine (Mule) to communicate with Anypoint Platform, you must provide the DNS or IP
address where your Anypoint Platform Private Cloud Edition (Anypoint Platform PCE) installation is
exposed to the local network. To do so, follow these steps:

1.  From Anypoint Platform, click **Access Management**.

2.  Click **DNS/IP**.

3.  In **Platform DNS/IP**, enter the address where you are hosting the platform.

4.  Click **Save**.

> [!NOTE] If you perform a DNS update that changes the endpoints that Mule instances use to connect
> to Runtime Manager, you must restart the Mule instances before they can connect to the new
> endpoints.

## See Also

- [Configuring Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/4.0/config-workflow)

<!-- document id=58459e87ce5fbdfd227bebdca421847db26840a4cd1ecfc1c32431a8d1a51cc7 url=/mulesoft/current/en-us/private-cloud/4.1/access-management-dns.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.1
---

# Configuring DNS on Anypoint Platform PCE

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

For Mule runtime engine (Mule) to communicate with Anypoint Platform, you must provide the DNS or IP
address where your Anypoint Platform Private Cloud Edition (Anypoint Platform PCE) installation is
exposed to the local network. To do so, follow these steps:

1.  From Anypoint Platform, click **Access Management**.

2.  Click **DNS/IP**.

3.  In **Platform DNS/IP**, enter the address where you are hosting the platform.

4.  Click **Save**.

> [!NOTE] If you perform a DNS update that changes the endpoints that Mule instances use to connect
> to Runtime Manager, you must restart the Mule instances before they can connect to the new
> endpoints.

## See Also

- [Configuring Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/4.1/config-workflow)

<!-- document id=f91f9ba03c06ca6706d903716f4f120b93b06cdb8835e600736233bd1f73a036 url=/mulesoft/current/en-us/private-cloud/4.2/access-management-dns.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.2
---

# Configuring DNS on Anypoint Platform PCE

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

For Mule runtime engine (Mule) to communicate with Anypoint Platform, you must provide the DNS or IP
address where your Anypoint Platform Private Cloud Edition (Anypoint Platform PCE) installation is
exposed to the local network. To do so, follow these steps:

1.  From Anypoint Platform, click **Access Management**.

2.  Click **DNS/IP**.

3.  In **Platform DNS/IP**, enter the address where you are hosting the platform.

4.  Click **Save**.

> [!NOTE] If you perform a DNS update that changes the endpoints that Mule instances use to connect
> to Runtime Manager, you must restart the Mule instances before they can connect to the new
> endpoints.

## See Also

- [Configuring Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/4.2/config-workflow)

<!-- document id=68a1b176d5d4a8e54ff7d2b9f55f5f57f947683b3a1128fa7182c09b12fc8ef2 url=/mulesoft/current/en-us/private-cloud/latest/access-management-dns.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.3
is-latest-version: true
---

# Configuring DNS on Anypoint Platform PCE

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

For Mule runtime engine (Mule) to communicate with Anypoint Platform, you must provide the DNS or IP
address where your Anypoint Platform Private Cloud Edition (Anypoint Platform PCE) installation is
exposed to the local network. To do so, follow these steps:

1.  From Anypoint Platform, click **Access Management**.

2.  Click **DNS/IP**.

3.  In **Platform DNS/IP**, enter the address where you are hosting the platform.

4.  Click **Save**.

> [!NOTE] If you perform a DNS update that changes the endpoints that Mule instances use to connect
> to Runtime Manager, you must restart the Mule instances before they can connect to the new
> endpoints.

## See Also

- [Configuring Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/latest/config-workflow)

<!-- document id=56c36ebc94dd7276594a5e0ac951bc5f916834a8c41bd1b44c0e4a5393a26e34 url=/mulesoft/current/en-us/private-cloud/4.0/grafana-dashboards.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.0
---

# Configuring Grafana Dashboards

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Monitor the health of your Anypoint Platform Private Cloud Edition (Anypoint Platform PCE)
installation and its running applications with Grafana dashboards. These dashboards provide a visual
representation of the data collected by the monitoring tools in your Anypoint Platform PCE
installation.

The Grafana application uses a Kubernetes service of type `NodePort` to expose the service to the
external network. To access Grafana, configure the load balancer to forward traffic to port `32380`.

Alternatively, use the `kubectl port-forward` command to access Grafana locally:

```bash
kubectl -n monitoring port-forward $(kubectl -n monitoring get svc --selector='app.kubernetes.io/name=grafana' -oname | head -n 1) 3000:80
```

## Access the Grafana Dashboard

To retrieve credentials for Grafana, use these commands:

```bash
kubectl -n monitoring get secrets grafana-creds -ojsonpath='{.data.admin-user}' | base64 --decode
kubectl -n monitoring get secrets grafana-creds -ojsonpath='{.data.admin-password}' | base64 --decode
```

## Create a Custom Dashboard

You can create custom dashboards in Grafana using its web interface. However, these dashboards are
lost if the Grafana pod restarts. To create a custom dashboard that persists across restarts, create
a ConfigMap with the label `grafana_dashboard=1`.

This example demonstrates how to create a ConfigMap with a custom dashboard:

1.  Create a file with the dashboard configuration, for example, `example-redis.yaml`:

```yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: my-custom-dashboard
  namespace: monitoring
  labels:
    grafana_dashboard: "1"
data:
  example-redis.json: |
    {
      "annotations": {
        "list": [
          {
            "builtIn": 1,
            "datasource": "-- Grafana --",
            "enable": true,
            "hide": true,
            "iconColor": "rgba(0, 211, 255, 1)",
            "name": "Annotations & Alerts",
            "type": "dashboard"
          }
        ]
      },
      "timezone": "browser",
      "title": "My Example Redis Dashboard",
      "description": "",
      "editable": true,
      "gnetId": null,
      "graphTooltip": 0,
      "id": 29,
      "iteration": 1645573265624,
      "links": [],
      "panels": [
        {
          "aliasColors": {
            "Max": "#890F02",
            "Used": "#7EB26D",
            "max": "#BF1B00"
          },
          "bars": false,
          "dashes": false,
          "datasource": null,
          "editable": false,
          "error": false,
          "fieldConfig": {
            "defaults": {},
            "overrides": []
          },
          "fill": 1,
          "fillGradient": 0,
          "hiddenSeries": false,
          "id": 7,
          "isNew": true,
          "legend": {
            "avg": false,
            "current": false,
            "hideEmpty": false,
            "hideZero": false,
            "max": false,
            "min": false,
            "show": true,
            "total": false,
            "values": false
          },
          "gridPos": {
            "x": 0,
            "y": 0,
            "h": 11,
            "w": 24
          },
          "lines": true,
          "linewidth": 2,
          "links": [],
          "nullPointMode": "null as zero",
          "options": {
            "alertThreshold": true
          },
          "percentage": false,
          "pluginVersion": "7.5.10",
          "pointradius": 5,
          "points": false,
          "renderer": "flot",
          "seriesOverrides": [],
          "spaceLength": 10,
          "stack": false,
          "steppedLine": false,
          "targets": [
            {
              "exemplar": true,
              "expr": "sum by (pod)(redis_used_memory{pod=~\"$pod\"})",
              "interval": "",
              "legendFormat": "{{pod}}",
              "refId": "B"
            }
          ],
          "thresholds": [],
          "timeFrom": null,
          "timeRegions": [],
          "timeShift": null,
          "title": "Memory Usage",
          "tooltip": {
            "msResolution": false,
            "shared": true,
            "sort": 0,
            "value_type": "cumulative"
          },
          "type": "graph",
          "xaxis": {
            "buckets": null,
            "mode": "time",
            "name": null,
            "show": true,
            "values": []
          },
          "yaxes": [
            {
              "format": "bytes",
              "label": "",
              "logBase": 1,
              "max": null,
              "min": 0,
              "show": true
            },
            {
              "format": "short",
              "label": null,
              "logBase": 1,
              "max": null,
              "min": null,
              "show": false
            }
          ],
          "yaxis": {
            "align": false,
            "alignLevel": null
          }
        }
      ],
      "refresh": false,
      "schemaVersion": 27,
      "style": "dark",
      "tags": [],
      "templating": {
        "list": [
          {
            "allValue": null,
            "current": {
              "selected": false,
              "text": "All",
              "value": "$__all"
            },
            "datasource": null,
            "definition": "label_values(redis_maxmemory, pod)",
            "description": null,
            "error": null,
            "hide": 0,
            "includeAll": true,
            "label": "Pod",
            "multi": true,
            "name": "pod",
            "options": [],
            "query": {
              "query": "label_values(redis_maxmemory, pod)",
              "refId": "StandardVariableQuery"
            },
            "refresh": 2,
            "regex": "",
            "skipUrlSync": false,
            "sort": 0,
            "tagValuesQuery": "",
            "tags": [],
            "tagsQuery": "",
            "type": "query",
            "useTags": false
          }
        ]
      },
      "time": {
        "from": "now-6h",
        "to": "now"
      },
      "timepicker": {
        "refresh_intervals": [
          "5s",
          "10s",
          "30s",
          "1m",
          "5m",
          "15m",
          "30m",
          "1h",
          "2h",
          "1d"
        ],
        "time_options": [
          "5m",
          "15m",
          "1h",
          "6h",
          "12h",
          "24h",
          "2d",
          "7d",
          "30d"
        ]
      }
    }
```

2.  Create the ConfigMap with the following command:

```bash
kubectl apply -f example-redis.yaml
```

To update the dashboard, modify the ConfigMap, and the dashboard updates automatically.

## Delete a Custom Dashboard

To delete a custom dashboard, delete the corresponding ConfigMap. The dashboard associated with the
ConfigMap is removed automatically.

```bash
kubectl -n monitoring delete cm my-custom-dashboard
```

## List All Persistent Dashboards

To get a list of all ConfigMaps with the label `grafana_dashboard=1`, use this command:

kubectl get configmaps --selector='grafana\_dashboard=1' -A

## See Also

- [Grafana documentation](https://grafana.com/docs/grafana/latest/visualizations/dashboards/)

<!-- document id=49d4b2dbcb0e9b0166438360a43ac1d759eb80b87ec626f3bd128f429c129e31 url=/mulesoft/current/en-us/private-cloud/4.1/grafana-dashboards.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.1
---

# Configuring Grafana Dashboards

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Monitor the health of your Anypoint Platform Private Cloud Edition (Anypoint Platform PCE)
installation and its running applications with Grafana dashboards. These dashboards provide a visual
representation of the data collected by the monitoring tools in your Anypoint Platform PCE
installation.

The Grafana application uses a Kubernetes service of type `NodePort` to expose the service to the
external network. To access Grafana, configure the load balancer to forward traffic to port `32380`.

Alternatively, use the `kubectl port-forward` command to access Grafana locally:

```bash
kubectl -n monitoring port-forward $(kubectl -n monitoring get svc --selector='app.kubernetes.io/name=grafana' -oname | head -n 1) 3000:80
```

## Access the Grafana Dashboard

To retrieve credentials for Grafana, use these commands:

```bash
kubectl -n monitoring get secrets grafana-creds -ojsonpath='{.data.admin-user}' | base64 --decode
kubectl -n monitoring get secrets grafana-creds -ojsonpath='{.data.admin-password}' | base64 --decode
```

## Create a Custom Dashboard

You can create custom dashboards in Grafana using its web interface. However, these dashboards are
lost if the Grafana pod restarts. To create a custom dashboard that persists across restarts, create
a ConfigMap with the label `grafana_dashboard=1`.

This example demonstrates how to create a ConfigMap with a custom dashboard:

1.  Create a file with the dashboard configuration, for example, `example-redis.yaml`:

```yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: my-custom-dashboard
  namespace: monitoring
  labels:
    grafana_dashboard: "1"
data:
  example-redis.json: |
    {
      "annotations": {
        "list": [
          {
            "builtIn": 1,
            "datasource": "-- Grafana --",
            "enable": true,
            "hide": true,
            "iconColor": "rgba(0, 211, 255, 1)",
            "name": "Annotations & Alerts",
            "type": "dashboard"
          }
        ]
      },
      "timezone": "browser",
      "title": "My Example Redis Dashboard",
      "description": "",
      "editable": true,
      "gnetId": null,
      "graphTooltip": 0,
      "id": 29,
      "iteration": 1645573265624,
      "links": [],
      "panels": [
        {
          "aliasColors": {
            "Max": "#890F02",
            "Used": "#7EB26D",
            "max": "#BF1B00"
          },
          "bars": false,
          "dashes": false,
          "datasource": null,
          "editable": false,
          "error": false,
          "fieldConfig": {
            "defaults": {},
            "overrides": []
          },
          "fill": 1,
          "fillGradient": 0,
          "hiddenSeries": false,
          "id": 7,
          "isNew": true,
          "legend": {
            "avg": false,
            "current": false,
            "hideEmpty": false,
            "hideZero": false,
            "max": false,
            "min": false,
            "show": true,
            "total": false,
            "values": false
          },
          "gridPos": {
            "x": 0,
            "y": 0,
            "h": 11,
            "w": 24
          },
          "lines": true,
          "linewidth": 2,
          "links": [],
          "nullPointMode": "null as zero",
          "options": {
            "alertThreshold": true
          },
          "percentage": false,
          "pluginVersion": "7.5.10",
          "pointradius": 5,
          "points": false,
          "renderer": "flot",
          "seriesOverrides": [],
          "spaceLength": 10,
          "stack": false,
          "steppedLine": false,
          "targets": [
            {
              "exemplar": true,
              "expr": "sum by (pod)(redis_used_memory{pod=~\"$pod\"})",
              "interval": "",
              "legendFormat": "{{pod}}",
              "refId": "B"
            }
          ],
          "thresholds": [],
          "timeFrom": null,
          "timeRegions": [],
          "timeShift": null,
          "title": "Memory Usage",
          "tooltip": {
            "msResolution": false,
            "shared": true,
            "sort": 0,
            "value_type": "cumulative"
          },
          "type": "graph",
          "xaxis": {
            "buckets": null,
            "mode": "time",
            "name": null,
            "show": true,
            "values": []
          },
          "yaxes": [
            {
              "format": "bytes",
              "label": "",
              "logBase": 1,
              "max": null,
              "min": 0,
              "show": true
            },
            {
              "format": "short",
              "label": null,
              "logBase": 1,
              "max": null,
              "min": null,
              "show": false
            }
          ],
          "yaxis": {
            "align": false,
            "alignLevel": null
          }
        }
      ],
      "refresh": false,
      "schemaVersion": 27,
      "style": "dark",
      "tags": [],
      "templating": {
        "list": [
          {
            "allValue": null,
            "current": {
              "selected": false,
              "text": "All",
              "value": "$__all"
            },
            "datasource": null,
            "definition": "label_values(redis_maxmemory, pod)",
            "description": null,
            "error": null,
            "hide": 0,
            "includeAll": true,
            "label": "Pod",
            "multi": true,
            "name": "pod",
            "options": [],
            "query": {
              "query": "label_values(redis_maxmemory, pod)",
              "refId": "StandardVariableQuery"
            },
            "refresh": 2,
            "regex": "",
            "skipUrlSync": false,
            "sort": 0,
            "tagValuesQuery": "",
            "tags": [],
            "tagsQuery": "",
            "type": "query",
            "useTags": false
          }
        ]
      },
      "time": {
        "from": "now-6h",
        "to": "now"
      },
      "timepicker": {
        "refresh_intervals": [
          "5s",
          "10s",
          "30s",
          "1m",
          "5m",
          "15m",
          "30m",
          "1h",
          "2h",
          "1d"
        ],
        "time_options": [
          "5m",
          "15m",
          "1h",
          "6h",
          "12h",
          "24h",
          "2d",
          "7d",
          "30d"
        ]
      }
    }
```

2.  Create the ConfigMap with the following command:

```bash
kubectl apply -f example-redis.yaml
```

To update the dashboard, modify the ConfigMap, and the dashboard updates automatically.

## Delete a Custom Dashboard

To delete a custom dashboard, delete the corresponding ConfigMap. The dashboard associated with the
ConfigMap is removed automatically.

```bash
kubectl -n monitoring delete cm my-custom-dashboard
```

## List All Persistent Dashboards

To get a list of all ConfigMaps with the label `grafana_dashboard=1`, use this command:

kubectl get configmaps --selector='grafana\_dashboard=1' -A

## See Also

- [Grafana documentation](https://grafana.com/docs/grafana/latest/visualizations/dashboards/)

<!-- document id=2ab8638ffa93d42a15d57abac23b441b5318f723900536977f529779c37f8f23 url=/mulesoft/current/en-us/private-cloud/4.2/grafana-dashboards.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.2
---

# Configuring Grafana Dashboards

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Monitor the health of your Anypoint Platform Private Cloud Edition (Anypoint Platform PCE)
installation and its running applications with Grafana dashboards. These dashboards provide a visual
representation of the data collected by the monitoring tools in your Anypoint Platform PCE
installation.

The Grafana application uses a Kubernetes service of type `NodePort` to expose the service to the
external network. To access Grafana, configure the load balancer to forward traffic to port `32380`.

Alternatively, use the `kubectl port-forward` command to access Grafana locally:

```bash
kubectl -n monitoring port-forward $(kubectl -n monitoring get svc --selector='app.kubernetes.io/name=grafana' -oname | head -n 1) 3000:80
```

## Access the Grafana Dashboard

To retrieve credentials for Grafana, use these commands:

```bash
kubectl -n monitoring get secrets grafana-creds -ojsonpath='{.data.admin-user}' | base64 --decode
kubectl -n monitoring get secrets grafana-creds -ojsonpath='{.data.admin-password}' | base64 --decode
```

## Create a Custom Dashboard

You can create custom dashboards in Grafana using its web interface. However, these dashboards are
lost if the Grafana pod restarts. To create a custom dashboard that persists across restarts, create
a ConfigMap with the label `grafana_dashboard=1`.

This example demonstrates how to create a ConfigMap with a custom dashboard:

1.  Create a file with the dashboard configuration, for example, `example-redis.yaml`:

```yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: my-custom-dashboard
  namespace: monitoring
  labels:
    grafana_dashboard: "1"
data:
  example-redis.json: |
    {
      "annotations": {
        "list": [
          {
            "builtIn": 1,
            "datasource": "-- Grafana --",
            "enable": true,
            "hide": true,
            "iconColor": "rgba(0, 211, 255, 1)",
            "name": "Annotations & Alerts",
            "type": "dashboard"
          }
        ]
      },
      "timezone": "browser",
      "title": "My Example Redis Dashboard",
      "description": "",
      "editable": true,
      "gnetId": null,
      "graphTooltip": 0,
      "id": 29,
      "iteration": 1645573265624,
      "links": [],
      "panels": [
        {
          "aliasColors": {
            "Max": "#890F02",
            "Used": "#7EB26D",
            "max": "#BF1B00"
          },
          "bars": false,
          "dashes": false,
          "datasource": null,
          "editable": false,
          "error": false,
          "fieldConfig": {
            "defaults": {},
            "overrides": []
          },
          "fill": 1,
          "fillGradient": 0,
          "hiddenSeries": false,
          "id": 7,
          "isNew": true,
          "legend": {
            "avg": false,
            "current": false,
            "hideEmpty": false,
            "hideZero": false,
            "max": false,
            "min": false,
            "show": true,
            "total": false,
            "values": false
          },
          "gridPos": {
            "x": 0,
            "y": 0,
            "h": 11,
            "w": 24
          },
          "lines": true,
          "linewidth": 2,
          "links": [],
          "nullPointMode": "null as zero",
          "options": {
            "alertThreshold": true
          },
          "percentage": false,
          "pluginVersion": "7.5.10",
          "pointradius": 5,
          "points": false,
          "renderer": "flot",
          "seriesOverrides": [],
          "spaceLength": 10,
          "stack": false,
          "steppedLine": false,
          "targets": [
            {
              "exemplar": true,
              "expr": "sum by (pod)(redis_used_memory{pod=~\"$pod\"})",
              "interval": "",
              "legendFormat": "{{pod}}",
              "refId": "B"
            }
          ],
          "thresholds": [],
          "timeFrom": null,
          "timeRegions": [],
          "timeShift": null,
          "title": "Memory Usage",
          "tooltip": {
            "msResolution": false,
            "shared": true,
            "sort": 0,
            "value_type": "cumulative"
          },
          "type": "graph",
          "xaxis": {
            "buckets": null,
            "mode": "time",
            "name": null,
            "show": true,
            "values": []
          },
          "yaxes": [
            {
              "format": "bytes",
              "label": "",
              "logBase": 1,
              "max": null,
              "min": 0,
              "show": true
            },
            {
              "format": "short",
              "label": null,
              "logBase": 1,
              "max": null,
              "min": null,
              "show": false
            }
          ],
          "yaxis": {
            "align": false,
            "alignLevel": null
          }
        }
      ],
      "refresh": false,
      "schemaVersion": 27,
      "style": "dark",
      "tags": [],
      "templating": {
        "list": [
          {
            "allValue": null,
            "current": {
              "selected": false,
              "text": "All",
              "value": "$__all"
            },
            "datasource": null,
            "definition": "label_values(redis_maxmemory, pod)",
            "description": null,
            "error": null,
            "hide": 0,
            "includeAll": true,
            "label": "Pod",
            "multi": true,
            "name": "pod",
            "options": [],
            "query": {
              "query": "label_values(redis_maxmemory, pod)",
              "refId": "StandardVariableQuery"
            },
            "refresh": 2,
            "regex": "",
            "skipUrlSync": false,
            "sort": 0,
            "tagValuesQuery": "",
            "tags": [],
            "tagsQuery": "",
            "type": "query",
            "useTags": false
          }
        ]
      },
      "time": {
        "from": "now-6h",
        "to": "now"
      },
      "timepicker": {
        "refresh_intervals": [
          "5s",
          "10s",
          "30s",
          "1m",
          "5m",
          "15m",
          "30m",
          "1h",
          "2h",
          "1d"
        ],
        "time_options": [
          "5m",
          "15m",
          "1h",
          "6h",
          "12h",
          "24h",
          "2d",
          "7d",
          "30d"
        ]
      }
    }
```

2.  Create the ConfigMap with the following command:

```bash
kubectl apply -f example-redis.yaml
```

To update the dashboard, modify the ConfigMap, and the dashboard updates automatically.

## Delete a Custom Dashboard

To delete a custom dashboard, delete the corresponding ConfigMap. The dashboard associated with the
ConfigMap is removed automatically.

```bash
kubectl -n monitoring delete cm my-custom-dashboard
```

## List All Persistent Dashboards

To get a list of all ConfigMaps with the label `grafana_dashboard=1`, use this command:

kubectl get configmaps --selector='grafana\_dashboard=1' -A

## See Also

- [Grafana documentation](https://grafana.com/docs/grafana/latest/visualizations/dashboards/)

<!-- document id=136e9f2f6101459e30719637a7a765e1aa537e16d0c41ce50ceeae4f27670e25 url=/mulesoft/current/en-us/private-cloud/4.0/access-management-security.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.0
---

# Configuring Security for Anypoint Platform PCE

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

To use Anypoint Platform Private Cloud Edition (Anypoint Platform PCE), you must supply TLS
credentials. Upload a certificate via the Anypoint Platform UI under **Access Management**, and
configure the platform to use this certificate to secure communications. Ensure that every machine
connected to the platform, including Mule runtime engine (Mule), trusts this certificate.
Additionally, you have the option to specify custom ciphers and Diffie-Hellman (DH) groups for the
key exchange method if needed.

When you replace or change the certificate, Anypoint Platform restarts the nginx server.

![Certificate and Private Key configuration under the Security tab in Access Management](/mulesoft/current/en-us/private-cloud/4.0/_images/on-prem-features-5f98d.png)

To configure the security, follow these steps:

1.  Create a certificate.

    Generate your certificate using a tool like OpenSSL. To be compatible with Anypoint Platform,
    ensure your certificate is in an `nginx` friendly format. The certificate must include the
    domain name of your installation as both the Common Name (CN) and the Subject Alternative Name
    (SAN).

2.  From Anypoint Platform, select **Access Management**.

3.  Select **Security**.

4.  Under **Certificate**, select **Browse** to select the certificate on your local system.

5.  Under **Key**, select **Browse** to select the private key for your certificate.

6.  For additional security, you can upload your own cipher and Diffie-Hellman group file.

    Note that this step is optional.

    1.  Deselect **Use default ciphers and DH Group**.

    2.  Enter a set of ciphers from the list of valid NGINX ciphers. If you are using Open SSL, you
        can view this list by running the `openssl ciphers` command. The cipher you enter must be in
        an `nginx` compatible format, for example:

        ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384

    3.  Generate `dhparam.pem` (the Diffie-Hellman group file) using the following `openssl`
        command:

        openssl dhparam 2048 -out dhparam.pem

    4.  Upload the `dhparam.pem` file from your system.

## See Also

- [Configuring Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/4.0/config-workflow)

<!-- document id=318188ae62cd15a4e0eef66db6cc14c4c079c0d74077e87abd676c6ef9aab2cd url=/mulesoft/current/en-us/private-cloud/4.1/access-management-security.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.1
---

# Configuring Security for Anypoint Platform PCE

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

To use Anypoint Platform Private Cloud Edition (Anypoint Platform PCE), you must supply TLS
credentials. Upload a certificate via the Anypoint Platform UI under **Access Management**, and
configure the platform to use this certificate to secure communications. Ensure that every machine
connected to the platform, including Mule runtime engine (Mule), trusts this certificate.
Additionally, you have the option to specify custom ciphers and Diffie-Hellman (DH) groups for the
key exchange method if needed.

When you replace or change the certificate, Anypoint Platform restarts the nginx server.

![Certificate and Private Key configuration under the Security tab in Access Management](/mulesoft/current/en-us/private-cloud/4.1/_images/on-prem-features-5f98d.png)

To configure the security, follow these steps:

1.  Create a certificate.

    Generate your certificate using a tool like OpenSSL. To be compatible with Anypoint Platform,
    ensure your certificate is in an `nginx` friendly format. The certificate must include the
    domain name of your installation as both the Common Name (CN) and the Subject Alternative Name
    (SAN).

2.  From Anypoint Platform, select **Access Management**.

3.  Select **Security**.

4.  Under **Certificate**, select **Browse** to select the certificate on your local system.

5.  Under **Key**, select **Browse** to select the private key for your certificate.

6.  For additional security, you can upload your own cipher and Diffie-Hellman group file.

    Note that this step is optional.

    1.  Deselect **Use default ciphers and DH Group**.

    2.  Enter a set of ciphers from the list of valid NGINX ciphers. If you are using Open SSL, you
        can view this list by running the `openssl ciphers` command. The cipher you enter must be in
        an `nginx` compatible format, for example:

        ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384

    3.  Generate `dhparam.pem` (the Diffie-Hellman group file) using the following `openssl`
        command:

        openssl dhparam 2048 -out dhparam.pem

    4.  Upload the `dhparam.pem` file from your system.

## See Also

- [Configuring Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/4.1/config-workflow)

<!-- document id=0c96d63146add324e62dc0b2a03a48d828fd91dd682191c02d91f617eb507a4a url=/mulesoft/current/en-us/private-cloud/4.2/access-management-security.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.2
---

# Configuring Security for Anypoint Platform PCE

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

To use Anypoint Platform Private Cloud Edition (Anypoint Platform PCE), you must supply TLS
credentials. Upload a certificate via the Anypoint Platform UI under **Access Management**, and
configure the platform to use this certificate to secure communications. Ensure that every machine
connected to the platform, including Mule runtime engine (Mule), trusts this certificate.
Additionally, you have the option to specify custom ciphers and Diffie-Hellman (DH) groups for the
key exchange method if needed.

When you replace or change the certificate, Anypoint Platform restarts the nginx server.

![Certificate and Private Key configuration under the Security tab in Access Management](/mulesoft/current/en-us/private-cloud/4.2/_images/on-prem-features-5f98d.png)

To configure the security, follow these steps:

1.  Create a certificate.

    Generate your certificate using a tool like OpenSSL. To be compatible with Anypoint Platform,
    ensure your certificate is in an `nginx` friendly format. The certificate must include the
    domain name of your installation as both the Common Name (CN) and the Subject Alternative Name
    (SAN).

2.  From Anypoint Platform, select **Access Management**.

3.  Select **Security**.

4.  Under **Certificate**, select **Browse** to select the certificate on your local system.

5.  Under **Key**, select **Browse** to select the private key for your certificate.

6.  For additional security, you can upload your own cipher and Diffie-Hellman group file.

    Note that this step is optional.

    1.  Deselect **Use default ciphers and DH Group**.

    2.  Enter a set of ciphers from the list of valid NGINX ciphers. If you are using Open SSL, you
        can view this list by running the `openssl ciphers` command. The cipher you enter must be in
        an `nginx` compatible format, for example:

        ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384

    3.  Generate `dhparam.pem` (the Diffie-Hellman group file) using the following `openssl`
        command:

        openssl dhparam 2048 -out dhparam.pem

    4.  Upload the `dhparam.pem` file from your system.

## See Also

- [Configuring Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/4.2/config-workflow)

<!-- document id=8c3b7c3410493d5384ffeb51a7d16bf3b169460a9b4d68ff3874b528eddc788a url=/mulesoft/current/en-us/private-cloud/latest/access-management-security.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.3
is-latest-version: true
---

# Configuring Security for Anypoint Platform PCE

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

To use Anypoint Platform Private Cloud Edition (Anypoint Platform PCE), you must supply TLS
credentials. Upload a certificate via the Anypoint Platform UI under **Access Management**, and
configure the platform to use this certificate to secure communications. Ensure that every machine
connected to the platform, including Mule runtime engine (Mule), trusts this certificate.
Additionally, you have the option to specify custom ciphers and Diffie-Hellman (DH) groups for the
key exchange method if needed.

When you replace or change the certificate, Anypoint Platform restarts the nginx server.

![Certificate and Private Key configuration under the Security tab in Access Management](/mulesoft/current/en-us/private-cloud/latest/_images/on-prem-features-5f98d.png)

To configure the security, follow these steps:

1.  Create a certificate.

    Generate your certificate using a tool like OpenSSL. To be compatible with Anypoint Platform,
    ensure your certificate is in an `nginx` friendly format. The certificate must include the
    domain name of your installation as both the Common Name (CN) and the Subject Alternative Name
    (SAN).

2.  From Anypoint Platform, select **Access Management**.

3.  Select **Security**.

4.  Under **Certificate**, select **Browse** to select the certificate on your local system.

5.  Under **Key**, select **Browse** to select the private key for your certificate.

6.  For additional security, you can upload your own cipher and Diffie-Hellman group file.

    Note that this step is optional.

    1.  Deselect **Use default ciphers and DH Group**.

    2.  Enter a set of ciphers from the list of valid NGINX ciphers. If you are using Open SSL, you
        can view this list by running the `openssl ciphers` command. The cipher you enter must be in
        an `nginx` compatible format, for example:

        ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384

    3.  Generate `dhparam.pem` (the Diffie-Hellman group file) using the following `openssl`
        command:

        openssl dhparam 2048 -out dhparam.pem

    4.  Upload the `dhparam.pem` file from your system.

## See Also

- [Configuring Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/latest/config-workflow)

<!-- document id=62ad5c064fbd646c6882945ea748e7296d61c87ff64b003cd3f55db4524f741f url=/mulesoft/current/en-us/private-cloud/4.0/access-management-SMTP.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.0
---

# Configuring SMTP in Anypoint Platform PCE

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Because Anypoint Platform Private Cloud Edition (Anypoint Platform PCE) does not provide an SMTP
server, you must set up your own SMTP email server to deliver email alerts generated by Runtime
Manager. The SMTP email server also sends email messages for platform infrastructure alerts,
including CPU, memory, and disk alerts.

You must direct your local installation of Anypoint Platform PCE to this server from the Access
Management panel.

> [!NOTE] Only SMTP servers with authentication are supported (anonymous SMTP relay servers are not
> supported). SMTPS is not supported.

## Connect to an Existing SMTP Server

1.  From Anypoint Platform, select **Access Management**.

2.  Select **SMTP**.

3.  Provide the following parameters information for your SMTP server:

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Field</th><th>Description</th><th>Example</th></tr></thead><tbody><tr><td><div><div><p>Host</p></div></div></td><td><div><div><p>Host name of your SMTP server.</p></div></div></td><td><div><div><p><code>smtp.gmail.com</code></p></div></div></td></tr><tr><td><div><div><p>Port</p></div></div></td><td><div><div><p>Port used to communicate to your SMTP server.</p></div></div></td><td><div><div><p><code>587</code></p></div></div></td></tr><tr><td><div><div><p>Username</p></div></div></td><td><div><div><p>Username to authenticate to your SMTP server.</p></div></div></td><td><div><div><p><code>mulesoft.onprem.smtp@gmail.com</code></p></div></div></td></tr><tr><td><div><div><p>Password</p></div></div></td><td><div><div><p>SMTP password.</p></div></div></td><td><div><div><p><code>examplepassphrase</code></p></div></div></td></tr></tbody></table>

> [!NOTE] To use anonymous logins for your SMTP server, leave the **Username** and **Password**
> fields empty.

4.  After entering your configuration, select **Save**.

![SMTP configuration window under the Access Management UI](/mulesoft/current/en-us/private-cloud/4.0/_images/on-premises-features-2c60a.png)

## See Also

- [Configuring Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/4.0/config-workflow)

<!-- document id=ec311c65071e1c86bf9574464ad9feaa8ad0b5d20adaadeef4fecf6979e8fc67 url=/mulesoft/current/en-us/private-cloud/4.1/access-management-SMTP.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.1
---

# Configuring SMTP in Anypoint Platform PCE

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Because Anypoint Platform Private Cloud Edition (Anypoint Platform PCE) does not provide an SMTP
server, you must set up your own SMTP email server to deliver email alerts generated by Runtime
Manager. The SMTP email server also sends email messages for platform infrastructure alerts,
including CPU, memory, and disk alerts.

You must direct your local installation of Anypoint Platform PCE to this server from the Access
Management panel.

> [!NOTE] Only SMTP servers with authentication are supported (anonymous SMTP relay servers are not
> supported). SMTPS is not supported.

## Connect to an Existing SMTP Server

1.  From Anypoint Platform, select **Access Management**.

2.  Select **SMTP**.

3.  Provide the following parameters information for your SMTP server:

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Field</th><th>Description</th><th>Example</th></tr></thead><tbody><tr><td><div><div><p>Host</p></div></div></td><td><div><div><p>Host name of your SMTP server.</p></div></div></td><td><div><div><p><code>smtp.gmail.com</code></p></div></div></td></tr><tr><td><div><div><p>Port</p></div></div></td><td><div><div><p>Port used to communicate to your SMTP server.</p></div></div></td><td><div><div><p><code>587</code></p></div></div></td></tr><tr><td><div><div><p>Username</p></div></div></td><td><div><div><p>Username to authenticate to your SMTP server.</p></div></div></td><td><div><div><p><code>mulesoft.onprem.smtp@gmail.com</code></p></div></div></td></tr><tr><td><div><div><p>Password</p></div></div></td><td><div><div><p>SMTP password.</p></div></div></td><td><div><div><p><code>examplepassphrase</code></p></div></div></td></tr></tbody></table>

> [!NOTE] To use anonymous logins for your SMTP server, leave the **Username** and **Password**
> fields empty.

4.  After entering your configuration, select **Save**.

![SMTP configuration window under the Access Management UI](/mulesoft/current/en-us/private-cloud/4.1/_images/on-premises-features-2c60a.png)

## See Also

- [Configuring Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/4.1/config-workflow)

<!-- document id=2be5e093c23dba67de146dded7ec8852658d7567271243c6bbb6ffa54553f771 url=/mulesoft/current/en-us/private-cloud/4.2/access-management-SMTP.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.2
---

# Configuring SMTP in Anypoint Platform PCE

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Because Anypoint Platform Private Cloud Edition (Anypoint Platform PCE) does not provide an SMTP
server, you must set up your own SMTP email server to deliver email alerts generated by Runtime
Manager. The SMTP email server also sends email messages for platform infrastructure alerts,
including CPU, memory, and disk alerts.

You must direct your local installation of Anypoint Platform PCE to this server from the Access
Management panel.

> [!NOTE] Only SMTP servers with authentication are supported (anonymous SMTP relay servers are not
> supported). SMTPS is not supported.

## Connect to an Existing SMTP Server

1.  From Anypoint Platform, select **Access Management**.

2.  Select **SMTP**.

3.  Provide the following parameters information for your SMTP server:

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Field</th><th>Description</th><th>Example</th></tr></thead><tbody><tr><td><div><div><p>Host</p></div></div></td><td><div><div><p>Host name of your SMTP server.</p></div></div></td><td><div><div><p><code>smtp.gmail.com</code></p></div></div></td></tr><tr><td><div><div><p>Port</p></div></div></td><td><div><div><p>Port used to communicate to your SMTP server.</p></div></div></td><td><div><div><p><code>587</code></p></div></div></td></tr><tr><td><div><div><p>Username</p></div></div></td><td><div><div><p>Username to authenticate to your SMTP server.</p></div></div></td><td><div><div><p><code>mulesoft.onprem.smtp@gmail.com</code></p></div></div></td></tr><tr><td><div><div><p>Password</p></div></div></td><td><div><div><p>SMTP password.</p></div></div></td><td><div><div><p><code>examplepassphrase</code></p></div></div></td></tr></tbody></table>

> [!NOTE] To use anonymous logins for your SMTP server, leave the **Username** and **Password**
> fields empty.

4.  After entering your configuration, select **Save**.

![SMTP configuration window under the Access Management UI](/mulesoft/current/en-us/private-cloud/4.2/_images/on-premises-features-2c60a.png)

## See Also

- [Configuring Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/4.2/config-workflow)

<!-- document id=df09225665abd4bac12aae4c05e5d02f902b6227d690204ea71b8be89ae38185 url=/mulesoft/current/en-us/private-cloud/latest/access-management-SMTP.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.3
is-latest-version: true
---

# Configuring SMTP in Anypoint Platform PCE

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Because Anypoint Platform Private Cloud Edition (Anypoint Platform PCE) does not provide an SMTP
server, you must set up your own SMTP email server to deliver email alerts generated by Runtime
Manager. The SMTP email server also sends email messages for platform infrastructure alerts,
including CPU, memory, and disk alerts.

You must direct your local installation of Anypoint Platform PCE to this server from the Access
Management panel.

> [!NOTE] Only SMTP servers with authentication are supported (anonymous SMTP relay servers are not
> supported). SMTPS is not supported.

## Connect to an Existing SMTP Server

1.  From Anypoint Platform, select **Access Management**.

2.  Select **SMTP**.

3.  Provide the following parameters information for your SMTP server:

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Field</th><th>Description</th><th>Example</th></tr></thead><tbody><tr><td><div><div><p>Host</p></div></div></td><td><div><div><p>Host name of your SMTP server.</p></div></div></td><td><div><div><p><code>smtp.gmail.com</code></p></div></div></td></tr><tr><td><div><div><p>Port</p></div></div></td><td><div><div><p>Port used to communicate to your SMTP server.</p></div></div></td><td><div><div><p><code>587</code></p></div></div></td></tr><tr><td><div><div><p>Username</p></div></div></td><td><div><div><p>Username to authenticate to your SMTP server.</p></div></div></td><td><div><div><p><code>mulesoft.onprem.smtp@gmail.com</code></p></div></div></td></tr><tr><td><div><div><p>Password</p></div></div></td><td><div><div><p>SMTP password.</p></div></div></td><td><div><div><p><code>examplepassphrase</code></p></div></div></td></tr><tr><td><div><div><p>Sender</p></div></div></td><td><div><div><p>Optional. Email address that alert notifications are sent from. Available starting with Anypoint Platform PCE 4.3.0. Leave this field blank to use the default sender address.</p></div></div></td><td><div><div><p><code>alerts@example.com</code></p></div></div></td></tr></tbody></table>

> [!NOTE] To use anonymous logins for your SMTP server, leave the **Username** and **Password**
> fields empty.

4.  After entering your configuration, select **Save**.

![SMTP configuration window under the Access Management UI](/mulesoft/current/en-us/private-cloud/latest/_images/on-premises-features-2c60a.png)

## Set a Custom Sender Address

In Anypoint Platform PCE versions before 4.3.0, outbound alert emails use a fixed sender address.
Mail systems that accept messages only from approved internal domains can reject those emails, and
Anypoint Platform PCE doesn’t report the rejection.

Starting with Anypoint Platform PCE 4.3.0, the SMTP page in **Access Management** includes an
optional **Sender** field. To set the address:

1.  From Anypoint Platform, select **Access Management**.

2.  Select **SMTP**.

3.  Configure the **Host**, **Port**, **Username**, and **Password** fields.

4.  In **Sender**, enter the email address to send alert notifications from.

5.  Select **Save**.

Anypoint Platform PCE checks that **Sender** is a properly formatted email address. If you leave
**Sender** blank, Anypoint Platform PCE uses the default sender behavior from versions before 4.3.0.

> [!IMPORTANT] Anypoint Platform PCE checks only that **Sender** is a properly formatted email
> address. It doesn’t check that your SMTP server is authorized to send from that address or domain.
> Use an address on a domain your SMTP server is authorized to send from. If the address is outside
> those domains, alert emails can fail to send, and Anypoint Platform PCE doesn’t show an error.
> Confirm the domains your SMTP server allows before you set **Sender**.

## See Also

- [Configuring Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/latest/config-workflow)

<!-- document id=115807e06237dc531dfca85b71709f7223d47f44c43ac7d99ae80daee2182a8e url=/mulesoft/current/en-us/private-cloud/3.2/install-disable-local-user.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 3.2
---

# Delete the Local User After Installing Anypoint Platform PCE

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

During installation, Anypoint Platform Private Cloud Edition (Anypoint Platform PCE) creates a local
Anypoint Platform user that enables you to configure platform components during installation. The
credentials for this user are stored locally in Anypoint Platform. However, after configuring an
external authentication provider such as LDAP, you should delete this user to improve security.

1.  Before deleting the local user, perform the following:

    - Install and configure your external identity provider.

    - Ensure that `SystemAdmin` user is not the owner of any other organizations.

2.  Select the new user to whom you want to assign administrator privileges. This user must be
    defined in your external identity provider.

3.  Determine the internal user ID for this user.

    1.  From Anypoint Platform, select Access Management.

    2.  Select Users and then select the name of the user.

    3.  Record the internal user ID. This ID appears in the URL as:

        ![User ID](/mulesoft/current/en-us/private-cloud/3.2/_images/access-management-user-id.png)

4.  Enter the gravity shell:

    gravity enter

5.  Identify one of the `authentication-server` containers:

    kubectl get pods -n access-management -l component=authentication-server

6.  Change the owner, providing the internal the `authentication-server` container and user ID
    obtained earlier:

    kubectl exec -it -n access-management <authentication-server-pod> -c application – node
    bin/change\_owner.js --new-owner-id <user\_id>

    This command changes the owner from the default system user to a new user managed by the
    external authentication provider. The command you use should be similar to the following
    example:

    kubectl exec -it -n access-management <authentication-server-pod> -c application – node
    bin/change\_owner.js --new-owner-id a363279f-982f-493c-b08f-9feb91be90d4

7.  Disable and delete the `System Admin` user.

    1.  Log in as the user you just added as the organization owner.

    2.  From Anypoint Platform, select Access Management.

    3.  Select Users and then select `username` in the same row as `SystemAdmin`.

    4.  Select Disable and then select Delete.

        This removes the default user from the platform.

<!-- document id=95d0c8126e717d89bd1467fcdcf45c2bea7367d7319e61667808039c30e726b0 url=/mulesoft/current/en-us/private-cloud/4.0/install-disable-local-user.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.0
---

# Deleting the Local User After Installing Anypoint Platform PCE

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

During installation, Anypoint Platform Private Cloud Edition (Anypoint Platform PCE) creates a local
Anypoint Platform user that enables you to configure platform components during installation. The
credentials for this user are stored locally in Anypoint Platform. However, after configuring an
external authentication provider such as LDAP, you should delete this user to improve security.

1.  Before deleting the local user, perform the following steps:

    - Install and configure your external identity provider.

    - Ensure that `SystemAdmin` user is not the owner of any other organizations.

2.  Select the new user to whom you want to assign administrator privileges. This user must be
    defined in your external identity provider.

3.  Determine the internal user ID for this user.

    1.  From Anypoint Platform, select **Access Management**.

    2.  Select **Users**.

    3.  Select the name of the user.

    4.  Record the internal user ID. This ID appears in the URL as:

        ![Example of User ID in the URL](/mulesoft/current/en-us/private-cloud/4.0/_images/access-management-user-id.png)

4.  Configure your installer machine with \`kubeconfig.yaml to access the Anypoint Platform PCE K8s
    cluster.

    1.  Set the environment variable `KUBECONFIG=/path/to/kubeconfig.yaml`.

    2.  Check access to kubernetes cluster with `kubectl get nodes`.

5.  Identify one of the `authentication-server` containers:

    kubectl get pods -n access-management -l component=authentication-server

6.  Change the owner, providing the internal the `authentication-server` container and user ID
    obtained earlier:

    kubectl exec -it -n access-management <authentication-server-pod> -c application – node
    bin/change\_owner.js --new-owner-id <user\_id>

    This command changes the owner from the default system user to a new user managed by the
    external authentication provider. The command you use should be similar to the following
    example:

    kubectl exec -it -n access-management <authentication-server-pod> -c application – node
    bin/change\_owner.js --new-owner-id a363279f-982f-493c-b08f-9feb91be90d4

7.  Disable and delete the `System Admin` user.

    1.  Log in as the user you just added as the organization owner.

    2.  From Anypoint Platform, select **Access Management**.

    3.  Select **Users**.

    4.  Select `username` in the same row as `SystemAdmin`.

    5.  Select **Disable**.

    6.  Select **Delete**.

This removes the default user from the platform.

## See Also

- [Configuring Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/4.0/config-workflow)

<!-- document id=bca551d0efd8ef4db604847bdf6aeb09734fed0150febc332a8d13c0919edf88 url=/mulesoft/current/en-us/private-cloud/4.1/install-disable-local-user.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.1
---

# Deleting the Local User After Installing Anypoint Platform PCE

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

During installation, Anypoint Platform Private Cloud Edition (Anypoint Platform PCE) creates a local
Anypoint Platform user that enables you to configure platform components during installation. The
credentials for this user are stored locally in Anypoint Platform. However, after configuring an
external authentication provider such as LDAP, you should delete this user to improve security.

1.  Before deleting the local user, perform the following steps:

    - Install and configure your external identity provider.

    - Ensure that `SystemAdmin` user is not the owner of any other organizations.

2.  Select the new user to whom you want to assign administrator privileges. This user must be
    defined in your external identity provider.

3.  Determine the internal user ID for this user.

    1.  From Anypoint Platform, select **Access Management**.

    2.  Select **Users**.

    3.  Select the name of the user.

    4.  Record the internal user ID. This ID appears in the URL as:

        ![Example of User ID in the URL](/mulesoft/current/en-us/private-cloud/4.1/_images/access-management-user-id.png)

4.  Configure your installer machine with \`kubeconfig.yaml to access the Anypoint Platform PCE K8s
    cluster.

    1.  Set the environment variable `KUBECONFIG=/path/to/kubeconfig.yaml`.

    2.  Check access to kubernetes cluster with `kubectl get nodes`.

5.  Identify one of the `authentication-server` containers:

    kubectl get pods -n access-management -l component=authentication-server

6.  Change the owner, providing the internal the `authentication-server` container and user ID
    obtained earlier:

    kubectl exec -it -n access-management <authentication-server-pod> -c application – node
    bin/change\_owner.js --new-owner-id <user\_id>

    This command changes the owner from the default system user to a new user managed by the
    external authentication provider. The command you use should be similar to the following
    example:

    kubectl exec -it -n access-management <authentication-server-pod> -c application – node
    bin/change\_owner.js --new-owner-id a363279f-982f-493c-b08f-9feb91be90d4

7.  Disable and delete the `System Admin` user.

    1.  Log in as the user you just added as the organization owner.

    2.  From Anypoint Platform, select **Access Management**.

    3.  Select **Users**.

    4.  Select `username` in the same row as `SystemAdmin`.

    5.  Select **Disable**.

    6.  Select **Delete**.

This removes the default user from the platform.

## See Also

- [Configuring Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/4.1/config-workflow)

<!-- document id=23836f9841791fb16898216b30346274968ed207aeb8d8c7ab0a04e2145ff809 url=/mulesoft/current/en-us/private-cloud/4.2/install-disable-local-user.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.2
---

# Deleting the Local User After Installing Anypoint Platform PCE

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

During installation, Anypoint Platform Private Cloud Edition (Anypoint Platform PCE) creates a local
Anypoint Platform user that enables you to configure platform components during installation. The
credentials for this user are stored locally in Anypoint Platform. However, after configuring an
external authentication provider such as LDAP, you should delete this user to improve security.

1.  Before deleting the local user, perform the following steps:

    - Install and configure your external identity provider.

    - Ensure that `SystemAdmin` user is not the owner of any other organizations.

2.  Select the new user to whom you want to assign administrator privileges. This user must be
    defined in your external identity provider.

3.  Determine the internal user ID for this user.

    1.  From Anypoint Platform, select **Access Management**.

    2.  Select **Users**.

    3.  Select the name of the user.

    4.  Record the internal user ID. This ID appears in the URL as:

        ![Example of User ID in the URL](/mulesoft/current/en-us/private-cloud/4.2/_images/access-management-user-id.png)

4.  Configure your installer machine with \`kubeconfig.yaml to access the Anypoint Platform PCE K8s
    cluster.

    1.  Set the environment variable `KUBECONFIG=/path/to/kubeconfig.yaml`.

    2.  Check access to kubernetes cluster with `kubectl get nodes`.

5.  Identify one of the `authentication-server` containers:

    kubectl get pods -n access-management -l component=authentication-server

6.  Change the owner, providing the internal the `authentication-server` container and user ID
    obtained earlier:

    kubectl exec -it -n access-management <authentication-server-pod> -c application – node
    bin/change\_owner.js --new-owner-id <user\_id>

    This command changes the owner from the default system user to a new user managed by the
    external authentication provider. The command you use should be similar to the following
    example:

    kubectl exec -it -n access-management <authentication-server-pod> -c application – node
    bin/change\_owner.js --new-owner-id a363279f-982f-493c-b08f-9feb91be90d4

7.  Disable and delete the `System Admin` user.

    1.  Log in as the user you just added as the organization owner.

    2.  From Anypoint Platform, select **Access Management**.

    3.  Select **Users**.

    4.  Select `username` in the same row as `SystemAdmin`.

    5.  Select **Disable**.

    6.  Select **Delete**.

This removes the default user from the platform.

## See Also

- [Configuring Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/4.2/config-workflow)

<!-- document id=81398f3d29d876acbb655af5eb49b6b7edea13c5987ad3c6dc8312f853c42ae8 url=/mulesoft/current/en-us/private-cloud/latest/install-disable-local-user.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.3
is-latest-version: true
---

# Deleting the Local User After Installing Anypoint Platform PCE

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

During installation, Anypoint Platform Private Cloud Edition (Anypoint Platform PCE) creates a local
Anypoint Platform user that enables you to configure platform components during installation. The
credentials for this user are stored locally in Anypoint Platform. However, after configuring an
external authentication provider such as LDAP, you should delete this user to improve security.

1.  Before deleting the local user, perform the following steps:

    - Install and configure your external identity provider.

    - Ensure that `SystemAdmin` user is not the owner of any other organizations.

2.  Select the new user to whom you want to assign administrator privileges. This user must be
    defined in your external identity provider.

3.  Determine the internal user ID for this user.

    1.  From Anypoint Platform, select **Access Management**.

    2.  Select **Users**.

    3.  Select the name of the user.

    4.  Record the internal user ID. This ID appears in the URL as:

        ![Example of User ID in the URL](/mulesoft/current/en-us/private-cloud/latest/_images/access-management-user-id.png)

4.  Configure your installer machine with \`kubeconfig.yaml to access the Anypoint Platform PCE K8s
    cluster.

    1.  Set the environment variable `KUBECONFIG=/path/to/kubeconfig.yaml`.

    2.  Check access to kubernetes cluster with `kubectl get nodes`.

5.  Identify one of the `authentication-server` containers:

    kubectl get pods -n access-management -l component=authentication-server

6.  Change the owner, providing the internal the `authentication-server` container and user ID
    obtained earlier:

    kubectl exec -it -n access-management <authentication-server-pod> -c application – node
    bin/change\_owner.js --new-owner-id <user\_id>

    This command changes the owner from the default system user to a new user managed by the
    external authentication provider. The command you use should be similar to the following
    example:

    kubectl exec -it -n access-management <authentication-server-pod> -c application – node
    bin/change\_owner.js --new-owner-id a363279f-982f-493c-b08f-9feb91be90d4

7.  Disable and delete the `System Admin` user.

    1.  Log in as the user you just added as the organization owner.

    2.  From Anypoint Platform, select **Access Management**.

    3.  Select **Users**.

    4.  Select `username` in the same row as `SystemAdmin`.

    5.  Select **Disable**.

    6.  Select **Delete**.

This removes the default user from the platform.

## See Also

- [Configuring Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/latest/config-workflow)

<!-- document id=0601e35da0a634b0bfedfdd64755b77b7bd7e2a66df04944eda6494a8008a93c url=/mulesoft/current/en-us/private-cloud/latest/deploy-apps.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.3
is-latest-version: true
---

# Deploying Mule Applications to Anypoint Platform PCE

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

After you install Anypoint Platform Private Cloud Edition (Anypoint Platform PCE) and register your
hybrid servers, you can deploy Mule applications to those servers through Runtime Manager.

Before you deploy, ensure that:

- Your servers are registered and running in Runtime Manager. See
  [About Servers, Server Groups, and Clusters](https://docs.mulesoft.com/runtime-manager/managing-servers).

- Your IDE is configured to use your Anypoint Platform PCE control plane rather than the default
  cloud Anypoint Platform.

You can develop and package applications with either Anypoint Code Builder or Anypoint Studio, then
deploy them to Anypoint Platform PCE.

## Deploy Using Anypoint Code Builder

Use Anypoint Code Builder in VS Code to develop, package, and deploy Mule applications to Anypoint
Platform PCE. You can follow the standard Anypoint Code Builder documentation without MuleSoft
Vibes. MuleSoft Vibes is optional.

- [Configuring Anypoint Code Builder for Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/latest/config-code-builder)

- [Deploying Mule Applications Using Anypoint Code Builder](https://docs.mulesoft.com/private-cloud/latest/deploy-apps-code-builder)

## Deploy Using Anypoint Studio

Configure Anypoint Studio to connect to your Anypoint Platform PCE instance, then package your
application and deploy it to a hybrid server in Runtime Manager:

- [Configuring Anypoint Studio for Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/latest/config-studio)

- [Export a Studio Project to a Deployable Mule Application](https://docs.mulesoft.com/studio/import-export-packages)

- [Deploying to Your Own Servers](https://docs.mulesoft.com/runtime-manager/deploying-to-your-own-servers)

> [!NOTE] Anypoint Studio’s **Deploy to CloudHub** option targets CloudHub and does not deploy
> applications to Anypoint Platform PCE hybrid servers. For PCE, export a deployable JAR and upload
> it in Runtime Manager.

## See Also

- [Managing Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/latest/operating-about)

- [Deploying to Your Own Servers](https://docs.mulesoft.com/runtime-manager/deploying-to-your-own-servers)

- [Troubleshooting Mule Runtime Engine Registration](https://docs.mulesoft.com/private-cloud/latest/register-server)

<!-- document id=1a02510a8f3c5f651d19d62fb2e68e43c0a532a0562393e92adf98d3f8809298 url=/mulesoft/current/en-us/private-cloud/latest/deploy-apps-code-builder.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.3
is-latest-version: true
---

# Deploying Mule Applications Using Anypoint Code Builder

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Follow these steps to develop, package, and deploy Mule applications to Anypoint Platform Private
Cloud Edition (Anypoint Platform PCE) using Anypoint Code Builder in VS Code. You can complete this
workflow without MuleSoft Vibes by following the standard Anypoint Code Builder documentation.
MuleSoft Vibes is optional.

1.  [Connect Anypoint Platform PCE with Anypoint Code Builder](#connect-acb)

2.  [Develop Mule Application](#develop-mule-app)

3.  [Package and Export the Mule Application](#package-export)

4.  [Deploy to Runtime Manager](#deploy-runtime-manager)

5.  [Publish to Exchange](#publish-exchange)

6.  [Validate the Deployment](#validate-deployment)

## Connect Anypoint Platform PCE with Anypoint Code Builder

To connect Anypoint Platform PCE with Anypoint Code Builder, follow the instructions in
[Configuring Anypoint Code Builder for Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/latest/config-code-builder).

Private cloud mode connects Anypoint Code Builder on your machine to the Anypoint Platform PCE
control plane. Sign-in uses OAuth or OIDC with the identity provider hosted by Anypoint Platform
PCE. Anypoint Code Builder keeps application metadata in your network and blocks standard cloud
telemetry.

## Develop Mule Application

Build the Mule application in VS Code with Anypoint Code Builder. You can create the specification,
the flow, DataWeave transformations, and security configuration without MuleSoft Vibes. Follow the
standard Anypoint Code Builder documentation:

- [Designing API Specs and Fragments](https://docs.mulesoft.com/anypoint-code-builder/des-designing-api-specs)

- [Developing Integrations](https://docs.mulesoft.com/anypoint-code-builder/int-developing-integrations)

MuleSoft Vibes is optional. If you use it, Vibes skills can generate the specification, the flow,
DataWeave transformations, and security configuration.

These skills are available in the skill pack:

- `build-mule-integration` generates integration flows, configures endpoints, and scaffolds
  orchestration.

- `secure-mule-app` scans the configuration for security risks, applies encryption, and suggests
  logging.

- DataWeave skills generate transformations and map payload schemas.

You can add organization-specific skills that enforce naming conventions, header standards, and
logging policies. Package those skills in a repository and use them with Anypoint Code Builder.

1.  In VS Code, open the Command Palette and run `MuleSoft: Design an API` to create the API
    specification. Anypoint Code Builder validates the specification locally.

2.  To mock the API on your machine, use the API Console.

3.  Run `MuleSoft: Implement an API Specification` to stub the interface and connect the services.

4.  To create a project from the canvas instead, select the Anypoint Code Builder icon in the
    primary side bar, select `Develop an Integration`, and create a Mule project.

5.  To import an asset from Exchange, run `MuleSoft: Import Asset From Exchange`. Select the asset
    type and add it to the project.

6.  Develop the flow, DataWeave transformations, and security configuration in Anypoint Code
    Builder. If you use MuleSoft Vibes, you can use natural language prompts for flow logic,
    DataWeave mappings, and the `secure-mule-app` skill.

7.  Create and run MUnit tests in the project before you package the application.

8.  Run a local debug session from the **Run and Debug** sidebar to test the logic before packaging.

![Anypoint Code Builder in VS Code, with the command palette open to MuleSoft: Login to Anypoint Platform, a Mule flow on the canvas, and the local runtime in the terminal](/mulesoft/current/en-us/private-cloud/latest/_images/pce-acb-vibes.png)

## Package and Export the Mule Application

Manually create the deployable Mule application artifact:

1.  In the VS Code Explorer, right-click your `mule-artifact.json` file or any XML file in
    `src/main/mule`.

2.  Select **MuleSoft: Export Mule Project**.

3.  Choose **Deployable JAR** and select **Include project sources**.

    Including project sources enables you to re-import the project later if needed.

4.  Save the JAR to your local machine.

## Deploy to Runtime Manager

Upload the JAR to your hybrid server. The server must be registered and in the **Running** state.

1.  Log in to Anypoint Platform PCE and navigate to **Runtime Manager**.

2.  Select the correct environment, and then click **Deploy Application**.

3.  Set the **Deployment Target** to your hybrid server or cluster.

4.  Click **Choose File** > **Upload File** and select the JAR you exported.

5.  Click **Deploy Application**.

After the application status is **Started**, apply API Manager policies to the endpoints. Use API
Manager in Anypoint Platform PCE, or the Anypoint CLI API Manager plugin from
[Configuring Anypoint Code Builder for Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/latest/config-code-builder).

## Publish to Exchange

Publishing an asset directly from Anypoint Code Builder to Exchange in Anypoint Platform PCE has
partial support. Publish the deployable JAR from Exchange in Anypoint Platform PCE:

1.  In Anypoint Platform PCE, navigate to **Exchange**.

2.  Click **Publish New Asset**.

3.  Provide an asset name and select **Mule Application** as the asset type.

4.  Upload the same JAR file.

    This publishes the project to your organization’s private library.

## Validate the Deployment

To validate the deployment, follow these steps:

1.  In Runtime Manager, wait until the application status is **Started**.

2.  Use an API client such as Postman or the VS Code Thunder Client to send a request to the server
    IP and the port defined in your HTTP Listener.

    For example: `[http://10.x.x.x:8081/api/test](http://10.x.x.x:8081/api/test)`

3.  Check the **Logs** tab in Runtime Manager to verify that the request was processed successfully.

## See Also

- [Deploying Mule Applications to Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/latest/deploy-apps)

- [Configuring Anypoint Code Builder for Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/latest/config-code-builder)

- [Developing Integrations](https://docs.mulesoft.com/anypoint-code-builder/int-developing-integrations)

- [Using Skills with MuleSoft Vibes](https://docs.mulesoft.com/anypoint-code-builder/vibes-skills)

- [Deploying to Your Own Servers](https://docs.mulesoft.com/runtime-manager/deploying-to-your-own-servers)

- [Managing Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/latest/operating-about)

<!-- document id=6b214fc7bff36a43d4c80085869d1ba5e5f2a723cda72a744f2c0e586cf5c9c8 url=/mulesoft/current/en-us/private-cloud/3.2/prereq-platform.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 3.2
---

# Environment Prerequisites

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

## Supported Environments

The following environments are the only environments supported by Anypoint Platform Private Cloud
Edition (Anypoint Platform PCE):

- VMWare bare metal virtualization

- Physical servers

- Amazon Web Services (AWS)

If you are using AWS, perform the steps provided in
[Provision AWS Prerequisites](https://docs.mulesoft.com/private-cloud/3.2/prereq-aws-terraform).

## See Also

- [Hardware Prerequisites](https://docs.mulesoft.com/private-cloud/3.2/prereq-hardware)

- [Software Prerequisites](https://docs.mulesoft.com/private-cloud/3.2/prereq-software)

- [Network Prerequisites](https://docs.mulesoft.com/private-cloud/3.2/prereq-network)

- [NFS Server Prerequisites](https://docs.mulesoft.com/private-cloud/3.2/verify-nfs)

- [Preinstallation Verification](https://docs.mulesoft.com/private-cloud/3.2/prereq-gravity-check)

<!-- document id=a19110146050eb72710d732ff2d94781470b494384ed7d4f5bba3f1cfcbec636 url=/mulesoft/current/en-us/private-cloud/3.2/prereq-other.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 3.2
---

# Gather Environment Information

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

During installation, you will be asked to provide the following information:

- Your Anypoint Platform Private Cloud Edition license file. For example, `license.pem`. Contact
  your MuleSoft representative for assistance.

- Name and location of the installation package. For example,
  `/home/ec2-user/anypoint-2.0.3-installer.tar.gz`. Contact your MuleSoft representative for
  assistance.

- AWS credentials

  - Admin ID

  - Admin email address

  - Admin password

- IP address for each server in the cluster

- Device names

  - System state directory

  - Application data

  - etcd

  - Docker

- NFS server information

  - DNS for NFS server

  - NFS server path

  - PLATFORM\_DNS (The DNS must be configured to the NFS server.)

- Anypoint Platform organization and administrator:

  - Administrator username

  - Administrator email

  - Administrator password

- SMTP server credentials

  - Host name

  - Port used to communicate to your SMTP server

  - User name to authenticate to your SMTP server

  - SMTP password

## See Also

- [Hardware Prerequisites](https://docs.mulesoft.com/private-cloud/3.2/prereq-hardware)

- [Software Prerequisites](https://docs.mulesoft.com/private-cloud/3.2/prereq-software)

- [Network Prerequisites](https://docs.mulesoft.com/private-cloud/3.2/prereq-network)

- [NFS Server Prerequisites](https://docs.mulesoft.com/private-cloud/3.2/verify-nfs)

<!-- document id=9394dcca39548d3005a7a561432a626b2838626be0e06ce9bafe33fe71c967d6 url=/mulesoft/current/en-us/private-cloud/3.2/prereq-hardware.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 3.2
---

# Hardware Prerequisites

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

To ensure the performance and stability of Anypoint Platform Private Cloud Edition (Anypoint
Platform PCE), every node in your Anypoint Platform PCE environment must meet the requirements
described in this topic.

> [!IMPORTANT] Before you install Anypoint Platform PCE, your infrastructure team must review each
> of the following sections and verify that your environment meets the stated disk and device
> requirements. If needed, contact your MuleSoft representative for assistance.

There are 2 components of PCE:

- Anypoint Platform Core

- Anypoint Monitoring (optional)

To ensure platform performance, stability, and high availability, Anypoint Platform Private Cloud
Edition (Anypoint Platform PCE) supports two network configurations: 4-node and 7-node.

Small configuration:

- 4 nodes for Control Plane

- 3 additional nodes for Anypoint Monitoring (optional add-on)

- NFS for asset storage

- Load balancer

Large configuration:

- 7 nodes for Control Plane

- 3 additional nodes for Monitoring (optional)

- NFS for asset storage

- Load balancer

To ensure high availability and performance, each node must run on its own server in both
configurations. If you are using a virtual machine to host the nodes, you must ensure that each VM
node is running on a separate physical server.

## Anypoint Platform Core

Prerequisites for 4-nodes or 7-nodes to run the Anypoint Platform Core.

### Memory and CPU Requirements

The following are the minimum requirements needed for the Anypoint Platform core. Depending on your
environment, you may need more CPU or memory.

<table><caption>Table 1. Memory and CPU Requirements</caption> <colgroup><col> <col></colgroup><thead><tr><th>Component</th><th>Requirement</th></tr></thead><tbody><tr><td><p>RAM</p></td><td><p>32 GB</p></td></tr><tr><td><p>CPU</p></td><td><p>8 Cores</p></td></tr></tbody></table>

> [!IMPORTANT] If the stated requirements for Memory and CPU are not met, Anypoint Platform PCE
> installation will fail.

For production environments, each node in your configuration must have the following dedicated
devices. All devices must be formatted either as **xfs** or **ext4**.

<table><caption>Table 2. Dedicated Device Requirements</caption> <colgroup><col> <col> <col> <col> <col></colgroup><thead><tr><th>Component</th><th>Size</th><th>Minimum IOPS</th><th>Mount Point</th><th>Description</th></tr></thead><tbody><tr><td><p>HDD 2 <a href="#system-state-directory-device">System State Directory Device</a></p></td><td><p>250 GB</p></td><td><p>1500</p></td><td><p>/var/lib/gravity</p></td><td><p>Stores system configuration and metadata, including databases and packages. Because package sizes can be large, it is important to estimate the minimum size requirements and allocate enough space as a dedicated device before installation.</p></td></tr><tr><td><p>HDD 3 <a href="#application-data-device">Application Data Device</a></p></td><td><p>250 GB</p></td><td><p>1500</p></td><td><p>/var/lib/data</p></td><td><p>Stores application configuration and data. The amount of space required should be at least 250 GB, but can vary depending on your specific use case. It is important to estimate the minimum size requirements and allocate enough space as a dedicated device ahead of time.</p></td></tr><tr><td><p>HDD 4 <a href="#docker-device">Docker Device</a></p></td><td><p>100 GB</p></td><td><p>3000</p></td><td><p>/var/lib/gravity/planet/docker</p></td><td><p>Used by Docker’s overlay storage driver. A minimum of 100GB is required for the overlay directory. Devices with 50GB or less will experience degraded system performance or might not work at all.</p></td></tr><tr><td><p>HDD 5 <a href="#etcd-device">Etcd Device</a></p></td><td><p>20 GB</p></td><td><p>3000</p></td><td><p>/var/lib/gravity/planet/etcd</p></td><td><p>Provides dedicated storage for the distributed database used for cluster coordination.</p></td></tr><tr><td><p>/tmp (Installer)</p></td><td><p>50 GB</p></td><td><p>N/A</p></td><td></td><td></td></tr><tr><td><p>/ (root)</p></td><td><p>50 GB</p></td><td><p>N/A</p></td><td></td><td><p>You must have at least 50GB in your home directory to download and unzip the installer file.</p></td></tr></tbody></table>

> [!NOTE] The space requirements listed in the previous table are based on average use. For
> environments with heavy traffic, validate the amount of space needed with MuleSoft Professional
> Services.

### System State Directory Device

The main purpose of the system state directory device is to store system configuration and metadata,
for example, database and packages. As package sizes can be arbitrarily large, it is important to
estimate the minimum size requirements and allocate enough space for the dedicated device.

Format this device either as `xfs` or `ext4` and mounted as `/var/lib/gravity`.

The following shell snippet is provided as an example for mounting the system state directory device
using systemd mount files and cannot be used as-is in production. You can also mount the system
state directory device by using `/etc/fstab` or some other method. Consult with your system
administrator to determine the best way to meet this requirement. If you use the following example
to guide this process, make sure to specify the correct device name in two places.

sudo mkfs.ext4 /dev/<device name> sudo mkdir -p /var/lib/gravity echo -e
"\[Mount\]\\nWhat=/dev/<device name>\\nWhere=/var/lib/gravity\\nType=ext4\\n\[Install\]\\nWantedBy=local-fs.target"
| sudo tee /etc/systemd/system/var-lib-gravity.mount sudo systemctl daemon-reload sudo systemctl
enable var-lib-gravity.mount sudo systemctl start var-lib-gravity.mount

### Application Data Device

The main purpose of the application data directory device is to store application configuration and
data. The minimum amount of space required is 250GB, but your use case might require more. It is
important to allocate enough space for the dedicated device.

Format this device either as `xfs` or `ext4` and mounted as `/var/lib/data`.

The following shell snippet is provided as an example for mounting the application data device using
systemd mount files, and cannot be used as-is in production. You can also mount the application data
device using `/etc/fstab` or some other method. Consult with your system administrator to determine
the best way to meet this requirement. If you use the following example to guide this process, make
sure to specify the correct device name in two places.

sudo mkfs.ext4 /dev/<device name> sudo mkdir -p /var/lib/data echo -e
"\[Mount\]\\nWhat=/dev/<device name>\\nWhere=/var/lib/data\\nType=ext4\\n\[Install\]\\nWantedBy=local-fs.target"
| sudo tee /etc/systemd/system/var-lib-data.mount sudo systemctl daemon-reload sudo systemctl enable
var-lib-data.mount sudo systemctl start var-lib-data.mount

### Etcd Device

The main purpose of the etcd device is to provide dedicated storage for a distributed database used
for cluster coordination. It does not require much space, 20GB is adequate.

Format this device either as `xfs` or `ext4` and mounted as `/var/lib/gravity/planet/etcd`.

The following shell snippet mounts the etcd device using systemd mount files to the path
`/var/lib/gravity/planet/etcd`.

You can also mount the etcd device using `/etc/fstab` or another method. Consult with your system
administrator to determine the best way to meet this requirement. If you use the following example
as a guide for this process, specify the correct device name in two places.

> [!NOTE] Mount this device AFTER you mount the System State device under `/var/lib/gravity/planet`.
> If you are using systemd units to mount the volumes, declare mount dependencies using
> `After=<device-name>.<mount>`.

sudo mkfs.ext4 /dev/<device name> sudo mkdir -p /var/lib/gravity/planet/etcd echo -e
"\[Mount\]\\nWhat=/dev/<device name>\\nWhere=/var/lib/gravity/planet/etcd\\nType=ext4\\n\[Install\]\\nWantedBy=local-fs.target"
| sudo tee /etc/systemd/system/var-lib-gravity-planet-etcd.mount sudo systemctl daemon-reload sudo
systemctl enable var-lib-gravity-planet-etcd.mount sudo systemctl start
var-lib-gravity-planet-etcd.mount

### Docker Device

Unless specified, Docker configuration defaults to the use of the overlay driver, which is
recommended for production.

Format this device as `xfs` or `ext4` and mount as `/var/lib/gravity/planet/docker`.

The following example shell snippet mounts the Docker device using `systemd` mount files to the path
`/var/lib/gravity/planet/docker`. You can also mount the Docker device using `/etc/fstab` or another
method. Consult with your system administrator to determine the best way to meet this requirement.
If you use the following example as a guide for this process, replace `<device name>` with the
correct device name in two places.

> [!NOTE] Mount this device AFTER you mount the System State device under `/var/lib/gravity/planet`.
> If you are using system.d units to mount the volumes, declare mount dependencies using
> `After=<device-name>.<mount>`

sudo mkfs.ext4 /dev/<device name> sudo mkdir -p /var/lib/gravity/planet/docker echo -e
"\[Mount\]\\nWhat=/dev/<device name>\\nWhere=/var/lib/gravity/planet/docker\\nType=ext4\\n\[Install\]\\nWantedBy=local-fs.target"
| sudo tee /etc/systemd/system/var-lib-gravity-planet-docker.mount sudo systemctl daemon-reload sudo
systemctl enable var-lib-gravity-planet-docker.mount sudo systemctl start
var-lib-gravity-planet-docker.mount

## Anypoint Monitoring

Anypoint Monitoring is an optional add-on that Anypoint Private Cloud supports. See
[Anypoint Monitoring on Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/3.2/anypoint-monitoring) for more information.

Prerequisites: The extra 3 nodes for the Monitoring Center Add-On.

### Memory and CPU Requirements

Monitoring Center Add-On hardware requirements are different from the Platform Core nodes, they
require more CPU, more memory and different disk mounts.

<table><caption>Table 3. Memory and CPU Requirements</caption> <colgroup><col> <col></colgroup><thead><tr><th>Component</th><th>Requirement</th></tr></thead><tbody><tr><td><p>RAM</p></td><td><p>128 GB</p></td></tr><tr><td><p>CPU</p></td><td><p>32 Cores</p></td></tr></tbody></table>

For production environments, each node in your configuration must have the following dedicated
devices. All devices must be formatted either as **xfs** or **ext4**.

<table><caption>Table 4. Dedicated Device Requirements</caption> <colgroup><col> <col> <col> <col> <col></colgroup><thead><tr><th>Component</th><th>Size</th><th>Minimum IOPS</th><th>Mount Point</th><th>Description</th></tr></thead><tbody><tr><td><p>HDD 2 <a href="#system-state-directory-device">System State Directory Device</a></p></td><td><p>250 GB</p></td><td><p>1500</p></td><td><p>/var/lib/gravity</p></td><td><p>Stores system configuration and metadata, including databases and packages. Package sizes can be large, so it is important to estimate the minimum size requirements and allocate enough space as a dedicated device before installation.</p></td></tr><tr><td><p>HDD 3 <a href="#docker-device">Docker Device</a></p></td><td><p>100 GB</p></td><td><p>3000</p></td><td><p>/var/lib/gravity/planet/docker</p></td><td><p>Used by Docker’s overlay storage driver. A minimum of 100GB is required for the overlay directory. Devices with 50GB or less will experience degraded system performance or might not work at all.</p></td></tr><tr><td><p>HDD 4 <a href="#dias-amv-device">Cassandra AMV Device</a></p></td><td><p>500 GB</p></td><td><p>1500</p></td><td><p>/var/lib/data/dias-meld &amp; /var/lib/data/dias-cassandra</p></td><td><p>Stores Cassandra database data for Monitoring Center Add-On. The amount of space required should be at least 250 GB, but can vary depending on your specific use case. It is important to estimate the minimum size requirements and allocate enough space as a dedicated device ahead of time.</p></td></tr><tr><td><p>HDD 5 <a href="#stolon-amv-device">Stolon AMV Device</a></p></td><td><p>250 GB</p></td><td><p>1500</p></td><td><p>/var/lib/data/stolon-amv</p></td><td><p>Stores Postgres database data for Monitorng Center Add-On. The amount of space required should be at least 250 GB, but can vary depending on your specific use case. It is important to estimate the minimum size requirements and allocate enough space as a dedicated device ahead of time.</p></td></tr><tr><td><p>HDD 7 <a href="#influxdb-amv-device">InfluxDB AMV Device</a></p></td><td><p>4 TB</p></td><td><p>1500</p></td><td><p>/var/lib/data/influxdb</p></td><td><p>Stores InfluxDB data for Monitoring Center Add-On. The amount of space required should be at least 250 GB, but can vary depending on your specific use case. It is important to estimate the minimum size requirements and allocate enough space as a dedicated device ahead of time.</p></td></tr><tr><td><p>HDD 7 <a href="#logstash-amv-device">logstash AMV Device</a></p></td><td><p>500 GB</p></td><td><p>1500</p></td><td><p>/var/lib/data/logstash</p></td><td><p>Stores Logstash data for Monitoring Center Add-On. The amount of space required should be at least 250 GB, but can vary depending on your specific use case. It is important to estimate the minimum size requirements and allocate enough space as a dedicated device ahead of time.</p></td></tr><tr><td><p>/tmp (Installer)</p></td><td><p>20 GB</p></td><td><p>N/A</p></td><td></td><td></td></tr><tr><td><p>/ (root)</p></td><td><p>10 GB</p></td><td><p>N/A</p></td><td></td><td><p>You must have at least 10GB in your home directory to download and unzip the installer file.</p></td></tr></tbody></table>

> [!NOTE] The space requirements listed in the previous table are based on average use. For
> environments with heavy traffic, validate the amount of space needed with MuleSoft Professional
> Services.

### System State Directory Device

The main purpose of the system state directory device is to store system configuration and metadata,
for example, database and packages. As package sizes can be arbitrarily large, it is important to
estimate the minimum size requirements and allocate enough space for the dedicated device.

Format this device either as `xfs` or `ext4` and mount as `/var/lib/gravity`.

The following shell snippet is provided as an example for mounting the system state directory device
using `systemd` mount files and cannot be used as-is in production. You can also mount the system
state directory device by using `/etc/fstab` or some other method. Consult with your system
administrator to determine the best way to meet this requirement. If you use the following example
as a guide for this process, replace `<device name>` with the correct device name in two places.

sudo mkfs.ext4 /dev/<device name> sudo mkdir -p /var/lib/gravity echo -e
"\[Mount\]\\nWhat=/dev/<device name>\\nWhere=/var/lib/gravity\\nType=ext4\\n\[Install\]\\nWantedBy=local-fs.target"
| sudo tee /etc/systemd/system/var-lib-gravity.mount sudo systemctl daemon-reload sudo systemctl
enable var-lib-gravity.mount sudo systemctl start var-lib-gravity.mount

### Docker Device

Unless specified, Docker configuration defaults to the use of the overlay driver, which is
recommended for production.

Format this device as `xfs` or `ext4` and mount as `/var/lib/gravity/planet/docker`.

The following example shell snippet mounts the Docker device using `systemd` mount files to the
path: `/var/lib/gravity/planet/docker`. You can also mount the Docker device using `/etc/fstab` or
another method. Consult with your system administrator to determine the best way to meet this
requirement. If you use the following example as a guide for this process, replace `<device name>`
with the correct device name in two places.

> [!NOTE] Mount this device AFTER you mount the System State device under `/var/lib/gravity/planet`.
> If you are using system.d units to mount the volumes, declare mount dependencies using
> `After=<device-name>.<mount>`

sudo mkfs.ext4 /dev/<device name> sudo mkdir -p /var/lib/gravity/planet/docker echo -e
"\[Mount\]\\nWhat=/dev/<device name>\\nWhere=/var/lib/gravity/planet/docker\\nType=ext4\\n\[Install\]\\nWantedBy=local-fs.target"
| sudo tee /etc/systemd/system/var-lib-gravity-planet-docker.mount sudo systemctl daemon-reload sudo
systemctl enable var-lib-gravity-planet-docker.mount sudo systemctl start
var-lib-gravity-planet-docker.mount

### DIAS Data Device

The main purpose of the DIAS Data directory device is to store Monitoring Center Add-On Cassandra
and Meld database data. The minimum amount of space required is 250GB, but your use case might
require more. It is important to allocate enough space for the dedicated device.

Format this device either as `xfs` or `ext4` and mount as `/var/lib/data`.

The following shell snippet is provided as an example for mounting the application data device using
`systemd` mount files, and cannot be used as-is in production. You can also mount the application
data device using `/etc/fstab` or some other method. Consult with your system administrator to
determine the best way to meet this requirement. If you use the following example as a guide for
this process, replace `<device name>` with the correct device name in two places.

sudo mkfs.ext4 /dev/<device name> sudo mkdir -p /var/lib/data echo -e
"\[Mount\]\\nWhat=/dev/<device name>\\nWhere=/var/lib/data\\nType=ext4\\n\[Install\]\\nWantedBy=local-fs.target"
| sudo tee /etc/systemd/system/var-lib-data-dias.mount sudo systemctl daemon-reload sudo systemctl
enable var-lib-data-dias.mount sudo systemctl start var-lib-data-dias.mount

Once mounted, create the following dirs if necessary on every Monitor Center Add-On node:

- /var/lib/data/dias-cassandra

- /var/lib/data/dias-meld

### Stolon AMV Device

The main purpose of the Stolon AMV directory device is to store Monitoring Center Add-On Postgres
database data. The minimum amount of space required is 250GB, but your use case might require more.
It is important to allocate enough space for the dedicated device.

Format this device either as `xfs` or `ext4` and mount as `/var/lib/data/stolon-amv`.

The following shell snippet is provided as an example for mounting the application data device using
`systemd` mount files, and cannot be used as-is in production. You can also mount the application
data device using `/etc/fstab` or some other method. Consult with your system administrator to
determine the best way to meet this requirement. If you use the following example as a guide for
this process, replace `<device name>` with the correct device name in two places.

sudo mkfs.ext4 /dev/<device name> sudo mkdir -p /var/lib/data/stolon-amv echo -e
"\[Mount\]\\nWhat=/dev/<device name>\\nWhere=/var/lib/data/stolon-amv\\nType=ext4\\n\[Install\]\\nWantedBy=local-fs.target"
| sudo tee /etc/systemd/system/var-lib-data-stolon-amv.mount sudo systemctl daemon-reload sudo
systemctl enable var-lib-data-stolon-amv.mount sudo systemctl start var-lib-data-stolon-amv.mount

### InfluxDB AMV Device

The main purpose of the InfluxDB AMV directory device is to store Monitoring Center Add-On InfluxDB
data. The minimum amount of space required is 250GB, but your use case might require more. It is
important to allocate enough space for the dedicated device.

Format this device either as `xfs` or `ext4` and mount as `/var/lib/data/influxdb`.

The following shell snippet is provided as an example for mounting the application data device using
`systemd` mount files, and cannot be used as-is in production. You can also mount the application
data device using `/etc/fstab` or some other method. Consult with your system administrator to
determine the best way to meet this requirement. If you use the following example as a guide for
this process, replace `<device name>` with the correct device name in two places.

sudo mkfs.ext4 /dev/<device name> sudo mkdir -p /var/lib/data/influxdb echo -e
"\[Mount\]\\nWhat=/dev/<device name>\\nWhere=/var/lib/data/influxdb\\nType=ext4\\n\[Install\]\\nWantedBy=local-fs.target"
| sudo tee /etc/systemd/system/var-lib-data-influxdb.mount sudo systemctl daemon-reload sudo
systemctl enable var-lib-data-influxdb.mount sudo systemctl start var-lib-data-influxdb.mount

Once mounted, create the following dirs if necessary on every Monitor Center Add-On node:

- /var/lib/data/influxdb/data

- /var/lib/data/influxdb/meta

### Logstash AMV Device

The main purpose of the Logstash AMV directory device is to store Monitoring Center Add-On Logstash
database data. The minimum amount of space required is 250GB, but your use case might require more.
It is important to allocate enough space for the dedicated device.

Format this device either as `xfs` or `ext4` and mount as `/var/lib/data/logstash`.

The following shell snippet is provided as an example for mounting the application data device using
`systemd` mount files, and cannot be used as-is in production. You can also mount the application
data device using `/etc/fstab` or some other method. Consult with your system administrator to
determine the best way to meet this requirement. If you use the following example as a guide for
this process, replace `<device name>` with the correct device name in two places.

sudo mkfs.ext4 /dev/<device name> sudo mkdir -p /var/lib/data/logstash echo -e
"\[Mount\]\\nWhat=/dev/<device name>\\nWhere=/var/lib/data/logstash\\nType=ext4\\n\[Install\]\\nWantedBy=local-fs.target"
| sudo tee /etc/systemd/system/var-lib-data-logstash.mount sudo systemctl daemon-reload sudo
systemctl enable var-lib-data-logstash.mount sudo systemctl start var-lib-data-logstash.mount

## Verify Devices

To verify that all devices are set up the same way on all nodes, run the `lsblk` command on the
Anypoint Monitoring and Visualizer nodes. Output from `lsblk` should resemble the following example:

\[root@ip-0-0-0-0 ~\]# lsblk NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT xvda 202:0 0 90G 0 disk ├─xvda1
202:1 0 1M 0 part └─xvda2 202:2 0 90G 0 part / xvdb 202:16 0 100G 0 disk
/var/lib/gravity/planet/docker xvdd 202:48 0 250G 0 disk /var/lib/data xvde 202:64 0 250G 0 disk
/var/lib/gravity xvdf 202:64 0 250G 0 disk /var/lib/data/stolon-amv xvdg 202:64 0 250G 0 disk
/var/lib/data/influxdb xvdh 202:64 0 250G 0 disk /var/lib/data/logstash xvdi 202:64 0 20G 0 disk
/tmp

## Verify Disk IOPS

Depending on your hardware or virtualization provider, you can configure disk IOPS (I/O operations
per second). Using the `iops` command, verify available IOPS on each device:

$ sudo ./iops --time 2 /dev/xvdb /dev/xvdb, 107.37 GB, 32 threads: 512 B blocks: 1893.0 IO/s, 946.5
KiB/s ( 7.8 Mbit/s) 1 KiB blocks: 1354.8 IO/s, 1.3 MiB/s ( 11.1 Mbit/s) 2 KiB blocks: 1091.8 IO/s,
2.1 MiB/s ( 17.9 Mbit/s) 4 KiB blocks: 807.1 IO/s, 3.2 MiB/s ( 26.4 Mbit/s) 8 KiB blocks: 803.7
IO/s, 6.3 MiB/s ( 52.7 Mbit/s) 16 KiB blocks: 787.4 IO/s, 12.3 MiB/s (103.2 Mbit/s) 32 KiB blocks:
700.8 IO/s, 21.9 MiB/s (183.7 Mbit/s) 64 KiB blocks: 590.0 IO/s, 36.9 MiB/s (309.3 Mbit/s) 128 KiB
blocks: 327.6 IO/s, 40.9 MiB/s (343.5 Mbit/s) ...

## Load Balancer Requirements

Anypoint Platform PCE must run in a production environment with multiple servers. To distribute
traffic among servers and to restrict access to specific ports, you must provide and configure a
load balancer.

You can use any load balancer, including NGINX, but NGINX is not required.

> [!NOTE] If using the [AWS Provisioner for Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/3.2/prereq-aws-terraform), you do not
> need to configure a separate load balancer. An Amazon ELB with the required configuration is
> created during installation.

### Load Balancer Configuration

You can configure your load balancer to use any method for distributing client requests, but in most
contexts a round robin strategy is ideal. Make sure the load balancer is accessible through an IP
address that is available to all machines on your network (including the Anypoint Platform PCE
nodes)

Your load balancer must route the following TCP ports:

<table><caption>Table 5. TCP Port Routing Requirements</caption> <colgroup><col> <col> <col></colgroup><thead><tr><th>Load Balancer Port</th><th>Instance Port</th><th>Internal Usage</th></tr></thead><tbody><tr><td><p><code>80</code></p></td><td><p><code>30080</code></p></td><td><p>HTTP redirects to HTTPs</p></td></tr><tr><td><p><code>443</code></p></td><td><p><code>30443</code></p></td><td><p>HTTPS port</p></td></tr><tr><td><p><code>8083</code></p></td><td><p><code>30883</code></p></td><td><p>HTTPS port for Mule runtimes to authenticate and renew certificates</p></td></tr><tr><td><p><code>8889</code></p></td><td><p><code>30889</code></p></td><td><p>WebSocket port for Mule runtimes to connect</p></td></tr><tr><td><p><code>8895</code></p></td><td><p><code>30895</code></p></td><td><p>(Only when Monitoring Center is enabled)</p></td></tr><tr><td><p><code>9500</code></p></td><td><p><code>32009</code></p></td><td><p>Ops Center access port</p></td></tr></tbody></table>

In each case, your load balancer must listen on the load balancer port and redirect incoming
requests to the instance port. Your Anypoint Platform PCE installation includes an internal NGINX
server that listens on each of the configured instance ports, and then performs the action listed in
the Internal Usage column.

Your load balancer should poll the address `HTTP:10256/healthz` to run a health check on your
platform servers and confirm that they are accessible.

> [!NOTE] Do not configure SSL certificates in your load balancer. TLS termination is handled by the
> platform with the certificates configured using Access Management. See
> [Configure Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/3.2/config-workflow).

### Implement a Load Balancer Using NGINX

1.  Enable stream block in your `/etc/nginx/nginx.conf` file by referencing all the configuration
    properties defined in `/etc/nginx/stream.d/*`.

    ```json
    stream {
       include /etc/nginx/stream.d/*.conf;
    }
    ```

2.  Delete the `default.conf` file from `/etc/nginx/conf.d`

3.  Create a folder named `/etc/nginx/stream.d` and in it create a file named `onprem.conf`

4.  Paste the following content in `onprem.conf`

    ```json
    server {
       listen 80;
       proxy_pass 0.0.0.0:30080;
    }

    server {
       listen 443;
       proxy_pass 0.0.0.0:30443;
    }

    server {
       listen 8083;
       proxy_pass 0.0.0.0:30883;
    }

    server {
       listen 8889;
       proxy_pass 0.0.0.0:30889;
    }

    server {
       listen 8895;
       proxy_pass 0.0.0.0:30895;
    }

    server {
       listen 9500;
       proxy_pass 0.0.0.0:32009;
    }

    server {
       listen 9501;
       proxy_pass 0.0.0.0:30083;
    }
    ```

5.  Enable the default ports on SELinux before starting the NGINX. Run the following commands one by
    one:

    semanage port -a -t http\_port\_t -p tcp 8083 semanage port -a -t http\_port\_t -p tcp 8889
    semanage port -a -t http\_port\_t -p tcp 8895 semanage port -a -t http\_port\_t -p tcp 9500
    semanage port -a -t http\_port\_t -p tcp 9501

6.  Start NGINX:

    service nginx restart

## See Also

- [Environment Prerequisites](https://docs.mulesoft.com/private-cloud/3.2/prereq-platform)

- [Software Prerequisites](https://docs.mulesoft.com/private-cloud/3.2/prereq-software)

- [Network Prerequisites](https://docs.mulesoft.com/private-cloud/3.2/prereq-network)

- [NFS Server Prerequisites](https://docs.mulesoft.com/private-cloud/3.2/verify-nfs)

- [Preinstallation Verification](https://docs.mulesoft.com/private-cloud/3.2/prereq-gravity-check)

- [Nginx](https://www.f5.com/products/nginx)

- [Anypoint Monitoring](https://docs.mulesoft.com/private-cloud/3.2/anypoint-monitoring)

<!-- document id=e2ac4f35cd07f342d2e6d9eaa3cb016e1d294825bb184123779d41ee9f7fb300 url=/mulesoft/current/en-us/private-cloud/3.2/install-workflow.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 3.2
---

# Installation Workflow

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

## Install Anypoint Platform Private Cloud Edition (Anypoint Platform PCE)

To install Anypoint Platform PCE, MuleSoft professional services must be involved throughout the
installation process. Prior to installation, have your infrastructure team verify that the required
infrastructure is correctly installed and configured as described in
[Product Prerequisites](https://docs.mulesoft.com/private-cloud/3.2/install-checklist).

## Install Anypoint Monitoring and Anypoint Visualizer

After installing Anypoint Platform PCE, contact MuleSoft Professional Services to enable Anypoint
Monitoring and Anypoint Visualizer. After they are enabled, you must install the agent for each of
these product components. See [Monitor Hybrid Runtimes](https://docs.mulesoft.com/monitoring/am-installing) and
[Set up Anypoint Visualizer](https://docs.mulesoft.com/visualizer/setup).

> [!NOTE] Multi-instance operation of On-Premises Anypoint Runtime Manager is available only if you
> purchase Anypoint Platform Base Subscription, On-premises Management, API Manager and API
> Analytics, and Platinum Subscription all together.

<!-- document id=ed5af47891981caf58e8d2b8498508249aec85b044e1d0bd1568ac31b0c6a974 url=/mulesoft/current/en-us/private-cloud/4.0/install-openshift.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.0
---

# Installing Anypoint Platform PCE on OpenShift

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Before installing Anypoint Platform Private Cloud Edition (Anypoint Platform PCE) on OpenShift
configure Security Context Constraints (SCC) to grant the required permissions for pods and create
roles for Prometheus, allowing it to collect metrics from the services. After these configurations
are complete, proceed with installing Anypoint Platform PCE.

> [!NOTE] You must have an operational OpenShift cluster prior to installing Anypoint Platform PCE.
> If you do not have one set up, refer to the OpenShift documentation for setup instructions.

Contact MuleSoft Professional Services to perform the installation of Anypoint Platform PCE.

## Configure the Openshift Environment

To configure the OpenShift Environment, configure Security Context Constraints (SCC) and roles for
Prometheus.

### Configure Security Context Constraints (SCC)

The following snippet contains the SCC configuration:

```yaml
apiVersion: security.openshift.io/v1
kind: SecurityContextConstraints
metadata:
  name: anypoint-anyuid
allowHostDirVolumePlugin: false
allowHostIPC: false
allowHostNetwork: false
allowHostPID: false
allowHostPorts: false
allowPrivilegeEscalation: true
allowPrivilegedContainer: false
allowedCapabilities: null
defaultAddCapabilities: null
fsGroup:
  type: RunAsAny
users: []
groups: []
readOnlyRootFilesystem: false
requiredDropCapabilities:
  - MKNOD
runAsUser:
  type: RunAsAny
seLinuxContext:
  type: MustRunAs
seccompProfiles:
  - runtime/default
supplementalGroups:
  type: RunAsAny
volumes:
  - configMap
  - csi
  - downwardAPI
  - emptyDir
  - ephemeral
  - persistentVolumeClaim
  - projected
  - secret
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: anypoint-scc
  namespace: default
rules:
  - apiGroups: ["security.openshift.io"]
    resourceNames:
      - anypoint-anyuid
    resources: ["securitycontextconstraints"]
    verbs: ["use"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: anypoint-scc
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: anypoint-scc
subjects:
  - kind: ServiceAccount
    name: anypoint-install
    namespace: default
  - kind: ServiceAccount
    name: anypoint-install
    namespace: dias
  - kind: ServiceAccount
    name: default
    namespace: pce
  - kind: ServiceAccount
    name: default
    namespace: access-management
  - kind: ServiceAccount
    name: authentication-server-service-account
    namespace: access-management
  - kind: ServiceAccount
    name: default
    namespace: design-center
  - kind: ServiceAccount
    name: default
    namespace: api-console-proxy
  - kind: ServiceAccount
    name: default
    namespace: amf
  - kind: ServiceAccount
    name: default
    namespace: arm
  - kind: ServiceAccount
    name: default
    namespace: api-manager
  - kind: ServiceAccount
    name: default
    namespace: mozart
  - kind: ServiceAccount
    name: default
    namespace: mocking
  - kind: ServiceAccount
    name: default
    namespace: api-manager
  - kind: ServiceAccount
    name: default
    namespace: audit-log
  - kind: ServiceAccount
    name: default
    namespace: trusted-domains
  - kind: ServiceAccount
    name: default
    namespace: api-designer
  - kind: ServiceAccount
    name: monitoring
    namespace: pce
  - kind: ServiceAccount
    name: default
    namespace: exchange
  - kind: ServiceAccount
    name: xapi-service-deployment-manager
    namespace: exchange
  - kind: ServiceAccount
    name: default
    namespace: core-paas
  - kind: ServiceAccount
    name: default
    namespace: monitoring-center
  - kind: ServiceAccount
    name: default
    namespace: visualizer
  - kind: ServiceAccount
    name: secrets-robot
    namespace: dias
  - kind: ServiceAccount
    name: default
    namespace: dias
  - kind: ServiceAccount
    name: default
    namespace: amc
  - kind: Group
    name: system:serviceaccounts:monitoring
  - kind: ServiceAccount
    name: default
    namespace: anypoint-flash
```

Save this file as `openshift-scc.yaml` and apply it to the OpenShift cluster:

```none
oc apply -f openshift-scc.yaml
```

### Configure Roles for Prometheus

Prometheus requires specific roles to collect metrics from Anypoint Platform PCE services. The
following snippet provides the necessary roles configuration:

```yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: pce-prometheus
rules:
  - apiGroups:
      - ""
    resources:
      - endpoints
      - pods
      - services
      - nodes
      - secrets
    verbs:
      - get
      - list
      - watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: pce-prometheus
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: pce-prometheus
subjects:
  - kind: ServiceAccount
    name: prometheus-k8s
    namespace: openshift-monitoring
```

Save this file as `openshift-monitoring.yaml` and apply it to the OpenShift cluster:

```none
oc apply -f openshift-monitoring.yaml
```

## Install Anypoint Platform PCE on OpenShift

The following snippet provides an example installation manifest for deploying Anypoint Platform PCE
on an OpenShift cluster:

```yaml
containerRegistry:
  endpoint: registry.pce.example.com
  username: username
  password: password
  certificate: ""
  subproject: example
  tlsSkipVerify: true
postInstallConfiguration:
  platformDNS: anypoint.pce.example.com
  fileSystemDNS: fs.pce.example.com
  firstUserAccount:
    organizationName: Example Org
    username: username
    email: username@mulesoft.com
    password: password
  platformCertificate: cert.pem
  platformCertificateKey: key.pem
amvInstallConfiguration:
  enabled: false
storageConfiguration:
  pceobjectstore:
    type: persistentVolumeClaim
    storageClass: example-csi
  stolon:
    type: persistentVolumeClaim
    storageClass: example-csi
monitoringAppConfiguration:
  monitoringStackEnabled: false
  grafana:
    enabled: true
    values: |
      datasources:
        datasources.yaml:
          apiVersion: 1
          datasources:
          - name: Prometheus
            type: prometheus
            url: https://prometheus-k8s.openshift-monitoring.svc:9091
            access: proxy
            isDefault: true
            jsonData:
              tlsSkipVerify: true
              httpHeaderName1: 'Authorization'
            secureJsonData:
              httpHeaderValue1: 'Bearer <Token>'
```

Note the `monitoringAppConfiguration` section in the snippet. This section disables the monitoring
stack for Anypoint Platform PCE and enables only the Grafana application. It is recommended to
disable the monitoring stack because OpenShift includes Prometheus by default. Enable Grafana and
configure its datasource to connect to Prometheus.

To obtain the token for connecting to Prometheus, run this command:

```none
oc create token prometheus-k8s -n openshift-monitoring --duration=87600h
```

After completing the installation, run the following commands to allow Prometheus in OpenShift to
collect metrics from platform services:

```none
oc label namespace default openshift.io/cluster-monitoring="true" --overwrite
oc label namespace pce openshift.io/cluster-monitoring="true" --overwrite
```

## See Also

- [Installing Anypoint Platform Private Cloud Edition (Anypoint Platform PCE)](https://docs.mulesoft.com/private-cloud/4.0/install-workflow)

- [Anypoint Platform PCE Prerequisites](https://docs.mulesoft.com/private-cloud/4.0/install-checklist)

<!-- document id=8744e0a6e38c1febde4ed4e6efa8ab3bdf24b002808829a3325fcc5a954dc4b7 url=/mulesoft/current/en-us/private-cloud/4.1/install-openshift.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.1
---

# Installing Anypoint Platform PCE on OpenShift

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Before installing Anypoint Platform Private Cloud Edition (Anypoint Platform PCE) on OpenShift
configure Security Context Constraints (SCC) to grant the required permissions for pods and create
roles for Prometheus, allowing it to collect metrics from the services. After these configurations
are complete, proceed with installing Anypoint Platform PCE.

> [!NOTE] You must have an operational OpenShift cluster prior to installing Anypoint Platform PCE.
> If you do not have one set up, refer to the OpenShift documentation for setup instructions.

Contact MuleSoft Professional Services to perform the installation of Anypoint Platform PCE.

> [!NOTE] Anypoint Platform PCE 4.1.0 is installed and validated on OpenShift 4.16.

## Configure the Openshift Environment

To configure the OpenShift Environment, configure Security Context Constraints (SCC) and roles for
Prometheus.

### Configure Security Context Constraints (SCC)

This snippet contains the SCC configuration:

```yaml
apiVersion: security.openshift.io/v1
kind: SecurityContextConstraints
metadata:
  name: anypoint-anyuid
allowHostDirVolumePlugin: false
allowHostIPC: false
allowHostNetwork: false
allowHostPID: false
allowHostPorts: false
allowPrivilegeEscalation: false
allowPrivilegedContainer: false
allowedCapabilities: null
defaultAddCapabilities: null
fsGroup:
  type: RunAsAny
users: []
groups: []
readOnlyRootFilesystem: false
requiredDropCapabilities:
  - MKNOD
runAsUser:
  type: MustRunAs
  uid: 2020
seLinuxContext:
  type: MustRunAs
seccompProfiles:
  - runtime/default
supplementalGroups:
  type: RunAsAny
volumes:
  - configMap
  - csi
  - downwardAPI
  - emptyDir
  - ephemeral
  - persistentVolumeClaim
  - projected
  - secret
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: anypoint-scc
  namespace: pce-core
rules:
  - apiGroups: ["security.openshift.io"]
    resourceNames:
      - anypoint-anyuid
    resources: ["securitycontextconstraints"]
    verbs: ["use"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: anypoint-scc
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: anypoint-scc
subjects:
  - kind: ServiceAccount
    name: pce-cluster-ssl-app
    namespace: pce-core
  - kind: ServiceAccount
    name: default
    namespace: pce-core
  - kind: ServiceAccount
    name: anypoint-install
    namespace: pce-core
  - kind: ServiceAccount
    name: anypoint-install
    namespace: dias
  - kind: ServiceAccount
    name: default
    namespace: pce
  - kind: ServiceAccount
    name: default
    namespace: access-management
  - kind: ServiceAccount
    name: authentication-server-service-account
    namespace: access-management
  - kind: ServiceAccount
    name: default
    namespace: api-console-proxy
  - kind: ServiceAccount
    name: default
    namespace: amf
  - kind: ServiceAccount
    name: default
    namespace: arm
  - kind: ServiceAccount
    name: default
    namespace: api-manager
  - kind: ServiceAccount
    name: default
    namespace: mozart
  - kind: ServiceAccount
    name: default
    namespace: mocking
  - kind: ServiceAccount
    name: default
    namespace: api-manager
  - kind: ServiceAccount
    name: default
    namespace: audit-log
  - kind: ServiceAccount
    name: default
    namespace: trusted-domains
  - kind: ServiceAccount
    name: default
    namespace: api-designer
  - kind: ServiceAccount
    name: monitoring
    namespace: pce
  - kind: ServiceAccount
    name: default
    namespace: exchange
  - kind: ServiceAccount
    name: xapi-service-deployment-manager
    namespace: exchange
  - kind: ServiceAccount
    name: default
    namespace: core-paas
  - kind: ServiceAccount
    name: default
    namespace: monitoring-center
  - kind: ServiceAccount
    name: default
    namespace: visualizer
  - kind: ServiceAccount
    name: secrets-robot
    namespace: dias
  - kind: ServiceAccount
    name: default
    namespace: dias
  - kind: ServiceAccount
    name: default
    namespace: amc
  - kind: Group
    name: system:serviceaccounts:monitoring
  - kind: ServiceAccount
    name: default
    namespace: anypoint-flash

---
apiVersion: security.openshift.io/v1
kind: SecurityContextConstraints
metadata:
  name: anypoint-anyuid-privileged
allowHostDirVolumePlugin: false
allowHostIPC: false
allowHostNetwork: false
allowHostPID: false
allowHostPorts: false
allowPrivilegeEscalation: true
allowPrivilegedContainer: false
allowedCapabilities: null
defaultAddCapabilities: null
fsGroup:
  type: RunAsAny
users: []
groups: []
readOnlyRootFilesystem: false
requiredDropCapabilities:
  - MKNOD
runAsUser:
  type: RunAsAny
seLinuxContext:
  type: MustRunAs
seccompProfiles:
  - runtime/default
supplementalGroups:
  type: RunAsAny
volumes:
  - configMap
  - csi
  - downwardAPI
  - emptyDir
  - ephemeral
  - persistentVolumeClaim
  - projected
  - secret
  - nfs
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: anypoint-scc-privileged
  namespace: pce-core
rules:
  - apiGroups: ["security.openshift.io"]
    resourceNames:
      - anypoint-anyuid-privileged
    resources: ["securitycontextconstraints"]
    verbs: ["use"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: anypoint-scc-privileged
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: anypoint-scc-privileged
subjects:
  - kind: ServiceAccount
    name: stolon
    namespace: pce-core
  - kind: ServiceAccount
    name: default
    namespace: pce-core
  - kind: ServiceAccount
    name: anypoint-install
    namespace: pce-core
  - kind: ServiceAccount
    name: seaweedfs-rw-sa
    namespace: pce-core
  - kind: ServiceAccount
    name: default
    namespace: api-manager
  - kind: ServiceAccount
    name: default
    namespace: design-center
  - kind: ServiceAccount
    name: default
    namespace: exchange
  - kind: ServiceAccount
    name: default
    namespace: logging-internal
  - kind: ServiceAccount
    name: default
    namespace: pce
  - kind: ServiceAccount
    name: monitoring
    namespace: pce
  - kind: ServiceAccount
    name: default
    namespace: trusted-domains
  - kind: ServiceAccount
    name: default
    namespace: mocking

---
apiVersion: security.openshift.io/v1
kind: SecurityContextConstraints
metadata:
  name: anypoint-pce-monitoring
allowHostDirVolumePlugin: false
allowHostIPC: false
allowHostNetwork: false
allowHostPID: false
allowHostPorts: false
allowPrivilegeEscalation: false
allowPrivilegedContainer: false
allowedCapabilities: null
defaultAddCapabilities: null
fsGroup:
  type: RunAsAny
users: []
groups: []
readOnlyRootFilesystem: false
requiredDropCapabilities:
  - MKNOD
runAsUser:
  type: MustRunAs
  uid: 472
seLinuxContext:
  type: MustRunAs
seccompProfiles:
  - runtime/default
supplementalGroups:
  type: RunAsAny
volumes:
  - configMap
  - csi
  - downwardAPI
  - emptyDir
  - ephemeral
  - persistentVolumeClaim
  - projected
  - secret
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: anypoint-pce-monitoring
rules:
  - apiGroups: ["security.openshift.io"]
    resourceNames:
      - anypoint-pce-monitoring
    resources: ["securitycontextconstraints"]
    verbs: ["use"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: anypoint-pce-monitoring
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: anypoint-pce-monitoring
subjects:
  - kind: ServiceAccount
    name: grafana
    namespace: monitoring
```

Save this file as `openshift-scc.yaml` and apply it to the OpenShift cluster:

```none
oc apply -f openshift-scc.yaml
```

### Configure Roles for Prometheus

Prometheus requires specific roles to collect metrics from Anypoint Platform PCE services. The
following snippet provides the necessary roles configuration:

```yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: pce-prometheus
rules:
  - apiGroups:
      - ""
    resources:
      - endpoints
      - pods
      - services
      - nodes
      - secrets
    verbs:
      - get
      - list
      - watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: pce-prometheus
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: pce-prometheus
subjects:
  - kind: ServiceAccount
    name: prometheus-k8s
    namespace: openshift-monitoring
```

Save this file as `openshift-monitoring.yaml` and apply it to the OpenShift cluster:

```none
oc apply -f openshift-monitoring.yaml
```

## Install Anypoint Platform PCE on OpenShift

The following snippet provides an example installation manifest for deploying Anypoint Platform PCE
on an OpenShift cluster:

```yaml
containerRegistry:
  endpoint: registry.pce.example.com
  username: username
  password: password
  certificate: ""
  subproject: example
  tlsSkipVerify: true
postInstallConfiguration:
  platformDNS: anypoint.pce.example.com
  fileSystemDNS: fs.pce.example.com
  firstUserAccount:
    organizationName: Example Org
    username: username
    email: username@mulesoft.com
    password: password
  platformCertificate: cert.pem
  platformCertificateKey: key.pem
amvInstallConfiguration:
  enabled: false
storageConfiguration:
  pceobjectstore:
    type: persistentVolumeClaim
    storageClass: example-csi
  stolon:
    type: persistentVolumeClaim
    storageClass: example-csi
monitoringAppConfiguration:
  monitoringStackEnabled: false
  grafana:
    enabled: true
    values: |
      datasources:
        datasources.yaml:
          apiVersion: 1
          datasources:
          - name: Prometheus
            type: prometheus
            url: https://prometheus-k8s.openshift-monitoring.svc:9091
            access: proxy
            isDefault: true
            jsonData:
              tlsSkipVerify: true
              httpHeaderName1: 'Authorization'
            secureJsonData:
              httpHeaderValue1: 'Bearer <Token>'
```

Note the `monitoringAppConfiguration` section in the snippet. This section disables the monitoring
stack for Anypoint Platform PCE and enables only the Grafana application. It is recommended to
disable the monitoring stack because OpenShift includes Prometheus by default. Enable Grafana and
configure its datasource to connect to Prometheus.

To obtain the token for connecting to Prometheus, run this command:

```none
oc create token prometheus-k8s -n openshift-monitoring --duration=87600h
```

After completing the installation, run the following commands to allow Prometheus in OpenShift to
collect metrics from platform services:

```none
oc label namespace default openshift.io/cluster-monitoring="true" --overwrite
oc label namespace pce openshift.io/cluster-monitoring="true" --overwrite
```

## See Also

- [Installing Anypoint Platform Private Cloud Edition (Anypoint Platform PCE)](https://docs.mulesoft.com/private-cloud/4.1/install-workflow)

- [Anypoint Platform PCE Prerequisites](https://docs.mulesoft.com/private-cloud/4.1/install-checklist)

<!-- document id=58fa648ce6283c79b644347c65f410860f1399368ffb7e3ebc426a1fabee82bc url=/mulesoft/current/en-us/private-cloud/4.2/install-openshift.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.2
---

# Installing Anypoint Platform PCE on OpenShift

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Before installing Anypoint Platform Private Cloud Edition (Anypoint Platform PCE) on OpenShift
configure Security Context Constraints (SCC) to grant the required permissions for pods and create
roles for Prometheus, allowing it to collect metrics from the services. After these configurations
are complete, proceed with installing Anypoint Platform PCE.

> [!NOTE] Contact MuleSoft Professional Services or your Anypoint PCE Certified Partner to perform
> the installation or upgrade of Anypoint Platform PCE.

> [!NOTE] You must have an operational OpenShift cluster prior to installing Anypoint Platform PCE.
> If you do not have one set up, refer to the OpenShift documentation for setup instructions.

> [!NOTE] Anypoint Platform PCE 4.2.1 is installed and validated on OpenShift 4.18 and 4.20.

> [!NOTE] It isn’t supported to in-place upgrade from an existing Openshift PCE 4.1.x cluster that’s
> been installed with full admin privilege to 4.2.1 or higher with no admin scope. If this is your
> case, consult [Migrating Anypoint Platform PCE to v4.x](https://docs.mulesoft.com/private-cloud/4.2/upgrade).

## Configure the Openshift Environment

To configure the OpenShift Environment, configure Security Context Constraints (SCC) and roles for
Prometheus.

### Configure Security Context Constraints (SCC)

This snippet contains the SCC configuration:

```yaml
apiVersion: security.openshift.io/v1
kind: SecurityContextConstraints
metadata:
  name: anypoint-anyuid
allowHostDirVolumePlugin: false
allowHostIPC: false
allowHostNetwork: false
allowHostPID: false
allowHostPorts: false
allowPrivilegeEscalation: false
allowPrivilegedContainer: false
allowedCapabilities: null
defaultAddCapabilities: null
fsGroup:
  type: RunAsAny
users: []
groups: []
readOnlyRootFilesystem: false
requiredDropCapabilities:
  - MKNOD
runAsUser:
  type: MustRunAs
  uid: 2020
seLinuxContext:
  type: MustRunAs
seccompProfiles:
  - runtime/default
supplementalGroups:
  type: RunAsAny
volumes:
  - configMap
  - csi
  - downwardAPI
  - emptyDir
  - ephemeral
  - persistentVolume
  - persistentVolumeClaim
  - projected
  - secret
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: anypoint-scc
  namespace: pce-core
rules:
  - apiGroups: ["security.openshift.io"]
    resourceNames:
      - anypoint-anyuid
    resources: ["securitycontextconstraints"]
    verbs: ["use"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: anypoint-scc
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: anypoint-scc
subjects:
  - kind: ServiceAccount
    name: pce-cluster-ssl-app
    namespace: pce-core
  - kind: ServiceAccount
    name: default
    namespace: pce-core
  - kind: ServiceAccount
    name: anypoint
    namespace: pce-core
  - kind: ServiceAccount
    name: anypoint-install
    namespace: pce-core
  - kind: ServiceAccount
    name: anypoint-install-anypoint-services
    namespace: pce-core
  - kind: ServiceAccount
    name: anypoint-install-cluster-ssl
    namespace: pce-core
  - kind: ServiceAccount
    name: anypoint-install-namespaces-job
    namespace: pce-core
  - kind: ServiceAccount
    name: anypoint-install-seaweedfs
    namespace: pce-core
  - kind: ServiceAccount
    name: anypoint-prometheus-install
    namespace: pce-core
  - kind: ServiceAccount
    name: anypoint-grafana-install
    namespace: pce-core
  - kind: ServiceAccount
    name: anypoint-install
    namespace: dias
  - kind: ServiceAccount
    name: default
    namespace: pce
  - kind: ServiceAccount
    name: default
    namespace: access-management
  - kind: ServiceAccount
    name: authentication-server-service-account
    namespace: access-management
  - kind: ServiceAccount
    name: default
    namespace: api-console-proxy
  - kind: ServiceAccount
    name: default
    namespace: amf
  - kind: ServiceAccount
    name: default
    namespace: arm
  - kind: ServiceAccount
    name: default
    namespace: api-manager
  - kind: ServiceAccount
    name: default
    namespace: mozart
  - kind: ServiceAccount
    name: default
    namespace: mocking
  - kind: ServiceAccount
    name: default
    namespace: api-manager
  - kind: ServiceAccount
    name: default
    namespace: audit-log
  - kind: ServiceAccount
    name: default
    namespace: trusted-domains
  - kind: ServiceAccount
    name: default
    namespace: api-designer
  - kind: ServiceAccount
    name: monitoring
    namespace: pce
  - kind: ServiceAccount
    name: default
    namespace: exchange
  - kind: ServiceAccount
    name: xapi-service-deployment-manager
    namespace: exchange
  - kind: ServiceAccount
    name: default
    namespace: core-paas
  - kind: ServiceAccount
    name: default
    namespace: monitoring-center
  - kind: ServiceAccount
    name: default
    namespace: visualizer
  - kind: ServiceAccount
    name: secrets-robot
    namespace: dias
  - kind: ServiceAccount
    name: default
    namespace: dias
  - kind: ServiceAccount
    name: default
    namespace: amc
  - kind: Group
    name: system:serviceaccounts:monitoring
  - kind: ServiceAccount
    name: default
    namespace: anypoint-flash
  - kind: ServiceAccount
    name: default
    namespace: design-center

---
apiVersion: security.openshift.io/v1
kind: SecurityContextConstraints
metadata:
  name: anypoint-anyuid-privileged
allowHostDirVolumePlugin: false
allowHostIPC: false
allowHostNetwork: false
allowHostPID: false
allowHostPorts: false
allowPrivilegeEscalation: true
allowPrivilegedContainer: false
allowedCapabilities: null
defaultAddCapabilities: null
fsGroup:
  type: RunAsAny
users: []
groups: []
readOnlyRootFilesystem: false
requiredDropCapabilities:
  - MKNOD
runAsUser:
  type: RunAsAny
seLinuxContext:
  type: MustRunAs
seccompProfiles:
  - runtime/default
supplementalGroups:
  type: RunAsAny
volumes:
  - configMap
  - csi
  - downwardAPI
  - emptyDir
  - ephemeral
  - persistentVolume
  - persistentVolumeClaim
  - projected
  - secret
  - nfs
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: anypoint-scc-privileged
rules:
  - apiGroups: ["security.openshift.io"]
    resourceNames:
      - anypoint-anyuid-privileged
    resources: ["securitycontextconstraints"]
    verbs: ["use"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: anypoint-scc-privileged
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: anypoint-scc-privileged
subjects:
  - kind: ServiceAccount
    name: stolon
    namespace: pce-core
  - kind: ServiceAccount
    name: default
    namespace: pce-core
  - kind: ServiceAccount
    name: anypoint-install
    namespace: pce-core
  - kind: ServiceAccount
    name: seaweedfs-rw-sa
    namespace: pce-core
  - kind: ServiceAccount
    name: default
    namespace: api-manager
  - kind: ServiceAccount
    name: default
    namespace: design-center
  - kind: ServiceAccount
    name: default
    namespace: exchange
  - kind: ServiceAccount
    name: default
    namespace: logging-internal
  - kind: ServiceAccount
    name: default
    namespace: pce
  - kind: ServiceAccount
    name: monitoring
    namespace: pce
  - kind: ServiceAccount
    name: default
    namespace: trusted-domains
  - kind: ServiceAccount
    name: default
    namespace: mocking

---
apiVersion: security.openshift.io/v1
kind: SecurityContextConstraints
metadata:
  name: anypoint-pce-monitoring
allowHostDirVolumePlugin: false
allowHostIPC: false
allowHostNetwork: false
allowHostPID: false
allowHostPorts: false
allowPrivilegeEscalation: false
allowPrivilegedContainer: false
allowedCapabilities: null
defaultAddCapabilities: null
fsGroup:
  type: RunAsAny
users: []
groups: []
readOnlyRootFilesystem: false
requiredDropCapabilities:
  - MKNOD
runAsUser:
  type: MustRunAs
  uid: 472
seLinuxContext:
  type: MustRunAs
seccompProfiles:
  - runtime/default
supplementalGroups:
  type: RunAsAny
volumes:
  - configMap
  - csi
  - downwardAPI
  - emptyDir
  - ephemeral
  - persistentVolumeClaim
  - projected
  - secret
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: anypoint-pce-monitoring
rules:
  - apiGroups: ["security.openshift.io"]
    resourceNames:
      - anypoint-pce-monitoring
    resources: ["securitycontextconstraints"]
    verbs: ["use"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: anypoint-pce-monitoring
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: anypoint-pce-monitoring
subjects:
  - kind: ServiceAccount
    name: grafana
    namespace: monitoring
```

Save this file as `openshift-scc.yaml` and apply it to the OpenShift cluster:

```none
oc apply -f openshift-scc.yaml
```

### Configure Roles for Prometheus

Prometheus requires specific roles to collect metrics from Anypoint Platform PCE services. The
following snippet provides the necessary roles configuration:

```yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: pce-prometheus
rules:
  - apiGroups:
      - ""
    resources:
      - endpoints
      - pods
      - services
      - nodes
      - secrets
    verbs:
      - get
      - list
      - watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: pce-prometheus
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: pce-prometheus
subjects:
  - kind: ServiceAccount
    name: prometheus-k8s
    namespace: openshift-monitoring
```

Save this file as `openshift-monitoring.yaml` and apply it to the OpenShift cluster:

```none
oc apply -f openshift-monitoring.yaml
```

## Install Anypoint Platform PCE on OpenShift

Create an `input.yaml` file using this template and update it with your environment details. This
template matches the PCE 4.2 installation configuration, with monitoring settings for OpenShift:

```yaml
# Container Registry configuration to upload PCE images
containerRegistry:
  endpoint: "" # Container Registry Endpoint
  username: "" # Provide either Username/Password OR Certificate to authenticate with container registry
  password: ""
  certificate: "/etc/registry/certificate/ca.crt"
  subproject: "mulesoft" # Container registry subproject under which all the PCE images will be part of.
  tlsSkipVerify: True # True or False.
# Platform configuration using CSI driver for filesystem access
platformConfiguration:
  platformDNS: ""
  fileSystemCsiDriverName: "" # CSI driver name (e.g., nfs.csi.k8s.io, efs.csi.aws.com)
  # Provide NFS DNS and path (not required if using EFS CSI Driver)
  # fileSystemDNS: ""
  # fileSystemPath: ""
  # Provide individual NFS volume handles (all 4 are required if using EFS CSI Driver. You'll need to create 4 access points pointing to the same dir in the EFS)
  fileSystemWcCsiVolumeHandle: "" # CSI volume handle for wc filesystem. E.g.: fs-0835b0d1eb7588eb1::fsap-03f6c68563ceb5acf
  fileSystem01CsiVolumeHandle: "" # CSI volume handle for 01 filesystem
  fileSystemBareCsiVolumeHandle: "" # CSI volume handle for bare filesystem
  fileSystemBackupRestoreCsiVolumeHandle: "" # CSI volume handle for backup-restore filesystem
  platformCertificate: /path/to/platform/certificate/cert.crt
  platformCertificateKey: path/to/platform/certificate/cert.key
  firstUserAccount:
    organizationName: "Test Org"
    username: "username"
    email: "username@mulesoft.com"
    password: "<a-valid-password>"
# Storage class configuration for persistent data services
storageConfiguration:
  pceobjectstore:
    type: "persistentVolumeClaim"
    storageClass: "<storage-class-name>"
    controlPlaneSize: "10Gi" # Optional. Defaults to 10Gi
    volumeSize: "100Gi" # Optional. Defaults to 100Gi
    volumeIndexSize: "10Gi" # Optional. Defaults to 10Gi
  stolon:
    type: "persistentVolumeClaim"
    storageClass: "<storage-class-name>"
    size: "100Gi" # Optional. Defaults to 100Gi
  backupRestoreTmp:
    storageClass: "<storage-class-name>" # Storage class for backup/restore temporary storage
# Configuration options for monitoring stack
monitoringAppConfiguration:
  monitoringStack:
    enabled: False # Defaults to True. Must be set to False for Openshift clusters.
  # Grafana configuration for OpenShift. Disable the monitoring stack because OpenShift includes Prometheus by default.
  grafana:
    enabled: True # Defaults to False.
    values: |
      datasources:
        datasources.yaml:
          apiVersion: 1
          datasources:
          - name: Prometheus
            type: prometheus
            url: https://prometheus-k8s.openshift-monitoring.svc:9091
            access: proxy
            isDefault: true
            jsonData:
              tlsSkipVerify: true
              httpHeaderName1: 'Authorization'
            secureJsonData:
              httpHeaderValue1: 'Bearer <Token>'
```

In the `monitoringAppConfiguration` section, set `monitoringStack.enabled` to `False` and enable
only Grafana. Disable the Anypoint Platform PCE monitoring stack because OpenShift includes
Prometheus by default. Enable Grafana and configure its datasource to connect to Prometheus.

To obtain the token for connecting to Prometheus, run this command:

```none
oc create token prometheus-k8s -n openshift-monitoring --duration=87600h
```

After you complete the installation, run these commands to allow Prometheus in OpenShift to collect
metrics from platform services:

```none
oc label namespace default openshift.io/cluster-monitoring="true" --overwrite
oc label namespace pce openshift.io/cluster-monitoring="true" --overwrite
```

## See Also

- [Installing or Upgrading Anypoint Platform Private Cloud Edition (Anypoint Platform PCE)](https://docs.mulesoft.com/private-cloud/4.2/install-workflow)

- [Anypoint Platform PCE Prerequisites](https://docs.mulesoft.com/private-cloud/4.2/install-checklist)

<!-- document id=8b92f1c36bda18491f4590c50171050cdd42cd37bbf98d397dbf63b2f855cb6d url=/mulesoft/current/en-us/private-cloud/latest/install-openshift.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.3
is-latest-version: true
---

# Installing Anypoint Platform PCE on OpenShift

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Before installing Anypoint Platform Private Cloud Edition (Anypoint Platform PCE) on OpenShift
configure Security Context Constraints (SCC) to grant the required permissions for pods and create
roles for Prometheus, allowing it to collect metrics from the services. After these configurations
are complete, proceed with installing Anypoint Platform PCE.

> [!NOTE] Contact MuleSoft Professional Services or your Anypoint PCE Certified Partner to perform
> the installation or upgrade of Anypoint Platform PCE.

> [!NOTE] You must have an operational OpenShift cluster prior to installing Anypoint Platform PCE.
> If you do not have one set up, refer to the OpenShift documentation for setup instructions.

> [!NOTE] Anypoint Platform PCE 4.2.1 is installed and validated on OpenShift 4.18 and 4.20.

> [!NOTE] It isn’t supported to in-place upgrade from an existing Openshift PCE 4.1.x cluster that’s
> been installed with full admin privilege to 4.2.1 or higher with no admin scope. If this is your
> case, consult [Migrating Anypoint Platform PCE to v4.x](https://docs.mulesoft.com/private-cloud/latest/upgrade).

## Configure the Openshift Environment

To configure the OpenShift Environment, configure Security Context Constraints (SCC) and roles for
Prometheus.

### Configure Security Context Constraints (SCC)

This snippet contains the SCC configuration:

```yaml
apiVersion: security.openshift.io/v1
kind: SecurityContextConstraints
metadata:
  name: anypoint-anyuid
allowHostDirVolumePlugin: false
allowHostIPC: false
allowHostNetwork: false
allowHostPID: false
allowHostPorts: false
allowPrivilegeEscalation: false
allowPrivilegedContainer: false
allowedCapabilities: null
defaultAddCapabilities: null
fsGroup:
  type: RunAsAny
users: []
groups: []
readOnlyRootFilesystem: false
requiredDropCapabilities:
  - MKNOD
runAsUser:
  type: MustRunAs
  uid: 2020
seLinuxContext:
  type: MustRunAs
seccompProfiles:
  - runtime/default
supplementalGroups:
  type: RunAsAny
volumes:
  - configMap
  - csi
  - downwardAPI
  - emptyDir
  - ephemeral
  - persistentVolume
  - persistentVolumeClaim
  - projected
  - secret
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: anypoint-scc
  namespace: pce-core
rules:
  - apiGroups: ["security.openshift.io"]
    resourceNames:
      - anypoint-anyuid
    resources: ["securitycontextconstraints"]
    verbs: ["use"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: anypoint-scc
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: anypoint-scc
subjects:
  - kind: ServiceAccount
    name: pce-cluster-ssl-app
    namespace: pce-core
  - kind: ServiceAccount
    name: default
    namespace: pce-core
  - kind: ServiceAccount
    name: anypoint
    namespace: pce-core
  - kind: ServiceAccount
    name: anypoint-install
    namespace: pce-core
  - kind: ServiceAccount
    name: anypoint-install-anypoint-services
    namespace: pce-core
  - kind: ServiceAccount
    name: anypoint-install-cluster-ssl
    namespace: pce-core
  - kind: ServiceAccount
    name: anypoint-install-namespaces-job
    namespace: pce-core
  - kind: ServiceAccount
    name: anypoint-install-seaweedfs
    namespace: pce-core
  - kind: ServiceAccount
    name: anypoint-prometheus-install
    namespace: pce-core
  - kind: ServiceAccount
    name: anypoint-grafana-install
    namespace: pce-core
  - kind: ServiceAccount
    name: anypoint-install
    namespace: dias
  - kind: ServiceAccount
    name: default
    namespace: pce
  - kind: ServiceAccount
    name: default
    namespace: access-management
  - kind: ServiceAccount
    name: authentication-server-service-account
    namespace: access-management
  - kind: ServiceAccount
    name: default
    namespace: api-console-proxy
  - kind: ServiceAccount
    name: default
    namespace: amf
  - kind: ServiceAccount
    name: default
    namespace: arm
  - kind: ServiceAccount
    name: default
    namespace: api-manager
  - kind: ServiceAccount
    name: default
    namespace: mozart
  - kind: ServiceAccount
    name: default
    namespace: mocking
  - kind: ServiceAccount
    name: default
    namespace: api-manager
  - kind: ServiceAccount
    name: default
    namespace: audit-log
  - kind: ServiceAccount
    name: default
    namespace: trusted-domains
  - kind: ServiceAccount
    name: default
    namespace: api-designer
  - kind: ServiceAccount
    name: monitoring
    namespace: pce
  - kind: ServiceAccount
    name: default
    namespace: exchange
  - kind: ServiceAccount
    name: xapi-service-deployment-manager
    namespace: exchange
  - kind: ServiceAccount
    name: default
    namespace: core-paas
  - kind: ServiceAccount
    name: default
    namespace: monitoring-center
  - kind: ServiceAccount
    name: default
    namespace: visualizer
  - kind: ServiceAccount
    name: secrets-robot
    namespace: dias
  - kind: ServiceAccount
    name: default
    namespace: dias
  - kind: ServiceAccount
    name: default
    namespace: amc
  - kind: Group
    name: system:serviceaccounts:monitoring
  - kind: ServiceAccount
    name: default
    namespace: anypoint-flash
  - kind: ServiceAccount
    name: default
    namespace: design-center

---
apiVersion: security.openshift.io/v1
kind: SecurityContextConstraints
metadata:
  name: anypoint-anyuid-privileged
allowHostDirVolumePlugin: false
allowHostIPC: false
allowHostNetwork: false
allowHostPID: false
allowHostPorts: false
allowPrivilegeEscalation: true
allowPrivilegedContainer: false
allowedCapabilities: null
defaultAddCapabilities: null
fsGroup:
  type: RunAsAny
users: []
groups: []
readOnlyRootFilesystem: false
requiredDropCapabilities:
  - MKNOD
runAsUser:
  type: RunAsAny
seLinuxContext:
  type: MustRunAs
seccompProfiles:
  - runtime/default
supplementalGroups:
  type: RunAsAny
volumes:
  - configMap
  - csi
  - downwardAPI
  - emptyDir
  - ephemeral
  - persistentVolume
  - persistentVolumeClaim
  - projected
  - secret
  - nfs
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: anypoint-scc-privileged
rules:
  - apiGroups: ["security.openshift.io"]
    resourceNames:
      - anypoint-anyuid-privileged
    resources: ["securitycontextconstraints"]
    verbs: ["use"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: anypoint-scc-privileged
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: anypoint-scc-privileged
subjects:
  - kind: ServiceAccount
    name: stolon
    namespace: pce-core
  - kind: ServiceAccount
    name: default
    namespace: pce-core
  - kind: ServiceAccount
    name: anypoint-install
    namespace: pce-core
  - kind: ServiceAccount
    name: seaweedfs-rw-sa
    namespace: pce-core
  - kind: ServiceAccount
    name: default
    namespace: api-manager
  - kind: ServiceAccount
    name: default
    namespace: design-center
  - kind: ServiceAccount
    name: default
    namespace: exchange
  - kind: ServiceAccount
    name: default
    namespace: logging-internal
  - kind: ServiceAccount
    name: default
    namespace: pce
  - kind: ServiceAccount
    name: monitoring
    namespace: pce
  - kind: ServiceAccount
    name: default
    namespace: trusted-domains
  - kind: ServiceAccount
    name: default
    namespace: mocking

---
apiVersion: security.openshift.io/v1
kind: SecurityContextConstraints
metadata:
  name: anypoint-pce-monitoring
allowHostDirVolumePlugin: false
allowHostIPC: false
allowHostNetwork: false
allowHostPID: false
allowHostPorts: false
allowPrivilegeEscalation: false
allowPrivilegedContainer: false
allowedCapabilities: null
defaultAddCapabilities: null
fsGroup:
  type: RunAsAny
users: []
groups: []
readOnlyRootFilesystem: false
requiredDropCapabilities:
  - MKNOD
runAsUser:
  type: MustRunAs
  uid: 472
seLinuxContext:
  type: MustRunAs
seccompProfiles:
  - runtime/default
supplementalGroups:
  type: RunAsAny
volumes:
  - configMap
  - csi
  - downwardAPI
  - emptyDir
  - ephemeral
  - persistentVolumeClaim
  - projected
  - secret
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: anypoint-pce-monitoring
rules:
  - apiGroups: ["security.openshift.io"]
    resourceNames:
      - anypoint-pce-monitoring
    resources: ["securitycontextconstraints"]
    verbs: ["use"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: anypoint-pce-monitoring
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: anypoint-pce-monitoring
subjects:
  - kind: ServiceAccount
    name: grafana
    namespace: monitoring
```

Save this file as `openshift-scc.yaml` and apply it to the OpenShift cluster:

```none
oc apply -f openshift-scc.yaml
```

### Configure Roles for Prometheus

Prometheus requires specific roles to collect metrics from Anypoint Platform PCE services. The
following snippet provides the necessary roles configuration:

```yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: pce-prometheus
rules:
  - apiGroups:
      - ""
    resources:
      - endpoints
      - pods
      - services
      - nodes
      - secrets
    verbs:
      - get
      - list
      - watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: pce-prometheus
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: pce-prometheus
subjects:
  - kind: ServiceAccount
    name: prometheus-k8s
    namespace: openshift-monitoring
```

Save this file as `openshift-monitoring.yaml` and apply it to the OpenShift cluster:

```none
oc apply -f openshift-monitoring.yaml
```

## Install Anypoint Platform PCE on OpenShift

The following snippet provides an example installation manifest for deploying Anypoint Platform PCE
on an OpenShift cluster:

```yaml
containerRegistry:
  endpoint: registry.pce.example.com
  username: username
  password: password
  certificate: ""
  subproject: example
  tlsSkipVerify: true
postInstallConfiguration:
  platformDNS: anypoint.pce.example.com
  fileSystemDNS: fs.pce.example.com
  firstUserAccount:
    organizationName: Example Org
    username: username
    email: username@mulesoft.com
    password: password
  platformCertificate: cert.pem
  platformCertificateKey: key.pem
amvInstallConfiguration:
  enabled: false
storageConfiguration:
  pceobjectstore:
    type: persistentVolumeClaim
    storageClass: example-csi
  stolon:
    type: persistentVolumeClaim
    storageClass: example-csi
monitoringAppConfiguration:
  monitoringStackEnabled: false
  grafana:
    enabled: true
    values: |
      datasources:
        datasources.yaml:
          apiVersion: 1
          datasources:
          - name: Prometheus
            type: prometheus
            url: https://prometheus-k8s.openshift-monitoring.svc:9091
            access: proxy
            isDefault: true
            jsonData:
              tlsSkipVerify: true
              httpHeaderName1: 'Authorization'
            secureJsonData:
              httpHeaderValue1: 'Bearer <Token>'
```

Note the `monitoringAppConfiguration` section in the snippet. This section disables the monitoring
stack for Anypoint Platform PCE and enables only the Grafana application. It is recommended to
disable the monitoring stack because OpenShift includes Prometheus by default. Enable Grafana and
configure its datasource to connect to Prometheus.

To obtain the token for connecting to Prometheus, run this command:

```none
oc create token prometheus-k8s -n openshift-monitoring --duration=87600h
```

After completing the installation, run the following commands to allow Prometheus in OpenShift to
collect metrics from platform services:

```none
oc label namespace default openshift.io/cluster-monitoring="true" --overwrite
oc label namespace pce openshift.io/cluster-monitoring="true" --overwrite
```

## See Also

- [Installing or Upgrading Anypoint Platform Private Cloud Edition (Anypoint Platform PCE)](https://docs.mulesoft.com/private-cloud/latest/install-workflow)

- [Anypoint Platform PCE Prerequisites](https://docs.mulesoft.com/private-cloud/latest/install-checklist)

<!-- document id=9613143e8e590636ddba780645077b7c80c61e2f379793a999c64efdca259548 url=/mulesoft/current/en-us/private-cloud/latest/install-byons.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.3
is-latest-version: true
---

# Installing Anypoint Platform PCE with Bring Your Own Namespaces

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Starting with Anypoint Platform Private Cloud Edition (Anypoint Platform PCE) 4.3.0, you can install
the platform in Bring Your Own Namespaces (BYONS) mode. In a standard installation, the installer
creates and names the Kubernetes namespaces it needs. In BYONS mode, your cluster administrator
creates and names those namespaces before installation, and Anypoint Platform PCE installs into the
namespaces you prepared.

Use BYONS when your organization must apply its own namespace names, or when cluster administrators
must create and review namespaces before any application is installed into them. Names must be valid
Kubernetes namespace names. They can follow your organization’s convention, such as names tied to a
cost center or business unit.

In both modes, the installed platform is the same. BYONS changes who creates the namespaces and what
they are named.

## Considerations

Before you install in BYONS mode, consider the following:

- BYONS mode is available starting with Anypoint Platform PCE 4.3.0. It is not available in earlier
  versions.

- Namespace names must be valid Kubernetes namespace names. Otherwise, they can follow your
  organization’s naming convention.

- The installer doesn’t create or delete namespaces in BYONS mode. Your organization keeps control
  of the namespace lifecycle.

- The installer validates the cluster before installation starts. Most configuration mistakes are
  caught before any change is made, and the installer reports what to correct.

## Before You Begin

To install in BYONS mode, your team provides the following:

- A namespace for every Anypoint Platform PCE component, created before installation.

- A label on each namespace so Anypoint Platform PCE can identify its purpose.

- A mapping that links each platform component to the namespace name you chose.

- Cluster-level permissions applied by your cluster administrator before installation begins. The
  installer doesn’t have broad cluster access in BYONS mode.

Additionally, your MuleSoft representative provides the BYONS installation package. The package
includes the list of required namespaces, the required labels, a mapping template.

## Compare BYONS with a Standard Installation

<table><colgroup><col> <col> <col></colgroup><thead><tr><th></th><th>Standard installation</th><th>BYONS installation</th></tr></thead><tbody><tr><td><p>Who creates the namespaces</p></td><td><p>The Anypoint Platform PCE installer</p></td><td><p>Your cluster administrator</p></td></tr><tr><td><p>Who names the namespaces</p></td><td><p>Anypoint Platform PCE, using fixed names</p></td><td><p>You, using your own names</p></td></tr><tr><td><p>Installer cluster access</p></td><td><p>Cluster-admin</p></td><td><p>Limited privileges. The installer doesn’t have cluster-admin rights.</p></td></tr><tr><td><p>When cluster-level resources are set up</p></td><td><p>During installation</p></td><td><p>Before installation, by your cluster administrator</p></td></tr></tbody></table>

## Install in BYONS Mode

A BYONS installation is a hand-off between your cluster administrator and the Anypoint Platform PCE
installer.

Before you start, contact your MuleSoft representative to review your naming conventions and obtain
the BYONS installation package. The package includes the list of required namespaces, the required
labels, a mapping template.

The installation process is as follows:

1.  Your cluster administrator creates every namespace Anypoint Platform PCE requires, using your
    organization’s names, and applies the required labels so the installer can recognize each
    namespace. Your cluster administrator also applies the cluster-level permissions the platform
    needs.

2.  Your cluster administrator provides a namespace mapping. The mapping tells Anypoint Platform PCE
    which of your namespace names corresponds to each platform component.

3.  The installer validates the cluster before it makes changes. It checks that every required
    namespace exists, that the names in the mapping match those namespaces, and that each namespace
    has the expected labels. If something is missing or inconsistent, the installer stops and
    reports what to correct.

4.  After validation succeeds, installation continues through the same phases as a standard
    installation. Anypoint Platform PCE places its components in the namespaces you created.

## See Also

- [Installing or Upgrading Anypoint Platform Private Cloud Edition (Anypoint Platform PCE)](https://docs.mulesoft.com/private-cloud/latest/install-workflow)

- [Anypoint Platform PCE Prerequisites](https://docs.mulesoft.com/private-cloud/latest/install-checklist)

<!-- document id=7761643dc44901fabf7a20bd7bf408e1c170201b197bfff69e344080df6eb9a4 url=/mulesoft/current/en-us/private-cloud/4.0/install-workflow.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.0
---

# Installing Anypoint Platform Private Cloud Edition (Anypoint Platform PCE)

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

The process to install Anypoint Platform Private Cloud Edition (Anypoint Platform PCE), consist of
the following steps:

1.  Setting up and verifying your infrastructure

2.  Performing a pre-installation verification

3.  Installing Anypoint Platform PCE

> [!NOTE] Contact MuleSoft Professional Services before performing the pre-installation verification
> and installation of Anypoint Platform PCE because they are involved in these processes.

> [!NOTE] To install Anypoint Platform PCE on OpenShift, see
> [Installing Anypoint Platform PCE on OpenShift](https://docs.mulesoft.com/private-cloud/4.0/install-openshift).

## Set Up and Verify your Infrastructure

Before you install Anypoint Platform PCE, ensure your infrastructure team installed and configured
correctly the infrastructure for your organization following the requirements as described in
[Anypoint Platform PCE Prerequisites](https://docs.mulesoft.com/private-cloud/4.0/install-checklist).

## Perform a Pre-installation Verification

To perform the pre-installation healthcheck verification for the Kubernetes (K8s) cluster, follow
these steps:

1.  Confirm your Kubernetes cluster version is 1.30.x or 1.29.x.

2.  Create an `input.yaml` file using the following template and update it with your environment
    details:

```json
    # Container Registry configuration to upload PCE images
containerRegistry:
 endpoint: "" # Container Registry Endpoint
 username: "" # Provide either Username/Password OR Certificate to authenticate with container registry
 password: ""
 certificate: "/etc/registry/certificate/ca.crt"
 subproject: "mulesoft" # Container registry subproject under which all the PCE images will be part of.
 tlsSkipVerify: True  # True or False.
# Configuration required to perform post installation setup for Anypoint platform
# All the fields in `postInstallConfiguration` are required.
postInstallConfiguration:
 platformDNS: ""
 fileSystemDNS: ""
 firstUserAccount:
   organizationName: 'Test Org'
   username: 'username'
   email: 'username@mulesoft.com'
   password: '<a-valid-password>'
 platformCertificate: /path/to/platform/certificate/cert.crt
 platformCertificateKey: path/to/platform/certificate/cert.key
# Storage class configuration for persistent data services
storageConfiguration:
 pceobjectstore:
   type: "persistentVolumeClaim"
   storageClass: "<storage-class-name>"
   controlPlaneSize: "10Gi" # Optional. Defaults to 10Gi
   volumeSize: "100Gi" # Optional. Defaults to 100Gi
   volumeIndexSize: "10Gi" # Optional. Defaults to 10Gi
 stolon:
   type: "persistentVolumeClaim"
   storageClass: "<storage-class-name>"
   size: "100Gi" # Optional. Defaults to 100Gi
# Configuration options for monitoring stack
monitoringAppConfiguration:
 monitoringStackEnabled: True # Defaults to True. Must be set to False for Openshift clusters.
 grafana:
    enabled: False  # Defaults to False. Set to True for OpenShift clusters.
```

3.  Obtain the `license.lic` file from the MuleSoft Professional Services team.

4.  Set the `KUBECONFIG` environment variable to the path to the `kubeconfig` file of the cluster.

5.  Verify that the cluster satisfies the prerequisites by running the following command against
    your `input.yaml` file and the `license.lic` file:

    `./pcectl pre-install-check --input-file/path/to/input.yaml --license-file /path/to/license.lic`

6.  For Anypoint Platform PCE workload to be scheduled on designated nodes, apply the following
    labels to all worker nodes:

    - `mulesoft-role=node`

    - `redis-role=node`

7.  Apply the following labels to any three worker nodes. These do not need to be the same three
    nodes:

    - `stolon-keeper=yes`

    - `pce-data-nodes=yes`

8.  (Optional) Apply taints to controlplane nodes to ensure that no Anypoint Platform PCE workload
    is scheduled on the control plane. This also affects any other workload your organization may
    want to run on control plane nodes. Consult with your Kubernetes cluster admin to perform this
    step:

    `mulesoft.pce/controlplane-node=true:NoSchedule`

## Install Anypoint Platform PCE

After your infrastructure is correctly set up and you performed a pre-installation verification,
MuleSoft Professional Services will assist you with the installation of Anypoint Platform PCE.

To install Anypoint Platform PCE, run this command:

`./pcectl install --input-file /path/to/input.yaml --license-file /path/to/license.lic`

## See Also

- [Anypoint Platform PCE Prerequisites](https://docs.mulesoft.com/private-cloud/4.0/install-checklist).

<!-- document id=9afc928fdd0f5e9f5428db65fbcf3066d18b522027b5e3312e7ce79c1633c155 url=/mulesoft/current/en-us/private-cloud/4.1/install-workflow.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.1
---

# Installing Anypoint Platform Private Cloud Edition (Anypoint Platform PCE)

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

The process to install Anypoint Platform Private Cloud Edition (Anypoint Platform PCE), consist of
the following steps:

1.  Setting up and verifying your infrastructure

2.  Performing a pre-installation verification

3.  Installing Anypoint Platform PCE

> [!NOTE] Contact MuleSoft Professional Services before performing the pre-installation verification
> and installation of Anypoint Platform PCE because they are involved in these processes.

> [!NOTE] To install Anypoint Platform PCE on OpenShift, see
> [Installing Anypoint Platform PCE on OpenShift](https://docs.mulesoft.com/private-cloud/4.1/install-openshift).

## Set Up and Verify your Infrastructure

Before you install Anypoint Platform PCE, ensure your infrastructure team installed and configured
correctly the infrastructure for your organization following the requirements as described in
[Anypoint Platform PCE Prerequisites](https://docs.mulesoft.com/private-cloud/4.1/install-checklist).

## Perform a Pre-installation Verification

To perform the pre-installation healthcheck verification for the Kubernetes (K8s) cluster, follow
these steps:

1.  Confirm your Kubernetes cluster version is 1.32.x or 1.31.x.

2.  Create an `input.yaml` file using the following template and update it with your environment
    details:

```json
# Container Registry configuration to upload PCE images
containerRegistry:
  endpoint: "" # Container Registry Endpoint
  username: "" # Provide either Username/Password OR Certificate to authenticate with container registry
  password: ""
  certificate: "/etc/registry/certificate/ca.crt"
  subproject: "mulesoft" # Container registry subproject under which all the PCE images will be part of.
  tlsSkipVerify: True  # True or False.
# All the fields in `platformConfiguration` are required.
platformConfiguration:
  platformDNS: ""
  fileSystemDNS: ""
  fileSystemPath: ""
  platformCertificate: /path/to/platform/certificate/cert.crt
  platformCertificateKey: path/to/platform/certificate/cert.key
  firstUserAccount:
    organizationName: 'Test Org'
    username: 'username'
    email: 'username@mulesoft.com'
    password: '<a-valid-password>'
# Storage class configuration for persistent data services
storageConfiguration:
  pceobjectstore:
    type: "persistentVolumeClaim"
    storageClass: "<storage-class-name>"
    controlPlaneSize: "10Gi" # Optional. Defaults to 10Gi
    volumeSize: "100Gi" # Optional. Defaults to 100Gi
    volumeIndexSize: "10Gi" # Optional. Defaults to 10Gi
  stolon:
    type: "persistentVolumeClaim"
    storageClass: "<storage-class-name>"
    size: "100Gi" # Optional. Defaults to 100Gi
# Configuration options for monitoring stack
monitoringAppConfiguration:
  monitoringStack:
    enabled:  True # Defaults to True. Must be set to False for Openshift clusters.
      values: | # Optional. If not provided, the default values will be used.
      prometheus:
        prometheusSpec:
          storageSpec:
            volumeClaimTemplate:
              spec:
                storageClassName: 'local-path',
                accessModes: ["ReadWriteOnce"]
                resources:
                  requests:
                    storage: 50Gi

## The following section is used to configure Grafana for an Openshift cluster. It is recommended to disable the monitoring stack as OpenShift includes Prometheus by default.
  grafana:
    enabled: False # Defaults to False.
    values: |
     datasources:
        datasources.yaml:
          apiVersion: 1
          datasources:
          - name: Prometheus
            type: prometheus
            url: https://prometheus-k8s.openshift-monitoring.svc:9091
            access: proxy
            isDefault: true
            jsonData:
              tlsSkipVerify: true
              httpHeaderName1: 'Authorization'
            secureJsonData:
              httpHeaderValue1: 'Bearer <Token>'
```

3.  Obtain the `license.lic` file from the MuleSoft Professional Services team.

4.  Set the `KUBECONFIG` environment variable to the path to the `kubeconfig` file of the cluster.

5.  Verify that the cluster satisfies the prerequisites by running the following command against
    your `input.yaml` file and the `license.lic` file:

    `./pcectl pre-install-check --input-file/path/to/input.yaml --license-file /path/to/license.lic`

6.  For Anypoint Platform PCE workload to be scheduled on designated nodes, apply the following
    labels to all worker nodes:

    - `mulesoft-role=node`

    - `redis-role=node`

7.  Apply the following labels to any three worker nodes. These do not need to be the same three
    nodes:

    - `stolon-keeper=yes`

    - `pce-data-nodes=yes`

8.  (Optional) Apply taints to controlplane nodes to ensure that no Anypoint Platform PCE workload
    is scheduled on the control plane. This also affects any other workload your organization may
    want to run on control plane nodes. Consult with your Kubernetes cluster admin to perform this
    step:

    `mulesoft.pce/controlplane-node=true:NoSchedule`

## Install Anypoint Platform PCE

After your infrastructure is correctly set up and you performed a pre-installation verification,
MuleSoft Professional Services will assist you with the installation of Anypoint Platform PCE.

To install Anypoint Platform PCE, run this command:

`./pcectl install --input-file /path/to/input.yaml --license-file /path/to/license.lic`

## See Also

- [Anypoint Platform PCE Prerequisites](https://docs.mulesoft.com/private-cloud/4.1/install-checklist).

<!-- document id=d2757510e9a273a53e14f86c252120983f43f7cd35c61c083a8eb080d4a4fb78 url=/mulesoft/current/en-us/private-cloud/4.2/install-workflow.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.2
---

# Installing or Upgrading Anypoint Platform Private Cloud Edition (Anypoint Platform PCE)

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

The process to install Anypoint Platform Private Cloud Edition (Anypoint Platform PCE), consist of
the following steps:

1.  Obtaining your Anypoint PCE installation distribution

2.  Setting up and verifying your infrastructure

3.  Performing a pre-installation verification

4.  Installing or Upgrading Anypoint Platform PCE

> [!NOTE] Contract Mulesoft Processional Services or your Anypoint PCE Certified Partner to obtain
> your Anypoint PCE installation distribution and before performing the pre-installation
> verification and installation or upgrade of the Anypoint PCE Platform to ensure they are involved
> in these procedures.

> [!NOTE] To install Anypoint Platform PCE on OpenShift, see
> [Installing Anypoint Platform PCE on OpenShift](https://docs.mulesoft.com/private-cloud/4.2/install-openshift).

## Set Up and Verify your Infrastructure

Before you install Anypoint Platform PCE, ensure your infrastructure team installed and configured
correctly the infrastructure for your organization following the requirements as described in
[Anypoint Platform PCE Prerequisites](https://docs.mulesoft.com/private-cloud/4.2/install-checklist).

## Perform a Pre-installation Verification

To perform the pre-installation healthcheck verification for the Kubernetes (K8s) cluster, follow
these steps:

1.  Confirm your Kubernetes cluster version is 1.34.x or 1.33.x.

2.  Create an `input.yaml` file using this template and update it with your environment details:

```json
# Container Registry configuration to upload PCE images
containerRegistry:
  endpoint: "" # Container Registry Endpoint
  username: "" # Provide either Username/Password OR Certificate to authenticate with container registry
  password: ""
  certificate: "/etc/registry/certificate/ca.crt"
  subproject: "mulesoft" # Container registry subproject under which all the PCE images will be part of.
  tlsSkipVerify: True  # True or False.
# Platform configuration using CSI driver for filesystem access
platformConfiguration:
  platformDNS: ""
  fileSystemCsiDriverName: "" # CSI driver name (e.g., nfs.csi.k8s.io, efs.csi.aws.com)
  # Provide NFS DNS and path (not required if using EFS CSI Driver)
  # fileSystemDNS: ""
  # fileSystemPath: ""
  # Provide individual NFS volume handles (all 4 are required if using EFS CSI Driver. You'll need to create 4 access points pointing to the same dir in the EFS)
  fileSystemWcCsiVolumeHandle: "" # CSI volume handle for wc filesystem. E.g.: fs-0835b0d1eb7588eb1::fsap-03f6c68563ceb5acf
  fileSystem01CsiVolumeHandle: "" # CSI volume handle for 01 filesystem
  fileSystemBareCsiVolumeHandle: "" # CSI volume handle for bare filesystem
  fileSystemBackupRestoreCsiVolumeHandle: "" # CSI volume handle for backup-restore filesystem
  platformCertificate: /path/to/platform/certificate/cert.crt
  platformCertificateKey: path/to/platform/certificate/cert.key
  firstUserAccount:
    organizationName: 'Test Org'
    username: 'username'
    email: 'username@mulesoft.com'
    password: '<a-valid-password>'
# Storage class configuration for persistent data services
storageConfiguration:
  pceobjectstore:
    type: "persistentVolumeClaim"
    storageClass: "<storage-class-name>"
    controlPlaneSize: "10Gi" # Optional. Defaults to 10Gi
    volumeSize: "100Gi" # Optional. Defaults to 100Gi
    volumeIndexSize: "10Gi" # Optional. Defaults to 10Gi
  stolon:
    type: "persistentVolumeClaim"
    storageClass: "<storage-class-name>"
    size: "100Gi" # Optional. Defaults to 100Gi
  backupRestoreTmp:
    storageClass: "<storage-class-name>" # Storage class for backup/restore temporary storage
# Configuration options for monitoring stack
monitoringAppConfiguration:
  monitoringStack:
    enabled:  True # Defaults to True. Must be set to False for Openshift clusters.
#    values: | # Optional. If not provided, the default values will be used.
#      prometheus:
#        prometheusSpec:
#          storageSpec:
#            volumeClaimTemplate:
#              spec:
#                storageClassName: 'local-path',
#                accessModes: ["ReadWriteOnce"]
#                resources:
#                  requests:
#                    storage: 50Gi

## The following section is used to configure Grafana for an Openshift cluster. It is recommended to disable the monitoring stack as OpenShift includes Prometheus by default.
#  grafana:
#    enabled: False # Defaults to False.
#    values: |
#      datasources:
#        datasources.yaml:
#          apiVersion: 1
#          datasources:
#          - name: Prometheus
#            type: prometheus
#            url: https://prometheus-k8s.openshift-monitoring.svc:9091
#            access: proxy
#            isDefault: true
#            jsonData:
#              tlsSkipVerify: true
#              httpHeaderName1: 'Authorization'
#            secureJsonData:
#              httpHeaderValue1: 'Bearer <Token>'
```

3.  Obtain the `license.lic` file from the MuleSoft Professional Services team.

4.  Set the `KUBECONFIG` environment variable to the path to the `kubeconfig` file of the cluster.

5.  Verify that the cluster satisfies the prerequisites by running the following command against
    your `input.yaml` file and the `license.lic` file:

    `./pcectl pre-install-check --input-file/path/to/input.yaml --license-file /path/to/license.lic`

6.  For Anypoint Platform PCE workload to be scheduled on designated nodes, apply the following
    labels to all worker nodes:

    - `mulesoft-role=node`

    - `redis-role=node`

7.  Apply the following labels to any three worker nodes. These do not need to be the same three
    nodes:

    - `stolon-keeper=yes`

    - `pce-data-nodes=yes`

8.  (Optional) Apply taints to controlplane nodes to ensure that no Anypoint Platform PCE workload
    is scheduled on the control plane. This also affects any other workload your organization may
    want to run on control plane nodes. Consult with your Kubernetes cluster admin to perform this
    step:

    `mulesoft.pce/controlplane-node=true:NoSchedule`

## Install Anypoint Platform PCE

After your infrastructure is correctly set up and you performed a pre-installation verification,
MuleSoft Professional Services or your Anypoint PCE Certified Partner will assist you with the
installation of Anypoint Platform PCE.

To install Anypoint Platform PCE, run this command:

`./pcectl install --input-file /path/to/input.yaml --license-file /path/to/license.lic`

## Upgrade Anypoint Platform PCE

After you have completed a pre-installation/upgrade verification, MuleSoft Professional Services or
your Anypoint PCE Certified Partner will assist you with the upgrade of Anypoint Platform PCE.

To upgrade Anypoint Platform PCE, run this command:

`./pcectl upgrade /path/to/input.yaml --license-file /path/to/license.lic`

## See Also

- [Anypoint Platform PCE Prerequisites](https://docs.mulesoft.com/private-cloud/4.2/install-checklist).

<!-- document id=d6291068ebd641724003b90c693012749b70326d93f399447f63a5a5fec6047c url=/mulesoft/current/en-us/private-cloud/latest/install-workflow.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.3
is-latest-version: true
---

# Installing or Upgrading Anypoint Platform Private Cloud Edition (Anypoint Platform PCE)

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

The process to install Anypoint Platform Private Cloud Edition (Anypoint Platform PCE), consist of
the following steps:

1.  Obtaining your Anypoint PCE installation distribution

2.  Setting up and verifying your infrastructure

3.  Performing a pre-installation verification

4.  Installing or Upgrading Anypoint Platform PCE

> [!NOTE] Contract Mulesoft Processional Services or your Anypoint PCE Certified Partner to obtain
> your Anypoint PCE installation distribution and before performing the pre-installation
> verification and installation or upgrade of the Anypoint PCE Platform to ensure they are involved
> in these procedures.

> [!NOTE] To install Anypoint Platform PCE on OpenShift, see
> [Installing Anypoint Platform PCE on OpenShift](https://docs.mulesoft.com/private-cloud/latest/install-openshift).

> [!NOTE] To install Anypoint Platform PCE into namespaces that your organization creates and names,
> see [Installing Anypoint Platform PCE with Bring Your Own Namespaces](https://docs.mulesoft.com/private-cloud/latest/install-byons).

## Set Up and Verify your Infrastructure

Before you install Anypoint Platform PCE, ensure your infrastructure team installed and configured
correctly the infrastructure for your organization following the requirements as described in
[Anypoint Platform PCE Prerequisites](https://docs.mulesoft.com/private-cloud/latest/install-checklist).

## Perform a Pre-installation Verification

To perform the pre-installation healthcheck verification for the Kubernetes (K8s) cluster, follow
these steps:

1.  Confirm your Kubernetes cluster version is 1.35.x, 1.34.x, 1.33.x, or 1.32.x.

2.  Create an `input.yaml` file using this template and update it with your environment details:

```json
# Container Registry configuration to upload PCE images
containerRegistry:
  endpoint: "" # Container Registry Endpoint
  username: "" # Provide either Username/Password OR Certificate to authenticate with container registry
  password: ""
  certificate: "/etc/registry/certificate/ca.crt"
  subproject: "mulesoft" # Container registry subproject under which all the PCE images will be part of.
  tlsSkipVerify: True  # True or False.
# Platform configuration for the shared ReadWriteMany (RWX) filesystem.
# Choose exactly one of the two storage modes below. NFS mode has two configuration
# variants (Option A or Option B). StorageClass mode is Option C. The modes are
# mutually exclusive.
platformConfiguration:
  platformDNS: ""
  # ---- NFS mode (Option A and Option B) ----
  # Requires a pre-installed CSI driver in the Kubernetes cluster.
  fileSystemCsiDriverName: "" # CSI driver name (e.g., nfs.csi.k8s.io, efs.csi.aws.com)
  # Optional NFS mount option overrides. Comma-separated string. Only used in NFS mode.
  fileSystemBareMountOptionsOverride: ""
  fileSystemWcMountOptionsOverride: ""
  fileSystem01MountOptionsOverride: ""
  # Option A - Generic NFS CSI driver: provide DNS and path.
  # fileSystemDNS: ""   # NFS server hostname or IP
  # fileSystemPath: ""  # NFS export path (e.g., /exports/pce)
  # Option B - CSI driver with individual volume handles (all 4 required, e.g. EFS CSI Driver
  # with 4 access points that point to the same directory in the EFS):
  fileSystemWcCsiVolumeHandle: "" # CSI volume handle for wc filesystem. E.g.: fs-0835b0d1eb7588eb1::fsap-03f6c68563ceb5acf
  fileSystem01CsiVolumeHandle: "" # CSI volume handle for 01 filesystem
  fileSystemBareCsiVolumeHandle: "" # CSI volume handle for bare filesystem
  fileSystemBackupRestoreCsiVolumeHandle: "" # CSI volume handle for backup-restore filesystem
  # ---- StorageClass mode (Option C, Anypoint Platform PCE 4.3.0 and later) ----
  # Mutually exclusive with NFS mode. The StorageClass must support ReadWriteMany.
  # Leave fileSystemCsiDriverName and all NFS-mode fields above empty when using this option.
  # For backup retention, use a StorageClass with reclaimPolicy: Retain so deleting the PVC
  # does not destroy historical backup tarballs.
  # fileSystemStorageClass: "" # e.g. ocs-storagecluster-cephfs
  platformCertificate: /path/to/platform/certificate/cert.crt
  platformCertificateKey: path/to/platform/certificate/cert.key
  firstUserAccount:
    organizationName: 'Test Org'
    username: 'username'
    email: 'username@mulesoft.com'
    password: '<a-valid-password>'
# Storage class configuration for persistent data services
storageConfiguration:
  pceobjectstore:
    type: "persistentVolumeClaim"
    storageClass: "<storage-class-name>"
    controlPlaneSize: "10Gi" # Optional. Defaults to 10Gi
    volumeSize: "100Gi" # Optional. Defaults to 100Gi
    volumeIndexSize: "10Gi" # Optional. Defaults to 10Gi
  stolon:
    type: "persistentVolumeClaim"
    storageClass: "<storage-class-name>"
    size: "100Gi" # Optional. Defaults to 100Gi
  backupRestoreTmp:
    storageClass: "<storage-class-name>" # Storage class for backup/restore temporary storage
```

3.  Obtain the `license.lic` file from the MuleSoft Professional Services team.

4.  Set the `KUBECONFIG` environment variable to the path to the `kubeconfig` file of the cluster.

5.  Verify that the cluster satisfies the prerequisites by running the following command against
    your `input.yaml` file and the `license.lic` file:

    `./pcectl pre-install-check --input-file/path/to/input.yaml --license-file /path/to/license.lic`

6.  For Anypoint Platform PCE workload to be scheduled on designated nodes, apply the following
    labels to all worker nodes:

    - `mulesoft-role=node`

    - `redis-role=node`

7.  Apply the following labels to any three worker nodes. These do not need to be the same three
    nodes:

    - `stolon-keeper=yes`

    - `pce-data-nodes=yes`

8.  (Optional) Apply taints to controlplane nodes to ensure that no Anypoint Platform PCE workload
    is scheduled on the control plane. This also affects any other workload your organization may
    want to run on control plane nodes. Consult with your Kubernetes cluster admin to perform this
    step:

    `mulesoft.pce/controlplane-node=true:NoSchedule`

## Install Anypoint Platform PCE

After your infrastructure is correctly set up and you performed a pre-installation verification,
MuleSoft Professional Services or your Anypoint PCE Certified Partner will assist you with the
installation of Anypoint Platform PCE.

To install Anypoint Platform PCE, run this command:

`./pcectl install --input-file /path/to/input.yaml --license-file /path/to/license.lic`

## Upgrade Anypoint Platform PCE

After you have completed a pre-installation/upgrade verification, MuleSoft Professional Services or
your Anypoint PCE Certified Partner will assist you with the upgrade of Anypoint Platform PCE.

To upgrade Anypoint Platform PCE, run this command:

`./pcectl upgrade /path/to/input.yaml --license-file /path/to/license.lic`

## See Also

- [Anypoint Platform PCE Prerequisites](https://docs.mulesoft.com/private-cloud/latest/install-checklist).

<!-- document id=50ccecaa98ea12fb7cdf1e982ba610c961367228b6935b84b430762815d9fd94 url=/mulesoft/current/en-us/private-cloud/4.1/access-management-concurrent-login.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.1
---

# Limiting Concurrent Login in Anypoint Platform PCE

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

You can limit concurrent logins to Anypoint Platform Private Cloud Edition (Anypoint Platform PCE)
so that a user can sign in from only one browser or device at a time. This applies to users in your
organization who log in to the platform to use other features (for example, to use Runtime Manager,
API Manager, or Access Management). When you limit concurrent logins, a new sign-in from another
browser or device signs the user out of the previous session.

> [!NOTE] The concurrent login limit configuration isn’t persistent. When you upgrade Anypoint
> Platform PCE, the upgrade reverts this configuration. After upgrading, repeat the steps in this
> section to restore the concurrent login limit.

## Configure Concurrent Login Limit

Run these commands in a terminal where `kubectl` is configured for your Anypoint Platform PCE
cluster and you have permissions to operate on it. No specific directory is required.

1.  Patch the authentication-server configmap:

    kubectl patch configmap authentication-server-env -p
    '{"data":{"AUTH\_SERVER\_FEATURES\_LIMITCONCURRENTSESSION":"true"}}' -n access-management

2.  Restart the authentication-server:

    kubectl rollout restart deployment authentication-server -n access-management

The concurrent login limit takes effect after you restart the authentication-server.

## See Also

- [Configuring Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/4.1/config-workflow)

<!-- document id=1255bcee4626ba59470488d69537f8868c6e35b4db22b56ab138270ea081c05d url=/mulesoft/current/en-us/private-cloud/4.2/access-management-concurrent-login.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.2
---

# Limiting Concurrent Login in Anypoint Platform PCE

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

You can limit concurrent logins to Anypoint Platform Private Cloud Edition (Anypoint Platform PCE)
so that a user can sign in from only one browser or device at a time. This applies to users in your
organization who log in to the platform to use other features (for example, to use Runtime Manager,
API Manager, or Access Management). When you limit concurrent logins, a new sign-in from another
browser or device signs the user out of the previous session.

> [!NOTE] The concurrent login limit configuration isn’t persistent. When you upgrade Anypoint
> Platform PCE, the upgrade reverts this configuration. After upgrading, repeat the steps in this
> section to restore the concurrent login limit.

## Configure Concurrent Login Limit

Run these commands in a terminal where `kubectl` is configured for your Anypoint Platform PCE
cluster and you have permissions to operate on it. No specific directory is required.

1.  Patch the authentication-server configmap:

    kubectl patch configmap authentication-server-env -p
    '{"data":{"AUTH\_SERVER\_FEATURES\_LIMITCONCURRENTSESSION":"true"}}' -n access-management

2.  Restart the authentication-server:

    kubectl rollout restart deployment authentication-server -n access-management

The concurrent login limit takes effect after you restart the authentication-server.

## See Also

- [Configuring Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/4.2/config-workflow)

<!-- document id=38d3493848fca6018bbcc1349f9f5de3a65561f1c3ed086835a3344edd03e3fc url=/mulesoft/current/en-us/private-cloud/latest/access-management-concurrent-login.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.3
is-latest-version: true
---

# Limiting Concurrent Login in Anypoint Platform PCE

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

You can limit concurrent logins to Anypoint Platform Private Cloud Edition (Anypoint Platform PCE)
so that a user can sign in from only one browser or device at a time. This applies to users in your
organization who log in to the platform to use other features (for example, to use Runtime Manager,
API Manager, or Access Management). When you limit concurrent logins, a new sign-in from another
browser or device signs the user out of the previous session.

> [!NOTE] The concurrent login limit configuration isn’t persistent. When you upgrade Anypoint
> Platform PCE, the upgrade reverts this configuration. After upgrading, repeat the steps in this
> section to restore the concurrent login limit.

## Configure Concurrent Login Limit

Run these commands in a terminal where `kubectl` is configured for your Anypoint Platform PCE
cluster and you have permissions to operate on it. No specific directory is required.

1.  Patch the authentication-server configmap:

    kubectl patch configmap authentication-server-env -p
    '{"data":{"AUTH\_SERVER\_FEATURES\_LIMITCONCURRENTSESSION":"true"}}' -n access-management

2.  Restart the authentication-server:

    kubectl rollout restart deployment authentication-server -n access-management

The concurrent login limit takes effect after you restart the authentication-server.

## See Also

- [Configuring Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/latest/config-workflow)

<!-- document id=5892e4e37dde7604308f332ea1eac76b1fc3d8a79818aadcffb1bca25702b672 url=/mulesoft/current/en-us/private-cloud/3.2/operating-about.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 3.2
---

# Managing Anypoint Platform PCE

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

After your installation is complete, your instance of Anypoint Platform Private Cloud Edition
(Anypoint Platform PCE) is ready to use. Users registered in your external identity service should
have access to your Anypoint platform
[organization](https://docs.mulesoft.com/access-management/managing-business-groups). As an admin, you can add
[roles](https://docs.mulesoft.com/access-management/roles) to these users.

You can also [register servers](https://docs.mulesoft.com/runtime-manager/managing-servers) so that you can then
[deploy to them](https://docs.mulesoft.com/runtime-manager/deploying-to-your-own-servers), and so on.

Mule app developers in your organization who create Mule apps through the
[Anypoint Studio](https://docs.mulesoft.com/studio/) IDE must set up their editors so the Mule apps interface with your
locally installed Anypoint Platform rather than the default cloud Anypoint Platform.

The following topics describe how to manage Anypoint Platform PCE after installation and
configuration is complete:

- Close port 61009 in the cluster security group. If you are using AWS, you can use the AWS
  Management Console to do this.

- [Configure Backup and Restore for Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/3.2/backup-and-disaster-recovery)

- [Ops Center](https://docs.mulesoft.com/private-cloud/3.2/managing-via-the-ops-center)

- [Add a Product License Using Ops Center](https://docs.mulesoft.com/private-cloud/3.2/ops-center-update-lic)

- [Setup Alerts for CPU and Memory Usage](https://docs.mulesoft.com/private-cloud/3.2/config-alerts)

- [Allow Addresses for API Platform Proxies](https://docs.mulesoft.com/private-cloud/3.2/config-add-proxy-allowlist)

- [Upload Custom Policies and Publish Assets to Exchange Using the Maven Client](https://docs.mulesoft.com/private-cloud/3.2/custom-policies)

- [Configure Anypoint Studio for Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/3.2/config-studio)

- [Update Nodes](https://docs.mulesoft.com/private-cloud/3.2/restarting-a-node)

- [Analyze Business and API Data Using ELK](https://docs.mulesoft.com/private-cloud/3.2/ext-analytics-elk)

- [Troubleshoot Mule Runtime Engine Registration](https://docs.mulesoft.com/private-cloud/3.2/register-server)

<!-- document id=ac246bcff3721e2f4673217082fdf06e83018ac4abd9cc1c8b9612221ab9863e url=/mulesoft/current/en-us/private-cloud/4.0/operating-about.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.0
---

# Managing Anypoint Platform PCE

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

After your installation is complete, your instance of Anypoint Platform Private Cloud Edition
(Anypoint Platform PCE) is ready to use.

## Users Using Anypoint Platform PCE

Ensure that users registered in your external identity service have access to your Anypoint Platform
[organization](https://docs.mulesoft.com/access-management/managing-business-groups).

You can also [register servers](https://docs.mulesoft.com/runtime-manager/managing-servers) so that you can then
[deploy to them](https://docs.mulesoft.com/runtime-manager/deploying-to-your-own-servers), and so on.

## Mule Developers Using Anypoint Studio

Mule app developers in your organization who create Mule apps through the
[Anypoint Studio](https://docs.mulesoft.com/studio/) IDE must set up their editors so the Mule apps interface with your
locally installed Anypoint Platform rather than the default cloud Anypoint Platform.

## Manage Anypoint Platform PCE

The following topics describe how to manage Anypoint Platform PCE:

- [Backing up and restoring for Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/4.0/backup-and-disaster-recovery)

- [Allowing addresses for API Platform proxies](https://docs.mulesoft.com/private-cloud/4.0/config-add-proxy-allowlist)

- [Uploading custom policies and publish assets to exchange using the Maven client](https://docs.mulesoft.com/private-cloud/4.0/custom-policies)

- [Adding Compatible Java Versions for Assets Using the Maven Client](https://docs.mulesoft.com/private-cloud/4.0/adding-compatible-java-versions-using-the-maven-client)

- [Configuring Anypoint Studio for Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/4.0/config-studio)

- [Analyzing Business and API Data Using ELK](https://docs.mulesoft.com/private-cloud/4.0/operating-about)

- [Troubleshooting Mule Runtime Engine Registration](https://docs.mulesoft.com/private-cloud/4.0/register-server)

- [Updating Nodes](https://docs.mulesoft.com/private-cloud/4.0/restarting-a-node)

## See Also

- [Installing Anypoint Platform Private Cloud Edition (Anypoint Platform PCE)](https://docs.mulesoft.com/private-cloud/4.0/install-workflow)

- [Configuring Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/4.0/config-workflow)

<!-- document id=cda84539e9c8a001e3e8026dc93e0381ee834f9b8972137fb450829853b93255 url=/mulesoft/current/en-us/private-cloud/4.1/operating-about.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.1
---

# Managing Anypoint Platform PCE

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

After your installation is complete, your instance of Anypoint Platform Private Cloud Edition
(Anypoint Platform PCE) is ready to use.

## Users Using Anypoint Platform PCE

Ensure that users registered in your external identity service have access to your Anypoint Platform
[organization](https://docs.mulesoft.com/access-management/managing-business-groups).

You can also [register servers](https://docs.mulesoft.com/runtime-manager/managing-servers) so that you can then
[deploy to them](https://docs.mulesoft.com/runtime-manager/deploying-to-your-own-servers), and so on.

## Mule Developers Using Anypoint Studio

Mule app developers in your organization who create Mule apps through the
[Anypoint Studio](https://docs.mulesoft.com/studio/) IDE must set up their editors so the Mule apps interface with your
locally installed Anypoint Platform rather than the default cloud Anypoint Platform.

## Manage Anypoint Platform PCE

The following topics describe how to manage Anypoint Platform PCE:

- [Backing up and restoring for Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/4.1/backup-and-disaster-recovery)

- [Allowing addresses for API Platform proxies](https://docs.mulesoft.com/private-cloud/4.1/config-add-proxy-allowlist)

- [Uploading custom policies and publish assets to exchange using the Maven client](https://docs.mulesoft.com/private-cloud/4.1/custom-policies)

- [Adding Compatible Java Versions for Assets Using the Maven Client](https://docs.mulesoft.com/private-cloud/4.1/adding-compatible-java-versions-using-the-maven-client)

- [Configuring Anypoint Studio for Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/4.1/config-studio)

- [Analyzing Business and API Data Using ELK](https://docs.mulesoft.com/private-cloud/4.1/operating-about)

- [Troubleshooting Mule Runtime Engine Registration](https://docs.mulesoft.com/private-cloud/4.1/register-server)

- [Updating Nodes](https://docs.mulesoft.com/private-cloud/4.1/restarting-a-node)

## See Also

- [Installing Anypoint Platform Private Cloud Edition (Anypoint Platform PCE)](https://docs.mulesoft.com/private-cloud/4.1/install-workflow)

- [Configuring Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/4.1/config-workflow)

<!-- document id=d798c7f91617d1b945ff01d1e7794aea10896d3b7182e7db99870f2803ccd68a url=/mulesoft/current/en-us/private-cloud/4.2/operating-about.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.2
---

# Managing Anypoint Platform PCE

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

After your installation is complete, your instance of Anypoint Platform Private Cloud Edition
(Anypoint Platform PCE) is ready to use.

## Users Using Anypoint Platform PCE

Ensure that users registered in your external identity service have access to your Anypoint Platform
[organization](https://docs.mulesoft.com/access-management/managing-business-groups).

You can also [register servers](https://docs.mulesoft.com/runtime-manager/managing-servers) so that you can then
[deploy to them](https://docs.mulesoft.com/runtime-manager/deploying-to-your-own-servers), and so on.

## Mule Developers Using Anypoint Studio

Mule app developers in your organization who create Mule apps through the
[Anypoint Studio](https://docs.mulesoft.com/studio/) IDE must set up their editors so the Mule apps interface with your
locally installed Anypoint Platform rather than the default cloud Anypoint Platform.

## Manage Anypoint Platform PCE

The following topics describe how to manage Anypoint Platform PCE:

- [Backing up and restoring for Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/4.2/backup-and-disaster-recovery)

- [Allowing addresses for API Platform proxies](https://docs.mulesoft.com/private-cloud/4.2/config-add-proxy-allowlist)

- [Uploading custom policies and publish assets to exchange using the Maven client](https://docs.mulesoft.com/private-cloud/4.2/custom-policies)

- [Adding Compatible Java Versions for Assets Using the Maven Client](https://docs.mulesoft.com/private-cloud/4.2/adding-compatible-java-versions-using-the-maven-client)

- [Configuring Anypoint Studio for Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/4.2/config-studio)

- [Analyzing Business and API Data Using ELK](https://docs.mulesoft.com/private-cloud/4.2/operating-about)

- [Troubleshooting Mule Runtime Engine Registration](https://docs.mulesoft.com/private-cloud/4.2/register-server)

- [Updating Nodes](https://docs.mulesoft.com/private-cloud/4.2/restarting-a-node)

## See Also

- [Installing or Upgrading Anypoint Platform Private Cloud Edition (Anypoint Platform PCE)](https://docs.mulesoft.com/private-cloud/4.2/install-workflow)

- [Configuring Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/4.2/config-workflow)

<!-- document id=99d7bd3441e8646379cbab5f52ba0c3f50007308b8478319df69649dd7b76a0d url=/mulesoft/current/en-us/private-cloud/latest/operating-about.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.3
is-latest-version: true
---

# Managing Anypoint Platform PCE

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

After your installation is complete, your instance of Anypoint Platform Private Cloud Edition
(Anypoint Platform PCE) is ready to use.

## Users Using Anypoint Platform PCE

Ensure that users registered in your external identity service have access to your Anypoint Platform
[organization](https://docs.mulesoft.com/access-management/managing-business-groups).

You can also [register servers](https://docs.mulesoft.com/runtime-manager/managing-servers) so that you can then
[deploy to them](https://docs.mulesoft.com/runtime-manager/deploying-to-your-own-servers), and so on.

## Mule Developers Using Anypoint Studio

Mule app developers in your organization who create Mule apps through the
[Anypoint Studio](https://docs.mulesoft.com/studio/) IDE must set up their editors so the Mule apps interface with your
locally installed Anypoint Platform rather than the default cloud Anypoint Platform. See
[Deploying Mule Applications to Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/latest/deploy-apps).

## Mule Developers Using Anypoint Code Builder

Mule app developers in your organization who create Mule apps through
[Anypoint Code Builder](https://docs.mulesoft.com/anypoint-code-builder/start-acb-desktop) must connect VS Code to your
Anypoint Platform PCE control plane, then package and deploy applications to Runtime Manager. See
[Deploying Mule Applications to Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/latest/deploy-apps).

## Manage Anypoint Platform PCE

The following topics describe how to manage Anypoint Platform PCE:

- [Backing up and restoring for Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/latest/backup-and-disaster-recovery)

- [Allowing addresses for API Platform proxies](https://docs.mulesoft.com/private-cloud/latest/config-add-proxy-allowlist)

- [Uploading custom policies and publish assets to exchange using the Maven client](https://docs.mulesoft.com/private-cloud/latest/custom-policies)

- [Adding Compatible Java Versions for Assets Using the Maven Client](https://docs.mulesoft.com/private-cloud/latest/adding-compatible-java-versions-using-the-maven-client)

- [Configuring Anypoint Studio for Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/latest/config-studio)

- [Deploying Mule Applications to Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/latest/deploy-apps)

- [Configuring Anypoint Code Builder for Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/latest/config-code-builder)

- [Deploying Mule Applications Using Anypoint Code Builder](https://docs.mulesoft.com/private-cloud/latest/deploy-apps-code-builder)

- [Analyzing Business and API Data Using ELK](https://docs.mulesoft.com/private-cloud/latest/operating-about)

- [Troubleshooting Mule Runtime Engine Registration](https://docs.mulesoft.com/private-cloud/latest/register-server)

- [Updating Nodes](https://docs.mulesoft.com/private-cloud/latest/restarting-a-node)

## See Also

- [Installing or Upgrading Anypoint Platform Private Cloud Edition (Anypoint Platform PCE)](https://docs.mulesoft.com/private-cloud/latest/install-workflow)

- [Configuring Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/latest/config-workflow)

<!-- document id=4a0f13eeb8b3f9fb5a16ad75804fe5d120a207ca09c52e5c9b9fc1e4892c68c0 url=/mulesoft/current/en-us/private-cloud/4.2/upgrade.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.2
---

# Migrating Anypoint Platform PCE v3.X to v4.X

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

> [!NOTE] This procedure is also applicable if you need to migrate from PCE 4.x to PCE 4.x instead
> of an in-place upgrade. Replace the 3.x system with your source PCE 4.x system in the procedure
> below.

> [!NOTE] Contact MuleSoft Professional Services or your Anypoint PCE Certified Partner to perform a
> migration of your Anypoint Platform PCE.

To migrate an Anypoint Platform Private Cloud Edition (Anypoint Platform PCE) deployment from
version 3.x to 4.x, perform a full state backup on your existing source cluster (Cluster 1) and
restore that data onto a newly provisioned target cluster (Cluster 2) running Anypoint Platform PCE
4.x.

Before proceeding, make sure that in your source Anypoint PCE 3.x cluster, you have `ssh` access to
your cluster nodes and the necessary `kubectl` permissions for both environments.

## Configure Environment and Security

Before generating the backup files, you must correctly identify the platform via DNS and secure it
with valid certificates.

### Define DNS and Platform Identification

1.  In Amazon Route 53, create a new A or CNAME record to point your load balancer to the PCE 3.x
    DNS (for example, `pce3.mulesoft.com`).

2.  In the Anypoint Platform UI, navigate to **Access Management > DNS/IP** and enter the Platform
    DNS address hosting your 3.x instance.

3.  In the Anypoint Platform UI, click **Save** to apply the DNS changes to the platform
    configuration.

### Set Up SSL Certificates

1.  In your local terminal, generate a 2048-bit RSA key and a self-signed certificate by running the
    provided `openssl` command.

    openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -keyout key.pem -out cert.pem

2.  In the Anypoint Platform UI, navigate to **Access Management > Security**.

3.  In the Anypoint Platform UI, click **Choose File** for both the **Certificate** and **Private
    Key** fields to upload the `cert.pem` and `key.pem` files generated in the previous step.

## Back Up Platform State and Infrastructure

This section focuses on capturing the database state and service configurations using the Gravity
and Kubernetes CLI tools.

### Patch Kubernetes Configuration

1.  In the PCE Cluster Terminal, apply the configuration patch to exclude incompatible secrets and
    buckets from the 4.x migration.

    kubectl apply -f pce3-update-config.yaml

    apiVersion: v1 kind: ConfigMap metadata: name: backup-restore-config data: namespaces: "default
    access-management amf amc arm audit-log api-designer api-manager core-paas design-center
    exchange mocking mozart pce pce-core visualizer dias monitoring-center" ignore-buckets:
    "cpc-resources static-assets healthz" ignore-databases: crowdmigrator ^db\\S\*$ sw\_database
    ignore-secrets: "objectstore-s3-secret telegraf-influxdb-creds nginx-ssl cluster-ca
    cluster-default-ssl dias-insight-cassandra-connection-password hybrid-rest-cloudhub-keystore
    hybrid-rest-root-cert runtime-manager-keystore runtime-manager-truststore cloudhub-mcm-keystore"
    #these hybrid/runtime-manager secrets are ignored since they are generated based on the platform
    DNS, which is not modified by b/r. See
    https://github.com/mulesoft/onprem-config-api/blob/master/assets/cloudhub-mcm-keystore/create-keystore.sh
    ignore-releases: "core-paas-namespaces stolon stolon-amv pce-seaweedfs-app pce-cluster-ssl-app
    dias-prov-k8s-am-influxdb-comp dias-prov-k8s-am-ingestor-comp" pvc-to-delete:
    "dias-prov-k8s-cassandra-comp dias-prov-k8s-insight-comp" skip-version-check: "true"

    apiVersion: v1 data: backup\_s3\_continue\_if\_error: "false" backup\_s3\_max\_attempts: "3"
    backup\_s3\_sequentially\_bucket\_names: "" backup\_s3\_sleep\_time\_seconds: "30"
    ignore-buckets: cpc-resources static-assets healthz ignore-databases: crowdmigrator ^db\\S\*$
    sw\_database ignore-releases: core-paas-namespaces stolon stolon-amv pce-seaweedfs-app
    pce-cluster-ssl-app dias-prov-k8s-am-influxdb-comp dias-prov-k8s-am-ingestor-comp
    ignore-secrets: objectstore-s3-secret telegraf-influxdb-creds nginx-ssl cluster-ca
    cluster-default-ssl dias-insight-cassandra-connection-password hybrid-rest-cloudhub-keystore
    hybrid-rest-root-cert runtime-manager-keystore runtime-manager-truststore cloudhub-mcm-keystore
    namespaces: default access-management amf amc arm audit-log api-designer api-manager core-paas
    design-center exchange mocking mozart pce pce-core visualizer dias monitoring-center
    pithos\_pod\_count: "2" pvc-to-delete: dias-prov-k8s-cassandra-comp dias-prov-k8s-insight-comp
    restore\_in\_parallel: "false" restore\_s3\_max\_attempts: "3"
    restore\_s3\_sleep\_time\_seconds: "30" skip-version-check: "true" kind: ConfigMap metadata:
    name: backup-restore-config

### Execute Gravity System Backup

1.  In the PCE Cluster Terminal (Backup Node), trigger the core platform state backup by executing
    the gravity backup command.

    gravity backup /var/lib/gravity/planet/share/backup-3x-$(date +%d-%m-%y).tar.gz

2.  In the PCE Cluster Terminal (Backup Node), generate the Anypoint Monitoring and Visualizer (AMV)
    specific backup using the internal restore script.

    /var/lib/gravity/site/packages/unpacked/gravitational.io/anypoint/3.2.0\*/resources/kubernetes/amv-backup-restore/amv-backup-restore.sh

## Preserve Persistent Data (NFS/EFS)

In addition to the database state, you must manually preserve the project files and working
directories stored on the distributed file system.

### Mount the External Storage

1.  In the PCE Cluster Terminal, create a mount point and install the necessary NFS utilities.

    mkdir nfs\_mount\_folder sudo yum install nfs-utils -y

2.  In the PCE Cluster Terminal, mount your AWS EFS (or external NFS) to the local directory.

    sudo mount -t nfs4 -o rw,vers=4.1 <your-efs-dns-address>:/ /home/ec2-user/nfs\_mount\_folder

### Compress and Offload Assets

1.  In the PCE Cluster Terminal, navigate to the mounted folder and compress the project and working
    directories.

    tar -cvzf projects.tar.gz projects tar -cvzf working\_Directories.tar.gz working\_Directories

2.  In your Local Terminal, securely download the four critical artifacts (Platform Backup, AMV
    Backup, Projects Archive, and Working Directories Archive) to your local machine.

    scp -i your-key.pem ec2-user@<pce-node-ip>:/tmp/backup-files/\*.tar.gz
    ~/Downloads/pce\_migration\_assets/

## Initialize the Target 4.x Environment

Before restoring data, you must configure the new cluster to recognize the platform identity and
security parameters.

### Update Platform Routing and Identification

1.  In Amazon Route 53, update your DNS records to point the load balancer to the new Anypoint PCE
    4.x cluster (Cluster 2).

2.  In the Anypoint Platform UI (New Cluster), navigate to **Access Management > DNS/IP** and enter
    the new DNS address assigned to your PCE 4.x instance.

### Apply New Security Certificates

1.  In the Anypoint Platform UI (New Cluster), navigate to **Access Management > Security** and
    upload the certificates generated for the 4.x environment.

2.  In the PCE 4.x Cluster Terminal, monitor the cluster to ensure all jobs related to DNS and
    certificate updates complete successfully and that all platform pods are in a `Running` state.

## Transfer and Stage Migration Assets

Move the data extracted from PCE 3.x into the target 4.x infrastructure.

### Mount the Target External Storage

1.  In the PCE 4.x Cluster Terminal, create the `nfs_mount_folder` and ensure the `nfs-utils`
    package is installed on the node.

2.  In the PCE 4.x Cluster Terminal, mount your AWS EFS or external storage to the local mount point
    using the `mount -t nfs4` command.

### Upload and Extract Backup Data

1.  In your Local Terminal, transfer the backup archives and project directories from your local
    machine to the new EC2 instance using the `scp` command.

2.  In the PCE 4.x Cluster Terminal, extract the `projects.tar.gz` and `working_Directories.tar.gz`
    files into their respective persistent storage paths.

## Execute the Restoration Process

Finalize the migration by updating system flags and triggering the restoration services via API.

### Adjust Kubernetes Migration Settings

1.  In the PCE 4.x Cluster Terminal, open the backup-restore configuration for editing by running
    the `kubectl edit` command.

    kubectl edit cm backup-restore-config -n pce-core

2.  In the editor, update the `skip-version-check` property to true to authorize the version-jump
    migration.

### Invoke Restoration Services via API

1.  In your Local Terminal, obtain an authentication bearer token by providing your credentials to
    the login endpoint.

    curl -k --request POST \\ --header "Content-Type: application/json" \\ --data
    '{"username":"<username>", "password": "<password>"}' \\ https://<platform-dns>/accounts/login

2.  In your Local Terminal, trigger the core platform restoration using the backup file and target
    NFS server details.

    curl -k https://<platform-dns>/platform/restore -X POST \\ -H "Authorization: Bearer
    ${token}" \\
     -H "Content-Type: application/json" \\
     -d "{\\"backup-file-name\\": \\"${backupFileName}.tar.gz\\",
    \\"nfs-server\\": \\"${fileSystemDns}\\", \\"nfs-path\\": \\"/\\"}"

3.  In your Local Terminal, trigger the AMV restoration to migrate Monitoring and Visualizer data.

    curl -k https://<platform-dns>/platform/amv/restore -X POST \\ -H "Authorization: Bearer
    ${token}" \\
     -H "Content-Type: application/json" \\
    -d "{\\"backup-file-name\\": \\"${backupFileName}.tar.gz\\",
    \\"nfs-server\\": \\"${fileSystemDns}\\", \\"nfs-path\\": \\"/\\"}"

## See Also

- [Anypoint Platform PCE Overview](https://docs.mulesoft.com/private-cloud/4.2/)

- [Installing or Upgrading Anypoint Platform Private Cloud Edition (Anypoint Platform PCE)](https://docs.mulesoft.com/private-cloud/4.2/install-workflow)

<!-- document id=b2e2b699b50895110251ebce03cea49fb229022eac3077a6ac65ab8a43a24b29 url=/mulesoft/current/en-us/private-cloud/latest/upgrade.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.3
is-latest-version: true
---

# Migrating Anypoint Platform PCE v3.X to v4.X

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

> [!NOTE] This procedure is also applicable if you need to migrate from PCE 4.x to PCE 4.x instead
> of an in-place upgrade. Replace the 3.x system with your source PCE 4.x system in the procedure
> below.

> [!NOTE] Contact MuleSoft Professional Services or your Anypoint PCE Certified Partner to perform a
> migration of your Anypoint Platform PCE.

To migrate an Anypoint Platform Private Cloud Edition (Anypoint Platform PCE) deployment from
version 3.x to 4.x, perform a full state backup on your existing source cluster (Cluster 1) and
restore that data onto a newly provisioned target cluster (Cluster 2) running Anypoint Platform PCE
4.x.

Before proceeding, make sure that in your source Anypoint PCE 3.x cluster, you have `ssh` access to
your cluster nodes and the necessary `kubectl` permissions for both environments.

## Configure Environment and Security

Before generating the backup files, you must correctly identify the platform via DNS and secure it
with valid certificates.

### Define DNS and Platform Identification

1.  In Amazon Route 53, create a new A or CNAME record to point your load balancer to the PCE 3.x
    DNS (for example, `pce3.mulesoft.com`).

2.  In the Anypoint Platform UI, navigate to **Access Management > DNS/IP** and enter the Platform
    DNS address hosting your 3.x instance.

3.  In the Anypoint Platform UI, click **Save** to apply the DNS changes to the platform
    configuration.

### Set Up SSL Certificates

1.  In your local terminal, generate a 2048-bit RSA key and a self-signed certificate by running the
    provided `openssl` command.

    openssl req -x509 -sha256 -nodes -days 365 -newkey rsa:2048 -keyout key.pem -out cert.pem

2.  In the Anypoint Platform UI, navigate to **Access Management > Security**.

3.  In the Anypoint Platform UI, click **Choose File** for both the **Certificate** and **Private
    Key** fields to upload the `cert.pem` and `key.pem` files generated in the previous step.

## Back Up Platform State and Infrastructure

This section focuses on capturing the database state and service configurations using the Gravity
and Kubernetes CLI tools.

### Patch Kubernetes Configuration

1.  In the PCE Cluster Terminal, apply the configuration patch to exclude incompatible secrets and
    buckets from the 4.x migration.

    kubectl apply -f pce3-update-config.yaml

    apiVersion: v1 kind: ConfigMap metadata: name: backup-restore-config data: namespaces: "default
    access-management amf amc arm audit-log api-designer api-manager core-paas design-center
    exchange mocking mozart pce pce-core visualizer dias monitoring-center" ignore-buckets:
    "cpc-resources static-assets healthz" ignore-databases: crowdmigrator ^db\\S\*$ sw\_database
    ignore-secrets: "objectstore-s3-secret telegraf-influxdb-creds nginx-ssl cluster-ca
    cluster-default-ssl dias-insight-cassandra-connection-password hybrid-rest-cloudhub-keystore
    hybrid-rest-root-cert runtime-manager-keystore runtime-manager-truststore cloudhub-mcm-keystore"
    #these hybrid/runtime-manager secrets are ignored since they are generated based on the platform
    DNS, which is not modified by b/r. See
    https://github.com/mulesoft/onprem-config-api/blob/master/assets/cloudhub-mcm-keystore/create-keystore.sh
    ignore-releases: "core-paas-namespaces stolon stolon-amv pce-seaweedfs-app pce-cluster-ssl-app
    dias-prov-k8s-am-influxdb-comp dias-prov-k8s-am-ingestor-comp" pvc-to-delete:
    "dias-prov-k8s-cassandra-comp dias-prov-k8s-insight-comp" skip-version-check: "true"

    apiVersion: v1 data: backup\_s3\_continue\_if\_error: "false" backup\_s3\_max\_attempts: "3"
    backup\_s3\_sequentially\_bucket\_names: "" backup\_s3\_sleep\_time\_seconds: "30"
    ignore-buckets: cpc-resources static-assets healthz ignore-databases: crowdmigrator ^db\\S\*$
    sw\_database ignore-releases: core-paas-namespaces stolon stolon-amv pce-seaweedfs-app
    pce-cluster-ssl-app dias-prov-k8s-am-influxdb-comp dias-prov-k8s-am-ingestor-comp
    ignore-secrets: objectstore-s3-secret telegraf-influxdb-creds nginx-ssl cluster-ca
    cluster-default-ssl dias-insight-cassandra-connection-password hybrid-rest-cloudhub-keystore
    hybrid-rest-root-cert runtime-manager-keystore runtime-manager-truststore cloudhub-mcm-keystore
    namespaces: default access-management amf amc arm audit-log api-designer api-manager core-paas
    design-center exchange mocking mozart pce pce-core visualizer dias monitoring-center
    pithos\_pod\_count: "2" pvc-to-delete: dias-prov-k8s-cassandra-comp dias-prov-k8s-insight-comp
    restore\_in\_parallel: "false" restore\_s3\_max\_attempts: "3"
    restore\_s3\_sleep\_time\_seconds: "30" skip-version-check: "true" kind: ConfigMap metadata:
    name: backup-restore-config

### Execute Gravity System Backup

1.  In the PCE Cluster Terminal (Backup Node), trigger the core platform state backup by executing
    the gravity backup command.

    gravity backup /var/lib/gravity/planet/share/backup-3x-$(date +%d-%m-%y).tar.gz

2.  In the PCE Cluster Terminal (Backup Node), generate the Anypoint Monitoring and Visualizer (AMV)
    specific backup using the internal restore script.

    /var/lib/gravity/site/packages/unpacked/gravitational.io/anypoint/3.2.0\*/resources/kubernetes/amv-backup-restore/amv-backup-restore.sh

## Preserve Persistent Data (Shared Filesystem)

In addition to the database state, you must manually preserve the project files and working
directories stored on the platform shared filesystem.

### Mount the External Storage

1.  In the PCE Cluster Terminal, create a mount point and install the necessary NFS utilities.

    mkdir nfs\_mount\_folder sudo yum install nfs-utils -y

2.  In the PCE Cluster Terminal, mount your AWS EFS (or external NFS) to the local directory.

    sudo mount -t nfs4 -o rw,vers=4.1 <your-efs-dns-address>:/ /home/ec2-user/nfs\_mount\_folder

### Compress and Offload Assets

1.  In the PCE Cluster Terminal, navigate to the mounted folder and compress the project and working
    directories.

    tar -cvzf projects.tar.gz projects tar -cvzf working\_Directories.tar.gz working\_Directories

2.  In your Local Terminal, securely download the four critical artifacts (Platform Backup, AMV
    Backup, Projects Archive, and Working Directories Archive) to your local machine.

    scp -i your-key.pem ec2-user@<pce-node-ip>:/tmp/backup-files/\*.tar.gz
    ~/Downloads/pce\_migration\_assets/

## Initialize the Target 4.x Environment

Before restoring data, you must configure the new cluster to recognize the platform identity and
security parameters.

### Update Platform Routing and Identification

1.  In Amazon Route 53, update your DNS records to point the load balancer to the new Anypoint PCE
    4.x cluster (Cluster 2).

2.  In the Anypoint Platform UI (New Cluster), navigate to **Access Management > DNS/IP** and enter
    the new DNS address assigned to your PCE 4.x instance.

### Apply New Security Certificates

1.  In the Anypoint Platform UI (New Cluster), navigate to **Access Management > Security** and
    upload the certificates generated for the 4.x environment.

2.  In the PCE 4.x Cluster Terminal, monitor the cluster to ensure all jobs related to DNS and
    certificate updates complete successfully and that all platform pods are in a `Running` state.

## Transfer and Stage Migration Assets

Move the data extracted from PCE 3.x into the target 4.x infrastructure.

### Mount the Target External Storage

1.  In the PCE 4.x Cluster Terminal, create the `nfs_mount_folder` and ensure the `nfs-utils`
    package is installed on the node.

2.  In the PCE 4.x Cluster Terminal, mount your AWS EFS or external storage to the local mount point
    using the `mount -t nfs4` command.

### Upload and Extract Backup Data

1.  In your Local Terminal, transfer the backup archives and project directories from your local
    machine to the new EC2 instance using the `scp` command.

2.  In the PCE 4.x Cluster Terminal, extract the `projects.tar.gz` and `working_Directories.tar.gz`
    files into their respective persistent storage paths.

## Execute the Restoration Process

Finalize the migration by updating system flags and triggering the restoration services via API.

### Adjust Kubernetes Migration Settings

1.  In the PCE 4.x Cluster Terminal, open the backup-restore configuration for editing by running
    the `kubectl edit` command.

    kubectl edit cm backup-restore-config -n pce-core

2.  In the editor, update the `skip-version-check` property to true to authorize the version-jump
    migration.

### Invoke Restoration Services via API

1.  In your Local Terminal, obtain an authentication bearer token by providing your credentials to
    the login endpoint.

    curl -k --request POST \\ --header "Content-Type: application/json" \\ --data
    '{"username":"<username>", "password": "<password>"}' \\ https://<platform-dns>/accounts/login

2.  In your Local Terminal, trigger the core platform restoration using the backup file and target
    NFS server details.

    curl -k https://<platform-dns>/platform/restore -X POST \\ -H "Authorization: Bearer
    ${token}" \\
     -H "Content-Type: application/json" \\
     -d "{\\"backup-file-name\\": \\"${backupFileName}.tar.gz\\",
    \\"nfs-server\\": \\"${fileSystemDns}\\", \\"nfs-path\\": \\"/\\"}"

3.  In your Local Terminal, trigger the AMV restoration to migrate Monitoring and Visualizer data.

    curl -k https://<platform-dns>/platform/amv/restore -X POST \\ -H "Authorization: Bearer
    ${token}" \\
     -H "Content-Type: application/json" \\
    -d "{\\"backup-file-name\\": \\"${backupFileName}.tar.gz\\",
    \\"nfs-server\\": \\"${fileSystemDns}\\", \\"nfs-path\\": \\"/\\"}"

## See Also

- [Anypoint Platform PCE Overview](https://docs.mulesoft.com/private-cloud/latest/)

- [Installing or Upgrading Anypoint Platform Private Cloud Edition (Anypoint Platform PCE)](https://docs.mulesoft.com/private-cloud/latest/install-workflow)

<!-- document id=a29225cc72095f8f36e935a15d5e0fee2ef3026490eb674b5d6f9e72f6b72980 url=/mulesoft/current/en-us/private-cloud/3.2/prereq-network.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 3.2
---

# Network Prerequisites

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

To ensure the performance and stability of Anypoint Platform Private Cloud Edition (Anypoint
Platform PCE), every node in your Anypoint Platform PCE environment must meet the network
requirements described in this topic.

> [!IMPORTANT] Before you install Anypoint Platform PCE, your infrastructure team must review each
> of the following sections and verify that your environment meets the stated network requirements.
> If needed, contact your MuleSoft representative for assistance.

## Verify Static IPs

All nodes in the cluster must have static private IPv4 assigned to them, and these must persist
after restarts. If IP addresses are not persistent between reboots, the cluster can fail.

## Verify VXLAN

The version of Kubernetes supported by Anypoint Platform PCE uses an overlay VXLAN and UDP transport
to encapsulate traffic. There is direct communication between cluster components.

The following table lists the ports used for inter-host communication. The table uses the following
source and destination descriptions:

- Anypoint Platform PCE nodes: Nodes that are members of the cluster.

- Installer node: The node on which you started the installation.

- Load Balancer: Any source that is outside the cluster.

- localhost: The port that is used only within the host where the request started.

You must ensure that all of the following ports are configured correctly on all nodes.

<table><caption>Table 1. Port Configuration Requirements</caption> <colgroup><col> <col> <col> <col> <col></colgroup><thead><tr><th>Protocol</th><th>Port/Range</th><th>Purpose</th><th>Source</th><th>Destination</th></tr></thead><tbody><tr><td><p>TCP/UDP</p></td><td><p>53</p></td><td><p>Internal cluster DNS</p></td><td><p>localhost</p></td><td><p>localhost</p></td></tr><tr><td><p>TCP</p></td><td><p>2379, 2380, 4001, 7001</p></td><td><p>etcd distributed database</p></td><td><p>Anypoint Platform PCE nodes</p></td><td><p>Anypoint Platform PCE nodes</p></td></tr><tr><td><p>TCP</p></td><td><p>4242</p></td><td><p>Installer</p></td><td><p>Anypoint Platform PCE nodes</p></td><td><p>Anypoint Platform PCE nodes</p></td></tr><tr><td><p>TCP</p></td><td><p>6443</p></td><td><p>Kubernetes API server</p></td><td><p>Anypoint Platform PCE nodes</p></td><td><p>Anypoint Platform PCE nodes</p></td></tr><tr><td><p>TCP</p></td><td><p>9443</p></td><td><p>HAProxy to load balance Kubernetes API Server</p></td><td><p>Anypoint Platform PCE nodes</p></td><td><p>Anypoint Platform PCE nodes</p></td></tr><tr><td><p>TCP</p></td><td><p>9100</p></td><td><p>Prometheus node-exporter</p></td><td><p>Anypoint Platform PCE nodes</p></td><td><p>Anypoint Platform PCE nodes</p></td></tr><tr><td><p>TCP</p></td><td><p>10248, 10250</p></td><td><p>Kubernetes Kubelet</p></td><td><p>Anypoint Platform PCE nodes</p></td><td><p>Anypoint Platform PCE nodes</p></td></tr><tr><td><p>TCP</p></td><td><p>10249, 10256</p></td><td><p>Kubernetes kube-proxy</p></td><td><p>Anypoint Platform PCE</p></td><td><p>Anypoint Platform PCE nodes</p></td></tr><tr><td><p>TCP</p></td><td><p>10251-10252</p></td><td><p>Kubernetes controller-manager and scheduler</p></td><td><p>Anypoint Platform PCE nodes</p></td><td><p>Anypoint Platform PCE nodes</p></td></tr><tr><td><p>TCP</p></td><td><p>10257-10259</p></td><td><p>Kubernetes controller-manager and scheduler (secure)</p></td><td><p>Anypoint Platform PCE nodes</p></td><td><p>Anypoint Platform PCE nodes</p></td></tr><tr><td><p>TCP</p></td><td><p>5000</p></td><td><p>Docker registry</p></td><td><p>Anypoint Platform PCE nodes</p></td><td><p>Anypoint Platform PCE nodes</p></td></tr><tr><td><p>TCP</p></td><td><p>3009-3012</p></td><td><p>Cluster control plane</p></td><td><p>Anypoint Platform PCE nodes</p></td><td><p>Anypoint Platform PCE nodes</p></td></tr><tr><td><p>TCP</p></td><td><p>3022</p></td><td><p>Cluster control plane</p></td><td><p>Anypoint Platform PCE nodes</p></td><td><p>Anypoint Platform PCE nodes</p></td></tr><tr><td><p>TCP</p></td><td><p>3023-3025</p></td><td><p>Cluster control plane</p></td><td><p>Anypoint Platform PCE nodes</p></td><td><p>Anypoint Platform PCE nodes</p></td></tr><tr><td><p>TCP</p></td><td><p>7575</p></td><td><p>Cluster control plane</p></td><td><p>Anypoint Platform PCE nodes</p></td><td><p>Anypoint Platform PCE nodes</p></td></tr><tr><td><p>TCP</p></td><td><p>7580</p></td><td><p>Cluster control plane monitoring endpoint</p></td><td><p>localhost</p></td><td><p>localhost</p></td></tr><tr><td><p>TCP</p></td><td><p>6060</p></td><td><p>Cluster control plane profiling endpoint</p></td><td><p>localhost</p></td><td><p>localhost</p></td></tr><tr><td><p>TCP</p></td><td><p>30000-32767</p></td><td><p>Internal services port range</p></td><td><p>Anypoint Platform PCE nodes</p></td><td><p>Anypoint Platform PCE nodes</p></td></tr><tr><td><p>TCP</p></td><td><p>61009-61010</p></td><td><p>Installer port ranges (only used during install)</p></td><td><p>Anypoint Platform PCE nodes</p></td><td><p>installer node</p></td></tr><tr><td><p>TCP</p></td><td><p>61022-61024</p></td><td><p>Installer port ranges (only used during install)</p></td><td><p>Anypoint Platform PCE nodes</p></td><td><p>installer node</p></td></tr><tr><td><p>TCP</p></td><td><p>61025</p></td><td><p>Installer port ranges (only used during install)</p></td><td><p>localhost</p></td><td><p>installer node</p></td></tr><tr><td><p>UDP</p></td><td><p>8472</p></td><td><p>Overlay VXLAN network</p></td><td><p>Anypoint Platform PCE nodes</p></td><td><p>Anypoint Platform PCE nodes</p></td></tr><tr><td><p>TCP</p></td><td><p>32009</p></td><td><p>Ops Center Admin UI</p></td><td><p>Load Balancer</p></td><td><p>Anypoint Platform PCE nodes</p></td></tr><tr><td><p>TCP</p></td><td><p>30080</p></td><td><p>HTTP public access</p></td><td><p>Load Balancer</p></td><td><p>Anypoint Platform PCE nodes</p></td></tr><tr><td><p>TCP</p></td><td><p>30443</p></td><td><p>HTTPS public access</p></td><td><p>Load Balancer</p></td><td><p>Anypoint Platform PCE nodes</p></td></tr><tr><td><p>TCP</p></td><td><p>30889</p></td><td><p>Mule Runtime Websocket</p></td><td><p>Load Balancer</p></td><td><p>Anypoint Platform PCE nodes</p></td></tr><tr><td><p>TCP</p></td><td><p>30883</p></td><td><p>Mule Runtime Authentication Service (for certificate renewals)</p></td><td><p>Load Balancer</p></td><td><p>Anypoint Platform PCE nodes</p></td></tr></tbody></table>

You can use netcat or a similar utility to verify port configuration.  
Anypoint Platform PCE nodes need to hit the platform API address on the load balancer via HTTPS.

## Enable Required Ports

- You must enable TCP ports 53, 3011, and 3012 on all nodes to allow communication with the database
  cluster.

- If you plan to use the GUI installer to install Anypoint Platform PCE, you must enable port 61009.

## Verify NAT Traffic Requirements

In some situations, the Kubernetes overlay network uses NAT. NAT requires that nodes be able to send
and receive packages with a source and destination different from the node’s internal IP.

Any software that monitors the network traffic must be tuned to allow this type of network
interaction.

## Disable OS NetworkManager Services

In some operating systems, like RHEL/CentOS 8.4, NetworkManager includes two extra services:
`nm-cloud-setup.service` and `nm-cloud-setup.timer`. These services add routing tables that
interfere with the configuration of the Kubernetes Container Network Interface (CNI) plugin. If
those services exist, disable them and restart the node before proceeding with the installation.

## Verify SMTP Server Requirements

Your network must include an SMTP server to manage email alerts that are triggered by the platform.
Anypoint Platform PCE must be connected to this SMTP server.

For additional information, refer to the instructions in
[Configure SMTP in Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/3.2/access-management-SMTP).

## Verify External Identity Provider Configuration and Client Management

Your network must include an external identity provider that is compatible with LDAP, OpenIDConnect,
or SAML. To configure an External Identity Provider for user SSO (LDAP, OpenIDConnect, and SAML) or
for external client management as OpenID Connect, the cluster must be able to access the external
identity provider endpoint.

For additional information, refer to the instructions in
[Configure an External Identity Provider in Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/3.2/install-config-ldap-pce).

## Synchronize Clocks

Ensure that the clocks on all servers are synchronized. Unsynchronized clocks can cause problems
with platform communications.

## See Also

- [Environment Prerequisites](https://docs.mulesoft.com/private-cloud/3.2/prereq-platform)

- [Hardware Prerequisites](https://docs.mulesoft.com/private-cloud/3.2/prereq-hardware)

- [Software Prerequisites](https://docs.mulesoft.com/private-cloud/3.2/prereq-software)

- [NFS Server Prerequisites](https://docs.mulesoft.com/private-cloud/3.2/verify-nfs)

- [Preinstallation Verification](https://docs.mulesoft.com/private-cloud/3.2/prereq-gravity-check)

<!-- document id=24d0d5e455cc1541a427414659b0c631f78029dcbf261711b5749f53fe53ba72 url=/mulesoft/current/en-us/private-cloud/3.2/verify-nfs.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 3.2
---

# NFS Server Prerequisites

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

> [!IMPORTANT] Before you install Anypoint Platform Private Cloud Edition (Anypoint Platform PCE),
> your infrastructure team must review each of the following sections and verify that your
> environment meets the stated requirements. If needed, contact your MuleSoft representative for
> assistance to ensure your NFS server is configured correctly.

## Verify NFS Server Setup

Anypoint Platform PCE version 2.0 and later requires a Network File System (NFS) server and an
available NFS endpoint. Your NFS server must meet the following requirements:

- Must be running on a filesystem that has at least 250 GB available.

- Must use any of these supported NFS versions: 4.0 or 4.1

- Can be backed by a network-attached storage (NAS) system.

- Must have port 2049 enabled for both TCP and UDP.

- Configure your network so that all of the PCE nodes can access the NFS server. The direct NFS
  client is Kubernetes 1.9 and requires conformance with NFS version 4.

NFS 4.0 and 4.1 don’t use the `portmapper` service.

## Verify Required Port Is Open

The NFS server requires port 2049 to be open for TCP and UDP.

On each node, use netcat or a similar utility to verify that the required port is open. Netcat is a
computer networking utility used to read and write to network connections using TCP or UDP.

On each node, run: `nc -zv <host_name> 2049`

> [!NOTE] By default, the netcat tool is not included with Anypoint Platform PCE. If you receive a
> `command not found` error, you can download and install netcat or a similar utility.

When the responses from netcat are successful, you receive a response similar to the following
example:

\[ec2-user@ip-10-1-1-97 ~\]$ nc -zv <nfs\_host\_name> 2049 Ncat: Version 7.50 (
https://nmap.org/ncat ) Ncat: Connected to 10.1.0.155:2049. Ncat: 0 bytes sent, 0 bytes received in
0.01 seconds.

## Verify NFS Server Is Mounted

On each node, mount the NFS server in a temporary directory.

1.  Switch to root:  
    `sudo su`

2.  To mount the NFS in a temporary directory, run the following commands and replace both the
    `<nfs-server>` and the `<nfs-path>` with your own values:  
    `mkdir -p /mnt/home`  
    `mount -t nfs4 -o proto=tcp,port=2049 <nfs-server>:<path> /mnt/home/`  
    If the mount fails, you do not have the required permissions.

## Verify NFS Performance

Perform careful analysis of your environment, both from the client and server point of view for
optimal NFS performance. This involves:

- Testing the performance and latency of your NFS server. Specifically, these operations will
  transfer data from the client (Anypoint Platform PCE environment) to the NFS server and measure
  how long each transfer takes.

- Using the command
  `time dd if=/dev/zero of=/mnt/home/<nameOfFile> bs=<blockSize> count=<amountOfBlocks>` to test NFS
  server performance while transferring files and specifying the following parameters:

  - Names `<nameOfFile>`

  - Block size and number of blocks in the transfer: `<blockSize>` and `<amountOfBlocks>`,
    respectively.

- Validating how Anypoint Platform PCE handles NFS file transfers. Perform read and write operations
  with both large (128MB) and small (80KB) files.

Perform all tests on each node.

### Test Writing and Reading Large Files on the NFS Server

Perform the following read and write tests using large files:

- File size: 128 MB

- Block size: 4 KB

- Number of blocks: 32768

While the tests are running, different files are generated (one file per test).

1.  Create a directory in which to mount the NFS server:

    sudo su mkdir -p /mnt/home

2.  Mount the NFS server:

    mount -t nfs4 -o proto=tcp,port=2049 <nfs-server>:<path> /mnt/home/

3.  Perform writes (five files of 128 MB each) on the NFS server:

    time for i in {1..5}; do dd if=/dev/zero of=/mnt/home/greatfile$i.test bs=4k count=32768; done

    The command output is similar to the following:

    \[root@ip-10-1-1-97 ec2-user\]# time for i in {1..5}; do dd if=/dev/zero
    of=/mnt/home/greatfile$i.test bs=4k count=32768; done 32768+0 records in 32768+0 records out
    134217728 bytes (134 MB) copied, 2.12805 s, 63.1 MB/s . . . real 0m8.378s user 0m0.034s sys
    0m0.792s

    The `real` parameter in the test output should be less than 15 seconds.

#### Validate Read Performance

1.  Unmount the NFS server:

    umount /mnt/home

2.  Remount the NFS server:

    mount -t nfs4 -o proto=tcp,port=2049 <nfs-server>:<path> /mnt/home/

3.  Perform reads from the NFS server by running the following command:

    time for i in {1..5}; do dd if=/mnt/home/greatfile$i.test of=/dev/null bs=4k; done

    The `real` parameter in the test output should be less than 15 seconds.

#### Clear the Caches

Unmount the NFS server to clear out any caches:

umount /mnt/home

### Test Writing and Reading Small Files on the NFS Server

Test small files as you did large files but with these sizes:

- File size: 80 KB

- Block size: 4 KB

- Number of blocks: 20

Before starting the test, verify that the `/mnt/home` directory from the previous test is created.

1.  Mount the NFS server:

    mount -t nfs4 -o proto=tcp,port=2049 <nfs-server>:<path> /mnt/home/

2.  Perform writes (five files of 80 KB each) on the NFS server:

    time for i in {1..30}; do dd if=/dev/zero of=/mnt/home/smallfile$i.test bs=4k count=20; done

    The `real` parameter in the test output should be around 2 seconds.

#### Validate Read Performance

1.  Unmount the NFS server:

    umount <nfs-server>

2.  Remount the NFS server:

    mount -t nfs4 -o proto=tcp,port=2049 <nfs-server>:<path> /mnt/home/

3.  Perform reads from the NFS server:

    time for i in {1..30}; do dd if=/mnt/home/smallfile$i.test of=/dev/null bs=4k; done

    The important parameter in the test output is the `real` parameter, which should be around 2
    seconds.

#### Delete the Test Files

When you finish the performance testing, delete the test files.

1.  Remove all generated files by running:

    rm -f /mnt/home/\*.test

2.  Unmount the NFS server:

    umount /mnt/home

## See Also

- [Troubleshoot NFS](https://docs.mulesoft.com/private-cloud/3.2/troubleshoot-nfs)

- [Environment Prerequisites](https://docs.mulesoft.com/private-cloud/3.2/prereq-platform)

- [Hardware Prerequisites](https://docs.mulesoft.com/private-cloud/3.2/prereq-hardware)

- [Software Prerequisites](https://docs.mulesoft.com/private-cloud/3.2/prereq-software)

- [Network Prerequisites](https://docs.mulesoft.com/private-cloud/3.2/prereq-network)

- [Preinstallation Verification](https://docs.mulesoft.com/private-cloud/3.2/prereq-gravity-check)

<!-- document id=b49348d756d7b09c4e05093ad0e106a5842e0a0443002b2cc20a899acc45cb54 url=/mulesoft/current/en-us/private-cloud/4.0/verify-nfs.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.0
---

# NFS Server Prerequisites

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

> [!IMPORTANT] Before you install Anypoint Platform Private Cloud Edition (Anypoint Platform PCE),
> your infrastructure team must review each of the following sections and verify that your
> environment meets the stated requirements. If needed, contact your MuleSoft representative for
> assistance to ensure your NFS server is configured correctly.

## Verify NFS Server Setup

Anypoint Platform PCE version 2.0 and later requires a Network File System (NFS) server and an
available NFS endpoint. Your NFS server must meet the following requirements:

- Must be running on a filesystem that has at least 250 GB available.

- Must use any of these supported NFS versions: 4.0 or 4.1

- Can be backed by a network-attached storage (NAS) system.

- Must have port 2049 enabled for both TCP and UDP.

- Configure your network so that all of the PCE nodes can access the NFS server. The direct NFS
  client is Kubernetes 1.9 and requires conformance with NFS version 4.

NFS 4.0 and 4.1 do not use the `portmapper` service.

## Verify Required Port Is Open

The NFS server requires port 2049 to be open for TCP and UDP.

On each node, use netcat or a similar utility to verify that the required port is open. Netcat is a
computer networking utility used to read and write to network connections using TCP or UDP.

On each node, run: `nc -zv <host_name> 2049`

> [!NOTE] By default, the netcat tool is not included with Anypoint Platform PCE. If you receive a
> `command not found` error, you can download and install netcat or a similar utility.

When the responses from netcat are successful, you receive a response similar to the following
example:

\[ec2-user@ip-10-1-1-97 ~\]$ nc -zv <nfs\_host\_name> 2049 Ncat: Version 7.50 (
https://nmap.org/ncat ) Ncat: Connected to 10.1.0.155:2049. Ncat: 0 bytes sent, 0 bytes received in
0.01 seconds.

## Verify NFS Server Is Mounted

On each node, mount the NFS server in a temporary directory.

1.  Switch to root:  
    `sudo su`

2.  To mount the NFS in a temporary directory, run the following commands and replace both the
    `<nfs-server>` and the `<nfs-path>` with your own values:  
    `mkdir -p /mnt/home`  
    `mount -t nfs4 -o proto=tcp,port=2049 <nfs-server>:<path> /mnt/home/`  
    If the mount fails, you do not have the required permissions.

## Verify NFS Performance

Perform careful analysis of your environment, both from the client and server point of view for
optimal NFS performance. This involves:

- Testing the performance and latency of your NFS server. Specifically, these operations will
  transfer data from the client (Anypoint Platform PCE environment) to the NFS server and measure
  how long each transfer takes.

- Using the command
  `time dd if=/dev/zero of=/mnt/home/<nameOfFile> bs=<blockSize> count=<amountOfBlocks>` to test NFS
  server performance while transferring files and specifying the following parameters:

  - Names `<nameOfFile>`

  - Block size and number of blocks in the transfer: `<blockSize>` and `<amountOfBlocks>`,
    respectively.

- Validating how Anypoint Platform PCE handles NFS file transfers. Perform read and write operations
  with both large (128MB) and small (80KB) files.

Perform all tests on each node.

### Test Writing and Reading Large Files on the NFS Server

Perform the following read and write tests using large files:

- File size: 128 MB

- Block size: 4 KB

- Number of blocks: 32768

While the tests are running, different files are generated (one file per test).

1.  Create a directory in which to mount the NFS server:

    sudo su mkdir -p /mnt/home

2.  Mount the NFS server:

    mount -t nfs4 -o proto=tcp,port=2049 <nfs-server>:<path> /mnt/home/

3.  Perform writes (five files of 128 MB each) on the NFS server:

    time for i in {1..5}; do dd if=/dev/zero of=/mnt/home/greatfile$i.test bs=4k count=32768; done

    The command output is similar to the following:

    \[root@ip-10-1-1-97 ec2-user\]# time for i in {1..5}; do dd if=/dev/zero
    of=/mnt/home/greatfile$i.test bs=4k count=32768; done 32768+0 records in 32768+0 records out
    134217728 bytes (134 MB) copied, 2.12805 s, 63.1 MB/s . . . real 0m8.378s user 0m0.034s sys
    0m0.792s

    The `real` parameter in the test output should be less than 15 seconds.

#### Validate Read Performance

1.  Unmount the NFS server:

    umount /mnt/home

2.  Remount the NFS server:

    mount -t nfs4 -o proto=tcp,port=2049 <nfs-server>:<path> /mnt/home/

3.  Perform reads from the NFS server by running the following command:

    time for i in {1..5}; do dd if=/mnt/home/greatfile$i.test of=/dev/null bs=4k; done

    The `real` parameter in the test output should be less than 15 seconds.

#### Clear the Caches

Unmount the NFS server to clear out any caches:

umount /mnt/home

### Test Writing and Reading Small Files on the NFS Server

Test small files as you did large files but with these sizes:

- File size: 80 KB

- Block size: 4 KB

- Number of blocks: 20

Before starting the test, verify that the `/mnt/home` directory from the previous test is created.

1.  Mount the NFS server:

    mount -t nfs4 -o proto=tcp,port=2049 <nfs-server>:<path> /mnt/home/

2.  Perform writes (five files of 80 KB each) on the NFS server:

    time for i in {1..30}; do dd if=/dev/zero of=/mnt/home/smallfile$i.test bs=4k count=20; done

    The `real` parameter in the test output should be around 2 seconds.

#### Validate Read Performance

1.  Unmount the NFS server:

    umount <nfs-server>

2.  Remount the NFS server:

    mount -t nfs4 -o proto=tcp,port=2049 <nfs-server>:<path> /mnt/home/

3.  Perform reads from the NFS server:

    time for i in {1..30}; do dd if=/mnt/home/smallfile$i.test of=/dev/null bs=4k; done

    The important parameter in the test output is the `real` parameter, which should be around 2
    seconds.

#### Delete the Test Files

When you finish the performance testing, delete the test files.

1.  Remove all generated files by running:

    rm -f /mnt/home/\*.test

2.  Unmount the NFS server:

    umount /mnt/home

## See Also

- [Troubleshoot NFS](https://docs.mulesoft.com/private-cloud/4.0/troubleshoot-nfs)

- [Environment Prerequisites](https://docs.mulesoft.com/private-cloud/4.0/install-checklist)

- [Hardware Prerequisites](https://docs.mulesoft.com/private-cloud/4.0/install-checklist)

- [Software Prerequisites](https://docs.mulesoft.com/private-cloud/4.0/install-checklist)

- [Network Prerequisites](https://docs.mulesoft.com/private-cloud/4.0/install-checklist)

- [Preinstallation Verification](https://docs.mulesoft.com/private-cloud/4.0/install-workflow)

<!-- document id=854fdb2aac9b338145825986de7d3ca5084f0602ab5c8bcbef0c7298b4f54f8a url=/mulesoft/current/en-us/private-cloud/4.1/verify-nfs.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.1
---

# NFS Server Prerequisites

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

> [!IMPORTANT] Before you install Anypoint Platform Private Cloud Edition (Anypoint Platform PCE),
> your infrastructure team must review each of the following sections and verify that your
> environment meets the stated requirements. If needed, contact your MuleSoft representative for
> assistance to ensure your NFS server is configured correctly.

## Verify NFS Server Setup

Anypoint Platform PCE version 2.0 and later requires a Network File System (NFS) server and an
available NFS endpoint. Your NFS server must meet the following requirements:

- Must be running on a filesystem that has at least 250 GB available.

- Must be using NFS 4.x.

- Can be backed by a network-attached storage (NAS) system.

- Must have port 2049 enabled for both TCP and UDP.

- Configure your network so that all of the PCE nodes can access the NFS server. The direct NFS
  client is Kubernetes 1.9 and requires conformance with NFS version 4.

NFS 4.x does not use the `portmapper` service.

## Verify Required Port Is Open

The NFS server requires port 2049 to be open for TCP and UDP.

On each node, use netcat or a similar utility to verify that the required port is open. Netcat is a
computer networking utility used to read and write to network connections using TCP or UDP.

On each node, run: `nc -zv <host_name> 2049`

> [!NOTE] By default, the netcat tool is not included with Anypoint Platform PCE. If you receive a
> `command not found` error, you can download and install netcat or a similar utility.

When the responses from netcat are successful, you receive a response similar to the following
example:

\[ec2-user@ip-10-1-1-97 ~\]$ nc -zv <nfs\_host\_name> 2049 Ncat: Version 7.50 (
https://nmap.org/ncat ) Ncat: Connected to 10.1.0.155:2049. Ncat: 0 bytes sent, 0 bytes received in
0.01 seconds.

## Verify NFS Server Is Mounted

On each node, mount the NFS server in a temporary directory.

1.  Switch to root:  
    `sudo su`

2.  To mount the NFS in a temporary directory, run the following commands and replace both the
    `<nfs-server>` and the `<nfs-path>` with your own values:  
    `mkdir -p /mnt/home`  
    `mount -t nfs4 -o proto=tcp,port=2049 <nfs-server>:<path> /mnt/home/`  
    If the mount fails, you do not have the required permissions.

## Verify NFS Performance

Perform careful analysis of your environment, both from the client and server point of view for
optimal NFS performance. This involves:

- Testing the performance and latency of your NFS server. Specifically, these operations will
  transfer data from the client (Anypoint Platform PCE environment) to the NFS server and measure
  how long each transfer takes.

- Using the command
  `time dd if=/dev/zero of=/mnt/home/<nameOfFile> bs=<blockSize> count=<amountOfBlocks>` to test NFS
  server performance while transferring files and specifying the following parameters:

  - Names `<nameOfFile>`

  - Block size and number of blocks in the transfer: `<blockSize>` and `<amountOfBlocks>`,
    respectively.

- Validating how Anypoint Platform PCE handles NFS file transfers. Perform read and write operations
  with both large (128MB) and small (80KB) files.

Perform all tests on each node.

### Test Writing and Reading Large Files on the NFS Server

Perform the following read and write tests using large files:

- File size: 128 MB

- Block size: 4 KB

- Number of blocks: 32768

While the tests are running, different files are generated (one file per test).

1.  Create a directory in which to mount the NFS server:

    sudo su mkdir -p /mnt/home

2.  Mount the NFS server:

    mount -t nfs4 -o proto=tcp,port=2049 <nfs-server>:<path> /mnt/home/

3.  Perform writes (five files of 128 MB each) on the NFS server:

    time for i in {1..5}; do dd if=/dev/zero of=/mnt/home/greatfile$i.test bs=4k count=32768; done

    The command output is similar to the following:

    \[root@ip-10-1-1-97 ec2-user\]# time for i in {1..5}; do dd if=/dev/zero
    of=/mnt/home/greatfile$i.test bs=4k count=32768; done 32768+0 records in 32768+0 records out
    134217728 bytes (134 MB) copied, 2.12805 s, 63.1 MB/s . . . real 0m8.378s user 0m0.034s sys
    0m0.792s

    The `real` parameter in the test output should be less than 15 seconds.

#### Validate Read Performance

1.  Unmount the NFS server:

    umount /mnt/home

2.  Remount the NFS server:

    mount -t nfs4 -o proto=tcp,port=2049 <nfs-server>:<path> /mnt/home/

3.  Perform reads from the NFS server by running the following command:

    time for i in {1..5}; do dd if=/mnt/home/greatfile$i.test of=/dev/null bs=4k; done

    The `real` parameter in the test output should be less than 15 seconds.

#### Clear the Caches

Unmount the NFS server to clear out any caches:

umount /mnt/home

### Test Writing and Reading Small Files on the NFS Server

Test small files as you did large files but with these sizes:

- File size: 80 KB

- Block size: 4 KB

- Number of blocks: 20

Before starting the test, verify that the `/mnt/home` directory from the previous test is created.

1.  Mount the NFS server:

    mount -t nfs4 -o proto=tcp,port=2049 <nfs-server>:<path> /mnt/home/

2.  Perform writes (five files of 80 KB each) on the NFS server:

    time for i in {1..30}; do dd if=/dev/zero of=/mnt/home/smallfile$i.test bs=4k count=20; done

    The `real` parameter in the test output should be around 2 seconds.

#### Validate Read Performance

1.  Unmount the NFS server:

    umount <nfs-server>

2.  Remount the NFS server:

    mount -t nfs4 -o proto=tcp,port=2049 <nfs-server>:<path> /mnt/home/

3.  Perform reads from the NFS server:

    time for i in {1..30}; do dd if=/mnt/home/smallfile$i.test of=/dev/null bs=4k; done

    The important parameter in the test output is the `real` parameter, which should be around 2
    seconds.

#### Delete the Test Files

When you finish the performance testing, delete the test files.

1.  Remove all generated files by running:

    rm -f /mnt/home/\*.test

2.  Unmount the NFS server:

    umount /mnt/home

## See Also

- [Troubleshoot NFS](https://docs.mulesoft.com/private-cloud/4.1/troubleshoot-nfs)

- [Environment Prerequisites](https://docs.mulesoft.com/private-cloud/4.1/install-checklist)

- [Hardware Prerequisites](https://docs.mulesoft.com/private-cloud/4.1/install-checklist)

- [Software Prerequisites](https://docs.mulesoft.com/private-cloud/4.1/install-checklist)

- [Network Prerequisites](https://docs.mulesoft.com/private-cloud/4.1/install-checklist)

- [Preinstallation Verification](https://docs.mulesoft.com/private-cloud/4.1/install-workflow)

<!-- document id=bcad41f2ce2420bc0bb497f02212c49a1982426a5591b5e099cdfd6e4525c8f7 url=/mulesoft/current/en-us/private-cloud/4.2/verify-nfs.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.2
---

# NFS Server Prerequisites

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

> [!IMPORTANT] Before you install Anypoint Platform Private Cloud Edition (Anypoint Platform PCE),
> your infrastructure team must review each of the following sections and verify that your
> environment meets the stated requirements. If needed, contact your MuleSoft representative for
> assistance to ensure your NFS server is configured correctly.

## CSI Driver Requirement

Starting with Anypoint Platform PCE 4.2.0, a pre-installed Container Storage Interface (CSI) driver
is a mandatory requirement. Anypoint Platform PCE uses the Kubernetes CSI driver to mount NFS
volumes into pods, replacing the previous method that relied on host binaries.

Some key benefits:

- Enhanced support for environments where custom tools cannot be installed on host nodes.

- Direct support for Amazon EKS users who can only use the Amazon EFS CSI Driver.

### Configure the CSI Driver

In the `platformConfiguration` section of your `input.yaml` file, specify the CSI driver name:

```yaml
platformConfiguration:
  fileSystemCsiDriverName: "" # CSI driver name (e.g., nfs.csi.k8s.io, efs.csi.aws.com)
```

### EFS CSI Driver Configuration

When using the Amazon EFS CSI Driver (for example, for Amazon EKS with EFS installations), provide
four individual CSI volume handles. These volume handles must point to four access points that all
target the same directory in the EFS:

```yaml
platformConfiguration:
  fileSystemCsiDriverName: "efs.csi.aws.com"
  fileSystemWcCsiVolumeHandle: "" # CSI volume handle for wc filesystem
  fileSystem01CsiVolumeHandle: "" # CSI volume handle for 01 filesystem
  fileSystemBareCsiVolumeHandle: "" # CSI volume handle for bare filesystem
  fileSystemBackupRestoreCsiVolumeHandle: "" # CSI volume handle for backup-restore filesystem
```

Each volume handle value follows the format `<file-system-id>::<access-point-id>`, for example:
`fs-0835b0d1eb7588eb1::fsap-03f6c68563ceb5acf`.

> [!NOTE] When using the EFS CSI Driver, you do not need to provide `fileSystemDNS` or
> `fileSystemPath` values.

## Verify NFS Server Setup

Anypoint Platform PCE version 2.0 and later requires a Network File System (NFS) server and an
available NFS endpoint. Your NFS server must meet the following requirements:

- Must be running on a filesystem that has at least 250 GB available.

- Must be using NFS 4.x.

- Can be backed by a network-attached storage (NAS) system.

- Must have port 2049 enabled for both TCP and UDP.

- Configure your network so that all of the PCE nodes can access the NFS server. The direct NFS
  client is Kubernetes 1.9 and requires conformance with NFS version 4.

NFS 4.x does not use the `portmapper` service.

## Verify Required Port Is Open

The NFS server requires port 2049 to be open for TCP and UDP.

On each node, use netcat or a similar utility to verify that the required port is open. Netcat is a
computer networking utility used to read and write to network connections using TCP or UDP.

On each node, run: `nc -zv <host_name> 2049`

> [!NOTE] By default, the netcat tool is not included with Anypoint Platform PCE. If you receive a
> `command not found` error, you can download and install netcat or a similar utility.

When the responses from netcat are successful, you receive a response similar to the following
example:

\[ec2-user@ip-10-1-1-97 ~\]$ nc -zv <nfs\_host\_name> 2049 Ncat: Version 7.50 (
https://nmap.org/ncat ) Ncat: Connected to 10.1.0.155:2049. Ncat: 0 bytes sent, 0 bytes received in
0.01 seconds.

## Verify NFS Server Is Mounted

On each node, mount the NFS server in a temporary directory.

1.  Switch to root:  
    `sudo su`

2.  To mount the NFS in a temporary directory, run the following commands and replace both the
    `<nfs-server>` and the `<nfs-path>` with your own values:  
    `mkdir -p /mnt/home`  
    `mount -t nfs4 -o proto=tcp,port=2049 <nfs-server>:<path> /mnt/home/`  
    If the mount fails, you do not have the required permissions.

## Verify NFS Performance

Perform careful analysis of your environment, both from the client and server point of view for
optimal NFS performance. This involves:

- Testing the performance and latency of your NFS server. Specifically, these operations will
  transfer data from the client (Anypoint Platform PCE environment) to the NFS server and measure
  how long each transfer takes.

- Using the command
  `time dd if=/dev/zero of=/mnt/home/<nameOfFile> bs=<blockSize> count=<amountOfBlocks>` to test NFS
  server performance while transferring files and specifying the following parameters:

  - Names `<nameOfFile>`

  - Block size and number of blocks in the transfer: `<blockSize>` and `<amountOfBlocks>`,
    respectively.

- Validating how Anypoint Platform PCE handles NFS file transfers. Perform read and write operations
  with both large (128MB) and small (80KB) files.

Perform all tests on each node.

### Test Writing and Reading Large Files on the NFS Server

Perform the following read and write tests using large files:

- File size: 128 MB

- Block size: 4 KB

- Number of blocks: 32768

While the tests are running, different files are generated (one file per test).

1.  Create a directory in which to mount the NFS server:

    sudo su mkdir -p /mnt/home

2.  Mount the NFS server:

    mount -t nfs4 -o proto=tcp,port=2049 <nfs-server>:<path> /mnt/home/

3.  Perform writes (five files of 128 MB each) on the NFS server:

    time for i in {1..5}; do dd if=/dev/zero of=/mnt/home/greatfile$i.test bs=4k count=32768; done

    The command output is similar to the following:

    \[root@ip-10-1-1-97 ec2-user\]# time for i in {1..5}; do dd if=/dev/zero
    of=/mnt/home/greatfile$i.test bs=4k count=32768; done 32768+0 records in 32768+0 records out
    134217728 bytes (134 MB) copied, 2.12805 s, 63.1 MB/s . . . real 0m8.378s user 0m0.034s sys
    0m0.792s

    The `real` parameter in the test output should be less than 15 seconds.

#### Validate Read Performance

1.  Unmount the NFS server:

    umount /mnt/home

2.  Remount the NFS server:

    mount -t nfs4 -o proto=tcp,port=2049 <nfs-server>:<path> /mnt/home/

3.  Perform reads from the NFS server by running the following command:

    time for i in {1..5}; do dd if=/mnt/home/greatfile$i.test of=/dev/null bs=4k; done

    The `real` parameter in the test output should be less than 15 seconds.

#### Clear the Caches

Unmount the NFS server to clear out any caches:

umount /mnt/home

### Test Writing and Reading Small Files on the NFS Server

Test small files as you did large files but with these sizes:

- File size: 80 KB

- Block size: 4 KB

- Number of blocks: 20

Before starting the test, verify that the `/mnt/home` directory from the previous test is created.

1.  Mount the NFS server:

    mount -t nfs4 -o proto=tcp,port=2049 <nfs-server>:<path> /mnt/home/

2.  Perform writes (five files of 80 KB each) on the NFS server:

    time for i in {1..30}; do dd if=/dev/zero of=/mnt/home/smallfile$i.test bs=4k count=20; done

    The `real` parameter in the test output should be around 2 seconds.

#### Validate Read Performance

1.  Unmount the NFS server:

    umount <nfs-server>

2.  Remount the NFS server:

    mount -t nfs4 -o proto=tcp,port=2049 <nfs-server>:<path> /mnt/home/

3.  Perform reads from the NFS server:

    time for i in {1..30}; do dd if=/mnt/home/smallfile$i.test of=/dev/null bs=4k; done

    The important parameter in the test output is the `real` parameter, which should be around 2
    seconds.

#### Delete the Test Files

When you finish the performance testing, delete the test files.

1.  Remove all generated files by running:

    rm -f /mnt/home/\*.test

2.  Unmount the NFS server:

    umount /mnt/home

## Override NFS Mount Options

By default, Anypoint Platform PCE 4.2.0 sets the `noresvport` NFS mount option, which is strongly
recommended for AWS and other cloud environments. If this default conflicts with your environment
requirements, you can override the NFS mount options by providing a comma-separated string in the
`platformConfiguration` section of your `input.yaml` file:

```yaml
platformConfiguration:
  fileSystemBareMountOptionsOverride: ""
  fileSystemWcMountOptionsOverride: ""
  fileSystem01MountOptionsOverride: ""
```

For example, to remove the `noresvport` option, provide a string with your custom mount options:

nfsvers=4.0,retrans=2,rsize=1048576,soft,sync,timeo=600,wsize=1048576

> [!NOTE] These fields are optional. If not specified, the default mount options are used.

## See Also

- [Troubleshoot NFS](https://docs.mulesoft.com/private-cloud/4.2/troubleshoot-nfs)

- [Anypoint Platform PCE Prerequisites](https://docs.mulesoft.com/private-cloud/4.2/install-checklist)

- [Installing Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/4.2/install-workflow)

<!-- document id=0013a37c3d7df85da7d7703c8f86f876cfc70709b7e1d486e7737c4b45f6ed83 url=/mulesoft/current/en-us/private-cloud/3.2/managing-via-the-ops-center.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 3.2
---

# Ops Center

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

The Ops Center is a web-based management tool that enables you to manage and monitor Anypoint
Platform Private Cloud Edition (Anypoint Platform PCE) and perform the following types of tasks:

- Add and remove servers

- View logs and configure log forwarding

- Monitor system stability and performance

## Access the Ops Center

1.  Go to the following URL:

    https://{platform-host}:9500

2.  Enter the admin user email address and password that you created during installation.

## Add Additional Servers

Adding servers enables you to scale up your cluster, even after the installation is complete.

1.  Log in to Ops Center.

2.  Select Servers and then select Add Existing.

3.  Select the type of node you want to add.

    The nodes available depend on the number of nodes in your installation.

4.  Select Continue.

    Ops Center displays a command similar to the following:

    curl -s --tlsv1.2 --insecure "https://172.31.48.9:3009/t/8402020736a8a04dda29bc81dfcd5211/node"
    | sudo bash

5.  Run the command that is displayed on the machine where you are installing the new server.

    - You must run this command from an account that has root access.

    - You can only perform this installation on one server at a time.

      After performing this command, the server is displayed in a list in Ops Center.

6.  If necessary, specify the IP address and devices.

7.  Select the server and then select Start Installation to begin installation of the new server.

## Remove a Server

You can remove individual servers from the cluster where the platform is installed.

> [!WARNING] Deleting a server also removes any applications that are deployed on the server.

1.  Log in to Ops Center.

2.  Select Servers.

3.  Select the IP address of the server you want to delete and then select Delete.

4.  Confirm that you want to delete the server.

## Configure Log Forwarding

Anypoint Platform PCE enables you to forward server-level log data. Log forwarding is designed to
forward your logs to a local third-party log solution. Forwarding log data to a cloud-based service
like Splunk Cloud is not supported.

> [!NOTE] This information is specific to forwarding log data from Anypoint Platform itself. For
> instructions on how to forward log data from the Mule servers and applications that run on
> Anypoint Platform, see
> [Sending Data from Runtime Manager to External Analytics Software](https://docs.mulesoft.com/runtime-manager/sending-data-from-arm-to-external-analytics-software).

Anypoint Platform uses `rsyslog` to handle logging. To forward logs to remote hosts, perform the
following steps:

1.  Log in to Ops Center.

2.  In the upper right-hand corner, select the admin user name.

    ![ops center settings](/mulesoft/current/en-us/private-cloud/3.2/_images/ops-center-settings.png)

3.  Select **Settings** and then select Logs.

4.  Select **Create** or **New Connector** if you already have a log forwarder configured.

5.  Configure your log forwarding as shown in the following example:

kind: logforwarder version: v2 metadata: name: forwarder1 spec: address: 192.168.100.1:514 protocol:
udp

## Monitor Stability and Performance

Ops Center enables you to view data about the stability and performance of the platform.

Metrics dashboards are available for the following application components:

- Anypoint Services

- Cluster

- Object Store

- Pods

- PostgreSQL

- Redis

High-resolution metrics are stored for a default period of 30 days. Other metrics are retained from
a period of 6 months up to 5 years.

### View Metrics

1.  Log in to Ops Center.

2.  Select the Monitoring tab.

    By default, Ops Center displays the Cluster dashboard.

When viewing dashboards, navigate by selecting from a series of drop-down menus. The options that
are available depend on the selected dashboard. For example, in the **Pods** dashboard, you can
select a `namespace` and a `podname`.

### Change the Time Scale Displayed in the Charts

To change the time scale displayed in the charts:

1.  Select the currently selected time scale.

2.  Select an option or provide start and end dates.

### Anypoint Services Dashboard

The **Anypoint Services** dashboard displays metrics for the different platform sub-components,
including Anypoint Exchange, API notebooks, or the Home page. You can filter data by a specific
microservice.

This dashboard displays the following metrics:

- Processor

- Memory

- Network

- Filesystem

Each of these metrics is displayed by service.

### Cluster Information Dashboard

The **Cluster Information** dashboard displays the following metrics for the various nodes that make
up your platform cluster. You can filter data by `nodename`.

- Overall CPU Usage

- CPU Usage by Node

- Individual CPU Usage

- Memory Usage by Node

- Individual Memory Usage

- Overall Cluster Network Usage

- Network Usage by Node

- Individual Node Network Usage

- Overall Cluster Filesystem Usage

- Filesystem Usage by Node

- Individual Node Filesystem Usage

These metrics have different scopes, depending on the context:

- Overall metrics show an aggregate number for the entire set of nodes.

- Metrics that are _by node_ display each node as a separate curve on the same chart.

- Individual node metrics are only displayed for the node that you selected in the **nodename**
  drop-down at the top of the section.

### Object Store Dashboard

The **Object Store** dashboard displays data about the different nodes that make up the object
store. It includes the following metrics:

- Node Status

- Read/Write Requests (in requests per second)

- Read/Write Latency

- Active Connections

- Unavailable Exceptions

- Disk Space Used

Metrics that deal with Read/Write values display read and write values as separate curves.

### Pod Dashboard

The **Pod** dashboard displays data for the individual Docker containers running different platform
services. You can filter data by `namespace` or `podname`.

The following metrics are displayed:

- Individual CPU Usage

- Individual Memory Usage

- Individual Network Usage

- File system Usage

These metrics are displayed for the selected `namespace` and `podname`.

### PostgreSQL Dashboard

The **PostgreSQL** dashboard displays data for the PostgreSQL server included in the platform. The
following metrics are displayed:

- Activity per type

- Cache Hit Ratio

- Active Connections

- Buffers

- Conflicts/Deadlocks

- PostgreSQL Containers CPU Usage per Pod

`Activity per type` displays different curves for rows fetched, returned, inserted, updated, and
deleted, at the level of time granularity that you choose.

## Download Data

To download the data displayed in this section as a JSON:

1.  Select the gear icon at the top of the Ops Center.

2.  Select **Export**.

![managing via the ops center f3b1c](/mulesoft/current/en-us/private-cloud/3.2/_images/managing-via-the-ops-center-f3b1c.png)

Alternatively, you can select **Save as…​** to download this file with a custom name. You can also
select the **View JSON** option to view this data without downloading it.

## Reset Your Password

To change the password required to log into the Ops Center:

1.  Enter the gravity utility:

    This utility is added during the platform installation.

    sudo gravity enter

2.  Reset the password using the following command:

    gravity site --insecure reset-password

    This command returns the administrator email and password, for example:

    password for admin@example.com has been reset to: xxxxxxxxx

## See Also

- [Add a Product License Using Ops Center](https://docs.mulesoft.com/private-cloud/3.2/ops-center-update-lic)

- [Set up Alerts for CPU and Memory Usage](https://docs.mulesoft.com/private-cloud/3.2/config-alerts)

<!-- document id=bf86276c6a9e290df86cf7736b3317a923ac3dc7880fc1dd6218bb278376a368 url=/mulesoft/current/en-us/private-cloud/3.2/prereq-gravity-check.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 3.2
---

# Preinstallation Verification

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

> [!IMPORTANT] Before installing or upgrading, your infrastructure team must review all prerequisite
> information in the following list and verify that your environment meets the stated requirements.
> If needed, contact your MuleSoft representative for assistance.

- [Environment Prerequisites](https://docs.mulesoft.com/private-cloud/3.2/prereq-platform)

- [Hardware Prerequisites](https://docs.mulesoft.com/private-cloud/3.2/prereq-hardware)

- [Software Prerequisites](https://docs.mulesoft.com/private-cloud/3.2/prereq-software)

- [Network Prerequisites](https://docs.mulesoft.com/private-cloud/3.2/prereq-network)

- [NFS Server Prerequisites](https://docs.mulesoft.com/private-cloud/3.2/verify-nfs)

## Verify Anypoint Platform Private Cloud Edition Nodes

Before you install Anypoint Platform Private Cloud Edition (Anypoint Platform PCE) on all nodes, run
the `gravity check` script to verify that each node meets the minimum requirements for Anypoint
Platform PCE, including CPU, RAM, and volume storage.

1.  Copy the following information from the node where you will run the installer to each node of
    your cluster:

    - The `gravity` binary.

    - The `app.yaml` manifest used by the `gravity` binary.

      These files are located in the folder of the installer.

2.  Run the following command from each node of your cluster:

    sudo ./gravity check --profile=app\_node app.yaml

    Valid values for `--profile` are:

    - app\_node

    - data\_node

    - general\_node (for 3 node installations)

If the command returns no output, your environment is set up correctly. If any node fails to satisfy
the minimum requirements, the command returns a list of failed checks and exits with a non-0 return
code.

<!-- document id=1ebb36be50046d06d1683090363bec384d3baeab1c7f1f5d8e435d5d28a4d8d9 url=/mulesoft/current/en-us/private-cloud/latest/verify-nfs.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.3
is-latest-version: true
---

# Shared Filesystem Prerequisites

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

> [!IMPORTANT] Before you install Anypoint Platform Private Cloud Edition (Anypoint Platform PCE),
> your infrastructure team must review each of the following sections and verify that your
> environment meets the stated requirements. If needed, contact your MuleSoft representative for
> assistance to ensure your shared filesystem is configured correctly.

Anypoint Platform PCE requires a `ReadWriteMany` (RWX) shared filesystem for the platform. Starting
with Anypoint Platform PCE 4.3.0, you can provide this filesystem using either of the following
storage modes:

- **NFS mode** — Bind the platform to an existing NFS server through a pre-installed CSI driver. Use
  this mode when your organization already operates an NFS server (for example, AWS EFS, NetApp,
  Isilon, or a self-managed NFS server) that you want the platform to consume.

- **StorageClass mode** — Provide a single RWX-capable Kubernetes `StorageClass` and let Anypoint
  Platform PCE dynamically provision the shared volumes. Use this mode when your cluster has an
  RWX-capable CSI driver such as CephFS available and you prefer not to operate an external NFS
  server.

You choose the mode at installation time by setting the corresponding fields in the
`platformConfiguration` section of your `input.yaml` file. The two modes are mutually exclusive.

> [!IMPORTANT] The installer rejects changes to the storage mode on an existing cluster. Switching
> between NFS and StorageClass mode after installation orphans the data stored on the previous
> volumes. Choose the mode carefully before installing.

## CSI Driver Requirement (NFS Mode)

When using NFS mode, a pre-installed Container Storage Interface (CSI) driver is a mandatory
requirement. Anypoint Platform PCE uses the Kubernetes CSI driver to mount NFS volumes into pods,
replacing the previous method that relied on host binaries.

Some key benefits:

- Enhanced support for environments where custom tools cannot be installed on host nodes.

- Direct support for Amazon EKS users who can only use the Amazon EFS CSI Driver.

> [!NOTE] The CSI driver requirement applies only to NFS mode. In StorageClass mode, the RWX-capable
> `StorageClass` handles provisioning through its own CSI driver.

### Configure the CSI Driver

In the `platformConfiguration` section of your `input.yaml` file, specify the CSI driver name:

```yaml
platformConfiguration:
  fileSystemCsiDriverName: "" # CSI driver name (e.g., nfs.csi.k8s.io, efs.csi.aws.com)
```

### EFS CSI Driver Configuration

When using the Amazon EFS CSI Driver (for example, for Amazon EKS with EFS installations), provide
four individual CSI volume handles. These volume handles must point to four access points that all
target the same directory in the EFS:

```yaml
platformConfiguration:
  fileSystemCsiDriverName: "efs.csi.aws.com"
  fileSystemWcCsiVolumeHandle: "" # CSI volume handle for wc filesystem
  fileSystem01CsiVolumeHandle: "" # CSI volume handle for 01 filesystem
  fileSystemBareCsiVolumeHandle: "" # CSI volume handle for bare filesystem
  fileSystemBackupRestoreCsiVolumeHandle: "" # CSI volume handle for backup-restore filesystem
```

Each volume handle value follows the format `<file-system-id>::<access-point-id>`, for example:
`fs-0835b0d1eb7588eb1::fsap-03f6c68563ceb5acf`.

> [!NOTE] When using the EFS CSI Driver, you do not need to provide `fileSystemDNS` or
> `fileSystemPath` values.

## StorageClass Mode

Starting with Anypoint Platform PCE 4.3.0, you can host the platform shared filesystem on any
Kubernetes `StorageClass` that supports `ReadWriteMany` access mode, without operating an external
NFS server. The `StorageClass` must be backed by an RWX-compliant CSI driver, for example CephFS
(`ocs-storagecluster-cephfs`) on OpenShift Data Foundation.

When you set `fileSystemStorageClass` in `platformConfiguration`, the installer provisions the
platform’s shared volumes and the backup-restore volume as dynamically created
`PersistentVolumeClaim` resources against the specified `StorageClass`. In this mode, the following
NFS-mode fields are not used:

- `fileSystemCsiDriverName`

- `fileSystemDNS`, `fileSystemPath`

- `fileSystemWcCsiVolumeHandle`, `fileSystem01CsiVolumeHandle`, `fileSystemBareCsiVolumeHandle`,
  `fileSystemBackupRestoreCsiVolumeHandle`

### Configure StorageClass Mode

In the `platformConfiguration` section of your `input.yaml` file, specify the RWX-capable
`StorageClass`:

```yaml
platformConfiguration:
  fileSystemStorageClass: "" # e.g. ocs-storagecluster-cephfs
```

### StorageClass Requirements

The `StorageClass` you provide must:

- Support the `ReadWriteMany` (RWX) access mode.

- Be backed by an RWX-compliant CSI driver (for example, CephFS).

- Be available and default-usable in the cluster where you install Anypoint Platform PCE.

> [!IMPORTANT] For backup retention, use a `StorageClass` with `reclaimPolicy: Retain` for the
> backup-restore volume. With `reclaimPolicy: Delete`, deleting the `PersistentVolumeClaim` also
> destroys the underlying storage and any historical backup tarballs stored on it.

## Verify NFS Server Setup

The following sections apply only when installing in NFS mode. If you are using StorageClass mode,
skip to [Installing Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/latest/install-workflow).

Anypoint Platform PCE version 2.0 and later requires a Network File System (NFS) server and an
available NFS endpoint. Your NFS server must meet the following requirements:

- Must be running on a filesystem that has at least 250 GB available.

- Must be using NFS 4.x.

- Can be backed by a network-attached storage (NAS) system.

- Must have port 2049 enabled for TCP.

- Configure your network so that all of the PCE nodes can access the NFS server. The direct NFS
  client is Kubernetes 1.9 and requires conformance with NFS version 4.

NFS 4.x does not use the `portmapper` service.

## Verify Required Port Is Open

The NFS server requires port 2049 to be open for TCP.

On each node, use netcat or a similar utility to verify that the required port is open. Netcat is a
computer networking utility used to read and write to network connections using TCP.

On each node, run: `nc -zv <host_name> 2049`

> [!NOTE] By default, the netcat tool is not included with Anypoint Platform PCE. If you receive a
> `command not found` error, you can download and install netcat or a similar utility.

When the responses from netcat are successful, you receive a response similar to the following
example:

\[ec2-user@ip-10-1-1-97 ~\]$ nc -zv <nfs\_host\_name> 2049 Ncat: Version 7.50 (
https://nmap.org/ncat ) Ncat: Connected to 10.1.0.155:2049. Ncat: 0 bytes sent, 0 bytes received in
0.01 seconds.

## Verify NFS Server Is Mounted

On each node, mount the NFS server in a temporary directory.

1.  Switch to root:  
    `sudo su`

2.  To mount the NFS in a temporary directory, run the following commands and replace both the
    `<nfs-server>` and the `<nfs-path>` with your own values:  
    `mkdir -p /mnt/home`  
    `mount -t nfs4 -o proto=tcp,port=2049 <nfs-server>:<path> /mnt/home/`  
    If the mount fails, you do not have the required permissions.

## Verify NFS Performance

Perform careful analysis of your environment, both from the client and server point of view for
optimal NFS performance. This involves:

- Testing the performance and latency of your NFS server. Specifically, these operations will
  transfer data from the client (Anypoint Platform PCE environment) to the NFS server and measure
  how long each transfer takes.

- Using the command
  `time dd if=/dev/zero of=/mnt/home/<nameOfFile> bs=<blockSize> count=<amountOfBlocks>` to test NFS
  server performance while transferring files and specifying the following parameters:

  - Names `<nameOfFile>`

  - Block size and number of blocks in the transfer: `<blockSize>` and `<amountOfBlocks>`,
    respectively.

- Validating how Anypoint Platform PCE handles NFS file transfers. Perform read and write operations
  with both large (128MB) and small (80KB) files.

Perform all tests on each node.

### Test Writing and Reading Large Files on the NFS Server

Perform the following read and write tests using large files:

- File size: 128 MB

- Block size: 4 KB

- Number of blocks: 32768

While the tests are running, different files are generated (one file per test).

1.  Create a directory in which to mount the NFS server:

    sudo su mkdir -p /mnt/home

2.  Mount the NFS server:

    mount -t nfs4 -o proto=tcp,port=2049 <nfs-server>:<path> /mnt/home/

3.  Perform writes (five files of 128 MB each) on the NFS server:

    time for i in {1..5}; do dd if=/dev/zero of=/mnt/home/greatfile$i.test bs=4k count=32768; done

    The command output is similar to the following:

    \[root@ip-10-1-1-97 ec2-user\]# time for i in {1..5}; do dd if=/dev/zero
    of=/mnt/home/greatfile$i.test bs=4k count=32768; done 32768+0 records in 32768+0 records out
    134217728 bytes (134 MB) copied, 2.12805 s, 63.1 MB/s . . . real 0m8.378s user 0m0.034s sys
    0m0.792s

    The `real` parameter in the test output should be less than 15 seconds.

#### Validate Read Performance

1.  Unmount the NFS server:

    umount /mnt/home

2.  Remount the NFS server:

    mount -t nfs4 -o proto=tcp,port=2049 <nfs-server>:<path> /mnt/home/

3.  Perform reads from the NFS server by running the following command:

    time for i in {1..5}; do dd if=/mnt/home/greatfile$i.test of=/dev/null bs=4k; done

    The `real` parameter in the test output should be less than 15 seconds.

#### Clear the Caches

Unmount the NFS server to clear out any caches:

umount /mnt/home

### Test Writing and Reading Small Files on the NFS Server

Test small files as you did large files but with these sizes:

- File size: 80 KB

- Block size: 4 KB

- Number of blocks: 20

Before starting the test, verify that the `/mnt/home` directory from the previous test is created.

1.  Mount the NFS server:

    mount -t nfs4 -o proto=tcp,port=2049 <nfs-server>:<path> /mnt/home/

2.  Perform writes (five files of 80 KB each) on the NFS server:

    time for i in {1..30}; do dd if=/dev/zero of=/mnt/home/smallfile$i.test bs=4k count=20; done

    The `real` parameter in the test output should be around 2 seconds.

#### Validate Read Performance

1.  Unmount the NFS server:

    umount <nfs-server>

2.  Remount the NFS server:

    mount -t nfs4 -o proto=tcp,port=2049 <nfs-server>:<path> /mnt/home/

3.  Perform reads from the NFS server:

    time for i in {1..30}; do dd if=/mnt/home/smallfile$i.test of=/dev/null bs=4k; done

    The important parameter in the test output is the `real` parameter, which should be around 2
    seconds.

#### Delete the Test Files

When you finish the performance testing, delete the test files.

1.  Remove all generated files by running:

    rm -f /mnt/home/\*.test

2.  Unmount the NFS server:

    umount /mnt/home

## Override NFS Mount Options

In NFS mode, Anypoint Platform PCE sets the `noresvport` NFS mount option by default, which is
strongly recommended for AWS and other cloud environments. If this default conflicts with your
environment requirements, you can override the NFS mount options by providing a comma-separated
string in the `platformConfiguration` section of your `input.yaml` file:

```yaml
platformConfiguration:
  fileSystemBareMountOptionsOverride: ""
  fileSystemWcMountOptionsOverride: ""
  fileSystem01MountOptionsOverride: ""
```

For example, to remove the `noresvport` option, provide a string with your custom mount options:

nfsvers=4.0,retrans=2,rsize=1048576,soft,sync,timeo=600,wsize=1048576

> [!NOTE] These fields are optional. If not specified, the default mount options are used.

## See Also

- [Troubleshoot NFS](https://docs.mulesoft.com/private-cloud/latest/troubleshoot-nfs)

- [Anypoint Platform PCE Prerequisites](https://docs.mulesoft.com/private-cloud/latest/install-checklist)

- [Installing Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/latest/install-workflow)

<!-- document id=e74a6938c8e75dc6f0d22bc7298faa3fbd0fd9c56db2c8a50309a77b7028d658 url=/mulesoft/current/en-us/private-cloud/3.2/prereq-software.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 3.2
---

# Software Prerequisites

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

To ensure the performance and stability of Anypoint Platform Private Cloud Edition (Anypoint
Platform PCE), every node in your Anypoint Platform PCE environment must meet the software
prerequisites described in this topic:

- Operating system (OS) prerequisites

- Third-party software prerequisites

- MuleSoft software prerequisites

> [!IMPORTANT] Before you install Anypoint Platform PCE, your infrastructure team must review each
> of the following sections and verify that your environment meets the stated software requirements.
> If needed, contact your MuleSoft representative for assistance.

## Operating System Prerequisites

### Verify Linux Distribution

The following Linux distributions are supported:

- Red Hat Enterprise Linux (RHEL) 7.8, 7.9, 8.1, 8.2, 8.3., 8.4, 8.5, 8.6, 8.7, 8.8, 9.2, 9.3, and
  9.5.

- CentOS 7.8 and 7.9

> [!NOTE] Anypoint Platform PCE no longer supports CentOS 8, as it has reached
> [end-of-life](https://www.centos.org/centos-linux-eol/).

### Check for SELinux Custom Profiles

Although SELinux is not required, Anypoint Platform PCE supports the default SELinux profile running
in strict mode. If your environment uses a custom profile, it must provide an unconstrained user
context when running the installer. Review any custom profiles with your MuleSoft representative.

### Enable and Load Kernel Modules

You must enable the following kernel modules on each node:

- `br_netfilter`

- `ebtable_filter`

- `ip_tables`

- `iptable_filter`

- `iptable_nat`

- `overlay`

For each kernel module, run a command similar to the following example to verify that each module is
loaded. Replace `br_netfilter` with the name of the kernel module you are checking:

root$ lsmod | grep br\_netfilter

- If this command does not display any output, then the module is not loaded. In this case, load the
  module using `modprobe`:

  root$ modprobe br\_netfilter

Ensure a module is loaded after a reboot by using the following command:

root$ echo 'br\_netfilter' > /etc/modules-load.d/br\_netfilter.conf

### Verify Kernel Settings

The following flags must be enabled:

- `net.bridge.bridge-nf-call-iptables=1`

- `net.ipv4.ip_forward=1`

- `fs.may_detach_mounts=1`

- `fs.inotify.max_queued_events=16384`

- `fs.inotify.max_user_instances=8192`

- `fs.inotify.max_user_watches=1048576`

The kubelet requires the following settings, which do not update the Kernel settings automatically:

- `vm.overcommit_memory=1`

- `kernel.panic=10`

- `kernel.panic_on_oops=1`

Ensure that no processes on your system overrides any of these flags. To set a parameter, use
`sysctl -w`, as shown in the following example:

root$ sysctl -w net.ipv4.ip\_forward=1

To make the changes permanent for the next reboot, write the changes to a file under
`/etc/sysctl.d`. Replace the setting in the following example with the setting you are configuring.

echo net.ipv4.ip\_forward=1 >> /etc/sysctl.d/10-ipv4-forwarding.conf

Permanently configure settings required by the kubelet:

cat > /etc/sysctl.d/90-kubelet.conf << EOF vm.overcommit\_memory=1 kernel.panic=10
kernel.panic\_on\_oops=1 EOF

Ensure that no processes or files conflict with those settings.

## Third Party Software Prerequisites

### Requirements When Firewalld Is Enabled

Firewalld is an iptables controller that defines rules for persistent network traffic. If you are
using firewalld with a Red Hat Enterprise Linux (RHEL) 7.3 operating system, you must enable
forwarding on the `docker0` device. You must also forward any packets being sent from or to the
10.0.0.0/8 subnet.

#### Determine If You Are Using Firewalld

To determine if your system is using firewalld, run the following command on every node:

systemctl status firewalld.service

If firewalld is installed, the following output is displayed:

$ sudo systemctl status firewalld.service \* firewalld.service - firewalld - dynamic firewall daemon
Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor preset: enabled) Active:
inactive (dead) Docs: man:firewalld(1)

If firewalld is not installed, an error message is displayed.

#### Enable Forwarding on Docker Device

To enable forwarding on the docker0 device, run the following commands:

firewall-cmd --permanent --direct --add-rule ipv4 filter FORWARD 1 -o docker0 -j ACCEPT -m comment
--comment "docker subnet"

firewall-cmd --permanent --direct --add-rule ipv4 filter FORWARD 1 -s 10.0.0.0/8 -j ACCEPT -m
comment --comment "docker subnet"

To enable forwarding on the 10.0.0.0/8 subnet, run the following commands:

firewall-cmd --permanent --direct --add-rule ipv4 filter INPUT 1 -s 10.0.0.0/8 -j ACCEPT -m comment
--comment "docker subnet"

firewall-cmd --permanent --direct --add-rule ipv4 filter INPUT 1 -d 10.0.0.0/8 -j ACCEPT -m comment
--comment "docker subnet"

### Remove Local DNS Servers

Remove local caching DNS servers listening on port 53, for example, `named`, `dnsmasq`, and `bind`.

### Install Required Tools

- Tool to Verify NFS Server Ports are Open

  Netcat is recommended, but you can use your tool of choice to verify the correct ports are open on
  the NFS server. If you do not have `netcat`, you can install it from
  [https://netcat.sourceforge.net/download.php](https://netcat.sourceforge.net/download.php) or
  follow the instructions at
  [https://linoxide.com/linux-how-to/install-use-netcat-command-linux/](https://linoxide.com/linux-how-to/install-use-netcat-command-linux/).

### Remove Server Configuration Management Software

Any Server Configuration Management software, such as Puppet, Chef, Ansible, and SaltStack, must be
removed. This software usually changes kernel modules and settings that are required, and can also
restart servers without following the correct shut down procedure, causing the system to enter a
failed state.

## MuleSoft Software Prerequisites

### Obtain Install Archive and License Key

Obtain the installer archive (`anypoint-3.2.x-installer.tar.gz`) and license key from your MuleSoft
account representative.

### Verify IP Forwarding and Bridging

To ensure proper cluster load balancing and routing, you must enable, correctly configure, and
verify the following items:

- Kernel IP forwarding

  To enable internal Kubernetes load balancing, you must enable IPv4 forwarding on all servers.

- Bridge-netfilter

  Enable the Linux kernel to translate packets to and from hosted containers.

  - IP addresses for bridge-netfiltering are managed by the overlay network created by Kubernetes.
    Verify that the CIDR block used for that network is in the private IP address range.

## Verify SSL Certificate Requirements

To use the Anypoint Platform PCE, you must provide SSL certificates. You can upload a certificate
through the Anypoint Platform PCE UI. This certificate must be trusted by every machine that is
connected to the platform.

> [!WARNING] You must register the same SSL certificate on every node containing Mule runtime
> engines managed by your installation.

### Uninstall Unsupported Software

Some software causes conflicts with Anypoint Platform PCE. You must uninstall this software before
performing Anypoint Platform PCE installation.

#### Docker

Uninstall Docker from all servers running the Anypoint Platform PCE. The Anypoint Platform PCE
installation includes a Docker package officially supported by Kubernetes.

## See Also

- [Environment Prerequisites](https://docs.mulesoft.com/private-cloud/3.2/prereq-platform)

- [Hardware Prerequisites](https://docs.mulesoft.com/private-cloud/3.2/prereq-hardware)

- [Network Prerequisites](https://docs.mulesoft.com/private-cloud/3.2/prereq-network)

- [NFS Server Prerequisites](https://docs.mulesoft.com/private-cloud/3.2/verify-nfs)

- [Preinstallation Verification](https://docs.mulesoft.com/private-cloud/3.2/prereq-gravity-check)

<!-- document id=99ed224282b6bb07954651d11dc424db01e20230a4e81d294b49c1adc0a362e4 url=/mulesoft/current/en-us/private-cloud/3.2/supported-cluster-config.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 3.2
---

# Supported Configurations for Anypoint Platform PCE

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

To ensure platform performance, stability, and high availability, Anypoint Platform Private Cloud
Edition (Anypoint Platform PCE) supports two network configurations: 4-node and 7-node. To ensure
high availability and performance, each node must run on its own server in both configurations. If
you are using a virtual machine to host the nodes, you must ensure that each VM node is running on a
separate physical server.

Both the 4-node and 7-node configurations have two separate components:

- Anypoint Platform Core

- Monitoring Center Add-On (optional)

## 4-Node Configuration

The 4-node configuration is the smallest configuration that Anypoint Platform PCE supports. This is
the minimum number of nodes that can enable high-availability and failover. In this configuration,
each node hosts the platform applications and services. You must configure a load balancer to use
round-robin distribution of traffic among each of the four nodes.

![4-node Configuration](/mulesoft/current/en-us/private-cloud/3.2/_images/configuration-4-node.png)

Three of the nodes host an instance of the database and object store. Hosting the database and
object store enables persistence but requires larger minimum disk and memory requirements. Although
three of the nodes contain a database, only one database is used as the primary. Applications on
each node write to this database only. The other two database instances are hot standby instances of
the primary database that take over as the primary database in case of failure.

## 7-Node Configuration

In the 7-node configuration, four nodes are dedicated to hosting platform applications and services.
The other three nodes host the database and object store instances. Although each node contains a
database, only one of the database nodes is used as the primary. Applications on each node write to
this database only. The other two database instances are hot standby instances of the primary
database that take over as the primary database in case of failure.

![7-node Configuration](/mulesoft/current/en-us/private-cloud/3.2/_images/configuration-7-node.png)

You must configure a load balancer to use round-robin distribution of traffic among all of the nodes
in your cluster.

## Supported Platform Components and Configuration

> [!WARNING] The following recommendations and limits are based on the following resources:
>
> - A 4-node environment consisting of 4 nodes of 8 cores and 32GB RAM, or
>
> - A 7-node environment consisting of 7 nodes of 8 cores and 32GB RAM.

### Mule Runtime Engine and Mule Applications

The following table shows the recommended and maximum number of Mule instances and Mule applications
that Anypoint Platform PCE supports:

<table><colgroup><col> <col> <col></colgroup><thead><tr><th></th><th>4-node Configuration</th><th>7-node Configuration</th></tr></thead><tbody><tr><td><p>Maximum number of Mule instances per environment</p></td><td><p>500</p></td><td><p>500</p></td></tr><tr><td><p>Maximum number of Mule instances across all environments</p></td><td><p>1500</p></td><td><p>3000</p></td></tr><tr><td><p>Maximum number of Mule instances per server group</p></td><td><p>20</p></td><td><p>20</p></td></tr><tr><td><p>Maximum Mule instances per cluster</p></td><td><p>8</p></td><td><p>8</p></td></tr><tr><td><p>Mule applications under management per environment (recommended)</p></td><td><p>Under 200</p></td><td><p>Around 200</p></td></tr><tr><td><p>Mule applications under management per environment (maximum)</p></td><td><p>500</p></td><td><p>500</p></td></tr><tr><td><p>Mule instances under management (maximum)</p></td><td><p>500 single Mule runtime engine, or 250 Mule runtime clusters, consisting of 2 Mule runtime engines per cluster</p></td><td><p>1000 single Mule runtime engines, or 500 Mule runtime clusters, consisting of 2 Mule runtime engines per cluster</p></td></tr><tr><td><p>Mule applications per Mule runtime engine (recommended)</p></td><td><p>Fewer than 25</p></td><td><p>Fewer than 25</p></td></tr><tr><td><p>Mule applications per Mule runtime engine (maximum)</p></td><td><p>100</p></td><td><p>150</p></td></tr></tbody></table>

### APIs and API Manager

<table><colgroup><col> <col> <col></colgroup><tbody><tr><td></td><td><p>4-node Configuration</p></td><td><p>7-node Configuration</p></td></tr><tr><td><p>Maximum instances per API group</p></td><td><p>100</p></td><td><p>100</p></td></tr><tr><td><p>Client applications (per user)</p></td><td><p>5000</p></td><td><p>5000</p></td></tr><tr><td><p>Client applications (per root organization)</p></td><td><p>10000</p></td><td><p>10000</p></td></tr><tr><td><p>Maximum API instances manager per root organization</p></td><td><p>6000</p></td><td><p>12000</p></td></tr><tr><td><p>Applied policies</p></td><td><p>12000</p></td><td><p>24000</p></td></tr><tr><td><p>Created contracts</p></td><td><p>12000</p></td><td><p>24000</p></td></tr></tbody></table>

For both 4-node and 7-node configurations, the following apply:

- Maximum instances per API group

- Applications

- A single API implementation with one policy counts as 0.5 APIs.

- A single clustered proxy with up to 5 policies counts as 1.

- All Mule instances are polling every 60 seconds.

### Access Management

<table><colgroup><col> <col> <col></colgroup><thead><tr><th></th><th>4-node Configuration</th><th>7-node Configuration</th></tr></thead><tbody><tr><td><p>Maximum number of supported business groups</p></td><td><p>75</p></td><td><p>N/A</p></td></tr><tr><td><p>Maximum number of users</p></td><td><p>10000</p></td><td><p>N/A</p></td></tr></tbody></table>

See the Access Management documentation for more information on
[identity management and supported providers](https://docs.mulesoft.com/access-management/external-identity).

### Exchange

<table><colgroup><col> <col> <col></colgroup><thead><tr><th></th><th>4-node Configuration</th><th>7-node Configuration</th></tr></thead><tbody><tr><td><p>Maximum Exchange assets</p></td><td><p>60,000</p></td><td><p>60,000</p></td></tr><tr><td><p>Maximum file size when publishing asset through UI</p></td><td><p>5 MB</p></td><td><p>5 MB</p></td></tr><tr><td><p>Maximum uncompressed file size</p></td><td><p>50 MB</p></td><td><p>50 MB</p></td></tr><tr><td><p>Maximum file size when publishing asset through Maven</p></td><td><p>200 MB</p></td><td><p>200</p></td></tr><tr><td><p>Maximum number of dependencies for a single asset</p></td><td><p>100</p></td><td><p>100</p></td></tr><tr><td><p>Maximum icon size</p></td><td><p>2 MB</p></td><td><p>2 MB</p></td></tr><tr><td><p>Maximum number of resources (attachments) per asset portal</p></td><td><p>100</p></td><td><p>100</p></td></tr><tr><td><p>Maximum resource size for attachments to the asset portal</p></td><td><p>2 MB</p></td><td><p>2 MB</p></td></tr><tr><td><p>Maximum indexable asset content for RAML or asset portal</p></td><td><p>1 MB</p></td><td><p>1 MB</p></td></tr><tr><td><p>Maximum number of categories per organization</p></td><td><p>500</p></td><td><p>500</p></td></tr><tr><td><p>Maximum number of custom configurations per organization</p></td><td><p>500</p></td><td><p>500</p></td></tr><tr><td><p>Maximum number of pages in a portal</p></td><td><p>50</p></td><td><p>50</p></td></tr><tr><td><p>Maximum length of page name</p></td><td><p>128 characters</p></td><td><p>128 characters</p></td></tr><tr><td><p>Maximum review title length</p></td><td><p>30 characters</p></td><td><p>30 characters</p></td></tr><tr><td><p>Maximum review text length</p></td><td><p>2048 characters</p></td><td><p>2048 characters</p></td></tr></tbody></table>

The 1 MB maximum indexable asset content for RAML or asset portal means that if your portal has more
than 1MB in text, only the first 1MB will be indexed, and if your portal has more than 1 MB in RAML
specifications, only the first 1 MB will be indexed.

### API Designer and API Mocking Service

The following apply to both 4-node and 7-node configurations.

<table><colgroup><col> <col></colgroup><tbody><tr><td><p>Maximum number of projects</p></td><td><p>Limited by version control system</p></td></tr><tr><td><p>Maximum number of concurrent users</p></td><td><p>16</p></td></tr><tr><td><p>Maximum number of mocking service instances</p></td><td><p>One per API version</p></td></tr><tr><td><p>Maximum number of mocking service users</p></td><td><p>16</p></td></tr></tbody></table>

### Anypoint Monitoring

Anypoint Monitoring is an optional, add-on component. See
[Anypoint Monitoring on Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/3.2/anypoint-monitoring). The following limitations apply
when using Anypoint Monitoring with Anypoint Platform PCE.

#### Enhanced API Analytics Monitoring Limits

- API Summary Metrics

  - Retention: 1 year

- API IP Address Metrics

  - Number of IP addresses per API per minute: limited to 20 unique IP addresses.

  - Retention: 1 hour

- API Endpoint Metrics

  - Number of endpoints per API per minute: limited to 100 unique endpoints

  - Retention: 1 hour

#### Application Monitoring Limits

- Number of endpoints per application per minute: 5 unique endpoints

- Number of client IP addresses per application per minute: 5 unique endpoints

#### Custom Metrics

- Up to 10000 alerts

- System performs

#### Advanced Alert Limits

- Up to 20 alerts

#### Performance Limits

- Number of Mule instances: 3000

- Number of applications: 12000

- Number of application replicas: up to 12000. An application can run on multiple Mule instances in
  a server group or cluster.

- Number of APIs: up to 120000

- Number of custom metrics: 50

#### Examples of Supported Parameters

- 6000 applications, each with 1 extra replica corresponds to 12000 application replicas

- 2000 applications, each with 6 extra replicas corresponds to 12000 application replicas

- 12000 applications, with no replicas corresponds to 12000 application replicas

#### Hardware Requirements

- 3 Nodes

- CPU: 32 cores

- Memory: 128 GB

- Disk requirements:

  - 4TB InfluxDB volume for each AMV node

  - 500 GB Logstash volume per AMV node

  - 500 GB insight-cassandra-meld volume per AMV node

  - IOPS: 1500 IPS per volume (1 voolume each for Influx, logstash, and insight-cassandra-meld)

  - Network: 10 GB/second

#### License Requirements

- The Influx Enterprise license (included in the Anypoint Monitoring subscription) is required to
  enable monitoring.

### Anypoint Visualizer

Anypoint Platform PCE does not the support the following Anypoint Visualizer features:

- List of applications

  If an application does not use Anypoint Monitoring, Anypoint Visualizer cannot track it on
  Anypoint Platform PCE.

- Policy visualization

## See Also

- [Anypoint Monitoring](https://docs.mulesoft.com/private-cloud/3.2/anypoint-monitoring)

- [Anypoint Visualizer](https://docs.mulesoft.com/visualizer/)

<!-- document id=5a57107b978a203f11f11348fa14eb73286e6108f03ca90607b75d471a863579 url=/mulesoft/current/en-us/private-cloud/4.0/supported-cluster-config.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.0
---

# Supported Configurations for Anypoint Platform PCE

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

To ensure platform performance, stability, and high availability, Anypoint Platform Private Cloud
Edition (Anypoint Platform PCE) supports two network configurations in Kubernetes (K8s) nodes:
4-node and 7-node.

## Anypoint Platform PCE 4.0 Architecture

The diagram illustrates MuleSoft’s planes (control plane and runtime plane) and their general
traffic flow within the Anypoint Platform PCE context:

![](/mulesoft/current/en-us/private-cloud/4.0/_images/pce4-diagram-architecture.png)

Control plane:

- A subset of Anypoint services is deployed in Kubernetes (customer’s choice - Anypoint Platform PCE
  v 4.0 supports RKE2, EKS-A, OpenShift).

- This constitutes the MuleSoft Control Plane, a web-based management and administration tool for
  the lifecycle of MuleSoft integration apps and APIs.

- Starting with Anypoint Platform PCE v4.0, use a dedicated Kubernetes control plane to separate
  cluster management components from customer workloads.

Runtime plane:

- MuleSoft offers various runtime planes

- Within Anypoint Platform PCE context, the test uses the Hybrid runtime plane to deploy and manage
  runtimes via the MuleSoft control plane.

The following recommendations and limits are based on these resources: \* A small (4-node)
environment consisting of 4 K8s worker nodes of 8 cores and 32GB RAM and 3 dedicated K8s control
plane nodes, or \* A large (7-node) environment consisting of 7 K8s worker nodes of 8 cores and 32GB
RAM and 3 dedicated K8s control plane nodes

## Mule Runtime Engine and Mule Applications

The following table shows the recommended and maximum number of Mule instances and Mule applications
that Anypoint Platform PCE supports:

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Description</th><th>Small cluster 4-node Configuration</th><th>Large cluster 7-node Configuration</th></tr></thead><tbody><tr><td><p>Maximum number of Mule instances per environment</p></td><td><p>500</p></td><td><p>500</p></td></tr><tr><td><p>Maximum number of Mule instances across all environments</p></td><td><p>1500</p></td><td><p>3000</p></td></tr><tr><td><p>Maximum number of Mule instances per server group</p></td><td><p>20</p></td><td><p>20</p></td></tr><tr><td><p>Maximum Mule instances per cluster</p></td><td><p>8</p></td><td><p>8</p></td></tr><tr><td><p>Mule applications under management per environment (recommended)</p></td><td><p>Under 200</p></td><td><p>Around 200</p></td></tr><tr><td><p>Mule applications under management per environment (maximum)</p></td><td><p>500</p></td><td><p>500</p></td></tr><tr><td><p>Mule applications per Mule runtime engine (recommended)</p></td><td><p>Fewer than 25</p></td><td><p>Fewer than 25</p></td></tr><tr><td><p>Mule applications per Mule runtime engine (maximum)</p></td><td><p>100</p></td><td><p>150</p></td></tr><tr><td><p>Number of Mule applications</p></td><td><p>6000</p></td><td><p>12000</p></td></tr><tr><td><p>Number of Mule application replicas. An application can run on multiple Mule instances in a server group or cluster.</p></td><td><p>12000</p></td><td><p>24000</p></td></tr></tbody></table>

## APIs and API Manager

The following table show the maximum instances per API, number of client applications, applied
policies and created contracts that Anypoint Platform PCE supports:

<table><colgroup><col> <col> <col></colgroup><tbody><tr><td><p>Description</p></td><td><p>Small cluster 4-node Configuration</p></td><td><p>Large cluster 7-node Configuration</p></td></tr><tr><td><p>Maximum instances per API group</p></td><td><p>100</p></td><td><p>100</p></td></tr><tr><td><p>Client applications (per user)</p></td><td><p>5000</p></td><td><p>5000</p></td></tr><tr><td><p>Client applications (per root organization)</p></td><td><p>10000</p></td><td><p>10000</p></td></tr><tr><td><p>Maximum API instances manager per root organization</p></td><td><p>6000</p></td><td><p>12000</p></td></tr><tr><td><p>Applied policies</p></td><td><p>18000</p></td><td><p>36000</p></td></tr><tr><td><p>Created contracts</p></td><td><p>12000</p></td><td><p>24000</p></td></tr></tbody></table>

## Access Management

The following table show the maximum number of business groups and number of users of Access
Management that Anypoint Platform PCE supports:

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Description</th><th>Small cluster 4-node Configuration</th><th>Large cluster 7-node Configuration</th></tr></thead><tbody><tr><td><p>Maximum number of supported business groups</p></td><td><p>75</p></td><td><p>N/A</p></td></tr><tr><td><p>Maximum number of users</p></td><td><p>10000</p></td><td><p>N/A</p></td></tr></tbody></table>

See the Access Management documentation for more information on
[identity management and supported providers](https://docs.mulesoft.com/access-management/external-identity).

## Exchange

The following table show the maximum number of exchange assets and file size information that
Anypoint Platform PCE supports:

<table><colgroup><col> <col> <col></colgroup><thead><tr><th>Description</th><th>Small cluster 4-node Configuration</th><th>Large cluster 7-node Configuration</th></tr></thead><tbody><tr><td><p>Maximum Exchange assets</p></td><td><p>60,000</p></td><td><p>60,000</p></td></tr><tr><td><p>Maximum file size when publishing asset through UI</p></td><td><p>5 MB</p></td><td><p>5 MB</p></td></tr><tr><td><p>Maximum uncompressed file size</p></td><td><p>50 MB</p></td><td><p>50 MB</p></td></tr><tr><td><p>Maximum file size when publishing asset through Maven</p></td><td><p>200 MB</p></td><td><p>200</p></td></tr><tr><td><p>Maximum number of dependencies for a single asset</p></td><td><p>100</p></td><td><p>100</p></td></tr><tr><td><p>Maximum icon size</p></td><td><p>2 MB</p></td><td><p>2 MB</p></td></tr><tr><td><p>Maximum number of resources (attachments) per asset portal</p></td><td><p>100</p></td><td><p>100</p></td></tr><tr><td><p>Maximum resource size for attachments to the asset portal</p></td><td><p>2 MB</p></td><td><p>2 MB</p></td></tr><tr><td><p>Maximum indexable asset content for RAML or asset portal</p></td><td><p>1 MB</p></td><td><p>1 MB</p></td></tr><tr><td><p>Maximum number of categories per organization</p></td><td><p>500</p></td><td><p>500</p></td></tr><tr><td><p>Maximum number of custom configurations per organization</p></td><td><p>500</p></td><td><p>500</p></td></tr><tr><td><p>Maximum number of pages in a portal</p></td><td><p>50</p></td><td><p>50</p></td></tr><tr><td><p>Maximum length of page name</p></td><td><p>128 characters</p></td><td><p>128 characters</p></td></tr><tr><td><p>Maximum review title length</p></td><td><p>30 characters</p></td><td><p>30 characters</p></td></tr><tr><td><p>Maximum review text length</p></td><td><p>2048 characters</p></td><td><p>2048 characters</p></td></tr></tbody></table>

## API Designer and API Mocking Service

The following apply to both 4-node and 7-node configurations.

<table><colgroup><col> <col></colgroup><tbody><tr><td><p>Maximum number of projects</p></td><td><p>Limited by version control system</p></td></tr><tr><td><p>Maximum number of concurrent users</p></td><td><p>16</p></td></tr><tr><td><p>Maximum number of mocking service instances</p></td><td><p>One per API version</p></td></tr><tr><td><p>Maximum number of mocking service users</p></td><td><p>16</p></td></tr></tbody></table>

## See Also

- [Anypoint Platform PCE Overview](https://docs.mulesoft.com/private-cloud/4.0/)

<!-- document id=6fc1d9834f3247f51c7cc06beff2a2037a6a4cefb29d70711d726bdc0d7cab05 url=/mulesoft/current/en-us/private-cloud/4.1/supported-cluster-config.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.1
---

# Supported Configurations for Anypoint Platform PCE

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

These are the supported configurations for Anypoint Platform Private Cloud (Anypoint Platform PCE).

## Anypoint Platform PCE 4.1 Architecture

The diagram illustrates MuleSoft’s planes (control plane and runtime plane) and their general
traffic flow within the Anypoint Platform PCE context:

![Anypoint Platform PCE 4.1 architecture](/mulesoft/current/en-us/private-cloud/4.1/_images/pce4-diagram-architecture.png)

Control plane:

- A subset of Anypoint Platform services is deployed to a supported Kubernetes distribution (RKE2,
  EKS-A, or OpenShift).

- This constitutes the MuleSoft Control Plane, a web-based management and administration tool for
  the lifecycle of MuleSoft integration apps and APIs.

- Starting with Anypoint Platform PCE v4.0, use a dedicated Kubernetes control plane to separate
  cluster management components from customer workloads.

Runtime plane:

- MuleSoft offers various runtime planes.

- Within the Anypoint Platform PCE context, use the Hybrid runtime plane to deploy and manage
  runtimes via the MuleSoft control plane.

## Mule Runtime Engine and Mule Applications

This table shows the recommended and maximum number of Mule instances and Mule applications that
Anypoint Platform PCE supports:

<table><colgroup><col> <col></colgroup><thead><tr><th>Description</th><th>Supported Capacity</th></tr></thead><tbody><tr><td><p>Maximum number of Mule instances per environment</p></td><td><p>500</p></td></tr><tr><td><p>Maximum number of Mule instances across all environments</p></td><td><p>4000</p></td></tr><tr><td><p>Maximum number of Mule instances per server group</p></td><td><p>20</p></td></tr><tr><td><p>Maximum Mule instances per cluster</p></td><td><p>8</p></td></tr><tr><td><p>Mule applications under management per environment (recommended)</p></td><td><p>Fewer than 200</p></td></tr><tr><td><p>Mule applications under management per environment (maximum)</p></td><td><p>500</p></td></tr><tr><td><p>Mule applications per Mule runtime engine (recommended)</p></td><td><p>Fewer than 25</p></td></tr><tr><td><p>Mule applications per Mule runtime engine (maximum)</p></td><td><p>100</p></td></tr><tr><td><p>Number of Mule applications</p></td><td><p>15000</p></td></tr><tr><td><p>Number of Mule application replicas. An application can run on multiple Mule instances in a server group or cluster.</p></td><td><p>30000</p></td></tr></tbody></table>

## APIs and API Manager

This table shows the maximum number of instances per API, number of client applications, applied
policies, and created contracts that Anypoint Platform PCE supports:

<table><colgroup><col> <col></colgroup><thead><tr><th>Description</th><th>Supported Capacity</th></tr></thead><tbody><tr><td><p>Maximum instances per API group</p></td><td><p>100</p></td></tr><tr><td><p>Client applications (per user)</p></td><td><p>5000</p></td></tr><tr><td><p>Client applications (per root organization)</p></td><td><p>10000</p></td></tr><tr><td><p>Maximum API instances managed per root organization</p></td><td><p>12000</p></td></tr><tr><td><p>Applied policies</p></td><td><p>36000</p></td></tr><tr><td><p>Created contracts</p></td><td><p>24000</p></td></tr></tbody></table>

## Access Management

This table shows the maximum number of business groups and number of Access Management users that
Anypoint Platform PCE supports:

<table><colgroup><col> <col></colgroup><thead><tr><th>Description</th><th>Supported Capacity</th></tr></thead><tbody><tr><td><p>Maximum number of supported business groups</p></td><td><p>75</p></td></tr><tr><td><p>Maximum number of users</p></td><td><p>10000</p></td></tr><tr><td><p>Maximum number of client providers</p></td><td><p>25</p></td></tr></tbody></table>

## Exchange

This table shows the maximum number of Anypoint Exchange (Exchange) assets and file size information
that Anypoint Platform PCE supports:

<table><colgroup><col> <col></colgroup><thead><tr><th>Description</th><th>Supported Capacity</th></tr></thead><tbody><tr><td><p>Maximum Exchange assets</p></td><td><p>60,000</p></td></tr><tr><td><p>Maximum file size when publishing asset through UI</p></td><td><p>5 MB</p></td></tr><tr><td><p>Maximum uncompressed file size</p></td><td><p>50 MB</p></td></tr><tr><td><p>Maximum file size when publishing asset through Maven</p></td><td><p>200 MB</p></td></tr><tr><td><p>Maximum number of dependencies for a single asset</p></td><td><p>100</p></td></tr><tr><td><p>Maximum icon size</p></td><td><p>2 MB</p></td></tr><tr><td><p>Maximum number of resources (attachments) per asset portal</p></td><td><p>100</p></td></tr><tr><td><p>Maximum resource size for attachments to the asset portal</p></td><td><p>2 MB</p></td></tr><tr><td><p>Maximum indexable asset content for RAML or asset portal</p></td><td><p>1 MB</p></td></tr><tr><td><p>Maximum number of categories per organization</p></td><td><p>500</p></td></tr><tr><td><p>Maximum number of custom configurations per organization</p></td><td><p>500</p></td></tr><tr><td><p>Maximum number of pages in a portal</p></td><td><p>50</p></td></tr><tr><td><p>Maximum length of page name</p></td><td><p>128 characters</p></td></tr><tr><td><p>Maximum review title length</p></td><td><p>30 characters</p></td></tr><tr><td><p>Maximum review text length</p></td><td><p>2048 characters</p></td></tr></tbody></table>

## API Designer and API Mocking Service

<table><colgroup><col> <col></colgroup><tbody><tr><td><p>Maximum number of projects</p></td><td><p>Limited by version control system</p></td></tr><tr><td><p>Maximum number of concurrent users</p></td><td><p>16</p></td></tr><tr><td><p>Maximum number of mocking service instances</p></td><td><p>One per API version</p></td></tr><tr><td><p>Maximum number of mocking service users</p></td><td><p>16</p></td></tr></tbody></table>

## See Also

- [Anypoint Platform PCE Overview](https://docs.mulesoft.com/private-cloud/4.1/)

<!-- document id=bde15e7536cdba54cabcc2fc1d24c1f6fa843c3614cb3fab33993d86aef8a25f url=/mulesoft/current/en-us/private-cloud/4.2/supported-cluster-config.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.2
---

# Supported Configurations for Anypoint Platform PCE

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

These are the supported configurations for Anypoint Platform Private Cloud (Anypoint Platform PCE).

## Anypoint Platform PCE 4.2 Architecture

The diagram illustrates MuleSoft’s planes (control plane and runtime plane) and their general
traffic flow within the Anypoint Platform PCE context:

![Anypoint Platform PCE 4.2 architecture](/mulesoft/current/en-us/private-cloud/4.2/_images/pce4-diagram-architecture.png)

Control plane:

- A subset of Anypoint Platform services is deployed to a supported Kubernetes distribution (RKE2,
  EKS-A, or OpenShift).

- This constitutes the MuleSoft Control Plane, a web-based management and administration tool for
  the lifecycle of MuleSoft integration apps and APIs.

- Starting with Anypoint Platform PCE v4.0, use a dedicated Kubernetes control plane to separate
  cluster management components from customer workloads.

Runtime plane:

- MuleSoft offers various runtime planes.

- Within the Anypoint Platform PCE context, use the Hybrid runtime plane to deploy and manage
  runtimes via the MuleSoft control plane.

## Mule Runtime Engine and Mule Applications

This table shows the recommended and maximum number of Mule instances and Mule applications that
Anypoint Platform PCE supports:

<table><colgroup><col> <col></colgroup><thead><tr><th>Description</th><th>Supported Capacity</th></tr></thead><tbody><tr><td><p>Maximum number of Mule instances per environment</p></td><td><p>500</p></td></tr><tr><td><p>Maximum number of Mule instances across all environments</p></td><td><p>4000</p></td></tr><tr><td><p>Maximum number of Mule instances per server group</p></td><td><p>20</p></td></tr><tr><td><p>Maximum Mule instances per cluster</p></td><td><p>8</p></td></tr><tr><td><p>Mule applications under management per environment (recommended)</p></td><td><p>Fewer than 200</p></td></tr><tr><td><p>Mule applications under management per environment (maximum)</p></td><td><p>500</p></td></tr><tr><td><p>Mule applications per Mule runtime engine (recommended)</p></td><td><p>Fewer than 25</p></td></tr><tr><td><p>Mule applications per Mule runtime engine (maximum)</p></td><td><p>100</p></td></tr><tr><td><p>Number of Mule applications</p></td><td><p>15000</p></td></tr><tr><td><p>Number of Mule application replicas. An application can run on multiple Mule instances in a server group or cluster.</p></td><td><p>30000</p></td></tr></tbody></table>

## APIs and API Manager

This table shows the maximum number of instances per API, number of client applications, applied
policies, and created contracts that Anypoint Platform PCE supports:

<table><colgroup><col> <col></colgroup><thead><tr><th>Description</th><th>Supported Capacity</th></tr></thead><tbody><tr><td><p>Maximum instances per API group</p></td><td><p>100</p></td></tr><tr><td><p>Client applications (per user)</p></td><td><p>5000</p></td></tr><tr><td><p>Client applications (per root organization)</p></td><td><p>10000</p></td></tr><tr><td><p>Maximum API instances managed per root organization</p></td><td><p>12000</p></td></tr><tr><td><p>Applied policies</p></td><td><p>36000</p></td></tr><tr><td><p>Created contracts</p></td><td><p>24000</p></td></tr></tbody></table>

## Access Management

This table shows the maximum number of business groups and number of Access Management users that
Anypoint Platform PCE supports:

<table><colgroup><col> <col></colgroup><thead><tr><th>Description</th><th>Supported Capacity</th></tr></thead><tbody><tr><td><p>Maximum number of supported business groups</p></td><td><p>75</p></td></tr><tr><td><p>Maximum number of users</p></td><td><p>10000</p></td></tr><tr><td><p>Maximum number of client providers</p></td><td><p>25</p></td></tr></tbody></table>

## Exchange

This table shows the maximum number of Anypoint Exchange (Exchange) assets and file size information
that Anypoint Platform PCE supports:

<table><colgroup><col> <col></colgroup><thead><tr><th>Description</th><th>Supported Capacity</th></tr></thead><tbody><tr><td><p>Maximum Exchange assets</p></td><td><p>60,000</p></td></tr><tr><td><p>Maximum file size when publishing asset through UI</p></td><td><p>5 MB</p></td></tr><tr><td><p>Maximum uncompressed file size</p></td><td><p>50 MB</p></td></tr><tr><td><p>Maximum file size when publishing asset through Maven</p></td><td><p>200 MB</p></td></tr><tr><td><p>Maximum number of dependencies for a single asset</p></td><td><p>100</p></td></tr><tr><td><p>Maximum icon size</p></td><td><p>2 MB</p></td></tr><tr><td><p>Maximum number of resources (attachments) per asset portal</p></td><td><p>100</p></td></tr><tr><td><p>Maximum resource size for attachments to the asset portal</p></td><td><p>2 MB</p></td></tr><tr><td><p>Maximum indexable asset content for RAML or asset portal</p></td><td><p>1 MB</p></td></tr><tr><td><p>Maximum number of categories per organization</p></td><td><p>500</p></td></tr><tr><td><p>Maximum number of custom configurations per organization</p></td><td><p>500</p></td></tr><tr><td><p>Maximum number of pages in a portal</p></td><td><p>50</p></td></tr><tr><td><p>Maximum length of page name</p></td><td><p>128 characters</p></td></tr><tr><td><p>Maximum review title length</p></td><td><p>30 characters</p></td></tr><tr><td><p>Maximum review text length</p></td><td><p>2048 characters</p></td></tr></tbody></table>

## API Designer and API Mocking Service

<table><colgroup><col> <col></colgroup><tbody><tr><td><p>Maximum number of projects</p></td><td><p>Limited by version control system</p></td></tr><tr><td><p>Maximum number of concurrent users</p></td><td><p>16</p></td></tr><tr><td><p>Maximum number of mocking service instances</p></td><td><p>One per API version</p></td></tr><tr><td><p>Maximum number of mocking service users</p></td><td><p>16</p></td></tr></tbody></table>

## See Also

- [Anypoint Platform PCE Overview](https://docs.mulesoft.com/private-cloud/4.2/)

<!-- document id=06010a1943b0112fd56810ee107f2f0aa356d99a8eb3a1365c697d3aca9e6571 url=/mulesoft/current/en-us/private-cloud/latest/supported-cluster-config.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.3
is-latest-version: true
---

# Supported Configurations for Anypoint Platform PCE

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

These are the supported configurations for Anypoint Platform Private Cloud (Anypoint Platform PCE).

## Anypoint Platform PCE 4.3 Architecture

The diagram illustrates MuleSoft’s planes (control plane and runtime plane) and their general
traffic flow within the Anypoint Platform PCE context:

![Anypoint Platform PCE 4.3 architecture, with the load balancer, Kubernetes worker and control-plane nodes, Mule runtimes, and external storage, SMTP, registry, NFS, and identity provider](/mulesoft/current/en-us/private-cloud/latest/_images/pce4.3-architecture-diagram.png)

Control plane:

- A subset of Anypoint Platform services is deployed to a supported Kubernetes distribution (RKE2,
  EKS-A, or OpenShift).

- This constitutes the MuleSoft Control Plane, a web-based management and administration tool for
  the lifecycle of MuleSoft integration apps and APIs.

- Starting with Anypoint Platform PCE v4.0, use a dedicated Kubernetes control plane to separate
  cluster management components from customer workloads.

Runtime plane:

- MuleSoft offers various runtime planes.

- Within the Anypoint Platform PCE context, use the Hybrid runtime plane to deploy and manage
  runtimes via the MuleSoft control plane.

## Mule Runtime Engine and Mule Applications

This table shows the recommended and maximum number of Mule instances and Mule applications that
Anypoint Platform PCE supports:

<table><colgroup><col> <col></colgroup><thead><tr><th>Description</th><th>Supported Capacity</th></tr></thead><tbody><tr><td><p>Maximum number of Mule instances per environment</p></td><td><p>500</p></td></tr><tr><td><p>Maximum number of Mule instances across all environments</p></td><td><p>4000</p></td></tr><tr><td><p>Maximum number of Mule instances per server group</p></td><td><p>20</p></td></tr><tr><td><p>Maximum Mule instances per cluster</p></td><td><p>8</p></td></tr><tr><td><p>Mule applications under management per environment (recommended)</p></td><td><p>Fewer than 200</p></td></tr><tr><td><p>Mule applications under management per environment (maximum)</p></td><td><p>500</p></td></tr><tr><td><p>Mule applications per Mule runtime engine (recommended)</p></td><td><p>Fewer than 25</p></td></tr><tr><td><p>Mule applications per Mule runtime engine (maximum)</p></td><td><p>100</p></td></tr><tr><td><p>Number of Mule applications</p></td><td><p>15000</p></td></tr><tr><td><p>Number of Mule application replicas. An application can run on multiple Mule instances in a server group or cluster.</p></td><td><p>30000</p></td></tr></tbody></table>

## APIs and API Manager

This table shows the maximum number of instances per API, number of client applications, applied
policies, and created contracts that Anypoint Platform PCE supports:

<table><colgroup><col> <col></colgroup><thead><tr><th>Description</th><th>Supported Capacity</th></tr></thead><tbody><tr><td><p>Maximum instances per API group</p></td><td><p>100</p></td></tr><tr><td><p>Client applications (per user)</p></td><td><p>5000</p></td></tr><tr><td><p>Client applications (per root organization)</p></td><td><p>10000</p></td></tr><tr><td><p>Maximum API instances managed per root organization</p></td><td><p>12000</p></td></tr><tr><td><p>Applied policies</p></td><td><p>36000</p></td></tr><tr><td><p>Created contracts</p></td><td><p>24000</p></td></tr></tbody></table>

## Access Management

This table shows the maximum number of business groups and number of Access Management users that
Anypoint Platform PCE supports:

<table><colgroup><col> <col></colgroup><thead><tr><th>Description</th><th>Supported Capacity</th></tr></thead><tbody><tr><td><p>Maximum number of supported business groups</p></td><td><p>75</p></td></tr><tr><td><p>Maximum number of users</p></td><td><p>10000</p></td></tr><tr><td><p>Maximum number of client providers</p></td><td><p>25</p></td></tr></tbody></table>

## Exchange

This table shows the maximum number of Anypoint Exchange (Exchange) assets and file size information
that Anypoint Platform PCE supports:

<table><colgroup><col> <col></colgroup><thead><tr><th>Description</th><th>Supported Capacity</th></tr></thead><tbody><tr><td><p>Maximum Exchange assets</p></td><td><p>60,000</p></td></tr><tr><td><p>Maximum file size when publishing asset through UI</p></td><td><p>5 MB</p></td></tr><tr><td><p>Maximum uncompressed file size</p></td><td><p>50 MB</p></td></tr><tr><td><p>Maximum file size when publishing asset through Maven</p></td><td><p>200 MB</p></td></tr><tr><td><p>Maximum number of dependencies for a single asset</p></td><td><p>100</p></td></tr><tr><td><p>Maximum icon size</p></td><td><p>2 MB</p></td></tr><tr><td><p>Maximum number of resources (attachments) per asset portal</p></td><td><p>100</p></td></tr><tr><td><p>Maximum resource size for attachments to the asset portal</p></td><td><p>2 MB</p></td></tr><tr><td><p>Maximum indexable asset content for RAML or asset portal</p></td><td><p>1 MB</p></td></tr><tr><td><p>Maximum number of categories per organization</p></td><td><p>500</p></td></tr><tr><td><p>Maximum number of custom configurations per organization</p></td><td><p>500</p></td></tr><tr><td><p>Maximum number of pages in a portal</p></td><td><p>50</p></td></tr><tr><td><p>Maximum length of page name</p></td><td><p>128 characters</p></td></tr><tr><td><p>Maximum review title length</p></td><td><p>30 characters</p></td></tr><tr><td><p>Maximum review text length</p></td><td><p>2048 characters</p></td></tr></tbody></table>

## API Designer and API Mocking Service

<table><colgroup><col> <col></colgroup><tbody><tr><td><p>Maximum number of projects</p></td><td><p>Limited by version control system</p></td></tr><tr><td><p>Maximum number of concurrent users</p></td><td><p>16</p></td></tr><tr><td><p>Maximum number of mocking service instances</p></td><td><p>One per API version</p></td></tr><tr><td><p>Maximum number of mocking service users</p></td><td><p>16</p></td></tr></tbody></table>

## See Also

- [Anypoint Platform PCE Overview](https://docs.mulesoft.com/private-cloud/latest/)

<!-- document id=d20b019d4866eccdd00ec2e6c0a8e77ab6e2c6d51f95e4aaae47764294700dfe url=/mulesoft/current/en-us/private-cloud/3.2/register-server.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 3.2
---

# Troubleshoot Mule Runtime Engine Registration

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

If you encounter a Mule runtime engine registration error when
[creating a server in Runtime Manager](https://docs.mulesoft.com/runtime-manager/servers-create), you might need to
configure Mule to trust the TLS certificates you are using.

To do so:

1.  Get the public certificate for Anypoint Platform Private Cloud Edition.

2.  Add the certificate to the truststore of the JVM you are using for the Mule runtime engine.

Using the following example, set `$ANYPOINT_DNS` to your DNS for Anypoint Platform Private Cloud
Edition. Replace the keystore location and password for your JVM truststore.

$ keytool -printcert -sslserver $ANYPOINT\_DNS:443 -rfc > /tmp/PCE\_Certificate.cer $ keytool
-importcert -alias anypoint.my-company -keystore <path to keystore> -storepass changeit -file
/tmp/PCE\_Certificate.cer

For more information about the CA certificate truststore, refer to your JVM vendor’s documentation:
for example, [Oracle documentation](https://docs.oracle.com/).

<!-- document id=2e1e3e5cee7c97acba9f5aab5f52affdd9140645972dec863024c7b568f5c321 url=/mulesoft/current/en-us/private-cloud/3.2/troubleshoot-nfs.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 3.2
---

# Troubleshoot NFS Errors

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

> [!IMPORTANT] Setting up and configuring an NFS server should be performed by your infrastructure
> team. If you experience problems with any of the following instructions, contact your
> infrastructure team for assistance.

You must have a connection from each node to NFS.

## “Server Not Responding”

Use a tool such as ping, traceroute, or tracepath to verify that the client and server machines can
communicate with each other. If communication fails between the client and server machines, examine
the network interface card (NIC) settings using either `ifconfig` or `ethtool` to verify the IP
settings.

## “Access Denied” or "Permission Denied"

Check the export permissions for the NFS file system. You can do this from the client or from the
server.

From the client:

`showmount -e server_name`

From the server:

`exportfs -a`

## "rpc mount export: RPC: Timed out"

The error message `Unable to access file system at [NFS SERVER]: rpc mount export: RPC: Timed out`
is caused by a DNS name resolution issue. NFS (RPC) needs reverse name resolution. If the NFS server
or client cannot resolve their name, this error occurs. Check the DNS configuration and the
`/etc/hosts` configuration.

## Mounting the NFS Server Fails

If the mount fails, you are probably missing some NFS-required libraries. If this happens, install
them by running:  
`yum install nfs-utils nfs-utils-lib`

### "mount failed: Not Permitted"

The error message `mount failed: exit status 32. Mounting command …​ not permitted` might occur when
trying to mount using the `noresvport` option because the ports might be limited. If this happens,
remove the `noresvport` option and add the `insecure` flag to the mount command.

## See Also

- [Verify NFS Server Communication](https://docs.mulesoft.com/private-cloud/3.2/verify-nfs)

- [Known Issues](https://help.salesforce.com/s/issues)

<!-- document id=73580c981a9e0286e1942802e5385b1512f4ffa3a5a173e3fc455e10d3dc4cdf url=/mulesoft/current/en-us/private-cloud/4.0/register-server.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.0
---

# Troubleshooting Mule Runtime Engine Registration

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

If you encounter a Mule runtime engine (Mule) registration error when
[creating a server in Runtime Manager](https://docs.mulesoft.com/runtime-manager/servers-create), configure Mule to
trust the TLS certificates you are using.

To do so:

1.  Get the public certificate for Anypoint Platform Private Cloud Edition (Anypoint Platform PCE).

2.  Add the certificate to the truststore of the JVM you are using for Mule.

Using the following example, set `$ANYPOINT_DNS` to your DNS for Anypoint Platform PCE. Replace the
keystore location and password for your JVM truststore.

$ keytool -printcert -sslserver $ANYPOINT\_DNS:443 -rfc > /tmp/PCE\_Certificate.cer $ keytool
-importcert -alias anypoint.my-company -keystore <path to keystore> -storepass changeit -file
/tmp/PCE\_Certificate.cer

For more information about the CA certificate truststore, see your JVM vendor’s documentation:
[Oracle documentation](https://docs.oracle.com/).

## See Also

- [Managing Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/4.0/operating-about)

<!-- document id=5e09523a2b91a373f8513b84289597328ec43a702a195e61f01c7d6805971653 url=/mulesoft/current/en-us/private-cloud/4.1/register-server.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.1
---

# Troubleshooting Mule Runtime Engine Registration

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

If you encounter a Mule runtime engine (Mule) registration error when
[creating a server in Runtime Manager](https://docs.mulesoft.com/runtime-manager/servers-create), configure Mule to
trust the TLS certificates you are using.

To do so:

1.  Get the public certificate for Anypoint Platform Private Cloud Edition (Anypoint Platform PCE).

2.  Add the certificate to the truststore of the JVM you are using for Mule.

Using the following example, set `$ANYPOINT_DNS` to your DNS for Anypoint Platform PCE. Replace the
keystore location and password for your JVM truststore.

$ keytool -printcert -sslserver $ANYPOINT\_DNS:443 -rfc > /tmp/PCE\_Certificate.cer $ keytool
-importcert -alias anypoint.my-company -keystore <path to keystore> -storepass changeit -file
/tmp/PCE\_Certificate.cer

For more information about the CA certificate truststore, see your JVM vendor’s documentation:
[Oracle documentation](https://docs.oracle.com/).

## See Also

- [Managing Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/4.1/operating-about)

<!-- document id=ad33ea526756134e07b497b1733fa8ba4d693c0a96cfd552b0870d349de5fe4a url=/mulesoft/current/en-us/private-cloud/4.2/register-server.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.2
---

# Troubleshooting Mule Runtime Engine Registration

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

If you encounter a Mule runtime engine (Mule) registration error when
[creating a server in Runtime Manager](https://docs.mulesoft.com/runtime-manager/servers-create), configure Mule to
trust the TLS certificates you are using.

To do so:

1.  Get the public certificate for Anypoint Platform Private Cloud Edition (Anypoint Platform PCE).

2.  Add the certificate to the truststore of the JVM you are using for Mule.

Using the following example, set `$ANYPOINT_DNS` to your DNS for Anypoint Platform PCE. Replace the
keystore location and password for your JVM truststore.

$ keytool -printcert -sslserver $ANYPOINT\_DNS:443 -rfc > /tmp/PCE\_Certificate.cer $ keytool
-importcert -alias anypoint.my-company -keystore <path to keystore> -storepass changeit -file
/tmp/PCE\_Certificate.cer

For more information about the CA certificate truststore, see your JVM vendor’s documentation:
[Oracle documentation](https://docs.oracle.com/).

## See Also

- [Managing Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/4.2/operating-about)

<!-- document id=5b57dbb4ab8c938092861a702a5ab1fbc7253cc4014b72bb680cbcdeb0a26bb5 url=/mulesoft/current/en-us/private-cloud/latest/register-server.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.3
is-latest-version: true
---

# Troubleshooting Mule Runtime Engine Registration

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

If you encounter a Mule runtime engine (Mule) registration error when
[creating a server in Runtime Manager](https://docs.mulesoft.com/runtime-manager/servers-create), configure Mule to
trust the TLS certificates you are using.

To do so:

1.  Get the public certificate for Anypoint Platform Private Cloud Edition (Anypoint Platform PCE).

2.  Add the certificate to the truststore of the JVM you are using for Mule.

Using the following example, set `$ANYPOINT_DNS` to your DNS for Anypoint Platform PCE. Replace the
keystore location and password for your JVM truststore.

$ keytool -printcert -sslserver $ANYPOINT\_DNS:443 -rfc > /tmp/PCE\_Certificate.cer $ keytool
-importcert -alias anypoint.my-company -keystore <path to keystore> -storepass changeit -file
/tmp/PCE\_Certificate.cer

For more information about the CA certificate truststore, see your JVM vendor’s documentation:
[Oracle documentation](https://docs.oracle.com/).

## See Also

- [Managing Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/latest/operating-about)

<!-- document id=3bf0d0e0ae3cf3e30fce0c3ea7c2ac1cd3980af2d47241df3f8ee1d37b0a4f18 url=/mulesoft/current/en-us/private-cloud/4.0/troubleshoot-nfs.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.0
---

# Troubleshooting NFS Errors

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

> [!IMPORTANT] Setting up and configuring an NFS server should be performed by your infrastructure
> team. If you experience problems with any of the following instructions, contact your
> infrastructure team for assistance.

You must have a connection from each node to NFS.

## “Server Not Responding”

Use a tool such as ping, traceroute, or tracepath to verify that the client and server machines can
communicate with each other. If communication fails between the client and server machines, examine
the network interface card (NIC) settings using either `ifconfig` or `ethtool` to verify the IP
settings.

## “Access Denied” or "Permission Denied"

Check the export permissions for the NFS file system. You can do this from the client or from the
server.

From the client:

`showmount -e server_name`

From the server:

`exportfs -a`

## "rpc mount export: RPC: Timed out"

The error message `Unable to access file system at [NFS SERVER]: rpc mount export: RPC: Timed out`
is caused by a DNS name resolution issue. NFS (RPC) needs reverse name resolution. If the NFS server
or client cannot resolve their name, this error occurs. Check the DNS configuration and the
`/etc/hosts` configuration.

## Mounting the NFS Server Fails

If the mount fails, you are probably missing some NFS-required libraries. If this happens, install
them by running:  
`yum install nfs-utils nfs-utils-lib`

### "mount failed: Not Permitted"

The error message `mount failed: exit status 32. Mounting command …​ not permitted` might occur when
trying to mount using the `noresvport` option because the ports might be limited. If this happens,
remove the `noresvport` option and add the `insecure` flag to the mount command.

## See Also

- [Verify NFS Server Communication](https://docs.mulesoft.com/private-cloud/4.0/verify-nfs)

- [Known Issues](https://help.salesforce.com/s/issues)

<!-- document id=cb207b343309d1aba8623a912916c2d441e7de9970ef04597483ea7036cf7308 url=/mulesoft/current/en-us/private-cloud/4.1/troubleshoot-nfs.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.1
---

# Troubleshooting NFS Errors

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

> [!IMPORTANT] Setting up and configuring an NFS server should be performed by your infrastructure
> team. If you experience problems with any of the following instructions, contact your
> infrastructure team for assistance.

You must have a connection from each node to NFS.

## “Server Not Responding”

Use a tool such as ping, traceroute, or tracepath to verify that the client and server machines can
communicate with each other. If communication fails between the client and server machines, examine
the network interface card (NIC) settings using either `ifconfig` or `ethtool` to verify the IP
settings.

## “Access Denied” or "Permission Denied"

Check the export permissions for the NFS file system. You can do this from the client or from the
server.

From the client:

`showmount -e server_name`

From the server:

`exportfs -a`

## "rpc mount export: RPC: Timed out"

The error message `Unable to access file system at [NFS SERVER]: rpc mount export: RPC: Timed out`
is caused by a DNS name resolution issue. NFS (RPC) needs reverse name resolution. If the NFS server
or client cannot resolve their name, this error occurs. Check the DNS configuration and the
`/etc/hosts` configuration.

## Mounting the NFS Server Fails

If the mount fails, you are probably missing some NFS-required libraries. If this happens, install
them by running:  
`yum install nfs-utils nfs-utils-lib`

### "mount failed: Not Permitted"

The error message `mount failed: exit status 32. Mounting command …​ not permitted` might occur when
trying to mount using the `noresvport` option because the ports might be limited. If this happens,
remove the `noresvport` option and add the `insecure` flag to the mount command.

## See Also

- [Verify NFS Server Communication](https://docs.mulesoft.com/private-cloud/4.1/verify-nfs)

- [Known Issues](https://help.salesforce.com/s/issues)

<!-- document id=c36bfc2a295aaa7aff9caedf2b0a7148efe986bc4e8635cc08d7cd0e99c4b35e url=/mulesoft/current/en-us/private-cloud/4.2/troubleshoot-nfs.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.2
---

# Troubleshooting NFS Errors

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

> [!IMPORTANT] Setting up and configuring an NFS server should be performed by your infrastructure
> team. If you experience problems with any of the following instructions, contact your
> infrastructure team for assistance.

You must have a connection from each node to NFS.

## “Server Not Responding”

Use a tool such as ping, traceroute, or tracepath to verify that the client and server machines can
communicate with each other. If communication fails between the client and server machines, examine
the network interface card (NIC) settings using either `ifconfig` or `ethtool` to verify the IP
settings.

## “Access Denied” or "Permission Denied"

Check the export permissions for the NFS file system. You can do this from the client or from the
server.

From the client:

`showmount -e server_name`

From the server:

`exportfs -a`

## "rpc mount export: RPC: Timed out"

The error message `Unable to access file system at [NFS SERVER]: rpc mount export: RPC: Timed out`
is caused by a DNS name resolution issue. NFS (RPC) needs reverse name resolution. If the NFS server
or client cannot resolve their name, this error occurs. Check the DNS configuration and the
`/etc/hosts` configuration.

## Mounting the NFS Server Fails

If the mount fails, you are probably missing some NFS-required libraries. If this happens, install
them by running:  
`yum install nfs-utils nfs-utils-lib`

### "mount failed: Not Permitted"

The error message `mount failed: exit status 32. Mounting command …​ not permitted` might occur when
trying to mount using the `noresvport` option because the ports might be limited. If this happens,
remove the `noresvport` option and add the `insecure` flag to the mount command.

## See Also

- [Verify NFS Server Communication](https://docs.mulesoft.com/private-cloud/4.2/verify-nfs)

- [Known Issues](https://help.salesforce.com/s/issues)

<!-- document id=eb8b28e69d2269b133c3c4f134d509b1f8691c295b53eb67df2329dca4261f21 url=/mulesoft/current/en-us/private-cloud/latest/troubleshoot-nfs.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.3
is-latest-version: true
---

# Troubleshooting NFS Errors

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

> [!IMPORTANT] Setting up and configuring an NFS server should be performed by your infrastructure
> team. If you experience problems with any of the following instructions, contact your
> infrastructure team for assistance.

> [!NOTE] This page applies only when installing Anypoint Platform PCE in NFS mode. If you are using
> StorageClass mode (Anypoint Platform PCE 4.3.0 and later), troubleshoot storage issues through
> your `StorageClass` provider and CSI driver instead. See
> [StorageClass Mode](https://docs.mulesoft.com/private-cloud/latest/verify-nfs#storage-class-mode).

You must have a connection from each node to NFS.

## “Server Not Responding”

Use a tool such as ping, traceroute, or tracepath to verify that the client and server machines can
communicate with each other. If communication fails between the client and server machines, examine
the network interface card (NIC) settings using either `ifconfig` or `ethtool` to verify the IP
settings.

## “Access Denied” or "Permission Denied"

Check the export permissions for the NFS file system. You can do this from the client or from the
server.

From the client:

`showmount -e server_name`

From the server:

`exportfs -a`

## "rpc mount export: RPC: Timed out"

The error message `Unable to access file system at [NFS SERVER]: rpc mount export: RPC: Timed out`
is caused by a DNS name resolution issue. NFS (RPC) needs reverse name resolution. If the NFS server
or client cannot resolve their name, this error occurs. Check the DNS configuration and the
`/etc/hosts` configuration.

## Mounting the NFS Server Fails

If the mount fails, you are probably missing some NFS-required libraries. If this happens, install
them by running:  
`yum install nfs-utils nfs-utils-lib`

### "mount failed: Not Permitted"

The error message `mount failed: exit status 32. Mounting command …​ not permitted` might occur when
trying to mount using the `noresvport` option because the ports might be limited. If this happens,
remove the `noresvport` option and add the `insecure` flag to the mount command.

## See Also

- [Verify NFS Server Communication](https://docs.mulesoft.com/private-cloud/latest/verify-nfs)

- [Known Issues](https://help.salesforce.com/s/issues)

<!-- document id=6923931938655b30df6e83a8f817de987ff9c5504c02b5dd139a31b1be348365 url=/mulesoft/current/en-us/private-cloud/3.2/license-influx-update.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 3.2
---

# Update InfluxDB License

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

To update the InfluxDB license, contact MuleSoft Professional Services for the new license and the
update instructions.

<!-- document id=e9f49fe7942415c458a82421633df65589fce477dfbe5adce2da43edb0310a53 url=/mulesoft/current/en-us/private-cloud/3.2/restarting-a-node.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 3.2
---

# Update Nodes

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

> [!NOTE] Where possible, we changed noninclusive terms to align with our company value of Equality.
> We maintained certain terms to avoid any effect on customer implementations.

## Before You Begin

- Set up and test the backup procedure on all clusters.

- Perform a backup before attempting node maintenance to preserve data in the event of a failure.

## Cluster and Application Updates

> [!IMPORTANT] You must perform the following steps on one Anypoint Platform Private Cloud Edition
> node at a time to minimize or eliminate component breakage during the update process. You must
> complete the entire process on each node before the next node is addressed. After each node is
> updated, verify the health status of all cluster components and applications before proceeding
> with the next node.

### Verify Cluster Health Status

Verify that the cluster is healthy before starting the update process. Otherwise, many of the
assumptions made in this process are not valid.

1.  Verify the output from the following commands:

    ```none
    gravity status
    etcdctl cluster-health
    ```

    If the output from the previous commands mentions a `degraded` state or `errors`, fix all issues
    before proceeding.

2.  Verify that all pods are running:

    ```none
    kubectl get pod -o wide --all-namespaces | grep -vi Running
    ```

    If the output from the previous command lists any pod not in "Running" state, then fix all
    issues before proceeding.

### Install Updates

Select a node on which to perform the following steps:

1.  Retrieve the name of the target node:

    ```none
    kubectl get nodes
    ```

2.  Drain the node:

    ```none
    kubectl drain --delete-local-data --ignore-daemonsets <node_name>
    ```

3.  After the node is drained, identify the gravity unit name:

    ```none
    sudo systemctl list-units --plain | awk '/planet-master/{print $1}'
    ```

    The previous command outputs a `systemd` unit name, which is used as the `$unit_name` value in
    the following step.

4.  Stop the gravity unit:

    ```none
    systemctl stop $unit_name
    systemctl status $unit_name
    ```

5.  After the `status` subcommand indicates that the gravity unit is stopped, install the updates
    and reboot the server.

### Perform Post-update Verification

1.  Verify that all systems correctly restarted:

    ```none
    systemctl status --failed
    ```

    The previous command should return zero units, which means that your system restart was
    successful and all units started. If any units failed to start, fix all issues before
    proceeding.

2.  Check the gravity `systemd` units:

    ```none
    systemctl list-units '*gravity__gravitational*'
    ```

3.  Check for errors in the logs by running `journalctl`.

4.  If everything started correctly, run `gravity enter` and verify the results.

5.  Check the cluster status again:

    ```none
    gravity status
    etcdctl cluster-health
    gravity get pod -o wide--all-namespaces | grep -vi Running
    ```

### Rejoin the Node

1.  Check the gravity Planet service and teleport status:

    ```none
    systemctl list-units '*gravity__gravitational*'
    ```

2.  If the status of the gravity service is not `loaded`, `active`, or `running`, then you must
    enable it:

    ```none
    systemctl enable --now <name_of_the_gravity_unit>
    ```

3.  Uncordon the node to set the target node to again schedule pods. This can take a few minutes to
    complete.

    ```none
    kubectl uncordon <node_name>
    ```

4.  Verify cluster status:

    ```none
    gravity status
    ```

    This command should display a `healthy` status for all nodes of the cluster. After you verify
    that the node has rejoined the cluster and is in healthy status, repeat the process for the next
    node in the cluster until all nodes are updated.

<!-- document id=9fbcde608c06076467485870b33728e79dd8c97107d0430fd549c7a6e88144b6 url=/mulesoft/current/en-us/private-cloud/4.0/restarting-a-node.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.0
---

# Updating Nodes

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

> [!NOTE] Where possible, we changed noninclusive terms to align with our company value of Equality.
> We maintained certain terms to avoid any effect on customer implementations.

## Before You Begin

- Set up and test the backup procedure on all clusters.

- Perform a backup before attempting node maintenance to preserve data in the event of a failure.

## Update Nodes for Clusters

See the following topics for details on each provider:

- [Rancher Kubernetes Engine (RKE2) OS Upgrade Process](https://support.scc.suse.com/s/redirect?language=en_US&id=000021301)

- OpenShift: Starting with version 4.16, the Machine Config Operator manages the node’s OS updates
  as part of the cluster update process. For more on node updates and the Machine Config Operator,
  see:

  - [Openshift Updates](https://docs.openshift.com/en/container-platform/4.16/updating/understanding_updates/intro-to-updates.html)

  - [Openshift Update Service](https://docs.openshift.com/en/container-platform/4.16/updating/understanding_updates/intro-to-updates.html#update-service-about_understanding-openshift-updates)

  - [Machine Config Operator Functionality](https://docs.openshift.com/en/container-platform/4.16/updating/understanding_updates/how-updates-work.html)

## See Also

- [Managing Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/4.0/operating-about)

<!-- document id=1a67bd1bbcabfa1d25dbf6d47ada9566cef329fd5b47a7de485b11d6cd979cc0 url=/mulesoft/current/en-us/private-cloud/4.1/restarting-a-node.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.1
---

# Updating Nodes

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

> [!NOTE] Where possible, we changed noninclusive terms to align with our company value of Equality.
> We maintained certain terms to avoid any effect on customer implementations.

## Before You Begin

- Set up and test the backup procedure on all clusters.

- Perform a backup before attempting node maintenance to preserve data in the event of a failure.

## Update Nodes for Clusters

See the following topics for details on each provider:

- [Rancher Kubernetes Engine (RKE2) OS Upgrade Process](https://support.scc.suse.com/s/redirect?language=en_US&id=000021301)

- OpenShift: Starting with version 4.16, the Machine Config Operator manages the node’s OS updates
  as part of the cluster update process. For more on node updates and the Machine Config Operator,
  see:

  - [Openshift Updates](https://docs.openshift.com/en/container-platform/4.16/updating/understanding_updates/intro-to-updates.html)

  - [Openshift Update Service](https://docs.openshift.com/en/container-platform/4.16/updating/understanding_updates/intro-to-updates.html#update-service-about_understanding-openshift-updates)

  - [Machine Config Operator Functionality](https://docs.openshift.com/en/container-platform/4.16/updating/understanding_updates/how-updates-work.html)

## See Also

- [Managing Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/4.1/operating-about)

<!-- document id=c4a11373b0e749e16bcedf44cb472effb105e0f773328f73d267ac7c15dea981 url=/mulesoft/current/en-us/private-cloud/4.2/restarting-a-node.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.2
---

# Updating Nodes

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

> [!NOTE] Where possible, we changed noninclusive terms to align with our company value of Equality.
> We maintained certain terms to avoid any effect on customer implementations.

## Before You Begin

- Set up and test the backup procedure on all clusters.

- Perform a backup before attempting node maintenance to preserve data in the event of a failure.

## Update Nodes for Clusters

See the following topics for details on each provider:

- [Rancher Kubernetes Engine (RKE2) OS Upgrade Process](https://support.scc.suse.com/s/redirect?language=en_US&id=000021301)

- OpenShift: Starting with version 4.16, the Machine Config Operator manages the node’s OS updates
  as part of the cluster update process. For more on node updates and the Machine Config Operator,
  see:

  - [Openshift Updates](https://docs.openshift.com/en/container-platform/4.16/updating/understanding_updates/intro-to-updates.html)

  - [Openshift Update Service](https://docs.openshift.com/en/container-platform/4.16/updating/understanding_updates/intro-to-updates.html#update-service-about_understanding-openshift-updates)

  - [Machine Config Operator Functionality](https://docs.openshift.com/en/container-platform/4.16/updating/understanding_updates/how-updates-work.html)

## See Also

- [Managing Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/4.2/operating-about)

<!-- document id=5a9cef81170f815ffe3b644d677ba3351929b7be8a658b1e87846f7b19d35283 url=/mulesoft/current/en-us/private-cloud/latest/restarting-a-node.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.3
is-latest-version: true
---

# Updating Nodes

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

> [!NOTE] Where possible, we changed noninclusive terms to align with our company value of Equality.
> We maintained certain terms to avoid any effect on customer implementations.

## Before You Begin

- Set up and test the backup procedure on all clusters.

- Perform a backup before attempting node maintenance to preserve data in the event of a failure.

## Update Nodes for Clusters

See the following topics for details on each provider:

- [Rancher Kubernetes Engine (RKE2) OS Upgrade Process](https://support.scc.suse.com/s/redirect?language=en_US&id=000021301)

- OpenShift: Starting with version 4.16, the Machine Config Operator manages the node’s OS updates
  as part of the cluster update process. For more on node updates and the Machine Config Operator,
  see:

  - [Openshift Updates](https://docs.openshift.com/en/container-platform/4.16/updating/understanding_updates/intro-to-updates.html)

  - [Openshift Update Service](https://docs.openshift.com/en/container-platform/4.16/updating/understanding_updates/intro-to-updates.html#update-service-about_understanding-openshift-updates)

  - [Machine Config Operator Functionality](https://docs.openshift.com/en/container-platform/4.16/updating/understanding_updates/how-updates-work.html)

## See Also

- [Managing Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/latest/operating-about)

<!-- document id=ca20e38853e468431c8bfdaf36f916292b998c7a59b7a02dc1c6258c48826353 url=/mulesoft/current/en-us/private-cloud/3.2/upgrade.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 3.2
---

# Upgrade Workflow

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

## MuleSoft Professional Services Required

Contact MuleSoft professional services prior to upgrading. MuleSoft professional services must be
involved throughout the upgrade process.

Before an Anypoint Platform Private Cloud Edition (Anypoint Platform PCE) upgrade is performed, you
must verify that your working installation meets any additional requirements of the new Anypoint
Platform PCE version, such as opening additional ports or adding a new port for the load balancer.

> [!NOTE] When upgrading from a previous Anypoint Platform PCE version, all policies available in
> the previous version remain. Policies are not replaced, but additional policies might be included
> with the upgrade.

Refer to [About Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/3.2/) for additional information about policies included with
Anypoint Platform PCE.

Refer to the
[Anypoint Platform Private Cloud Edition Release Notes](https://docs.mulesoft.com/release-notes/pce/anypoint-private-cloud-release-notes)
for additional information about the most recent Anypoint Platform PCE version.

<!-- document id=badd5dcb134fe367bc6570663620658af9b9db189187a1e00b648688a926d911 url=/mulesoft/current/en-us/private-cloud/4.0/upgrade.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.0
---

# Upgrading Anypoint Platform PCE v3.2.3 to v4.0.0

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Before you upgrade Anypoint Platform Private Cloud Edition (Anypoint Platform PCE) to version 4.0,
verify that your working installation meets any additional requirements of the new Anypoint Platform
PCE version. Note that if your Anypoint Platform PCE version is earlier than version 3.2.3, you must
first upgrade to version 3.2.3 and then upgrade to version 4.0.

See the following topics:

- [Anypoint Platform PCE Overview](https://docs.mulesoft.com/private-cloud/4.0/)

- [Anypoint Platform PCE Prerequisites](https://docs.mulesoft.com/private-cloud/4.0/install-checklist)

> [!NOTE] Contact MuleSoft professional services prior to upgrading. MuleSoft professional services
> must be involved throughout the upgrade process.

## See Also

- [Anypoint Platform PCE Overview](https://docs.mulesoft.com/private-cloud/4.0/)

- [Installing Anypoint Platform Private Cloud Edition (Anypoint Platform PCE)](https://docs.mulesoft.com/private-cloud/4.0/install-workflow)

<!-- document id=ba541bd5fa572a3c0aa0620877a3ea994ceb21c9af03dd28aad6e644b51b5202 url=/mulesoft/current/en-us/private-cloud/4.1/upgrade.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.1
---

# Upgrading Anypoint Platform PCE v3.2.5 to v4.1.x

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

Before you upgrade Anypoint Platform Private Cloud Edition (Anypoint Platform PCE) to version 4.1,
verify that your working installation meets any additional requirements of the new Anypoint Platform
PCE version. If your current PCE version is earlier than 3.2.4, upgrade to 3.2.5 to minimize
potential issues.

See the following topics:

- [Anypoint Platform PCE Overview](https://docs.mulesoft.com/private-cloud/4.1/)

- [Anypoint Platform PCE Prerequisites](https://docs.mulesoft.com/private-cloud/4.1/install-checklist)

> [!NOTE] Contact MuleSoft professional services prior to upgrading. MuleSoft professional services
> must be involved throughout the upgrade process.

## See Also

- [Anypoint Platform PCE Overview](https://docs.mulesoft.com/private-cloud/4.1/)

- [Installing Anypoint Platform Private Cloud Edition (Anypoint Platform PCE)](https://docs.mulesoft.com/private-cloud/4.1/install-workflow)

<!-- document id=31feb6f4071335d4f1537c346d85893c9b36591108f332bedc9890d7cb768298 url=/mulesoft/current/en-us/private-cloud/3.2/custom-policies.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 3.2
---

# Upload Custom Policies and Publish Assets to Exchange Using the Maven Client

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

There are differences between Anypoint Platform Private Cloud Edition (Anypoint Platform PCE) and
the cloud version of Anypoint Platform that you must consider when uploading custom policies and
publishing assets to Anypoint Exchange using the Maven client.

See the following documentation for the cloud version of Anypoint Platform for details:

- [Getting started with Custom Policies development](https://docs.mulesoft.com/mule-gateway/policies-custom-getting-started)

- [Uploading Custom Policies](https://docs.mulesoft.com/mule-gateway/policies-custom-upload-to-exchange)

- [Maven facade API](https://anypoint.mulesoft.com/exchange/portals/anypoint-platform/f1e97bc6-315a-4490-82a7-23abe036327a.anypoint-platform/exchange-maven-facade-api-http/)

Perform the following steps for Anypoint Platform PCE:

1.  Add the server and repository sections in the `settings.xml` file to set up the archetype for
    your project:

    The following snippet shows the relevant sections:

    ```xml
        ...
        <server>
           <id>apce-repository</id>
           <username>myusername</username>
           <password>mypassword</password>
        </server>
        ...
        <repository>
           <id>apce-repository</id>
           <name>Anypoint PCE Repository</name>
           <url>https://${ANYPOINT_DNS}/exchange/maven</url>
        </repository>
        ...
    ```

    In the following examples, ${ANYPOINT\_DNS} is set to your DNS for Anypoint Platform PCE. The
    `username` and `password` must correspond with your installation.

2.  Generate the archetype:

    Follow the standard process:
    [Getting started with Custom Policies development](https://docs.mulesoft.com/mule-gateway/policies-custom-getting-started).
    For example:

    mvn -Parchetype-repository archetype:generate \\ -DarchetypeGroupId=org.mule.tools \\
    -DarchetypeArtifactId=api-gateway-custom-policy-archetype \\ -DarchetypeVersion=1.0.0 \\
    -DgroupId=${orgId} \\
    -DartifactId=${policyName} \\ -Dversion=1.0.0-SNAPSHOT \\
    -Dpackage=mule-policy

3.  Replace the `exchange.url` in the `pom.xml` file. By default, `exchange.url` points to the cloud
    version of Anypoint Platform. `maven.anypoint.mulesoft.com` must point to the Anypoint Platform
    PCE endpoint:

    <exchange.url>https://${ANYPOINT\_DNS}/exchange/maven/api/v1/organizations/${orgId}/maven</exchange.url>

    The `repositoryId` must match the one you configured for Maven in the `settings.xml` file.

4.  Package the custom policy.

    Follow the same process as documented for the cloud version of Anypoint Platform in
    [Packaging a Custom Policy](https://docs.mulesoft.com/mule-gateway/policies-custom-package).

5.  Upload the custom policy.

    Follow the same process as documented for the cloud version of Anypoint Platform in
    [Uploading a Custom Policy to Exchange](https://docs.mulesoft.com/mule-gateway/policies-custom-upload-to-exchange).

    If you receive an error similar to:

    \[ERROR\] Failed to execute goal org.apache.maven.plugins:maven-deploy-plugin:2.8.2:deploy
    (default-deploy) on project
    ${policyName}:
    Failed to retrieve remote metadata ${groupId}:${policyName}:1.0.0-SNAPSHOT/maven-metadata.xml: Could not transfer metadata ${orgId}:${policyName}:1.0.0-SNAPSHOT/maven-metadata.xml from/to exchange-server (https://${ANYPOINT\_DNS}/exchange/maven/api/v1/organizations/${orgId}/maven):
    PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to
    find valid certification path to requested target -> \[Help 1\]

    This means the certificate of the platform is not trusted by the local Maven. The solution is to
    trust the certificate in the environment where Maven is running, as shown in the following
    example:

    keytool -printcert -sslserver ${ANYPOINT\_DNS}:443 -rfc > /tmp/anypoint.crt keytool -importcert
    -alias my-company.com -keystore /etc/ssl/certs/java/cacerts -storepass changeit -file
    /tmp/anypoint.crt

    In the previous example, $ANYPOINT\_DNS is set to the DNS for Anypoint Platform PCE. Replace the
    location and password for your JVM’s truststore.

6.  Verify your policy was uploaded by directly visiting
    `https://${ANYPOINT_DNS}/exchange/?type=policy` or
    `https://${ANYPOINT_DNS}/exchange/${orgID}/${artifactId}/`.

    For an API managed by Mule 4 or later, the policy is displayed in the **Apply Policy** dialog.

<!-- document id=c4d53fe8a3b1cb60c0a7d54c6d7c7cbc09f16ac03c6ea594b2321fcea2b150da url=/mulesoft/current/en-us/private-cloud/4.0/custom-policies.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.0
---

# Uploading Custom Policies and Publish Assets to Exchange Using the Maven Client

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

There are differences between Anypoint Platform Private Cloud Edition (Anypoint Platform PCE) and
the cloud version of Anypoint Platform that you must consider when uploading custom policies and
publishing assets to Anypoint Exchange using the Maven client.

For details of the cloud version of Anypoint Platform, see:

- [Getting started with Custom Policies development](https://docs.mulesoft.com/mule-gateway/policies-custom-getting-started)

- [Uploading Custom Policies](https://docs.mulesoft.com/mule-gateway/policies-custom-upload-to-exchange)

- [Maven facade API](https://anypoint.mulesoft.com/exchange/portals/anypoint-platform/f1e97bc6-315a-4490-82a7-23abe036327a.anypoint-platform/exchange-maven-facade-api-http/)

Perform the following steps for Anypoint Platform PCE:

1.  Add the server and repository sections in the `settings.xml` file to set up the archetype for
    your project:

    The following snippet shows the relevant sections:

    ```xml
        ...
        <server>
           <id>apce-repository</id>
           <username>myusername</username>
           <password>mypassword</password>
        </server>
        ...
        <repository>
           <id>apce-repository</id>
           <name>Anypoint PCE Repository</name>
           <url>https://${ANYPOINT_DNS}/exchange/maven</url>
        </repository>
        ...
    ```

    In the following examples, ${ANYPOINT\_DNS} is set to your DNS for Anypoint Platform PCE. The
    `username` and `password` must correspond with your installation.

2.  Generate the archetype:

    Follow the standard process:
    [Getting started with Custom Policies development](https://docs.mulesoft.com/mule-gateway/policies-custom-getting-started).
    For example:

    mvn -Parchetype-repository archetype:generate \\ -DarchetypeGroupId=org.mule.tools \\
    -DarchetypeArtifactId=api-gateway-custom-policy-archetype \\ -DarchetypeVersion=1.0.0 \\
    -DgroupId=${orgId} \\
    -DartifactId=${policyName} \\ -Dversion=1.0.0-SNAPSHOT \\
    -Dpackage=mule-policy

3.  Replace the `exchange.url` in the `pom.xml` file. By default, `exchange.url` points to the cloud
    version of Anypoint Platform. `maven.anypoint.mulesoft.com` must point to the Anypoint Platform
    PCE endpoint:

    <exchange.url>https://${ANYPOINT\_DNS}/exchange/maven/api/v1/organizations/${orgId}/maven</exchange.url>

    The `repositoryId` must match the one you configured for Maven in the `settings.xml` file.

4.  Package the custom policy.

    Follow the same process as documented for the cloud version of Anypoint Platform in
    [Packaging a Custom Policy](https://docs.mulesoft.com/mule-gateway/policies-custom-package).

5.  Upload the custom policy.

    Follow the same process as documented for the cloud version of Anypoint Platform in
    [Uploading a Custom Policy to Exchange](https://docs.mulesoft.com/mule-gateway/policies-custom-upload-to-exchange).

    If you receive an error similar to:

    \[ERROR\] Failed to execute goal org.apache.maven.plugins:maven-deploy-plugin:2.8.2:deploy
    (default-deploy) on project
    ${policyName}:
    Failed to retrieve remote metadata ${groupId}:${policyName}:1.0.0-SNAPSHOT/maven-metadata.xml: Could not transfer metadata ${orgId}:${policyName}:1.0.0-SNAPSHOT/maven-metadata.xml from/to exchange-server (https://${ANYPOINT\_DNS}/exchange/maven/api/v1/organizations/${orgId}/maven):
    PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to
    find valid certification path to requested target -> \[Help 1\]

    This means the certificate of the platform is not trusted by the local Maven. The solution is to
    trust the certificate in the environment where Maven is running, as shown in the following
    example:

    keytool -printcert -sslserver ${ANYPOINT\_DNS}:443 -rfc > /tmp/anypoint.crt keytool -importcert
    -alias my-company.com -keystore /etc/ssl/certs/java/cacerts -storepass changeit -file
    /tmp/anypoint.crt

    In the previous example, $ANYPOINT\_DNS is set to the DNS for Anypoint Platform PCE. Replace the
    location and password for your JVM’s truststore.

6.  Verify your policy was uploaded by directly visiting
    `https://${ANYPOINT_DNS}/exchange/?type=policy` or
    `https://${ANYPOINT_DNS}/exchange/${orgID}/${artifactId}/`.

    For an API managed by Mule 4 or later, the policy is displayed in the **Apply Policy** dialog.

## See Also

- [Managing Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/4.0/operating-about)

<!-- document id=7372b6cc06c20af34ff2af1317e0b4ee7244a552174bf63472223edf7cfd9980 url=/mulesoft/current/en-us/private-cloud/4.1/custom-policies.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.1
---

# Uploading Custom Policies and Publish Assets to Exchange Using the Maven Client

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

There are differences between Anypoint Platform Private Cloud Edition (Anypoint Platform PCE) and
the cloud version of Anypoint Platform that you must consider when uploading custom policies and
publishing assets to Anypoint Exchange using the Maven client.

For details of the cloud version of Anypoint Platform, see:

- [Getting started with Custom Policies development](https://docs.mulesoft.com/mule-gateway/policies-custom-getting-started)

- [Uploading Custom Policies](https://docs.mulesoft.com/mule-gateway/policies-custom-upload-to-exchange)

- [Maven facade API](https://anypoint.mulesoft.com/exchange/portals/anypoint-platform/f1e97bc6-315a-4490-82a7-23abe036327a.anypoint-platform/exchange-maven-facade-api-http/)

Perform the following steps for Anypoint Platform PCE:

1.  Add the server and repository sections in the `settings.xml` file to set up the archetype for
    your project:

    The following snippet shows the relevant sections:

    ```xml
        ...
        <server>
           <id>apce-repository</id>
           <username>myusername</username>
           <password>mypassword</password>
        </server>
        ...
        <repository>
           <id>apce-repository</id>
           <name>Anypoint PCE Repository</name>
           <url>https://${ANYPOINT_DNS}/exchange/maven</url>
        </repository>
        ...
    ```

    In the following examples, ${ANYPOINT\_DNS} is set to your DNS for Anypoint Platform PCE. The
    `username` and `password` must correspond with your installation.

2.  Generate the archetype:

    Follow the standard process:
    [Getting started with Custom Policies development](https://docs.mulesoft.com/mule-gateway/policies-custom-getting-started).
    For example:

    mvn -Parchetype-repository archetype:generate \\ -DarchetypeGroupId=org.mule.tools \\
    -DarchetypeArtifactId=api-gateway-custom-policy-archetype \\ -DarchetypeVersion=1.0.0 \\
    -DgroupId=${orgId} \\
    -DartifactId=${policyName} \\ -Dversion=1.0.0-SNAPSHOT \\
    -Dpackage=mule-policy

3.  Replace the `exchange.url` in the `pom.xml` file. By default, `exchange.url` points to the cloud
    version of Anypoint Platform. `maven.anypoint.mulesoft.com` must point to the Anypoint Platform
    PCE endpoint:

    <exchange.url>https://${ANYPOINT\_DNS}/exchange/maven/api/v1/organizations/${orgId}/maven</exchange.url>

    The `repositoryId` must match the one you configured for Maven in the `settings.xml` file.

4.  Package the custom policy.

    Follow the same process as documented for the cloud version of Anypoint Platform in
    [Packaging a Custom Policy](https://docs.mulesoft.com/mule-gateway/policies-custom-package).

5.  Upload the custom policy.

    Follow the same process as documented for the cloud version of Anypoint Platform in
    [Uploading a Custom Policy to Exchange](https://docs.mulesoft.com/mule-gateway/policies-custom-upload-to-exchange).

    If you receive an error similar to:

    \[ERROR\] Failed to execute goal org.apache.maven.plugins:maven-deploy-plugin:2.8.2:deploy
    (default-deploy) on project
    ${policyName}:
    Failed to retrieve remote metadata ${groupId}:${policyName}:1.0.0-SNAPSHOT/maven-metadata.xml: Could not transfer metadata ${orgId}:${policyName}:1.0.0-SNAPSHOT/maven-metadata.xml from/to exchange-server (https://${ANYPOINT\_DNS}/exchange/maven/api/v1/organizations/${orgId}/maven):
    PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to
    find valid certification path to requested target -> \[Help 1\]

    This means the certificate of the platform is not trusted by the local Maven. The solution is to
    trust the certificate in the environment where Maven is running, as shown in the following
    example:

    keytool -printcert -sslserver ${ANYPOINT\_DNS}:443 -rfc > /tmp/anypoint.crt keytool -importcert
    -alias my-company.com -keystore /etc/ssl/certs/java/cacerts -storepass changeit -file
    /tmp/anypoint.crt

    In the previous example, $ANYPOINT\_DNS is set to the DNS for Anypoint Platform PCE. Replace the
    location and password for your JVM’s truststore.

6.  Verify your policy was uploaded by directly visiting
    `https://${ANYPOINT_DNS}/exchange/?type=policy` or
    `https://${ANYPOINT_DNS}/exchange/${orgID}/${artifactId}/`.

    For an API managed by Mule 4 or later, the policy is displayed in the **Apply Policy** dialog.

## See Also

- [Managing Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/4.1/operating-about)

<!-- document id=f06a44430428945b3b2bd409278b8c0a53d209314378b55683e29f35114b682e url=/mulesoft/current/en-us/private-cloud/4.2/custom-policies.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.2
---

# Uploading Custom Policies and Publish Assets to Exchange Using the Maven Client

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

There are differences between Anypoint Platform Private Cloud Edition (Anypoint Platform PCE) and
the cloud version of Anypoint Platform that you must consider when uploading custom policies and
publishing assets to Anypoint Exchange using the Maven client.

For details of the cloud version of Anypoint Platform, see:

- [Getting started with Custom Policies development](https://docs.mulesoft.com/mule-gateway/policies-custom-getting-started)

- [Uploading Custom Policies](https://docs.mulesoft.com/mule-gateway/policies-custom-upload-to-exchange)

- [Maven facade API](https://anypoint.mulesoft.com/exchange/portals/anypoint-platform/f1e97bc6-315a-4490-82a7-23abe036327a.anypoint-platform/exchange-maven-facade-api-http/)

Perform the following steps for Anypoint Platform PCE:

1.  Add the server and repository sections in the `settings.xml` file to set up the archetype for
    your project:

    The following snippet shows the relevant sections:

    ```xml
        ...
        <server>
           <id>apce-repository</id>
           <username>myusername</username>
           <password>mypassword</password>
        </server>
        ...
        <repository>
           <id>apce-repository</id>
           <name>Anypoint PCE Repository</name>
           <url>https://${ANYPOINT_DNS}/exchange/maven</url>
        </repository>
        ...
    ```

    In the following examples, ${ANYPOINT\_DNS} is set to your DNS for Anypoint Platform PCE. The
    `username` and `password` must correspond with your installation.

2.  Generate the archetype:

    Follow the standard process:
    [Getting started with Custom Policies development](https://docs.mulesoft.com/mule-gateway/policies-custom-getting-started).
    For example:

    mvn -Parchetype-repository archetype:generate \\ -DarchetypeGroupId=org.mule.tools \\
    -DarchetypeArtifactId=api-gateway-custom-policy-archetype \\ -DarchetypeVersion=1.0.0 \\
    -DgroupId=${orgId} \\
    -DartifactId=${policyName} \\ -Dversion=1.0.0-SNAPSHOT \\
    -Dpackage=mule-policy

3.  Replace the `exchange.url` in the `pom.xml` file. By default, `exchange.url` points to the cloud
    version of Anypoint Platform. `maven.anypoint.mulesoft.com` must point to the Anypoint Platform
    PCE endpoint:

    <exchange.url>https://${ANYPOINT\_DNS}/exchange/maven/api/v1/organizations/${orgId}/maven</exchange.url>

    The `repositoryId` must match the one you configured for Maven in the `settings.xml` file.

4.  Package the custom policy.

    Follow the same process as documented for the cloud version of Anypoint Platform in
    [Packaging a Custom Policy](https://docs.mulesoft.com/mule-gateway/policies-custom-package).

5.  Upload the custom policy.

    Follow the same process as documented for the cloud version of Anypoint Platform in
    [Uploading a Custom Policy to Exchange](https://docs.mulesoft.com/mule-gateway/policies-custom-upload-to-exchange).

    If you receive an error similar to:

    \[ERROR\] Failed to execute goal org.apache.maven.plugins:maven-deploy-plugin:2.8.2:deploy
    (default-deploy) on project
    ${policyName}:
    Failed to retrieve remote metadata ${groupId}:${policyName}:1.0.0-SNAPSHOT/maven-metadata.xml: Could not transfer metadata ${orgId}:${policyName}:1.0.0-SNAPSHOT/maven-metadata.xml from/to exchange-server (https://${ANYPOINT\_DNS}/exchange/maven/api/v1/organizations/${orgId}/maven):
    PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to
    find valid certification path to requested target -> \[Help 1\]

    This means the certificate of the platform is not trusted by the local Maven. The solution is to
    trust the certificate in the environment where Maven is running, as shown in the following
    example:

    keytool -printcert -sslserver ${ANYPOINT\_DNS}:443 -rfc > /tmp/anypoint.crt keytool -importcert
    -alias my-company.com -keystore /etc/ssl/certs/java/cacerts -storepass changeit -file
    /tmp/anypoint.crt

    In the previous example, $ANYPOINT\_DNS is set to the DNS for Anypoint Platform PCE. Replace the
    location and password for your JVM’s truststore.

6.  Verify your policy was uploaded by directly visiting
    `https://${ANYPOINT_DNS}/exchange/?type=policy` or
    `https://${ANYPOINT_DNS}/exchange/${orgID}/${artifactId}/`.

    For an API managed by Mule 4 or later, the policy is displayed in the **Apply Policy** dialog.

## See Also

- [Managing Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/4.2/operating-about)

<!-- document id=4b379ba47481432275b74eced0320344cbbcd3c96f70a9447c11cd908d1f3498 url=/mulesoft/current/en-us/private-cloud/latest/custom-policies.md -->

---
product: Anypoint Platform Private Cloud Edition
version: 4.3
is-latest-version: true
---

# Uploading Custom Policies and Publish Assets to Exchange Using the Maven Client

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

There are differences between Anypoint Platform Private Cloud Edition (Anypoint Platform PCE) and
the cloud version of Anypoint Platform that you must consider when uploading custom policies and
publishing assets to Anypoint Exchange using the Maven client.

For details of the cloud version of Anypoint Platform, see:

- [Getting started with Custom Policies development](https://docs.mulesoft.com/mule-gateway/policies-custom-getting-started)

- [Uploading Custom Policies](https://docs.mulesoft.com/mule-gateway/policies-custom-upload-to-exchange)

- [Maven facade API](https://anypoint.mulesoft.com/exchange/portals/anypoint-platform/f1e97bc6-315a-4490-82a7-23abe036327a.anypoint-platform/exchange-maven-facade-api-http/)

Perform the following steps for Anypoint Platform PCE:

1.  Add the server and repository sections in the `settings.xml` file to set up the archetype for
    your project:

    The following snippet shows the relevant sections:

    ```xml
        ...
        <server>
           <id>apce-repository</id>
           <username>myusername</username>
           <password>mypassword</password>
        </server>
        ...
        <repository>
           <id>apce-repository</id>
           <name>Anypoint PCE Repository</name>
           <url>https://${ANYPOINT_DNS}/exchange/maven</url>
        </repository>
        ...
    ```

    In the following examples, ${ANYPOINT\_DNS} is set to your DNS for Anypoint Platform PCE. The
    `username` and `password` must correspond with your installation.

2.  Generate the archetype:

    Follow the standard process:
    [Getting started with Custom Policies development](https://docs.mulesoft.com/mule-gateway/policies-custom-getting-started).
    For example:

    mvn -Parchetype-repository archetype:generate \\ -DarchetypeGroupId=org.mule.tools \\
    -DarchetypeArtifactId=api-gateway-custom-policy-archetype \\ -DarchetypeVersion=1.0.0 \\
    -DgroupId=${orgId} \\
    -DartifactId=${policyName} \\ -Dversion=1.0.0-SNAPSHOT \\
    -Dpackage=mule-policy

3.  Replace the `exchange.url` in the `pom.xml` file. By default, `exchange.url` points to the cloud
    version of Anypoint Platform. `maven.anypoint.mulesoft.com` must point to the Anypoint Platform
    PCE endpoint:

    <exchange.url>https://${ANYPOINT\_DNS}/exchange/maven/api/v1/organizations/${orgId}/maven</exchange.url>

    The `repositoryId` must match the one you configured for Maven in the `settings.xml` file.

4.  Package the custom policy.

    Follow the same process as documented for the cloud version of Anypoint Platform in
    [Packaging a Custom Policy](https://docs.mulesoft.com/mule-gateway/policies-custom-package).

5.  Upload the custom policy.

    Follow the same process as documented for the cloud version of Anypoint Platform in
    [Uploading a Custom Policy to Exchange](https://docs.mulesoft.com/mule-gateway/policies-custom-upload-to-exchange).

    If you receive an error similar to:

    \[ERROR\] Failed to execute goal org.apache.maven.plugins:maven-deploy-plugin:2.8.2:deploy
    (default-deploy) on project
    ${policyName}:
    Failed to retrieve remote metadata ${groupId}:${policyName}:1.0.0-SNAPSHOT/maven-metadata.xml: Could not transfer metadata ${orgId}:${policyName}:1.0.0-SNAPSHOT/maven-metadata.xml from/to exchange-server (https://${ANYPOINT\_DNS}/exchange/maven/api/v1/organizations/${orgId}/maven):
    PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to
    find valid certification path to requested target -> \[Help 1\]

    This means the certificate of the platform is not trusted by the local Maven. The solution is to
    trust the certificate in the environment where Maven is running, as shown in the following
    example:

    keytool -printcert -sslserver ${ANYPOINT\_DNS}:443 -rfc > /tmp/anypoint.crt keytool -importcert
    -alias my-company.com -keystore /etc/ssl/certs/java/cacerts -storepass changeit -file
    /tmp/anypoint.crt

    In the previous example, $ANYPOINT\_DNS is set to the DNS for Anypoint Platform PCE. Replace the
    location and password for your JVM’s truststore.

6.  Verify your policy was uploaded by directly visiting
    `https://${ANYPOINT_DNS}/exchange/?type=policy` or
    `https://${ANYPOINT_DNS}/exchange/${orgID}/${artifactId}/`.

    For an API managed by Mule 4 or later, the policy is displayed in the **Apply Policy** dialog.

## See Also

- [Managing Anypoint Platform PCE](https://docs.mulesoft.com/private-cloud/latest/operating-about)