This release includes initial support for BBR. Try it out and give us your feedback in the #container-networking channel on cloudfoundry.slack.com.
Take a look at known issues for current limitations and known issues.
Verified with the following:
Manifest Changes
Links Enabled
The policy-server now provides database connection info via a link which the new policy-server-internal job consumes:
cf_networking.policy_server.database.typecf_networking.policy_server.database.usernamecf_networking.policy_server.database.passwordcf_networking.policy_server.database.portcf_networking.policy_server.database.namecf_networking.policy_server.database.host
New Properties
- REQUIRED: A new job
policy-server-internalhas been added. This job requires the following properties:cf_networking.policy_server_internal.ca_certcf_networking.policy_server_internal.server_certcf_networking.policy_server_internal.server_key
There are additional optional paramaters that can be set and are viewable in the spec file
- An optional parameter has been added to configure the path to the iptables kernel log for
the iptables_logger.cf_networking.iptables_logger.kernel_log_file
Removed Properties
- The
policy-serverjob has removed the following properties:cf_networking.policy_server.internal_listen_portcf_networking.policy_server.ca_certcf_networking.policy_server.server_certcf_networking.policy_server.server_key
Changed Properties
- The
consul.agent.services.policy-serverproperty for theconsul_agentjob on theapiinstance group
should be renamed toconsul.agent.services.policy-server-internal.
Significant Changes
CLI Changes
BBR Changes
- An operator can lock the policy server so policies cannot be added/deleted
- operator can use scripts deployed with a colocated job to restore the policy server database on mysql
- operator can use scripts deployed with a colocated job to lock and unlock the policy server API
- operator can use scripts deployed with a colocated job to backup the policy server database on mysql