cloudfoundry/diego-release v1.26.1

Diego v1.26.1

on GitHub

Changes from v1.26.0 to v1.26.1

• Verified with garden-runc-release v1.9.3.
• Verified with garden-windows-bosh-release v0.8.0.
• Verified with etcd-release v117.
• Verified with cf-mysql-release v35.
• Verified with cflinuxfs2-release v1.156.0.

IMPORTANT: If you are upgrading existing Diego cells from an earlier grootfs version to v0.26.0, you must recreate them in order to apply the correct disk quotas to Docker-image-based containers. Containers based on preloaded rootfses such as cflinuxfs2 will set disk quotas correctly. Please see the grootfs v0.26.0 release notes for more information. (An earlier version of these release notes overstated the severity of upgrading grootfs in place on the Diego cells.)

NOTE: This version of Diego recreates many BOSH-Lite certificate and key values on account of the expiration of many of the end-entity certificates. We apologize for the difficulty in coordinating these with the BOSH-Lite certificates in the cf-release repository, and for the delay in producing a new Diego final release that includes the new credentials.

Significant changes

Instance Identity Credentials (Experimental)

• As a CF operator, I expect to be able to have DNS SAN name in my instance identity credentials in order to validate they are for the correct application

v2 Loggregator API Adoption (Experimental)

• Locket should emit lock and presence expiration counters via the v2 loggregator API when so configured

Per-Instance Proxy (Experimental)

• As a CF operator, I expect to be able to opt my Linux Diego cells into supplying sidecar Envoy proxies
• As a BBS client, I expect to be able to discover the TLS-proxied ports for each container port on an ActualLRP instance so that I can connect to the instance securely

Windows Support

• As a Windows app developer, I expect the platform to be able to supply additional CA certs so that I can trust them in addition to the system default ones

Manifest Generation

• cloudfoundry/diego-release #342: Enable global route-emitter to register TCP routes
• Modify the ops files to use scheduler instead of diego-brain as the job name
• Legacy manifest generation should support new syslog-drain and log reverse proxy certs

Component Logging and Metrics

• As a Diego operator, I expect to be able to observe the number of file descriptors each BBS instance has open so that I can be aware of changes in utilization

Test Suites and Tooling

• Replace expired DUSTs certs
• dusts should only have one doppler vm as part of the cloud-controller deployment

BOSH job changes

None.

BOSH property changes

vizzini

• Added enable_container_proxy_tests: Whether the Vizzini tests should assume cells provide a per-container proxy. Defaults to false.

BOSH link changes

None.