Skip to content

Releases: cloudfoundry/diego-release

Diego v0.1436.0

14 Oct 00:41
Compare
Choose a tag to compare

Changes from v0.1435.0 to v0.1436.0

Significant changes

BOSH job changes

  • Add benchmark-bbs job for certain Diego benchmarks against the BBS API. As with the acceptance-tests and smoke-tests jobs, this is an errand that runs a test suite. It is not presently suitable to run against a production deployment, as the benchmark suite will alter the BBS database.

BOSH property changes

  • Add properties under benchmark-bbs.* for the BBS-benchmarking errand.

Diego v0.1435.0

09 Oct 08:44
Compare
Choose a tag to compare

Changes from v0.1434.0 to v0.1435.0

Significant changes

BOSH job changes

  • etcd job removed from diego-release in favor of the same job from etcd-release.

BOSH property changes

  • Add diego.stager.insecure_docker_registry_list: List of insecure Docker registries to allow access to when staging.
  • Remove diego.stager.insecure_docker_registry.

Diego 0.1434.0

26 Sep 03:09
Compare
Choose a tag to compare

Changes from 0.1432.0 to 0.1434.0

Breaking changes from 0.1432.0

Buildpack Staging Response

Other significant changes

BOSH job changes

None.

BOSH property changes

  • Add parameters for tuning SSL connections between BBS clients and servers:
    • Properties:
      • diego.*.bbs.client_session_cache_size: Size of session ID cache for component's BBS client to maintain.
      • diego.*.bbs.max_idle_conns_per_host: Number of idle connections for each BBS client to maintain to BBS servers
    • Jobs:
      • auctioneer
      • converger
      • nsync
      • rep
      • route_emitter
      • ssh_proxy
      • stager
      • tps
  • Add diego.bbs.etcd.client_session_cache_size: Size of session ID cache for BBS's etcd client to maintain.
  • Add diego.bbs.etcd.max_idle_conns_per_host: Number of idle connections for BBS's etcd client to maintain to etcd.

Overrides of garden-linux-release property defaults

The spiff-based manifest-generation templates in diego-release provide values for the following properties in garden-linux-release:

  • garden.enable_graph_cleanup: Default to true.
  • garden.persistent_image_list: Default to ["/var/vcap/packages/rootfs_cflinuxfs2/rootfs"]

Values in the property-overrides.yml stub can override both of these defaults.

Diego 0.1433.0

25 Sep 06:00
Compare
Choose a tag to compare
Create final release 0.1433.0

Diego 0.1432.0

24 Sep 07:36
Compare
Choose a tag to compare

Changes from 0.1431.0 to 0.1432.0

Breaking changes from 0.1431.0

SSH Authentication to CF Instances

Associated to Diego story "The Diego SSH Proxy no longer accepts a user's access token as an SSH password for CF app instances".

Diego's SSH proxy no longer accepts a CF user's access token as a password for access to a CF app instance. It will instead accept only a one-time authorization code issued by UAA for its client. This client must also be registered with the UAA: for example, this client is registered for BOSH-lite deployments. As long as the name of the client is ssh-proxy, CC will advertise the correct client name in its /v2/info endpoint, and the Diego manifest-generation templates will flow the client secret to the SSH Proxy job.

For SSH access to CF app instances running on this release, we recommend you upgrade to version 0.2.0 or later of the Diego SSH plugin, or consult the diego-ssh repo for the current curl-based instructions to request a code from UAA.

Other significant changes

SSH

Performance

Misc

BOSH job changes

  • Remove receptor job. The Lattice team has taken ownership of the receptor component and will be maintaining it from now on.

BOSH property changes

  • Add diego.ssh_proxy.uaa_token_url: URL for the SSH proxy to use to request an access token from the UAA in exchange for its one-time auth code.
  • Add diego.ssh_proxy.uaa_secret: Client secret for the SSH proxy to supply to UAA.
  • Remove all properties under diego.receptor.

Diego 0.1431.0

21 Sep 14:56
Compare
Choose a tag to compare

Changes from 0.1430.0 to 0.1431.0

Breaking changes

Auction request payloads

Associated to Diego story "The auction should only send resources and identifiers back and forth". This may cause instance downtime during an upgrade from 0.1430.0 and earlier.

Mutual SSL Auth to BBS

Associated to Diego story "All communication with the BBS should be secured via mutually-authenticated SSL". By default, the BBS will now require mutual SSL authentication for access to its API endpoints. If this is enabled, components on an older release will be unable to communicate with the BBS when deploying an update, so cells may be unable to evacuate.

To configure the BBS with SSL correctly, it is easiest to use the scripts/generate-bbs-certs script to generate a CA certificate and key and certificates and keys for the BBS server and its clients. The contents of these certificates and client and server keys must then be included in the deployment manifest. If using the spiff-based manifest-generation tooling, these values can be included in the property-overrides.yml stub once and will flow to the BBS server and its clients.

Significant changes

BOSH job changes

  • Added vizzini job to run the vizzini test suite as an errand.

BOSH property changes

  • Added acceptance_tests.skip_ssh_without_plugin_tests: When true, skip SSH DATs that do not use the SSH plugin.
  • Added properties for vizzini job:
    • vizzini.bbs.api_location: Address for vizzini to reach the BBS.
    • vizzini.routable_domain_suffix: Domain to use for vizzini to register routes during the test.
    • vizzini.nodes: Number of tests to run in parallel.
    • vizzini.verbose: Whether to log verbosely during the test run.
  • Added BBS encryption properties:
    • diego.bbs.encryption_keys: List of label/passphrase pairs available to the BBS for encryption.
    • diego.bbs.active_key_label: Label of the encryption key to be used to encrypt the database.
  • Added BBS mutual SSL auth properties:
    • Properties for BBS server job:
      • diego.bbs.require_ssl: whether the BBS requires SSL for communication.
      • diego.bbs.ca_cert: CA certificate used to sign BBS client and server SSL certificates.
      • diego.bbs.server_cert: SSL certificate that the BBS presents.
      • diego.bbs.server_key: Private key paired with the BBS's SSL certificate.
    • New BBS properties for client jobs:
      • Properties:
        • diego.*.bbs.ca_cert
        • diego.*.bbs.client_cert
        • diego.*.bbs.client_key
        • diego.*.bbs.require_ssl
      • Jobs:
        • auctioneer
        • converger
        • nsync
        • receptor
        • rep
        • route_emitter
        • ssh_proxy
        • stager
        • tps
        • vizzini
  • Changed diego.*.bbs.api_url to diego.*.bbs.api_location for all jobs using the old property.
  • Removed etcd communication properties from Diego core jobs:
    • Properties:
      • diego.*.etcd.machines
      • diego.*.etcd.ca_cert
      • diego.*.etcd.client_cert
      • diego.*.etcd.client_key
      • diego.*.etcd.require_ssl
    • Jobs:
      • auctioneer
      • converger
      • receptor
      • rep

Diego 0.1430.0

11 Sep 16:51
Compare
Choose a tag to compare

Version 0.1430.0 of Diego is recommended for use with CF v218.

Changes from 0.1428.0 to 0.1430.0

Configuration notes

  • If upgrading from 0.1428.0 to 0.1430.0, we recommend you to deploy 0.1428.0 with the diego.bbs.serialization_format BOSH property set to proto. 0.1430.0 contains a BBS migration that encodes all the data in etcd as protobufs, which the first BBS server that receives the update will run. Setting this property to proto in advance guarantees that the other BBS servers will not accidentally write JSON-encoded records back into etcd before they also update to 0.1430.0. Note that unfortunately this property is not configurable via the manifest-generation templates in 0.1428.0, but it can be added directly to the properties section of the BOSH manifest.

Significant changes

BOSH job changes

  • Remove runtime_metrics_server job: the BBS server now emits Task and LRP metrics during convergence, and periodically emits etcd metrics.

BOSH property changes

  • Add diego.nsync.bbs.api_url: Address for the Nsync processes to contact the BBS server.
  • Add diego.route_emitter.bbs.api_url: Address for the Route-Emitter to contact the BBS server.
  • Add diego.ssh_proxy.bbs.api_url: Address for the SSH-Proxy to contact the BBS server.
  • Add diego.ssh_proxy.diego_credentials: Credentials to be used with the Diego authentication method.
  • Add diego.tps.bbs.api_url: Address for the TPS processes to contact the BBS server.
  • Remove diego.bbs.serialization_format.
  • Remove diego.nsync.diego_api_url.
  • Remove diego.route_emitter.diego_api_url.
  • Remove diego.ssh_proxy.diego_api_url.
  • Remove diego.tps.diego_api_url.

Diego 0.1429.0

11 Sep 15:01
Compare
Choose a tag to compare
Create final release 0.1429.0

Diego 0.1428.0

10 Sep 18:50
Compare
Choose a tag to compare

Version 0.1428.0 of Diego is recommended for use with CF v217.

Changes from 0.1412.0 to 0.1428.0

Breaking changes

Other significant changes

BOSH job changes

  • Add cc_uploader job: contains cc-upload-brokering handlers formerly present in the file-server.
  • Add rootfses job: unpackages the cflinuxfs2 rootfs.
  • Remove garden-linux job.

BOSH property changes

  • Move diego.file_server.cc.* to diego.cc_uploader.cc.*
    • This includes: diego.cc_uploader.cc.base_url,
      diego.cc_uploader.cc.basic_auth_password,
      diego.cc_uploader.cc.job_polling_interval_in_seconds,
      diego.cc_uploader.cc.staging_upload_user and
      diego.cc_uploader.cc.staging_upload_password.
    • Also keeps diego.file_server.log_level and diego.cc_uploader.log_level
      available.
  • Add diego.cc_uploader.address: Address on which cc-uploader handles requests.
  • Add diego.cc_uploader.debug_addr: Address for cc-uploader debug server.
  • Add diego.cc_uploader.cc.external_port: CC Port for cc-uploader.
  • Add diego.rep.evacuation_timeout_in_seconds: The time to wait for evacuation to complete in seconds.
  • Add diego.bbs.serialization_format: Default format for BBS records.
  • Add diego.converger.bbs.api_url: Address for the converger to contact the BBS server.
  • Add diego.stager.bbs.api_url: Address for the stager to contact the BBS server.
  • Add diego.stager.cc_uploader_url: Address for the stager to contact the cc-uploader.
  • Add diego.stager.docker_registry_address: Address for stager to contact the caching docker registry.
  • Remove diego.auctioneer.receptor_task_handler_url.
  • Remove diego.converger.receptor_task_handler_url.
  • Remove diego.rep.receptor_task_handler_url.
  • Remove diego.stager.diego_api_url.
  • Remove diego.executor.allow_privileged: Executor now always allows privileged actions (those running as 'root').
  • Remove diego.garden-linux in favor of garden:
    • diego.garden-linux.listen_network => garden.listen_network
    • diego.garden-linux.listen_address => garden.listen_address
    • diego.garden-linux.allow_networks => garden.allow_networks
    • diego.garden-linux.insecure_docker_registry_list => garden.insecure_docker_registry_list
    • diego.garden-linux.mtu => garden.network_mtu
    • Add garden.deny_networks: List of CIDR blocks to which containers will be denied access.
    • A full list of the garden-linux-release properties can be found here

Diego 0.1427.1

31 Aug 16:09
Compare
Choose a tag to compare
Create final release 0.1427.1