Diego v2.27.0

Resources

• Download release v2.27.0 from bosh.io.
• Verified with cloudfoundry/cf-deployment @ b7755d6003ed72b1c49da5baf95acde93f2c5601.

Changes from v2.26.0 to v2.27.0

Significant changes

BBS API

• As a BBS API client, I expect the FailTask BBS call to be deprecated so that I know to use RejectTask and CompleteTask instead

Routing Stability: Suspect Cells and ActualLRPs

• As a CF operator, I expect the BBS always to generate suspect ActualLRPs for missing cells so that app operators can benefit from increased routing stability automatically

Per-Instance Proxy

• cloudfoundry/executor #42: fix proxy service node id to be Istio-compatible

Test Suites and Tooling

• diego v1.0.0 and diego v1.25.2 should use grace artifact from diego assets bucket

Documentation

• Complete BBS API deprecation docs after #158949366

Cleanup

• As a Diego operator, I want not to depend on the obsolete dropsonde and sonde-go packages. (incomplete, paused)
• eliminate unused code in diego-release

BOSH job changes

None.

BOSH property changes

bbs

• Removed experimental generate_suspect_actual_lrps property. The BBS now always generates Suspect ActualLRPs when cells fail to maintain their presence through a convergence cycle.

BOSH link changes

None.

Diego v2.26.0

Resources

• Download release v2.26.0 from bosh.io.
• Verified with cloudfoundry/cf-deployment @ 892aee1f05f2529724fc7718280ed0c0e0eb3b0e.

Changes from v2.25.0 to v2.26.0

Significant changes

Per-Instance Proxy

• cloudfoundry/executor #41: Use envoyproxy/go-control-plane for generating proxy bootstrap configuration

App Logging and Metrics

• As a BBS API client, I expect to be able to set arbitrary metric tags on DesiredLRPs so that I can control the metadata tags that the Diego cells emit on the container metrics for app instances

Component Logging and Metrics

• As a CF operator, I expect to see periodic metrics about the number of cells that the BBS considers either present or missing so that I can understand the overall degree of control-plane instability in my environment
• As a CF operator, I expect to see log lines and periodic metrics about requests to Locket that were cancelled by a Locket client so that I can better diagnose lock and presence thrashing
• cloudfoundry/lager #37: Honor all relevant flags in lagerflags.New
• cloudfoundry/locket #8: Intermittent "sql: no rows in result set" using postgres

BOSH job changes

None.

BOSH property changes

None.

BOSH link changes

ssh_proxy

• Optionally consumes link of type cloud_controller_https_endpoint.

Diego v2.25.0

Resources

• Download release v2.25.0 from bosh.io.
• Verified with cloudfoundry/cf-deployment @ 6056a1ad6868c7f5953915d95fce07bd553a62c5.

Changes from v2.24.0 to v2.25.0

Significant changes

BBS API

• As a CF operator, I expect the Diego cell rep to use the new "flattened" ActualLRP API endpoints instead of ActualLRPGroup-based ones so that it will continue to function after their future removal

Volume Support

• nfs, smb, efs drivers have TLS configured in ops files

Garden OCI Image Support (Experimental)

• As a CF operator, I expect to be able to opt the Diego cells into converting some declarative resources into a 2-layer Garden OCI image spec so that I can assess its operational differences

Per-Instance Proxy

• As a CF operator, I expect the rep to recognize all CA certs in the container proxy trusted CA certs list so that the container Envoy proxies use them to validate clients

Dependencies

• As a CF operator, I expect Diego components to use Golang 1.11.4 so that they are up to date with this important dependency
• bump golang.org/x/* packages for go1.11
• Upgrade our GRPC version
• As a CF operator, I expect the cfdot job to use the latest version of jq so that I have access to new jq features, bugfixes, and security updates

Test Suites and Tooling

• add ability to opt vizzini into producing ginkgo output that tells us about panicked tests

Documentation

• Document in contributing how to use mysql/postgres docker images to run units tests locally

Cleanup

• replace hacky eventually check in the bbs convergence tests when flattened actual lrp is introduced

BOSH job changes

None.

BOSH property changes

rep and rep_windows

• Added containers.layering_mode: Configures downloaded container asset management mode. Valid values are 'single-layer' and 'two-layer'. Setting this property to 'two-layer' enables the conversion of some downloaded Task and LRP assets to container image layers. Defaults to single-layer.

vizzini

• Added vizzini.stream: Stream output from parallel test nodes. This option will lead to less coherent output but is useful when debugging. Defaults to false.

BOSH link changes

None.

Diego v2.24.0

Resources

• Download release v2.24.0 from bosh.io.
• Verified with cloudfoundry/cf-deployment @ 9aff399a4f7a07e5162b4e17407bfa5944c5de38.

Changes from v2.23.0 to v2.24.0

Significant changes

BBS Relational Datastore

• Task convergence should not end early when failing to deserialize a single Task record

Routing Stability: Suspect Cells and ActualLRPs

• As a CF operator, I expect that BBS LRP convergence cleans up stray suspect ActualLRPs so that the BBS DB does not accumulate an unbounded amount of stale data

De-Consuling Locks

• As a CF operator, I expect the Diego cells to fail over sufficiently quickly when a Locket server becomes unreachable so that I can maintain sufficient capacity to run staging tasks and new app instances

Garden OCI Image Support (Experimental)

• As a CF operator, I expect to be able to opt CC into specifying LRP and Task asset downloads as declarative resources so that I can give the Diego and Garden components more flexibility in downloading and storing these assets
• As a CF operator, I expect Task containers created using image layers for any container-exclusive assets to have setup durations that include the download of those assets

Test Suites and Tooling

• As a Diego contributor, I expect the DUSTs, inigo, and other component-level test suites to generate their own valid certificates for component configuration so that I do not have to deal with the expiration of fixture certificates

BOSH job changes

None.

BOSH property changes

None.

BOSH link changes

None.

Diego v2.23.0

Resources

• Download release v2.23.0 from bosh.io.
• Verified with cloudfoundry/cf-deployment @ 96bb58d41235784d47d628868b2fb9b2a27692c7.

Changes from v2.22.0 to v2.23.0

Significant changes

BBS API

• Investigate automatic diffing of BBS state after controller functions run in order to generate events automatically

Custom CAs

• cloudfoundry/certsplitter #2: Append trailing newline to each certificate in output

SSH

• As a CF operator, I expect the SSH-proxy to connect to the correct backend app-instance TLS port only when appropriate so that I am not confused by extraneous fallback behavior

Volume Support

• Bump to CSI 1.0.0
• cloudfoundry/cfdot #4: Changes for Bump to CSI v1.0.0 With gRPC v1.10.0

Garden OCI Image Support (Experimental)

• As a CF operator, I expect to be able to observe quantitative data for container setup time so that I can compare performance between cells that use different translation modes from LRP/Task resources to downloads and container operations

Per-Instance Proxy

• As a CF operator, I expect to be able to enable the container proxy in TLS mode experimentally on Windows 2016 Diego cells so that I can opt into better routing consistency and security

Component Logging and Metrics

• cloudfoundry/lager #36: Fix invalid entries written by lagger in few corner cases

Test Suites and Tooling

• As a Diego contributor, I expect the DUSTs, inigo, and other component-level test suites to generate their own valid certificates for component configuration so that I do not have to deal with the expiration of fixture certificates

BOSH job changes

None.

BOSH property changes

None.

BOSH link changes

None.

Diego v2.22.0

Resources

• Download release v2.22.0 from bosh.io.
• Verified with cloudfoundry/cf-deployment @ 86fd61b0cda17e71337758af26108ff66b5e4849.

Changes from v2.21.0 to v2.22.0

Significant changes

SSH

• As a CF operator, I expect to be able to opt the SSH proxy to connect to the TLS-proxied port with client credentials so that I can enable CF SSH with authenticated container ingress

Volume Support

• Rename voldriver to dockerdriver
• cloudfoundry/inigo #20: Update for dockerdriver repo rename (ne voldriver)

Per-Instance Proxy

• As a CF app developer, I expect my app instances to be placed reliably quickly when the Diego cells enable instance proxies so that my app instances start up consistently
• As a CF operator, I expect the properties and operations files to enable the Envoy proxy and to allocate extra memory for it to be marked as stable on the Linux rep job so that I feel comfortable enabling them by default

Component Logging and Metrics

• As a CF operator, I expect the BBS and the rep not to log app failure reasons of arbitrary length so that I do not end up with component log lines that are excessively long or log files that rotate too fast

Dependencies

• As a CF operator, I expect Diego components to use Golang 1.11.2 so that they are up to date with this important dependency

Test Suites and Tooling

• Update the cert fixtures in DUSTs that have expiration dates in 2018

Documentation

• As a Diego contributor, I would like to understand the system by which BBS endpoints are revised
• As a CF operator, I expect to find a polished version of the "cf start" LRP log-message guide in the diego-release docs so that I can understand the details of this important Diego service workflow
• Complete BBS API deprecation docs after #158949366
• cloudfoundry/bbs #35: Add deprecation comments to all route constants and entries
• cloudfoundry/bbs #36: Add _r0 to RemoveDesiredLRP route constant name

BOSH job changes

None.

BOSH property changes

bbs

• Added logging.max_data_string_length. Maximum length of string field to log before truncating the field. Default: 640.

rep

• Added logging.max_data_string_length. Maximum length of string field to log before truncating the field. Default: 640.
• Changed containers.proxy.enabled no longer to be experimental.
• Changed containers.proxy.additional_memory_allocation_mb no longer to be experimental.

rep_windows

• Added logging.max_data_string_length. Maximum length of string field to log before truncating the field. Default: 640.

ssh_proxy

• Added backends.tls.enabled: Whether to enable the SSH proxy to connect to backends via TLS. Default: false.
• Added backends.tls.ca_certificates: List of CA certificates to verify backends. Default: [].
• Added backends.tls.client_certificate: Optional, client certificate to use for TLS connections to backends.
• Added backends.tls.client_private_key: Optional, private key matching client certificate to use for TLS connections to backends.

BOSH link changes

None.

Diego v2.21.0

Resources

• Download release v2.21.0 from bosh.io.
• Verified with cloudfoundry/cf-deployment @ daf4b5377948c9df8d2c4ed6ec6beca68bf1e469.

Changes from v2.20.0 to v2.21.0

Significant changes

BBS API

• Incorrect route deregistration when a replacement CLAIMED LRP starts evacuating
• cloudfoundry/bbs #38: Emit removed events when DesiredLRPHandler deletes actual lrp

Per-Instance Proxy (Experimental)

• Diego configures Envoy to use filesystem Secret Discovery Service
• Envoy pulls ADS from Pilot while still serving static listeners for route-integrity
• cloudfoundry/executor #39: configure Envoy to use filesystem SDS
• cloudfoundry/executor #40: Get envoy to receive dynamic config from pilot
• cloudfoundry/rep #26: Update config test for container_proxy_ads_servers
• cloudfoundry/diego-release #415: Add container_proxy_ads_servers property to rep jobs
• Evaluate and merge Container Networking PRs to allow Pilot configuration of Envoy proxy

Component Logging and Metrics

• investigate lack of cf-apps domain freshness on warp-drive

BOSH job changes

None.

BOSH property changes

rep and rep_windows

• Added containers.proxy.ads_addresses: Experimental. Optional list of addresses to which the container Envoy proxy should make Envoy Aggregated Discovery Service API calls.

BOSH link changes

None.

Diego v2.20.0

Resources

• Download release v2.20.0 from bosh.io.
• Verified with cloudfoundry/cf-deployment @ 483d04f15c334652dd192882417b7bc8fdf982ce.

Changes from v2.19.0 to v2.20.0

Significant changes

BBS API

• cloudfoundry/bbs #34: image_layer.proto not valid when compiled to Ruby (for Cloud Controller)

Container Execution

• As a CF operator, I expect the cell rep to put a network-namespaced property on its garden-healthcheck containers so that the container networking Garden plugin can distinguish it from LRP or Task containers

Routing Stability: Suspect Cells and ActualLRPs

• As a CF operator, I expect to be able to use cfdot to list all of the ActualLRPs for a DesiredLRP when one of them is running on a suspect cell
• As a BBS API client, I expect to be able to see instance-specific events for ActualLRPs as they go through cell state changes so that I can understand changes to a single instance
• Investigate and fix event-handler nil-dereference panics

Volume Support

• nfsv3driver drain logic doesn't get stuck if there are bad or stuck mounts
• cloudfoundry/executor #38: Ensure volumes get unmounted even when garden fails to destroy the container
• cloudfoundry/lager #35: Add redactingPrettySink class for log filtering with formatted timestamps and log level

Garden OCI Image Support (Experimental)

• As a BBS API client, I expect the BBS to allow me to retrieve LRPs and Tasks with declarative resources so that I can inspect the assets that have been specified
• bbs panics in event handler when desired lrp changed events occur

Per-Instance Proxy (Experimental)

• As a CF contributor, I expect the Envoy binary in diego-release to include the fix to issue #4409 (from PR #4684) so that I can start reconfiguring it to use the secret discovery service APIs

Rootless Garden Integration

• cloudfoundry/diego-release #414: Make possible for garden to access shared data in rootless

App Logging and Metrics

• cloudfoundry/diego-logging-client #6: Introduce SendCPUUsage client method
• cloudfoundry/executor #35: Send CPU usage to metron client

Component Logging and Metrics

• As a Diego operator, I expect to see metrics about the BBS's usage of its backing database so I can better diagnose errors related to database contention

Security

• As a CF operator, I expect to be able to connect the BBS and Locket to a database with only CA verification of the host so that they can connect over TLS to Google Cloud SQL and Azure SQL databases

Documentation

• Complete BBS API deprecation docs after #158949366

BOSH job changes

None.

BOSH property changes

bbs

• Added database.tls.enable_identity_verification: Whether to verify the identity of the backing database when connecting over TLS. Defaults to true.

locket

• Added database.tls.enable_identity_verification: Whether to verify the identity of the backing database when connecting over TLS. Defaults to true.

BOSH link changes

None.

Diego v2.19.0

Resources

• Download release v2.19.0 from bosh.io.
• Verified with cloudfoundry/cf-deployment @ cfc55f38f26819830060d126c9a4632bd3de7da6.

Changes from v2.18.0 to v2.19.0

Significant changes

Container Execution

• As a CF developer, I expect that my app instances are created promptly even when some other container on the Diego cell is taking several minutes to create so that my app instances run reliably

Routing Stability: Suspect Cells and ActualLRPs

• As a BBS API client, I expect to be able to see instance-specific events for ActualLRPs as they go through cell state changes so that I can understand changes to a single instance (in flight)
• As a CF operator, I expect to be able to use cfdot to observe instance-specific events in the LRP event stream
• As a BBS API client, I expect ActualLRPGroup lists and events to reflect the resolution of the flat ActualLRP lists consistently so that I am certain I have an accurate representation of ActualLRP state
• As a CF operator, I expect to see periodic metrics about the number of Suspect Running and Suspect Claimed ActualLRP instances so that I can understand the overall degree of instance instability in my environment

Volume Support

• cloudfoundry/inigo #19: Update volman tests for unique volume IDs
• cloudfoundry/executor #36: Add Optional Support for Unique Volume IDs

Dependencies

• As a CF operator, I expect Diego components to use Golang 1.11.1 so that they are up to date with this important dependency

BOSH job changes

None.

BOSH property changes

None.

BOSH link changes

None.

Diego v2.18.0

Resources

• Download release v2.18.0 from bosh.io.
• Verified with cloudfoundry/cf-deployment @ 37f49ef3fdd3938e4671fd7b3e9ca9255cb5497f.

Changes from v2.17.0 to v2.18.0

Significant changes

Container Placement

• As a CF operator, I expect Diego to permit a reasonable number of Task placement retries by default so that I can automatically provide greater resilience in Task execution

Routing Stability: Suspect Cells and ActualLRPs

• As a BBS API client, I expect ActualLRPGroup lists and events to reflect the resolution of the flat ActualLRP lists consistently so that I am certain I have an accurate representation of ActualLRP state (in flight)
• refactor evacuation_handler in the presence of flattened actual LRPs

Container Networking Support

• As a CF operator, I would like to revert the executor's garden healthcheck containers to the original naming prefix for a short period of time so that I can continue to integrate with existing container-networking systems

Per-Instance Proxy (Experimental)

• latest envoy causes timeouts connecting to python app
• As a CF app developer, I expect that the cell rep waits a short, configurable duration of time before shutting down my app process gracefully so that the app's local Envoy proxy has time to load certs that clients will reject
• look into consistent vizzini failures on warp-drive

Component Logging and Metrics

• As a CF operator, I expect the auctioneer to log the duration of the cell state requests so that I can determine which cells are responding slowly
• As a CF operator, I expect each Locket's DBQueriesInFlight metric to report the maximum number of queries that have been in flight concurrently over the DB-metric reporting period so that I can better understand the concurrent DB activity from that component instance

Dependencies

• As a Diego operator, I expect the Diego component to use Golang 1.11 so that I am up-to-date with this important dependency

Documentation

• Update the bbs schema description

Cleanup

• Remove configuration default values from cmd/main.go and prune unused fields
• cloudfoundry/bytefmt #19: Performance optimizations (without regexp / fmt)

BOSH job changes

None.

BOSH property changes

bbs

• Changed diego.bbs.sql.max_idle_connections: Default set to 200, to match previous BBS config default.
• Changed diego.bbs.sql.max_open_connections: Default set to 200, to match previous BBS config default.
• Changed tasks.max_retries: Default changed from 0 to 3.

benchmark-bbs

• Added logging.format.timestamp: Format for timestamp in test component logs. Defaults to unix-epoch.
• Changed benchmark-bbs.aws_region: Default set to us-west-1, to match previous benchmark test config default.
• Changed benchmark-bbs.log_level: Default set to mysql, to match previous benchmark test config default.
• Changed benchmark-bbs.num_populate_workers: Default set to 10, to match previous benchmark test config default.
• Changed benchmark-bbs.num_reps: Default set to 10, to match previous benchmark test config default.
• Changed benchmark-bbs.num_trials: Default set to 10, to match previous benchmark test config default.
• Changed benchmark-bbs.sql.db_driver: Default set to mysql, to match previous benchmark test config default.

rep and rep_windows

• Added containers.proxy.configuration_reload_duration: Duration of time for the container Envoy proxy to pick up final listener configuration before graceful shutdown. Defaults to 5s.
• Changed diego.executor.container_metrics_report_interval: Default set to 15s, to match previous rep config default.
• Changed diego.executor.garden_healthcheck.process.env: Default set to "", to match previous rep config default.

ssh_proxy

• Changed diego.ssh_proxy.idle_connection_timeout_in_seconds: Default set to 300, to match previous ssh-proxy config default.

vizzini

• Changed max_task_retries: Default changed from 0 to 3.

BOSH link changes

None.