cloudfoundry/diego-release v1.7.0

Diego v1.7.0

on GitHub

Changes from v1.6.2 to v1.7.0

• Verified with garden-runc-release v1.1.1.
• Verified with garden-windows-bosh-release v0.2.0.
• Verified with etcd-release v92.
• Verified with cf-mysql-release v34.
• Verified with cflinuxfs2-rootfs-release v1.50.0.

Significant changes

cfdot

• As a cfdot user, I expect to be able to cancel a pending or running Task

Local Route Emitters (Experimental)

• As a Diego operator, I expect the local route emitters not to produce quadratically growing info log volume at scale across the deployment

De-Consuling Locks (Experimental)

• As a Diego operator, I expect the relational BBS lock to expire within no more than 30 seconds
• As a Diego operator, I expect the active BBS to shutdown if it loses or cannot be sure that it holds the relational lock
• As a Diego operator, I expect to be able to migrate the BBS lock from Consul to the BBS DB safely

Instance Identity Credentials (Experimental)

• As a CF Linux app developer, I expect instance identity credentials to be available in conventional locations in my application instance (in flight)
• As a CF Linux app developer, I expect to find instance identity credentials in locations provided by conventional environment variables
• As a CF Linux app developer, I expect the instance identity certificate to be suitable for TLS client and server communication (in flight)

Volume Support

• Update the Service Broker API to v2.10 Volume Services

BOSH 2.0 Support

• As a Diego operator, I expect to be able to connect the route-emitter to the CF NATS cluster via a BOSH link

Windows Support

• As a developer, when I restart an app that had a manually configured start command or Procfile with the legacy path to the WAS.exe, I should get a warning in my logs

Test Suites and Tooling

• Look into locket flakes
• Investigate units-common failure.
• Investigate failed units-common
• Investigate units-common that has failed: drops its presence
• Fix flaky locket and harmonizer tests
• investigate units-common hanging test
• use the golang server for all lrps in inigo
• Investigate failed inigo-grootfs build

Security

• As a Diego operator, I expect to be able to configure the SSH proxy to communicate to the UAA via its internal endpoint
• Remove unused generate-diego-ca-certs
• update examples/aws to include new loggregator cert instructions and statsd-injector certs

De-Incubation

• As an OSS developer, I expect Diego Golang code repositories to enforce their import via a canonical path in the code.cloudfoundry.org domain
• Convert cflager package into a subpackage of lager

BOSH job changes

None.

BOSH property changes

• Added diego.executor.instance_identity_ca_cert: CA certificate for generating instance-identity credentials. Experimental, may be subject to change.
• Added diego.executor.instance_identity_key: Private key for generating instance-identity credentials. Experimental, may be subject to change.
• Added diego.ssh_proxy.uaa.ca_cert: CA certificate for SSH-proxy communication to UAA.
• Added diego.ssh_proxy.uaa.port: Port for SSH-proxy communication to UAA.
• Added diego.ssh_proxy.uaa.url: URL for SSH-proxy communication to UAA.

BOSH link changes

• route_emitter and route_emitter_windows jobs consume optional nats link.