PLANNING

• Understanding Postgres Enterprise Manager components and architecture
  • PEM architecture
    • PEM server
    • PEM agent
    • PEM web application
    • SQL Profiler extension
• Deployment considerations
  • How PEM licensing works
    • Licensing rules
    • Examples
      • Adding PEM to a fully supported environment
      • Adding unsupported servers to PEM
  • PEM server and agent connection management mechanism
    • Without PgBouncer
    • With PgBouncer
  • Authentication options
    • 1. Two-factor authentication (2FA)
    • 2. Kerberos authentication
      • Linux-based kerberos
      • Windows active directory (SSPI)
  • Deciding on an SSL model
    • Certificate management models
  • Securing your deployment
    • Web server security configuration
      • Recommendations applied by default
      • Optimize HTTP headers for security
      • Additional recommendations that can be applied manually
    • PEM application security configurations
      • Session timeout
      • RestAPI header customization
      • Role-based access control in PEM
      • Password management
      • Run PEM agent jobs with a non-root user
      • Changing the PEM agent and PEM backend database server certificates
  • Web server installation options
    • PEM server and web server on separate hosts
    • PEM server and web server on the same host
  • Sizing PEM deployments
    • Factors affecting resource requirements
      • Number of agents/connections
      • Size of frequently accessed data - memory
      • Rate of probe and alert execution - CPU and alert threads
    • PEM t-shirt sizing
  • High availability patterns for PEM deployment
    • Running multiple instances of the PEM backend database
      • A primary
      • Connections must go to the primary
    • Running multiple PEM web application instances
    • Upgrading an HA PEM deployment
    • Load balancers, proxies, and VIPs
      • Using a virtual IP (VIP) managed by the failover manager
      • Using a load balancer
    • Reference architectures
      • C1: Colocated with single endpoint
      • S1: Separated with single endpoint for database
      • CM: Colocated with multi-host connection strings
      • SM: Separated with multi-host connection strings