From 54ae226204bf71ef579b8021adbbaa1ef3c75948 Mon Sep 17 00:00:00 2001 From: Wei Quan Date: Fri, 25 Sep 2026 12:31:33 +0200 Subject: [PATCH 1/6] Remove native WebDAV blobstore provider The native WebDAV blobstore (nginx + blobstore_url_signer) is no longer supported. DAV is still available via blobstore_type: storage-cli with provider: dav. Removed: - jobs/blobstore (nginx_webdav + blobstore_url_signer processes) - packages/nginx_webdav and packages/blobstore_url_signer - src/github.com/cloudfoundry/blobstore_url_signer submodule - webdav_config sections from all job templates (cc_ng, worker, clock, cc_deployment_updater, blobstore_benchmark) - webdav ca_cert.pem templates from cc_ng, cc_deployment_updater, and shared_job_templates - webdav_config properties from cc_ng, worker, clock specs - blobstore_waiter webdav health check (no-op for storage-cli providers) - webdav test fixtures in cc_ng and cc_deployment_updater specs --- .gitmodules | 3 - README.md | 1 - jobs/blobstore/monit | 17 -- jobs/blobstore/spec | 105 ------- jobs/blobstore/templates/backup.erb | 27 -- .../templates/bin/blobstore_nginx.erb | 9 - jobs/blobstore/templates/blobstore.conf.erb | 273 ------------------ jobs/blobstore/templates/blobstore.crt.erb | 1 - jobs/blobstore/templates/blobstore.key.erb | 1 - .../templates/blobstore_public.crt.erb | 1 - .../templates/blobstore_public.key.erb | 1 - jobs/blobstore/templates/bpm.yml.erb | 16 - jobs/blobstore/templates/mime.types | 73 ----- jobs/blobstore/templates/nginx.conf.erb | 40 --- jobs/blobstore/templates/pre-start.sh.erb | 37 --- jobs/blobstore/templates/restore.erb | 24 -- jobs/blobstore/templates/write_users.erb | 3 - .../templates/cloud_controller_ng.yml.erb | 2 +- jobs/cc_deployment_updater/spec | 4 - .../templates/buildpacks_ca_cert.pem.erb | 1 - .../templates/cloud_controller_ng.yml.erb | 36 --- .../templates/droplets_ca_cert.pem.erb | 1 - .../templates/packages_ca_cert.pem.erb | 1 - .../templates/resource_pool_ca_cert.pem.erb | 1 - jobs/cloud_controller_clock/spec | 80 +---- .../templates/cloud_controller_ng.yml.erb | 36 --- jobs/cloud_controller_ng/spec | 108 +------ .../templates/buildpacks_ca_cert.pem.erb | 1 - .../templates/cloud_controller_ng.yml.erb | 36 --- .../templates/droplets_ca_cert.pem.erb | 1 - .../templates/packages_ca_cert.pem.erb | 1 - .../templates/resource_pool_ca_cert.pem.erb | 1 - jobs/cloud_controller_worker/spec | 80 +---- .../templates/cloud_controller_ng.yml.erb | 36 --- packages/blobstore_url_signer/packaging | 10 - packages/blobstore_url_signer/spec | 8 - packages/nginx_webdav/README.md | 10 - packages/nginx_webdav/packaging | 47 --- packages/nginx_webdav/spec | 8 - scripts/sync_submodule_config | 2 +- shared_job_templates/blobstore_waiter.sh.erb | 36 +-- .../buildpacks_ca_cert.pem.erb | 1 - shared_job_templates/droplets_ca_cert.pem.erb | 1 - shared_job_templates/packages_ca_cert.pem.erb | 1 - .../resource_pool_ca_cert.pem.erb | 1 - spec/blobstore/backup_spec.rb | 90 ------ spec/blobstore/restore_spec.rb | 94 ------ .../cc_deployment_updater_spec.rb | 25 +- .../cloud_controller_ng_spec.rb | 40 +-- .../cloudfoundry/blobstore_url_signer | 1 - 50 files changed, 31 insertions(+), 1402 deletions(-) delete mode 100644 jobs/blobstore/monit delete mode 100644 jobs/blobstore/spec delete mode 100644 jobs/blobstore/templates/backup.erb delete mode 100644 jobs/blobstore/templates/bin/blobstore_nginx.erb delete mode 100644 jobs/blobstore/templates/blobstore.conf.erb delete mode 100644 jobs/blobstore/templates/blobstore.crt.erb delete mode 100644 jobs/blobstore/templates/blobstore.key.erb delete mode 100644 jobs/blobstore/templates/blobstore_public.crt.erb delete mode 100644 jobs/blobstore/templates/blobstore_public.key.erb delete mode 100644 jobs/blobstore/templates/bpm.yml.erb delete mode 100644 jobs/blobstore/templates/mime.types delete mode 100644 jobs/blobstore/templates/nginx.conf.erb delete mode 100644 jobs/blobstore/templates/pre-start.sh.erb delete mode 100644 jobs/blobstore/templates/restore.erb delete mode 100644 jobs/blobstore/templates/write_users.erb delete mode 100644 jobs/cc_deployment_updater/templates/buildpacks_ca_cert.pem.erb delete mode 100644 jobs/cc_deployment_updater/templates/droplets_ca_cert.pem.erb delete mode 100644 jobs/cc_deployment_updater/templates/packages_ca_cert.pem.erb delete mode 100644 jobs/cc_deployment_updater/templates/resource_pool_ca_cert.pem.erb delete mode 120000 jobs/cloud_controller_ng/templates/buildpacks_ca_cert.pem.erb delete mode 120000 jobs/cloud_controller_ng/templates/droplets_ca_cert.pem.erb delete mode 120000 jobs/cloud_controller_ng/templates/packages_ca_cert.pem.erb delete mode 120000 jobs/cloud_controller_ng/templates/resource_pool_ca_cert.pem.erb delete mode 100644 packages/blobstore_url_signer/packaging delete mode 100644 packages/blobstore_url_signer/spec delete mode 100644 packages/nginx_webdav/README.md delete mode 100644 packages/nginx_webdav/packaging delete mode 100644 packages/nginx_webdav/spec delete mode 100644 shared_job_templates/buildpacks_ca_cert.pem.erb delete mode 100644 shared_job_templates/droplets_ca_cert.pem.erb delete mode 100644 shared_job_templates/packages_ca_cert.pem.erb delete mode 100644 shared_job_templates/resource_pool_ca_cert.pem.erb delete mode 100644 spec/blobstore/backup_spec.rb delete mode 100644 spec/blobstore/restore_spec.rb delete mode 160000 src/github.com/cloudfoundry/blobstore_url_signer diff --git a/.gitmodules b/.gitmodules index 9c8e646440..602915f94f 100644 --- a/.gitmodules +++ b/.gitmodules @@ -1,6 +1,3 @@ -[submodule "src/github.com/cloudfoundry/blobstore_url_signer"] - path = src/github.com/cloudfoundry/blobstore_url_signer - url = https://github.com/cloudfoundry/blobstore_url_signer [submodule "src/cloud_controller_ng"] path = src/cloud_controller_ng url = https://github.com/cloudfoundry/cloud_controller_ng diff --git a/README.md b/README.md index 6e449c23cd..d917fad16b 100644 --- a/README.md +++ b/README.md @@ -11,7 +11,6 @@ This is the [bosh release](http://bosh.io/docs/release.html) for Cloud Foundry's * [Cloud Controller](https://github.com/cloudfoundry/cloud_controller_ng): The primary API of Cloud Foundry. * [Cloud Controller Clock](https://github.com/cloudfoundry/cloud_controller_ng): Triggers periodic jobs for the Cloud Controller. * [Cloud Controller Workers](https://github.com/cloudfoundry/cloud_controller_ng): Execute background jobs for the Cloud Controller. -* [Webdav Blobstore](https://github.com/cloudfoundry/capi-release/tree/develop/jobs/blobstore): An optional stand-alone blobstore for the Cloud Controller. * [NFS Mounter](https://github.com/cloudfoundry/capi-release/tree/develop/jobs/nfs_mounter): Connects Cloud Controller with an NFS blobstore. * [CC Uploader](https://github.com/cloudfoundry/cc-uploader): Uploads files from [Diego](https://github.com/cloudfoundry/diego-release) to the Cloud Controller. * [TPS Watcher](https://github.com/cloudfoundry/tps): Reports crash events from Diego to the Cloud Controller. diff --git a/jobs/blobstore/monit b/jobs/blobstore/monit deleted file mode 100644 index cd18d38a50..0000000000 --- a/jobs/blobstore/monit +++ /dev/null @@ -1,17 +0,0 @@ -<% if spec.bootstrap %> -check process blobstore_nginx - with pidfile /var/vcap/sys/run/bpm/blobstore/nginx.pid - start program "/var/vcap/jobs/bpm/bin/bpm start blobstore -p nginx" - stop program "/var/vcap/jobs/bpm/bin/bpm stop blobstore -p nginx" - group vcap - - check process blobstore_url_signer - with pidfile /var/vcap/sys/run/bpm/blobstore/url_signer.pid - start program "/var/vcap/jobs/bpm/bin/bpm start blobstore -p url_signer" - stop program "/var/vcap/jobs/bpm/bin/bpm stop blobstore -p url_signer" - group vcap - -<% else %> -# This file intentionally left blank -# Blobstore job is only run on the bootstrap instance -<% end %> diff --git a/jobs/blobstore/spec b/jobs/blobstore/spec deleted file mode 100644 index 650093bfef..0000000000 --- a/jobs/blobstore/spec +++ /dev/null @@ -1,105 +0,0 @@ ---- -name: blobstore - -templates: - bpm.yml.erb: config/bpm.yml - bin/blobstore_nginx.erb: bin/blobstore_nginx - - nginx.conf.erb: config/nginx.conf - blobstore.conf.erb: config/sites/blobstore.conf - mime.types: config/mime.types - write_users.erb: config/write_users - blobstore.crt.erb: ssl/blobstore.crt - blobstore.key.erb: ssl/blobstore.key - blobstore_public.crt.erb: ssl/blobstore_public.crt - blobstore_public.key.erb: ssl/blobstore_public.key - pre-start.sh.erb: bin/pre-start - backup.erb: bin/bbr/backup - restore.erb: bin/bbr/restore - -packages: -- nginx_webdav -- blobstore_url_signer -- capi_utils - -consumes: -- name: directories_to_backup - type: directories_to_backup - -properties: - select_directories_to_backup: - description: | - The list of directories to backup using BBR. Valid values are: buildpacks, droplets, packages. - Remove directories that you do not want to backup. - default: - - "buildpacks" - - "droplets" - - "packages" - - blobstore.internal_access_rules: - description: >- - List of allow / deny rules for the blobstore internal server. Defaults - to RFC 1918 Private Networks. Will be followed by 'deny all'. See - http://nginx.org/en/docs/http/ngx_http_access_module.html for valid rules - default: - - "allow 10.0.0.0/8;" - - "allow 172.16.0.0/12;" - - "allow 192.168.0.0/16;" - - temporary_disable_non_tls_endpoints: - description: "nginx_cc and cc_uploader components disable non-TLS endpoints" - default: false - - blobstore.port: - description: TCP port on which the blobstore server (nginx) listens - default: 8080 - blobstore.public_tls_port: - description: TCP port on which the blobstore server (nginx) listens - default: 8081 - blobstore.tls.port: - description: The TCP port on which the internal blobstore server listens - default: 4443 - - blobstore.tls.cert: - description: The PEM-encoded certificate (optionally as a certificate chain) for serving blobs over TLS/SSL - - blobstore.tls.private_key: - description: The PEM-encoded private key for signing TLS/SSL traffic - - blobstore.public_tls.cert: - description: The PEM-encoded certificate (optionally as a certificate chain) for serving blobs over TLS/SSL - - blobstore.public_tls.private_key: - description: The PEM-encoded private key for signing TLS/SSL traffic - - - blobstore.admin_users: - description: | - List of Username and Password pairs that have admin access to the blobstore. Cloud Controller must use one of these to access the blobstore via HTTP Basic Auth. - Example: - users: - - username: user1 - password: password1 - - username: user2 - password: password2 - - blobstore.secure_link.secret: - description: "The secret used for signing URLs. Must not contain $, or any other variables that are used by and cannot be escaped in the Nginx config." - - blobstore.max_upload_size: - description: "Max allowed file size for upload" - default: "0" - - blobstore.nginx_workers_per_core: - description: "Number of NGINX worker processes per CPU core" - default: 2 - - release_level_backup: - description: "toggle to enable backups of the blobstore with bbr" - default: true - - system_domain: - description: "The system domain. The public server will listen on host 'blobstore.system-domain.tld'" - - domain: - description: "DEPRECATED: The system domain. The public server will listen on host 'blobstore.system-domain.tld'" diff --git a/jobs/blobstore/templates/backup.erb b/jobs/blobstore/templates/backup.erb deleted file mode 100644 index 783be6edd0..0000000000 --- a/jobs/blobstore/templates/backup.erb +++ /dev/null @@ -1,27 +0,0 @@ -#!/usr/bin/env bash - -set -eux - -<% - dirs = link('directories_to_backup') - dir_to_key = { - "droplets" => dirs.p("cc.droplets.droplet_directory_key"), - "buildpacks" => dirs.p("cc.buildpacks.buildpack_directory_key"), - "packages" => dirs.p("cc.packages.app_package_directory_key") - } -%> - -<% if p('release_level_backup') %> - mkdir -p $BBR_ARTIFACT_DIRECTORY/shared - - <% p('select_directories_to_backup').each do |directory| %> - <% key = dir_to_key.fetch(directory) { raise "Unknown directory in select_directories_to_backup: '#{directory}'" } %> - if [ -d /var/vcap/store/shared/<%= key %> ]; then - cp --recursive --link /var/vcap/store/shared/<%= key %> $BBR_ARTIFACT_DIRECTORY/shared - fi - - <% if directory.eql? "droplets" %> - rm --force --recursive $BBR_ARTIFACT_DIRECTORY/shared/<%= key %>/buildpack_cache - <% end %> - <% end %> -<% end %> diff --git a/jobs/blobstore/templates/bin/blobstore_nginx.erb b/jobs/blobstore/templates/bin/blobstore_nginx.erb deleted file mode 100644 index 25280622c6..0000000000 --- a/jobs/blobstore/templates/bin/blobstore_nginx.erb +++ /dev/null @@ -1,9 +0,0 @@ -#!/usr/bin/env bash - -source /var/vcap/packages/capi_utils/cpu_utils.sh - -cpu_count=$(( $(cpu_count) * <%= p('blobstore.nginx_workers_per_core') %> )) - -exec /var/vcap/packages/nginx_webdav/sbin/nginx \ --c /var/vcap/jobs/blobstore/config/nginx.conf \ --g "worker_processes ${cpu_count};" diff --git a/jobs/blobstore/templates/blobstore.conf.erb b/jobs/blobstore/templates/blobstore.conf.erb deleted file mode 100644 index 6448eb15c2..0000000000 --- a/jobs/blobstore/templates/blobstore.conf.erb +++ /dev/null @@ -1,273 +0,0 @@ -<% -# /signed/ location pair — emitted once per server block (internal, public HTTP, public TLS). -# Split into two locations to avoid nginx's regex+alias+dav_methods collision on large PUTs: -# the verify location checks HMAC and rewrites; the internal location does the actual file I/O. -signed_location = <<~NGINX - # ensure the contents of this location block always match the other server /signed/ location blocks - location ~ ^/signed/(?.+)$ { - if ( $request_method !~ ^(GET|HEAD|PUT)$ ) { - return 405; - } - - secure_link_hmac $arg_st,$arg_ts,$arg_e; - secure_link_hmac_secret #{p('blobstore.secure_link.secret')}; - secure_link_hmac_message $request_method$blob_path$arg_ts$arg_e; - secure_link_hmac_algorithm sha256; - - if ($secure_link_hmac != "1") { - return 403; - } - - rewrite ^/signed/(.*)$ /signed-internal/$1 last; - } - - location /signed-internal/ { - internal; - - dav_methods PUT DELETE; - create_full_put_path on; - send_timeout 600s; - - alias /var/vcap/store/shared/; - } -NGINX -%> -# Default server -# - -<% unless p('temporary_disable_non_tls_endpoints') %> - -server { - listen <%= p('blobstore.port') %>; - return 404; -} -<% end %> - -server { - listen <%= p('blobstore.public_tls_port') %> ssl; - - ssl_certificate /var/vcap/jobs/blobstore/ssl/blobstore_public.crt; - ssl_certificate_key /var/vcap/jobs/blobstore/ssl/blobstore_public.key; - - ssl_ciphers DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384; - ssl_protocols TLSv1.2 TLSv1.3; - ssl_session_cache shared:SSL:10m; - ssl_session_timeout 10m; - return 404; -} - -upstream blob_url_signer { - server unix:/var/vcap/data/blobstore/signer.sock; -} - -# Internal server -server { - listen <%= p('blobstore.tls.port') %> ssl; - server_name blobstore.service.cf.internal; - ssl_certificate /var/vcap/jobs/blobstore/ssl/blobstore.crt; - ssl_certificate_key /var/vcap/jobs/blobstore/ssl/blobstore.key; - - ssl_ciphers DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384; - ssl_protocols TLSv1.2 TLSv1.3; - ssl_session_cache shared:SSL:10m; - ssl_session_timeout 10m; - - root /var/vcap/store/shared/; - - <%= p('blobstore.internal_access_rules').join("\n ") %> - deny all; - - access_log /var/vcap/sys/log/blobstore/internal_access.log; - error_log /var/vcap/sys/log/blobstore/internal_error.log; - - client_max_body_size <%= p('blobstore.max_upload_size') %>; - - location /admin/ { - auth_basic "Blobstore Admin"; - auth_basic_user_file write_users; - - dav_methods DELETE PUT COPY; - dav_ext_methods PROPFIND; - - create_full_put_path on; - - alias /var/vcap/store/shared/; - } - - location /sign { - auth_basic "Blobstore Signing"; - auth_basic_user_file write_users; - - proxy_pass http://blob_url_signer; - } - -<%= signed_location %> - - # ensure the contents of this location block always match the public server /read/ location block - location /read/ { - if ( $request_method !~ ^(GET|HEAD)$ ) { - return 405; - } - - secure_link $arg_md5,$arg_expires; - secure_link_md5 "$secure_link_expires$uri <%= p('blobstore.secure_link.secret') %>"; - - if ($secure_link = "") { - return 403; - } - - if ($secure_link = "0") { - return 410; - } - - alias /var/vcap/store/shared/; - } - - # ensure the contents of this location block always match the public server /write/ location block - location /write/ { - dav_methods PUT; - create_full_put_path on; - - if ( $request_method !~ ^(PUT)$ ) { - return 405; - } - - secure_link $arg_md5,$arg_expires; - secure_link_md5 "$secure_link_expires$uri <%= p('blobstore.secure_link.secret') %>"; - - if ($secure_link = "") { - return 403; - } - - if ($secure_link = "0") { - return 410; - } - - alias /var/vcap/store/shared/; - } -} - -# Public server -# - -<% unless p('temporary_disable_non_tls_endpoints') %> -server { - server_name blobstore.<%= p('system_domain') %>; - - listen <%= p('blobstore.port') %>; - - root /var/vcap/store/shared/; - - access_log /var/vcap/sys/log/blobstore/public_access.log; - error_log /var/vcap/sys/log/blobstore/public_error.log; - -<%= signed_location %> - - # ensure the contents of this location block always match the internal server /read/ location block - location /read/ { - if ( $request_method !~ ^(GET|HEAD)$ ) { - return 405; - } - - secure_link $arg_md5,$arg_expires; - secure_link_md5 "$secure_link_expires$uri <%= p('blobstore.secure_link.secret') %>"; - - if ($secure_link = "") { - return 403; - } - - if ($secure_link = "0") { - return 410; - } - - alias /var/vcap/store/shared/; - } - - # ensure the contents of this location block always match the internal server /write/ location block - location /write/ { - dav_methods PUT; - create_full_put_path on; - - if ( $request_method !~ ^(PUT)$ ) { - return 405; - } - - secure_link $arg_md5,$arg_expires; - secure_link_md5 "$secure_link_expires$uri <%= p('blobstore.secure_link.secret') %>"; - - if ($secure_link = "") { - return 403; - } - - if ($secure_link = "0") { - return 410; - } - - alias /var/vcap/store/shared/; - } -} - -<% end %> - -server { - listen <%= p('blobstore.public_tls_port') %> ssl; - server_name blobstore.<%= p('system_domain') %>; - - ssl_certificate /var/vcap/jobs/blobstore/ssl/blobstore_public.crt; - ssl_certificate_key /var/vcap/jobs/blobstore/ssl/blobstore_public.key; - - ssl_ciphers DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384; - ssl_protocols TLSv1.2 TLSv1.3; - ssl_session_cache shared:SSL:10m; - ssl_session_timeout 10m; - - root /var/vcap/store/shared/; - - access_log /var/vcap/sys/log/blobstore/public_access.log; - error_log /var/vcap/sys/log/blobstore/public_error.log; - -<%= signed_location %> - - # ensure the contents of this location block always match the internal server /read/ location block - location /read/ { - if ( $request_method !~ ^(GET|HEAD)$ ) { - return 405; - } - - secure_link $arg_md5,$arg_expires; - secure_link_md5 "$secure_link_expires$uri <%= p('blobstore.secure_link.secret') %>"; - - if ($secure_link = "") { - return 403; - } - - if ($secure_link = "0") { - return 410; - } - - alias /var/vcap/store/shared/; - } - - # ensure the contents of this location block always match the internal server /write/ location block - location /write/ { - dav_methods PUT; - create_full_put_path on; - - if ( $request_method !~ ^(PUT)$ ) { - return 405; - } - - secure_link $arg_md5,$arg_expires; - secure_link_md5 "$secure_link_expires$uri <%= p('blobstore.secure_link.secret') %>"; - - if ($secure_link = "") { - return 403; - } - - if ($secure_link = "0") { - return 410; - } - - alias /var/vcap/store/shared/; - } -} diff --git a/jobs/blobstore/templates/blobstore.crt.erb b/jobs/blobstore/templates/blobstore.crt.erb deleted file mode 100644 index 413ef54e75..0000000000 --- a/jobs/blobstore/templates/blobstore.crt.erb +++ /dev/null @@ -1 +0,0 @@ -<%= p('blobstore.tls.cert') %> diff --git a/jobs/blobstore/templates/blobstore.key.erb b/jobs/blobstore/templates/blobstore.key.erb deleted file mode 100644 index eb8e0bf3f8..0000000000 --- a/jobs/blobstore/templates/blobstore.key.erb +++ /dev/null @@ -1 +0,0 @@ -<%= p('blobstore.tls.private_key') %> diff --git a/jobs/blobstore/templates/blobstore_public.crt.erb b/jobs/blobstore/templates/blobstore_public.crt.erb deleted file mode 100644 index ebbbe12dde..0000000000 --- a/jobs/blobstore/templates/blobstore_public.crt.erb +++ /dev/null @@ -1 +0,0 @@ -<%= p('blobstore.public_tls.cert') %> diff --git a/jobs/blobstore/templates/blobstore_public.key.erb b/jobs/blobstore/templates/blobstore_public.key.erb deleted file mode 100644 index c99e4a2823..0000000000 --- a/jobs/blobstore/templates/blobstore_public.key.erb +++ /dev/null @@ -1 +0,0 @@ -<%= p('blobstore.public_tls.private_key') %> diff --git a/jobs/blobstore/templates/bpm.yml.erb b/jobs/blobstore/templates/bpm.yml.erb deleted file mode 100644 index a17ca0537b..0000000000 --- a/jobs/blobstore/templates/bpm.yml.erb +++ /dev/null @@ -1,16 +0,0 @@ ---- -processes: -- name: nginx - executable: /var/vcap/jobs/blobstore/bin/blobstore_nginx - additional_volumes: - - path: /var/vcap/store/shared - writable: true - ephemeral_disk: true - persistent_disk: true -- name: url_signer - executable: /var/vcap/packages/blobstore_url_signer/bin/blobstore_url_signer - ephemeral_disk: true - args: - - --secret=<%= p("blobstore.secure_link.secret") %> - - --network=unix - - --laddr=/var/vcap/data/blobstore/signer.sock diff --git a/jobs/blobstore/templates/mime.types b/jobs/blobstore/templates/mime.types deleted file mode 100644 index 9fafe7093d..0000000000 --- a/jobs/blobstore/templates/mime.types +++ /dev/null @@ -1,73 +0,0 @@ -types { - text/html html htm shtml; - text/css css; - text/xml xml; - image/gif gif; - image/jpeg jpeg jpg; - application/x-javascript js; - application/atom+xml atom; - application/rss+xml rss; - - text/mathml mml; - text/plain txt; - text/vnd.sun.j2me.app-descriptor jad; - text/vnd.wap.wml wml; - text/x-component htc; - - image/png png; - image/tiff tif tiff; - image/vnd.wap.wbmp wbmp; - image/x-icon ico; - image/x-jng jng; - image/x-ms-bmp bmp; - image/svg+xml svg; - - application/java-archive jar war ear; - application/mac-binhex40 hqx; - application/msword doc; - application/pdf pdf; - application/postscript ps eps ai; - application/rtf rtf; - application/vnd.ms-excel xls; - application/vnd.ms-powerpoint ppt; - application/vnd.wap.wmlc wmlc; - application/vnd.wap.xhtml+xml xhtml; - application/vnd.google-earth.kml+xml kml; - application/vnd.google-earth.kmz kmz; - application/x-7z-compressed 7z; - application/x-cocoa cco; - application/x-java-archive-diff jardiff; - application/x-java-jnlp-file jnlp; - application/x-makeself run; - application/x-perl pl pm; - application/x-pilot prc pdb; - application/x-rar-compressed rar; - application/x-redhat-package-manager rpm; - application/x-sea sea; - application/x-shockwave-flash swf; - application/x-stuffit sit; - application/x-tcl tcl tk; - application/x-x509-ca-cert der pem crt; - application/x-xpinstall xpi; - application/zip zip; - - application/octet-stream bin exe dll; - application/octet-stream deb; - application/octet-stream dmg; - application/octet-stream eot; - application/octet-stream iso img; - application/octet-stream msi msp msm; - - audio/midi mid midi kar; - audio/mpeg mp3; - audio/x-realaudio ra; - - video/3gpp 3gpp 3gp; - video/mpeg mpeg mpg; - video/quicktime mov; - video/x-flv flv; - video/x-mng mng; - video/x-ms-asf asx asf; - video/x-ms-wmv wmv; - video/x-msvideo avi; -} diff --git a/jobs/blobstore/templates/nginx.conf.erb b/jobs/blobstore/templates/nginx.conf.erb deleted file mode 100644 index 082e668114..0000000000 --- a/jobs/blobstore/templates/nginx.conf.erb +++ /dev/null @@ -1,40 +0,0 @@ -daemon off; - -error_log /var/vcap/sys/log/blobstore/error.log; -pid /var/vcap/data/blobstore/nginx.pid; - -events { - worker_connections 8192; -} - -http { - server_names_hash_bucket_size 128; - include /var/vcap/jobs/blobstore/config/mime.types; - default_type text/html; - - log_format timed_combined '$remote_addr - $remote_user [$time_local] ' - '"$request" $status $body_bytes_sent ' - '"$http_referer" "$http_user_agent" ' - '$request_time $upstream_response_time $pipe'; - - access_log /var/vcap/sys/log/blobstore/access.log timed_combined; - server_tokens off; - - client_body_temp_path /var/vcap/data/blobstore/tmp/client_body_temp; - proxy_temp_path /var/vcap/data/blobstore/tmp/proxy_temp; - fastcgi_temp_path /var/vcap/data/blobstore/tmp/fastcgi_temp; - uwsgi_temp_path /var/vcap/data/blobstore/tmp/uwsgi_temp; - scgi_temp_path /var/vcap/data/blobstore/tmp/scgi_temp; - - sendfile on; - sendfile_max_chunk 1M; # Make sure not to block on fast clients reading large files - tcp_nopush on; - tcp_nodelay on; - read_ahead 1; # Enable read_ahead. On Linux the actual value is ignored (as long as it is > 0) - - keepalive_timeout 75 20; - - gzip off; - - include /var/vcap/jobs/blobstore/config/sites/*; -} diff --git a/jobs/blobstore/templates/pre-start.sh.erb b/jobs/blobstore/templates/pre-start.sh.erb deleted file mode 100644 index 708910407a..0000000000 --- a/jobs/blobstore/templates/pre-start.sh.erb +++ /dev/null @@ -1,37 +0,0 @@ -#!/usr/bin/env bash - -set -ex - -function setup_blobstore_directories { - local run_dir=/var/vcap/sys/run/blobstore - local log_dir=/var/vcap/sys/log/blobstore - local store_dir=/var/vcap/store/shared - local data_dir=/var/vcap/data/blobstore - local store_tmp_dir=$store_dir/tmp/uploads - local data_tmp_dir=$data_dir/tmp/uploads - local nginx_webdav_dir=/var/vcap/packages/nginx_webdav - - mkdir -p $run_dir - mkdir -p $log_dir - mkdir -p $store_dir - mkdir -p $store_tmp_dir - mkdir -p $data_dir - mkdir -p $data_tmp_dir - - chown vcap:vcap $store_dir - local dirs="$run_dir $log_dir $store_tmp_dir $data_dir $data_tmp_dir $nginx_webdav_dir ${nginx_webdav_dir}/.." - local num_needing_chown=$(find $dirs -not -user vcap -or -not -group vcap | wc -l) - - if [ $num_needing_chown -gt 0 ]; then - echo "chowning ${num_needing_chown} files to vcap:vcap" - find $dirs -not -user vcap -or -not -group vcap | xargs chown vcap:vcap - else - echo "no chowning needed, all relevant files are vcap:vcap already" - fi -} - -<% if spec.bootstrap %> -setup_blobstore_directories -<% else %> -echo "Blobstore job is only run on the bootstrap instance" -<% end %> diff --git a/jobs/blobstore/templates/restore.erb b/jobs/blobstore/templates/restore.erb deleted file mode 100644 index 9f906264d4..0000000000 --- a/jobs/blobstore/templates/restore.erb +++ /dev/null @@ -1,24 +0,0 @@ -#!/usr/bin/env bash - -set -eux - -<% - dirs = link('directories_to_backup') - dir_to_key = { - "droplets" => dirs.p("cc.droplets.droplet_directory_key"), - "buildpacks" => dirs.p("cc.buildpacks.buildpack_directory_key"), - "packages" => dirs.p("cc.packages.app_package_directory_key") - } -%> - -<% if p('release_level_backup') %> - <% p('select_directories_to_backup').each do |directory| %> - <% key = dir_to_key.fetch(directory) { raise "Unknown directory in select_directories_to_backup: '#{directory}'" } %> - rm --recursive --force /var/vcap/store/shared/<%= key %> - if [ -d $BBR_ARTIFACT_DIRECTORY/shared/<%= key %> ]; then - cp --recursive --link $BBR_ARTIFACT_DIRECTORY/shared/<%= key %> /var/vcap/store/shared - fi - <% end %> - - chown --recursive vcap:vcap /var/vcap/store/shared -<% end %> diff --git a/jobs/blobstore/templates/write_users.erb b/jobs/blobstore/templates/write_users.erb deleted file mode 100644 index b3f569d8ed..0000000000 --- a/jobs/blobstore/templates/write_users.erb +++ /dev/null @@ -1,3 +0,0 @@ -<% p('blobstore.admin_users').each do |user| %> -<%= user['username'] %>:{PLAIN}<%= user['password'] %> -<% end %> diff --git a/jobs/blobstore_benchmark/templates/cloud_controller_ng.yml.erb b/jobs/blobstore_benchmark/templates/cloud_controller_ng.yml.erb index 3beb3c2ea9..c1f750727f 100644 --- a/jobs/blobstore_benchmark/templates/cloud_controller_ng.yml.erb +++ b/jobs/blobstore_benchmark/templates/cloud_controller_ng.yml.erb @@ -60,7 +60,7 @@ section = cc_cfg[k] next unless section.is_a?(Hash) - %w[connection_config webdav_config].each do |hk| + %w[connection_config].each do |hk| section[hk] = {} if section.key?(hk) && section[hk].nil? end diff --git a/jobs/cc_deployment_updater/spec b/jobs/cc_deployment_updater/spec index ae4c3152f3..a004f89164 100644 --- a/jobs/cc_deployment_updater/spec +++ b/jobs/cc_deployment_updater/spec @@ -23,10 +23,6 @@ templates: mutual_tls.crt.erb: config/certs/mutual_tls.crt mutual_tls.key.erb: config/certs/mutual_tls.key credhub_ca.crt.erb: config/certs/credhub_ca.crt - packages_ca_cert.pem.erb: config/certs/packages_ca_cert.pem - resource_pool_ca_cert.pem.erb: config/certs/resource_pool_ca_cert.pem - droplets_ca_cert.pem.erb: config/certs/droplets_ca_cert.pem - buildpacks_ca_cert.pem.erb: config/certs/buildpacks_ca_cert.pem prom_scraper_config.yml.erb: config/prom_scraper_config.yml scrape.crt.erb: config/certs/scrape.crt scrape.key.erb: config/certs/scrape.key diff --git a/jobs/cc_deployment_updater/templates/buildpacks_ca_cert.pem.erb b/jobs/cc_deployment_updater/templates/buildpacks_ca_cert.pem.erb deleted file mode 100644 index e8d78ef934..0000000000 --- a/jobs/cc_deployment_updater/templates/buildpacks_ca_cert.pem.erb +++ /dev/null @@ -1 +0,0 @@ -<%= link("cloud_controller_internal").p('cc.buildpacks.webdav_config.ca_cert') %> diff --git a/jobs/cc_deployment_updater/templates/cloud_controller_ng.yml.erb b/jobs/cc_deployment_updater/templates/cloud_controller_ng.yml.erb index b8211663b5..a5af130b13 100644 --- a/jobs/cc_deployment_updater/templates/cloud_controller_ng.yml.erb +++ b/jobs/cc_deployment_updater/templates/cloud_controller_ng.yml.erb @@ -200,15 +200,6 @@ storage_cli_optional_flags: <%= link("cloud_controller_internal").p("cc.storage_ resource_pool: blobstore_type: <%= link("cloud_controller_internal").p("cc.resource_pool.blobstore_type") %> - webdav_config: - blobstore_timeout: <%= link("cloud_controller_internal").p("cc.resource_pool.webdav_config.blobstore_timeout") %> - public_endpoint: <%= link("cloud_controller_internal").p("cc.resource_pool.webdav_config.public_endpoint") %> - private_endpoint: <%= link("cloud_controller_internal").p("cc.resource_pool.webdav_config.private_endpoint") %> - username: <%= link("cloud_controller_internal").p("cc.resource_pool.webdav_config.username") %> - password: <%= yaml_escape(link("cloud_controller_internal").p("cc.resource_pool.webdav_config.password")) %> - <% if link("cloud_controller_internal").p("cc.resource_pool.webdav_config.ca_cert") != "" && link("cloud_controller_internal").p("cc.resource_pool.webdav_config.ca_cert") != nil %> - ca_cert_path: "/var/vcap/jobs/cc_deployment_updater/config/certs/resource_pool_ca_cert.pem" - <% end %> minimum_size: <%= link("cloud_controller_internal").p("cc.resource_pool.minimum_size") %> maximum_size: <%= link("cloud_controller_internal").p("cc.resource_pool.maximum_size") %> resource_directory_key: <%= link("cloud_controller_internal").p("cc.resource_pool.resource_directory_key") %> @@ -219,15 +210,6 @@ resource_pool: packages: blobstore_type: <%= link("cloud_controller_internal").p("cc.packages.blobstore_type") %> - webdav_config: - blobstore_timeout: <%= link("cloud_controller_internal").p("cc.packages.webdav_config.blobstore_timeout") %> - public_endpoint: <%= link("cloud_controller_internal").p("cc.packages.webdav_config.public_endpoint") %> - private_endpoint: <%= link("cloud_controller_internal").p("cc.packages.webdav_config.private_endpoint") %> - username: <%= link("cloud_controller_internal").p("cc.packages.webdav_config.username") %> - password: <%= yaml_escape(link("cloud_controller_internal").p("cc.packages.webdav_config.password")) %> - <% if link("cloud_controller_internal").p("cc.packages.webdav_config.ca_cert") != "" && link("cloud_controller_internal").p("cc.packages.webdav_config.ca_cert") != nil %> - ca_cert_path: "/var/vcap/jobs/cc_deployment_updater/config/certs/packages_ca_cert.pem" - <% end %> app_package_directory_key: <%= link("cloud_controller_internal").p("cc.packages.app_package_directory_key") %> <% if (pk_provider = link("cloud_controller_internal").p("cc.packages.blobstore_provider", nil)) %> blobstore_provider: <%= pk_provider %> @@ -238,15 +220,6 @@ packages: droplets: blobstore_type: <%= link("cloud_controller_internal").p("cc.droplets.blobstore_type") %> - webdav_config: - blobstore_timeout: <%= link("cloud_controller_internal").p("cc.droplets.webdav_config.blobstore_timeout") %> - public_endpoint: <%= link("cloud_controller_internal").p("cc.droplets.webdav_config.public_endpoint") %> - private_endpoint: <%= link("cloud_controller_internal").p("cc.droplets.webdav_config.private_endpoint") %> - username: <%= link("cloud_controller_internal").p("cc.droplets.webdav_config.username") %> - password: <%= yaml_escape(link("cloud_controller_internal").p("cc.droplets.webdav_config.password")) %> - <% if link("cloud_controller_internal").p("cc.droplets.webdav_config.ca_cert") != "" && link("cloud_controller_internal").p("cc.droplets.webdav_config.ca_cert") != nil %> - ca_cert_path: "/var/vcap/jobs/cc_deployment_updater/config/certs/droplets_ca_cert.pem" - <% end %> droplet_directory_key: <%= link("cloud_controller_internal").p("cc.droplets.droplet_directory_key") %> <% if (dp_provider = link("cloud_controller_internal").p("cc.droplets.blobstore_provider", nil)) %> blobstore_provider: <%= dp_provider %> @@ -255,15 +228,6 @@ droplets: buildpacks: blobstore_type: <%= link("cloud_controller_internal").p("cc.buildpacks.blobstore_type") %> - webdav_config: - blobstore_timeout: <%= link("cloud_controller_internal").p("cc.buildpacks.webdav_config.blobstore_timeout") %> - public_endpoint: <%= link("cloud_controller_internal").p("cc.buildpacks.webdav_config.public_endpoint") %> - private_endpoint: <%= link("cloud_controller_internal").p("cc.buildpacks.webdav_config.private_endpoint") %> - username: <%= link("cloud_controller_internal").p("cc.buildpacks.webdav_config.username") %> - password: <%= yaml_escape(link("cloud_controller_internal").p("cc.buildpacks.webdav_config.password")) %> - <% if link("cloud_controller_internal").p("cc.buildpacks.webdav_config.ca_cert") != "" && link("cloud_controller_internal").p("cc.buildpacks.webdav_config.ca_cert") != nil %> - ca_cert_path: "/var/vcap/jobs/cc_deployment_updater/config/certs/buildpacks_ca_cert.pem" - <% end %> buildpack_directory_key: <%= link("cloud_controller_internal").p("cc.buildpacks.buildpack_directory_key") %> <% if (bp_provider = link("cloud_controller_internal").p("cc.buildpacks.blobstore_provider", nil)) %> blobstore_provider: <%= bp_provider %> diff --git a/jobs/cc_deployment_updater/templates/droplets_ca_cert.pem.erb b/jobs/cc_deployment_updater/templates/droplets_ca_cert.pem.erb deleted file mode 100644 index 1f8fccfe60..0000000000 --- a/jobs/cc_deployment_updater/templates/droplets_ca_cert.pem.erb +++ /dev/null @@ -1 +0,0 @@ -<%= link("cloud_controller_internal").p('cc.droplets.webdav_config.ca_cert') %> diff --git a/jobs/cc_deployment_updater/templates/packages_ca_cert.pem.erb b/jobs/cc_deployment_updater/templates/packages_ca_cert.pem.erb deleted file mode 100644 index 56bd3fae7f..0000000000 --- a/jobs/cc_deployment_updater/templates/packages_ca_cert.pem.erb +++ /dev/null @@ -1 +0,0 @@ -<%= link("cloud_controller_internal").p('cc.packages.webdav_config.ca_cert') %> diff --git a/jobs/cc_deployment_updater/templates/resource_pool_ca_cert.pem.erb b/jobs/cc_deployment_updater/templates/resource_pool_ca_cert.pem.erb deleted file mode 100644 index fdd3789c21..0000000000 --- a/jobs/cc_deployment_updater/templates/resource_pool_ca_cert.pem.erb +++ /dev/null @@ -1 +0,0 @@ -<%= link("cloud_controller_internal").p('cc.resource_pool.webdav_config.ca_cert') %> diff --git a/jobs/cloud_controller_clock/spec b/jobs/cloud_controller_clock/spec index b5745d9c8e..232e6eb46e 100644 --- a/jobs/cloud_controller_clock/spec +++ b/jobs/cloud_controller_clock/spec @@ -210,26 +210,8 @@ properties: cc.resource_pool.connection_config: description: "Storage CLI connection configuration" cc.resource_pool.blobstore_type: - description: "The type of blobstore backing to use. Valid values: ['webdav', 'storage-cli']" + description: "The type of blobstore backing to use. Valid values: ['storage-cli']" default: "storage-cli" - cc.resource_pool.webdav_config.blobstore_timeout: - description: "The timeout in seconds for requests to the blobstore" - default: 5 - cc.resource_pool.webdav_config.public_endpoint: - description: "The location of the webdav server eg: https://blobstore.com" - default: "" - cc.resource_pool.webdav_config.private_endpoint: - description: "The location of the webdav server eg: https://blobstore.internal" - default: "https://blobstore.service.cf.internal:4443" - cc.resource_pool.webdav_config.username: - description: "The basic auth user that CC uses to connect to the admin endpoint on webdav" - default: "" - cc.resource_pool.webdav_config.password: - description: "The basic auth password that CC uses to connect to the admin endpoint on webdav" - default: "" - cc.resource_pool.webdav_config.ca_cert: - description: "The ca cert to use when communicating with webdav" - default: "" cc.resource_pool.minimum_size: description: "Minimum size of a resource to add to the pool" default: 65536 @@ -246,26 +228,8 @@ properties: cc.packages.connection_config: description: "Storage CLI connection configuration" cc.packages.blobstore_type: - description: "The type of blobstore backing to use. Valid values: ['webdav', 'storage-cli']" + description: "The type of blobstore backing to use. Valid values: ['storage-cli']" default: "storage-cli" - cc.packages.webdav_config.blobstore_timeout: - description: "The timeout in seconds for requests to the blobstore" - default: 5 - cc.packages.webdav_config.public_endpoint: - description: "The location of the webdav server eg: https://blobstore.com" - default: "" - cc.packages.webdav_config.private_endpoint: - description: "The location of the webdav server eg: https://blobstore.internal" - default: "https://blobstore.service.cf.internal:4443" - cc.packages.webdav_config.username: - description: "The basic auth user that CC uses to connect to the admin endpoint on webdav" - default: "" - cc.packages.webdav_config.password: - description: "The basic auth password that CC uses to connect to the admin endpoint on webdav" - default: "" - cc.packages.webdav_config.ca_cert: - description: "The ca cert to use when communicating with webdav" - default: "" cc.packages.app_package_directory_key: description: "Directory (bucket) used store app packages. It does not have be pre-created." default: "cc-packages" @@ -279,26 +243,8 @@ properties: cc.droplets.connection_config: description: "Storage CLI connection configuration" cc.droplets.blobstore_type: - description: "The type of blobstore backing to use. Valid values: ['webdav', 'storage-cli']" + description: "The type of blobstore backing to use. Valid values: ['storage-cli']" default: "storage-cli" - cc.droplets.webdav_config.blobstore_timeout: - description: "The timeout in seconds for requests to the blobstore" - default: 5 - cc.droplets.webdav_config.public_endpoint: - description: "The location of the webdav server eg: https://blobstore.com" - default: "" - cc.droplets.webdav_config.private_endpoint: - description: "The location of the webdav server eg: https://blobstore.internal" - default: "https://blobstore.service.cf.internal:4443" - cc.droplets.webdav_config.username: - description: "The basic auth user that CC uses to connect to the admin endpoint on webdav" - default: "" - cc.droplets.webdav_config.password: - description: "The basic auth password that CC uses to connect to the admin endpoint on webdav" - default: "" - cc.droplets.webdav_config.ca_cert: - description: "The ca cert to use when communicating with webdav" - default: "" cc.droplets.droplet_directory_key: description: "Directory (bucket) used store droplets. It does not have be pre-created." default: "cc-droplets" @@ -309,26 +255,8 @@ properties: cc.buildpacks.connection_config: description: "Storage CLI connection configuration" cc.buildpacks.blobstore_type: - description: "The type of blobstore backing to use. Valid values: ['webdav', 'storage-cli']" + description: "The type of blobstore backing to use. Valid values: ['storage-cli']" default: "storage-cli" - cc.buildpacks.webdav_config.blobstore_timeout: - description: "The timeout in seconds for requests to the blobstore" - default: 5 - cc.buildpacks.webdav_config.public_endpoint: - description: "The location of the webdav server eg: https://blobstore.com" - default: "" - cc.buildpacks.webdav_config.private_endpoint: - description: "The location of the webdav server eg: https://blobstore.internal" - default: "https://blobstore.service.cf.internal:4443" - cc.buildpacks.webdav_config.username: - description: "The basic auth user that CC uses to connect to the admin endpoint on webdav" - default: "" - cc.buildpacks.webdav_config.password: - description: "The basic auth password that CC uses to connect to the admin endpoint on webdav" - default: "" - cc.buildpacks.webdav_config.ca_cert: - description: "The ca cert to use when communicating with webdav" - default: "" cc.buildpacks.buildpack_directory_key: description: "Directory (bucket) used store buildpacks. It does not have be pre-created." default: "cc-buildpacks" diff --git a/jobs/cloud_controller_clock/templates/cloud_controller_ng.yml.erb b/jobs/cloud_controller_clock/templates/cloud_controller_ng.yml.erb index 650ef6a0b4..2ac8cb066e 100644 --- a/jobs/cloud_controller_clock/templates/cloud_controller_ng.yml.erb +++ b/jobs/cloud_controller_clock/templates/cloud_controller_ng.yml.erb @@ -233,15 +233,6 @@ default_health_check_timeout: <%= p("cc.default_health_check_timeout") %> resource_pool: blobstore_type: <%= p("cc.resource_pool.blobstore_type") %> - webdav_config: - blobstore_timeout: <%= p("cc.resource_pool.webdav_config.blobstore_timeout") %> - public_endpoint: <%= p("cc.resource_pool.webdav_config.public_endpoint") %> - private_endpoint: <%= p("cc.resource_pool.webdav_config.private_endpoint") %> - username: <%= p("cc.resource_pool.webdav_config.username") %> - password: <%= yaml_escape(p("cc.resource_pool.webdav_config.password")) %> - <% if p("cc.resource_pool.webdav_config.ca_cert") != "" && p("cc.resource_pool.webdav_config.ca_cert") != nil %> - ca_cert_path: "/var/vcap/jobs/cloud_controller_clock/config/certs/resource_pool_ca_cert.pem" - <% end %> minimum_size: <%= p("cc.resource_pool.minimum_size") %> maximum_size: <%= p("cc.resource_pool.maximum_size") %> resource_directory_key: <%= p("cc.resource_pool.resource_directory_key") %> @@ -249,42 +240,15 @@ resource_pool: packages: blobstore_type: <%= p("cc.packages.blobstore_type") %> - webdav_config: - blobstore_timeout: <%= p("cc.packages.webdav_config.blobstore_timeout") %> - public_endpoint: <%= p("cc.packages.webdav_config.public_endpoint") %> - private_endpoint: <%= p("cc.packages.webdav_config.private_endpoint") %> - username: <%= p("cc.packages.webdav_config.username") %> - password: <%= yaml_escape(p("cc.packages.webdav_config.password")) %> - <% if p("cc.packages.webdav_config.ca_cert") != "" && p("cc.packages.webdav_config.ca_cert") != nil %> - ca_cert_path: "/var/vcap/jobs/cloud_controller_clock/config/certs/packages_ca_cert.pem" - <% end %> app_package_directory_key: <%= p("cc.packages.app_package_directory_key") %> max_package_size: <%= p("cc.packages.max_package_size") %> droplets: blobstore_type: <%= p("cc.droplets.blobstore_type") %> - webdav_config: - blobstore_timeout: <%= p("cc.droplets.webdav_config.blobstore_timeout") %> - public_endpoint: <%= p("cc.droplets.webdav_config.public_endpoint") %> - private_endpoint: <%= p("cc.droplets.webdav_config.private_endpoint") %> - username: <%= p("cc.droplets.webdav_config.username") %> - password: <%= yaml_escape(p("cc.droplets.webdav_config.password")) %> - <% if p("cc.droplets.webdav_config.ca_cert") != "" && p("cc.droplets.webdav_config.ca_cert") != nil %> - ca_cert_path: "/var/vcap/jobs/cloud_controller_clock/config/certs/droplets_ca_cert.pem" - <% end %> droplet_directory_key: <%= p("cc.droplets.droplet_directory_key") %> buildpacks: blobstore_type: <%= p("cc.buildpacks.blobstore_type") %> - webdav_config: - blobstore_timeout: <%= p("cc.buildpacks.webdav_config.blobstore_timeout") %> - public_endpoint: <%= p("cc.buildpacks.webdav_config.public_endpoint") %> - private_endpoint: <%= p("cc.buildpacks.webdav_config.private_endpoint") %> - username: <%= p("cc.buildpacks.webdav_config.username") %> - password: <%= yaml_escape(p("cc.buildpacks.webdav_config.password")) %> - <% if p("cc.buildpacks.webdav_config.ca_cert") != "" && p("cc.buildpacks.webdav_config.ca_cert") != nil %> - ca_cert_path: "/var/vcap/jobs/cloud_controller_clock/config/certs/buildpacks_ca_cert.pem" - <% end %> buildpack_directory_key: <%= p("cc.buildpacks.buildpack_directory_key") %> db_encryption_key: <%= p("cc.db_encryption_key") %> diff --git a/jobs/cloud_controller_ng/spec b/jobs/cloud_controller_ng/spec index ba7e1b0d25..58a33e96af 100644 --- a/jobs/cloud_controller_ng/spec +++ b/jobs/cloud_controller_ng/spec @@ -16,12 +16,10 @@ templates: cloud_controller_ng.yml.erb: config/cloud_controller_ng.yml blobstore_waiter.sh.erb: bin/blobstore_waiter.sh - buildpacks_ca_cert.pem.erb: config/certs/buildpacks_ca_cert.pem cloud_controller_api_health_check.erb: bin/cloud_controller_ng_health_check ccng_monit_http_healthcheck.sh.erb: bin/ccng_monit_http_healthcheck console.erb: bin/console drain.sh.erb: bin/drain - droplets_ca_cert.pem.erb: config/certs/droplets_ca_cert.pem logcache_tls.crt.erb: config/certs/logcache_tls.crt logcache_tls.key.erb: config/certs/logcache_tls.key logcache_tls_ca.crt.erb: config/certs/logcache_tls_ca.crt @@ -43,13 +41,11 @@ templates: newrelic_plugin.yml.erb: config/newrelic_plugin.yml nginx.conf.erb: config/nginx.conf nginx_maintenance.conf.erb: config/nginx_maintenance.conf - packages_ca_cert.pem.erb: config/certs/packages_ca_cert.pem perform_blobstore_benchmarks.erb: bin/perform_blobstore_benchmarks post-start.sh.erb: bin/post-start pre-start.sh.erb: bin/pre-start public_upload.conf.erb: config/public_upload.conf restart_drain.sh.erb: bin/restart_drain - resource_pool_ca_cert.pem.erb: config/certs/resource_pool_ca_cert.pem shutdown_drain.rb.erb: bin/shutdown_drain ruby_version.sh.erb: bin/ruby_version.sh seed_db.sh.erb: bin/seed_db @@ -121,12 +117,6 @@ provides: - cc.buildpacks.blobstore_provider - cc.buildpacks.blobstore_type - cc.buildpacks.buildpack_directory_key - - cc.buildpacks.webdav_config.blobstore_timeout - - cc.buildpacks.webdav_config.ca_cert - - cc.buildpacks.webdav_config.password - - cc.buildpacks.webdav_config.private_endpoint - - cc.buildpacks.webdav_config.public_endpoint - - cc.buildpacks.webdav_config.username - cc.cpu_weight_min_memory - cc.cpu_weight_max_memory - cc.credential_references.interpolate_service_bindings @@ -145,12 +135,6 @@ provides: - cc.droplets.blobstore_provider - cc.droplets.blobstore_type - cc.droplets.droplet_directory_key - - cc.droplets.webdav_config.blobstore_timeout - - cc.droplets.webdav_config.ca_cert - - cc.droplets.webdav_config.password - - cc.droplets.webdav_config.private_endpoint - - cc.droplets.webdav_config.public_endpoint - - cc.droplets.webdav_config.username - cc.external_host - cc.external_port - cc.external_protocol @@ -170,23 +154,11 @@ provides: - cc.packages.blobstore_type - cc.packages.max_package_size - cc.packages.max_valid_packages_stored - - cc.packages.webdav_config.blobstore_timeout - - cc.packages.webdav_config.ca_cert - - cc.packages.webdav_config.password - - cc.packages.webdav_config.private_endpoint - - cc.packages.webdav_config.public_endpoint - - cc.packages.webdav_config.username - cc.resource_pool.blobstore_provider - cc.resource_pool.blobstore_type - cc.resource_pool.maximum_size - cc.resource_pool.minimum_size - cc.resource_pool.resource_directory_key - - cc.resource_pool.webdav_config.blobstore_timeout - - cc.resource_pool.webdav_config.ca_cert - - cc.resource_pool.webdav_config.password - - cc.resource_pool.webdav_config.private_endpoint - - cc.resource_pool.webdav_config.public_endpoint - - cc.resource_pool.webdav_config.username - cc.stacks - cc.staging_timeout_in_seconds - cc.staging_upload_password @@ -516,26 +488,8 @@ properties: cc.resource_pool.connection_config: description: "Storage CLI connection configuration" cc.resource_pool.blobstore_type: - description: "The type of blobstore backing to use. Valid values: ['webdav', 'storage-cli']" + description: "The type of blobstore backing to use. Valid values: ['storage-cli']" default: "storage-cli" - cc.resource_pool.webdav_config.blobstore_timeout: - description: "The timeout in seconds for requests to the blobstore" - default: 5 - cc.resource_pool.webdav_config.public_endpoint: - description: "The location of the webdav server eg: https://blobstore.com" - default: "" - cc.resource_pool.webdav_config.private_endpoint: - description: "The location of the webdav server eg: https://blobstore.internal" - default: "https://blobstore.service.cf.internal:4443" - cc.resource_pool.webdav_config.username: - description: "The basic auth user that CC uses to connect to the admin endpoint on webdav" - default: "" - cc.resource_pool.webdav_config.password: - description: "The basic auth password that CC uses to connect to the admin endpoint on webdav" - default: "" - cc.resource_pool.webdav_config.ca_cert: - description: "The ca cert to use when communicating with webdav" - default: "" cc.resource_pool.minimum_size: description: "Minimum size of a resource to add to the pool" default: 65536 @@ -552,26 +506,8 @@ properties: cc.packages.connection_config: description: "Storage CLI connection configuration" cc.packages.blobstore_type: - description: "The type of blobstore backing to use. Valid values: ['webdav', 'storage-cli']" + description: "The type of blobstore backing to use. Valid values: ['storage-cli']" default: "storage-cli" - cc.packages.webdav_config.blobstore_timeout: - description: "The timeout in seconds for requests to the blobstore" - default: 5 - cc.packages.webdav_config.public_endpoint: - description: "The location of the webdav server eg: https://blobstore.com" - default: "" - cc.packages.webdav_config.private_endpoint: - description: "The location of the webdav server eg: https://blobstore.internal" - default: "https://blobstore.service.cf.internal:4443" - cc.packages.webdav_config.username: - description: "The basic auth user that CC uses to connect to the admin endpoint on webdav" - default: "" - cc.packages.webdav_config.password: - description: "The basic auth password that CC uses to connect to the admin endpoint on webdav" - default: "" - cc.packages.webdav_config.ca_cert: - description: "The ca cert to use when communicating with webdav" - default: "" cc.packages.app_package_directory_key: description: "Directory (bucket) used store app packages. It does not have be pre-created. Should contain only alphanumeric characters, '-', '_', and '.'" default: "cc-packages" @@ -588,26 +524,8 @@ properties: cc.droplets.connection_config: description: "Storage CLI connection configuration" cc.droplets.blobstore_type: - description: "The type of blobstore backing to use. Valid values: ['webdav', 'storage-cli']" + description: "The type of blobstore backing to use. Valid values: ['storage-cli']" default: "storage-cli" - cc.droplets.webdav_config.blobstore_timeout: - description: "The timeout in seconds for requests to the blobstore" - default: 5 - cc.droplets.webdav_config.public_endpoint: - description: "The location of the webdav server eg: https://blobstore.com" - default: "" - cc.droplets.webdav_config.private_endpoint: - description: "The location of the webdav server eg: https://blobstore.internal" - default: "https://blobstore.service.cf.internal:4443" - cc.droplets.webdav_config.username: - description: "The basic auth user that CC uses to connect to the admin endpoint on webdav" - default: "" - cc.droplets.webdav_config.password: - description: "The basic auth password that CC uses to connect to the admin endpoint on webdav" - default: "" - cc.droplets.webdav_config.ca_cert: - description: "The ca cert to use when communicating with webdav" - default: "" cc.droplets.droplet_directory_key: description: "Directory (bucket) used store droplets. It does not have be pre-created. Should contain only alphanumeric characters, '-', '_', and '.'" default: "cc-droplets" @@ -621,26 +539,8 @@ properties: cc.buildpacks.connection_config: description: "Storage CLI connection configuration" cc.buildpacks.blobstore_type: - description: "The type of blobstore backing to use. Valid values: ['webdav', 'storage-cli']" + description: "The type of blobstore backing to use. Valid values: ['storage-cli']" default: "storage-cli" - cc.buildpacks.webdav_config.blobstore_timeout: - description: "The timeout in seconds for requests to the blobstore" - default: 5 - cc.buildpacks.webdav_config.public_endpoint: - description: "The location of the webdav server eg: https://blobstore.com" - default: "" - cc.buildpacks.webdav_config.private_endpoint: - description: "The location of the webdav server eg: https://blobstore.internal" - default: "https://blobstore.service.cf.internal:4443" - cc.buildpacks.webdav_config.username: - description: "The basic auth user that CC uses to connect to the admin endpoint on webdav" - default: "" - cc.buildpacks.webdav_config.password: - description: "The basic auth password that CC uses to connect to the admin endpoint on webdav" - default: "" - cc.buildpacks.webdav_config.ca_cert: - description: "The ca cert to use when communicating with webdav" - default: "" cc.buildpacks.buildpack_directory_key: description: "Directory (bucket) used store buildpacks. It does not have be pre-created. Should contain only alphanumeric characters, '-', '_', and '.'" default: "cc-buildpacks" diff --git a/jobs/cloud_controller_ng/templates/buildpacks_ca_cert.pem.erb b/jobs/cloud_controller_ng/templates/buildpacks_ca_cert.pem.erb deleted file mode 120000 index 9c9bc307ac..0000000000 --- a/jobs/cloud_controller_ng/templates/buildpacks_ca_cert.pem.erb +++ /dev/null @@ -1 +0,0 @@ -../../../shared_job_templates/buildpacks_ca_cert.pem.erb \ No newline at end of file diff --git a/jobs/cloud_controller_ng/templates/cloud_controller_ng.yml.erb b/jobs/cloud_controller_ng/templates/cloud_controller_ng.yml.erb index c7f69f1ca7..e7ecda7862 100644 --- a/jobs/cloud_controller_ng/templates/cloud_controller_ng.yml.erb +++ b/jobs/cloud_controller_ng/templates/cloud_controller_ng.yml.erb @@ -344,59 +344,23 @@ default_quota_definition: <%= p("cc.default_quota_definition") %> resource_pool: blobstore_type: <%= p("cc.resource_pool.blobstore_type") %> - webdav_config: - blobstore_timeout: <%= p("cc.resource_pool.webdav_config.blobstore_timeout") %> - public_endpoint: <%= p("cc.resource_pool.webdav_config.public_endpoint") %> - private_endpoint: <%= p("cc.resource_pool.webdav_config.private_endpoint") %> - username: <%= p("cc.resource_pool.webdav_config.username") %> - password: <%= yaml_escape(p("cc.resource_pool.webdav_config.password")) %> - <% if p("cc.resource_pool.webdav_config.ca_cert") != "" && p("cc.resource_pool.webdav_config.ca_cert") != nil %> - ca_cert_path: "/var/vcap/jobs/cloud_controller_ng/config/certs/resource_pool_ca_cert.pem" - <% end %> minimum_size: <%= p("cc.resource_pool.minimum_size") %> maximum_size: <%= p("cc.resource_pool.maximum_size") %> resource_directory_key: <%= p("cc.resource_pool.resource_directory_key") %> packages: blobstore_type: <%= p("cc.packages.blobstore_type") %> - webdav_config: - blobstore_timeout: <%= p("cc.packages.webdav_config.blobstore_timeout") %> - public_endpoint: <%= p("cc.packages.webdav_config.public_endpoint") %> - private_endpoint: <%= p("cc.packages.webdav_config.private_endpoint") %> - username: <%= p("cc.packages.webdav_config.username") %> - password: <%= yaml_escape(p("cc.packages.webdav_config.password")) %> - <% if p("cc.packages.webdav_config.ca_cert") != "" && p("cc.packages.webdav_config.ca_cert") != nil %> - ca_cert_path: "/var/vcap/jobs/cloud_controller_ng/config/certs/packages_ca_cert.pem" - <% end %> app_package_directory_key: <%= p("cc.packages.app_package_directory_key") %> max_valid_packages_stored: <%= p("cc.packages.max_valid_packages_stored") %> max_package_size: <%= p("cc.packages.max_package_size") %> droplets: blobstore_type: <%= p("cc.droplets.blobstore_type") %> - webdav_config: - blobstore_timeout: <%= p("cc.droplets.webdav_config.blobstore_timeout") %> - public_endpoint: <%= p("cc.droplets.webdav_config.public_endpoint") %> - private_endpoint: <%= p("cc.droplets.webdav_config.private_endpoint") %> - username: <%= p("cc.droplets.webdav_config.username") %> - password: <%= yaml_escape(p("cc.droplets.webdav_config.password")) %> - <% if p("cc.droplets.webdav_config.ca_cert") != "" && p("cc.droplets.webdav_config.ca_cert") != nil %> - ca_cert_path: "/var/vcap/jobs/cloud_controller_ng/config/certs/droplets_ca_cert.pem" - <% end %> droplet_directory_key: <%= p("cc.droplets.droplet_directory_key") %> max_staged_droplets_stored: <%= p("cc.droplets.max_staged_droplets_stored") %> buildpacks: blobstore_type: <%= p("cc.buildpacks.blobstore_type") %> - webdav_config: - blobstore_timeout: <%= p("cc.buildpacks.webdav_config.blobstore_timeout") %> - public_endpoint: <%= p("cc.buildpacks.webdav_config.public_endpoint") %> - private_endpoint: <%= p("cc.buildpacks.webdav_config.private_endpoint") %> - username: <%= p("cc.buildpacks.webdav_config.username") %> - password: <%= yaml_escape(p("cc.buildpacks.webdav_config.password")) %> - <% if p("cc.buildpacks.webdav_config.ca_cert") != "" && p("cc.buildpacks.webdav_config.ca_cert") != nil %> - ca_cert_path: "/var/vcap/jobs/cloud_controller_ng/config/certs/buildpacks_ca_cert.pem" - <% end %> buildpack_directory_key: <%= p("cc.buildpacks.buildpack_directory_key") %> db_encryption_key: <%= p("cc.db_encryption_key") %> diff --git a/jobs/cloud_controller_ng/templates/droplets_ca_cert.pem.erb b/jobs/cloud_controller_ng/templates/droplets_ca_cert.pem.erb deleted file mode 120000 index d19041ffde..0000000000 --- a/jobs/cloud_controller_ng/templates/droplets_ca_cert.pem.erb +++ /dev/null @@ -1 +0,0 @@ -../../../shared_job_templates/droplets_ca_cert.pem.erb \ No newline at end of file diff --git a/jobs/cloud_controller_ng/templates/packages_ca_cert.pem.erb b/jobs/cloud_controller_ng/templates/packages_ca_cert.pem.erb deleted file mode 120000 index 1d24977063..0000000000 --- a/jobs/cloud_controller_ng/templates/packages_ca_cert.pem.erb +++ /dev/null @@ -1 +0,0 @@ -../../../shared_job_templates/packages_ca_cert.pem.erb \ No newline at end of file diff --git a/jobs/cloud_controller_ng/templates/resource_pool_ca_cert.pem.erb b/jobs/cloud_controller_ng/templates/resource_pool_ca_cert.pem.erb deleted file mode 120000 index 25569fb402..0000000000 --- a/jobs/cloud_controller_ng/templates/resource_pool_ca_cert.pem.erb +++ /dev/null @@ -1 +0,0 @@ -../../../shared_job_templates/resource_pool_ca_cert.pem.erb \ No newline at end of file diff --git a/jobs/cloud_controller_worker/spec b/jobs/cloud_controller_worker/spec index 855d6743db..1b9a59b5a0 100644 --- a/jobs/cloud_controller_worker/spec +++ b/jobs/cloud_controller_worker/spec @@ -151,26 +151,8 @@ properties: cc.resource_pool.connection_config: description: "Storage CLI connection configuration" cc.resource_pool.blobstore_type: - description: "The type of blobstore backing to use. Valid values: ['webdav', 'storage-cli']" + description: "The type of blobstore backing to use. Valid values: ['storage-cli']" default: "storage-cli" - cc.resource_pool.webdav_config.blobstore_timeout: - description: "The timeout in seconds for requests to the blobstore" - default: 5 - cc.resource_pool.webdav_config.public_endpoint: - description: "The location of the webdav server eg: https://blobstore.com" - default: "" - cc.resource_pool.webdav_config.private_endpoint: - description: "The location of the webdav server eg: https://blobstore.internal" - default: "https://blobstore.service.cf.internal:4443" - cc.resource_pool.webdav_config.username: - description: "The basic auth user that CC uses to connect to the admin endpoint on webdav" - default: "" - cc.resource_pool.webdav_config.password: - description: "The basic auth password that CC uses to connect to the admin endpoint on webdav" - default: "" - cc.resource_pool.webdav_config.ca_cert: - description: "The CA certificate to use when communicating with webdav" - default: "" cc.resource_pool.minimum_size: description: "Minimum size of a resource to add to the pool" default: 65536 @@ -187,26 +169,8 @@ properties: cc.packages.connection_config: description: "Storage CLI connection configuration" cc.packages.blobstore_type: - description: "The type of blobstore backing to use. Valid values: ['webdav', 'storage-cli']" + description: "The type of blobstore backing to use. Valid values: ['storage-cli']" default: "storage-cli" - cc.packages.webdav_config.blobstore_timeout: - description: "The timeout in seconds for requests to the blobstore" - default: 5 - cc.packages.webdav_config.public_endpoint: - description: "The location of the webdav server eg: https://blobstore.com" - default: "" - cc.packages.webdav_config.private_endpoint: - description: "The location of the webdav server eg: https://blobstore.internal" - default: "https://blobstore.service.cf.internal:4443" - cc.packages.webdav_config.username: - description: "The basic auth user that CC uses to connect to the admin endpoint on webdav" - default: "" - cc.packages.webdav_config.password: - description: "The basic auth password that CC uses to connect to the admin endpoint on webdav" - default: "" - cc.packages.webdav_config.ca_cert: - description: "The CA certificate to use when communicating with webdav" - default: "" cc.packages.app_package_directory_key: description: "Directory (bucket) used store app packages. It does not have be pre-created." default: "cc-packages" @@ -220,26 +184,8 @@ properties: cc.droplets.connection_config: description: "Storage CLI connection configuration" cc.droplets.blobstore_type: - description: "The type of blobstore backing to use. Valid values: ['webdav', 'storage-cli']" + description: "The type of blobstore backing to use. Valid values: ['storage-cli']" default: "storage-cli" - cc.droplets.webdav_config.blobstore_timeout: - description: "The timeout in seconds for requests to the blobstore" - default: 5 - cc.droplets.webdav_config.public_endpoint: - description: "The location of the webdav server eg: https://blobstore.com" - default: "" - cc.droplets.webdav_config.private_endpoint: - description: "The location of the webdav server eg: https://blobstore.internal" - default: "https://blobstore.service.cf.internal:4443" - cc.droplets.webdav_config.username: - description: "The basic auth user that CC uses to connect to the admin endpoint on webdav" - default: "" - cc.droplets.webdav_config.password: - description: "The basic auth password that CC uses to connect to the admin endpoint on webdav" - default: "" - cc.droplets.webdav_config.ca_cert: - description: "The CA certificate to use when communicating with webdav" - default: "" cc.droplets.droplet_directory_key: description: "Directory (bucket) used store droplets. It does not have be pre-created." default: "cc-droplets" @@ -250,26 +196,8 @@ properties: cc.buildpacks.connection_config: description: "Storage CLI connection configuration" cc.buildpacks.blobstore_type: - description: "The type of blobstore backing to use. Valid values: ['webdav', 'storage-cli']" + description: "The type of blobstore backing to use. Valid values: ['storage-cli']" default: "storage-cli" - cc.buildpacks.webdav_config.blobstore_timeout: - description: "The timeout in seconds for requests to the blobstore" - default: 5 - cc.buildpacks.webdav_config.public_endpoint: - description: "The location of the webdav server eg: https://blobstore.com" - default: "" - cc.buildpacks.webdav_config.private_endpoint: - description: "The location of the webdav server eg: https://blobstore.internal" - default: "https://blobstore.service.cf.internal:4443" - cc.buildpacks.webdav_config.username: - description: "The basic auth user that CC uses to connect to the admin endpoint on webdav" - default: "" - cc.buildpacks.webdav_config.password: - description: "The basic auth password that CC uses to connect to the admin endpoint on webdav" - default: "" - cc.buildpacks.webdav_config.ca_cert: - description: "The CA certificate to use when communicating with webdav" - default: "" cc.buildpacks.buildpack_directory_key: description: "Directory (bucket) used store buildpacks. It does not have be pre-created." default: "cc-buildpacks" diff --git a/jobs/cloud_controller_worker/templates/cloud_controller_ng.yml.erb b/jobs/cloud_controller_worker/templates/cloud_controller_ng.yml.erb index 01f66b3467..ea31b5c424 100644 --- a/jobs/cloud_controller_worker/templates/cloud_controller_ng.yml.erb +++ b/jobs/cloud_controller_worker/templates/cloud_controller_ng.yml.erb @@ -189,15 +189,6 @@ storage_cli_optional_flags: <%= p("cc.storage_cli_optional_flags") %> resource_pool: blobstore_type: <%= p("cc.resource_pool.blobstore_type") %> - webdav_config: - blobstore_timeout: <%= p("cc.resource_pool.webdav_config.blobstore_timeout") %> - public_endpoint: <%= p("cc.resource_pool.webdav_config.public_endpoint") %> - private_endpoint: <%= p("cc.resource_pool.webdav_config.private_endpoint") %> - username: <%= p("cc.resource_pool.webdav_config.username") %> - password: <%= yaml_escape(p("cc.resource_pool.webdav_config.password")) %> - <% if p("cc.resource_pool.webdav_config.ca_cert") != "" && p("cc.resource_pool.webdav_config.ca_cert") != nil %> - ca_cert_path: "/var/vcap/jobs/cloud_controller_worker/config/certs/resource_pool_ca_cert.pem" - <% end %> minimum_size: <%= p("cc.resource_pool.minimum_size") %> maximum_size: <%= p("cc.resource_pool.maximum_size") %> resource_directory_key: <%= p("cc.resource_pool.resource_directory_key") %> @@ -205,43 +196,16 @@ resource_pool: packages: blobstore_type: <%= p("cc.packages.blobstore_type") %> - webdav_config: - blobstore_timeout: <%= p("cc.packages.webdav_config.blobstore_timeout") %> - public_endpoint: <%= p("cc.packages.webdav_config.public_endpoint") %> - private_endpoint: <%= p("cc.packages.webdav_config.private_endpoint") %> - username: <%= p("cc.packages.webdav_config.username") %> - password: <%= yaml_escape(p("cc.packages.webdav_config.password")) %> - <% if p("cc.packages.webdav_config.ca_cert") != "" && p("cc.packages.webdav_config.ca_cert") != nil %> - ca_cert_path: "/var/vcap/jobs/cloud_controller_worker/config/certs/packages_ca_cert.pem" - <% end %> app_package_directory_key: <%= p("cc.packages.app_package_directory_key") %> max_package_size: <%= p("cc.packages.max_package_size") %> max_valid_packages_stored: <%= link("cloud_controller_internal").p("cc.packages.max_valid_packages_stored") %> droplets: blobstore_type: <%= p("cc.droplets.blobstore_type") %> - webdav_config: - blobstore_timeout: <%= p("cc.droplets.webdav_config.blobstore_timeout") %> - public_endpoint: <%= p("cc.droplets.webdav_config.public_endpoint") %> - private_endpoint: <%= p("cc.droplets.webdav_config.private_endpoint") %> - username: <%= p("cc.droplets.webdav_config.username") %> - password: <%= yaml_escape(p("cc.droplets.webdav_config.password")) %> - <% if p("cc.droplets.webdav_config.ca_cert") != "" && p("cc.droplets.webdav_config.ca_cert") != nil %> - ca_cert_path: "/var/vcap/jobs/cloud_controller_worker/config/certs/droplets_ca_cert.pem" - <% end %> droplet_directory_key: <%= p("cc.droplets.droplet_directory_key") %> buildpacks: blobstore_type: <%= p("cc.buildpacks.blobstore_type") %> - webdav_config: - blobstore_timeout: <%= p("cc.buildpacks.webdav_config.blobstore_timeout") %> - public_endpoint: <%= p("cc.buildpacks.webdav_config.public_endpoint") %> - private_endpoint: <%= p("cc.buildpacks.webdav_config.private_endpoint") %> - username: <%= p("cc.buildpacks.webdav_config.username") %> - password: <%= yaml_escape(p("cc.buildpacks.webdav_config.password")) %> - <% if p("cc.buildpacks.webdav_config.ca_cert") != "" && p("cc.buildpacks.webdav_config.ca_cert") != nil %> - ca_cert_path: "/var/vcap/jobs/cloud_controller_worker/config/certs/buildpacks_ca_cert.pem" - <% end %> buildpack_directory_key: <%= p("cc.buildpacks.buildpack_directory_key") %> db_encryption_key: <%= p("cc.db_encryption_key") %> diff --git a/packages/blobstore_url_signer/packaging b/packages/blobstore_url_signer/packaging deleted file mode 100644 index 9e2bec4932..0000000000 --- a/packages/blobstore_url_signer/packaging +++ /dev/null @@ -1,10 +0,0 @@ -#!/bin/bash -set -eu - -mkdir -p $BOSH_INSTALL_TARGET/bin - -source /var/vcap/packages/golang-1-linux/bosh/compile.env - -pushd github.com/cloudfoundry/blobstore_url_signer - go build -buildvcs=false -mod=vendor -o "${BOSH_INSTALL_TARGET}/bin/blobstore_url_signer" . -popd diff --git a/packages/blobstore_url_signer/spec b/packages/blobstore_url_signer/spec deleted file mode 100644 index 02da91ef05..0000000000 --- a/packages/blobstore_url_signer/spec +++ /dev/null @@ -1,8 +0,0 @@ ---- -name: blobstore_url_signer - -dependencies: - - golang-1-linux - -files: - - github.com/cloudfoundry/blobstore_url_signer/**/* diff --git a/packages/nginx_webdav/README.md b/packages/nginx_webdav/README.md deleted file mode 100644 index 44037f1b33..0000000000 --- a/packages/nginx_webdav/README.md +++ /dev/null @@ -1,10 +0,0 @@ -nginx_webdav -============ -This is the nginx we use to front our blobstore. - -This file can be downloaded from the following locations: - -| Filename | Homepage | Download URL | -|-----------------------------------------| -------- | ------------ | -| expat/expat-2.5.0.tar.bz2 | https://github.com/libexpat/libexpat/releases/download/R_2_5_0/expat-2.5.0.tar.gz | -| nginx/nginx-dav-ext-module-3.0.0.tar.gz | https://github.com/arut/nginx-dav-ext-module | https://github.com/arut/nginx-dav-ext-module/archive/v3.0.0.tar.gz | diff --git a/packages/nginx_webdav/packaging b/packages/nginx_webdav/packaging deleted file mode 100644 index 6ab0072153..0000000000 --- a/packages/nginx_webdav/packaging +++ /dev/null @@ -1,47 +0,0 @@ -set -e -x -# enable secure_link_hmac (SHA256 signed URLs) - -echo "Extracting expat..." -tar xvf expat/expat-2.5.0.tar.bz2 - -pushd expat-2.5.0 - ./configure - - make - make install - make check -popd - -echo "Extracting pcre..." -tar xzvf nginx/pcre-8.45.tar.gz - -echo "Extracting nginx..." -tar xzvf nginx/nginx-1.30.5.tar.gz - -echo "Extracting webdav extensions" -tar xzvf nginx/nginx-dav-ext-module-3.0.0.tar.gz - -echo "Extracting HMAC secure link module" -tar xzvf nginx/ngx_http_hmac_secure_link_module-0.3.tar.gz - -sed -i 's@"nginx/"@"-/"@g' nginx-1.30.5/src/core/nginx.h -sed -i 's@r->headers_out.server == NULL@0@g' nginx-1.30.5/src/http/ngx_http_header_filter_module.c -sed -i 's@r->headers_out.server == NULL@0@g' nginx-1.30.5/src/http/v2/ngx_http_v2_filter_module.c -sed -i 's@
nginx
@@g' nginx-1.30.5/src/http/ngx_http_special_response.c - -echo "Building nginx..." -pushd nginx-1.30.5 - ./configure \ - --prefix=${BOSH_INSTALL_TARGET} \ - --with-ld-opt="-L /usr/local/lib" \ - --with-cc-opt="-I /usr/local/include" \ - --with-pcre=../pcre-8.45 \ - --with-http_dav_module \ - --with-http_secure_link_module \ - --with-http_ssl_module \ - --add-module=../nginx-dav-ext-module-3.0.0 \ - --add-module=../ngx_http_hmac_secure_link_module-0.3 - - make - make install -popd diff --git a/packages/nginx_webdav/spec b/packages/nginx_webdav/spec deleted file mode 100644 index 23edb28b6e..0000000000 --- a/packages/nginx_webdav/spec +++ /dev/null @@ -1,8 +0,0 @@ ---- -name: nginx_webdav -files: - - expat/expat-2.5.0.tar.bz2 - - nginx/nginx-1.30.5.tar.gz - - nginx/pcre-8.45.tar.gz - - nginx/nginx-dav-ext-module-3.0.0.tar.gz - - nginx/ngx_http_hmac_secure_link_module-0.3.tar.gz diff --git a/scripts/sync_submodule_config b/scripts/sync_submodule_config index 278f33656e..7bf52117ff 100755 --- a/scripts/sync_submodule_config +++ b/scripts/sync_submodule_config @@ -22,4 +22,4 @@ go get code.cloudfoundry.org/locket/cmd/... } > /tmp/packages -cat /tmp/packages | xargs gosub sync -i src/cloud_controller_ng -i src/github.com/cloudfoundry/blobstore_url_signer +cat /tmp/packages | xargs gosub sync -i src/cloud_controller_ng diff --git a/shared_job_templates/blobstore_waiter.sh.erb b/shared_job_templates/blobstore_waiter.sh.erb index 0c75b18e08..2c00ecedf5 100644 --- a/shared_job_templates/blobstore_waiter.sh.erb +++ b/shared_job_templates/blobstore_waiter.sh.erb @@ -1,37 +1,3 @@ -function try_to_curl { - local url=$1 - local max_attempts=$2 - local interval_in_seconds=$3 - - curl -s -k "$url" >/dev/null - - found=$? - blobstore_check_attempts=0 - - while [ $found -ne 0 ] - do - sleep $interval_in_seconds - blobstore_check_attempts=$((blobstore_check_attempts+1)) - - curl -s -k "$url" >/dev/null - found=$? - - if [[ blobstore_check_attempts -eq $max_attempts ]]; then - echo "Blobstore is not available" - exit 1 - fi - done -} - function wait_for_blobstore { - max_attempts=30 - sleep_length=1 - - <% if p('cc.buildpacks.blobstore_type') == 'webdav' %> - - echo "Checking for blobstore availability" - try_to_curl "<%= p('cc.buildpacks.webdav_config.private_endpoint') %>" $max_attempts $sleep_length - echo "Blobstore is available" - - <% end %> + : # no-op: blobstore availability check is not required for storage-cli providers } diff --git a/shared_job_templates/buildpacks_ca_cert.pem.erb b/shared_job_templates/buildpacks_ca_cert.pem.erb deleted file mode 100644 index 3c650c76f8..0000000000 --- a/shared_job_templates/buildpacks_ca_cert.pem.erb +++ /dev/null @@ -1 +0,0 @@ -<%= p('cc.buildpacks.webdav_config.ca_cert') %> diff --git a/shared_job_templates/droplets_ca_cert.pem.erb b/shared_job_templates/droplets_ca_cert.pem.erb deleted file mode 100644 index 8cb15668a7..0000000000 --- a/shared_job_templates/droplets_ca_cert.pem.erb +++ /dev/null @@ -1 +0,0 @@ -<%= p('cc.droplets.webdav_config.ca_cert') %> diff --git a/shared_job_templates/packages_ca_cert.pem.erb b/shared_job_templates/packages_ca_cert.pem.erb deleted file mode 100644 index a0990d4ed1..0000000000 --- a/shared_job_templates/packages_ca_cert.pem.erb +++ /dev/null @@ -1 +0,0 @@ -<%= p('cc.packages.webdav_config.ca_cert') %> diff --git a/shared_job_templates/resource_pool_ca_cert.pem.erb b/shared_job_templates/resource_pool_ca_cert.pem.erb deleted file mode 100644 index 898c4b6c18..0000000000 --- a/shared_job_templates/resource_pool_ca_cert.pem.erb +++ /dev/null @@ -1 +0,0 @@ -<%= p('cc.resource_pool.webdav_config.ca_cert') %> diff --git a/spec/blobstore/backup_spec.rb b/spec/blobstore/backup_spec.rb deleted file mode 100644 index 808475fe87..0000000000 --- a/spec/blobstore/backup_spec.rb +++ /dev/null @@ -1,90 +0,0 @@ -# frozen_string_literal: true - -require 'rspec' -require 'bosh/template/test' -require 'yaml' -require 'json' - -module Bosh - module Template - module Test - describe 'blobstore BBR backup script' do - def template - release_path = File.join(File.dirname(__FILE__), '../..') - release = ReleaseDir.new(release_path) - job = release.job('blobstore') - job.template('bin/bbr/backup') - end - - let(:links) do - [ - Link.new(name: 'directories_to_backup', properties: { - 'cc' => { - 'droplets' => { - 'droplet_directory_key' => 'some_droplets_directory_key' - }, - 'buildpacks' => { - 'buildpack_directory_key' => 'some_buildpacks_directory_key' - }, - 'packages' => { - 'app_package_directory_key' => 'some_packages_directory_key' - } - } - }) - ] - end - - it 'templates all the backup commands' do - expect(template.render({}, consumes: links)).to( - include( - 'mkdir -p $BBR_ARTIFACT_DIRECTORY/shared', - 'cp --recursive --link /var/vcap/store/shared/some_droplets_directory_key', - 'cp --recursive --link /var/vcap/store/shared/some_buildpacks_directory_key', - 'cp --recursive --link /var/vcap/store/shared/some_packages_directory_key', - 'rm --force --recursive $BBR_ARTIFACT_DIRECTORY/shared/some_droplets_directory_key/buildpack_cache' - ) - ) - end - - context 'when release_level_backup is false' do - it 'does not template any commands' do - expect(template.render({ 'release_level_backup' => false }, consumes: links)).not_to( - include( - 'mkdir -p', - 'cp --recursive', - 'rm --force' - ) - ) - end - end - - context 'when select_directories_to_backup are set' do - it 'templates the backup command for the selected directories' do - backup_script = template.render({ 'select_directories_to_backup' => ['buildpacks'] }, consumes: links) - expect(backup_script).to( - include( - 'mkdir -p $BBR_ARTIFACT_DIRECTORY/shared', - 'cp --recursive --link /var/vcap/store/shared/some_buildpacks_directory_key' - ) - ) - - expect(backup_script).not_to( - include( - 'some_droplets_directory_key', - 'some_packages_directory_key' - ) - ) - end - end - - context 'when select_directories_to_backup contains an unknown directory' do - it 'fails to render' do - expect do - template.render({ 'select_directories_to_backup' => ['some-unknown-directory'] }, consumes: links) - end.to raise_error("Unknown directory in select_directories_to_backup: 'some-unknown-directory'") - end - end - end - end - end -end diff --git a/spec/blobstore/restore_spec.rb b/spec/blobstore/restore_spec.rb deleted file mode 100644 index 18ad21db7e..0000000000 --- a/spec/blobstore/restore_spec.rb +++ /dev/null @@ -1,94 +0,0 @@ -# frozen_string_literal: true - -require 'rspec' -require 'bosh/template/test' -require 'yaml' -require 'json' - -module Bosh - module Template - module Test - describe 'blobstore BBR restore script' do - def template - release_path = File.join(File.dirname(__FILE__), '../..') - release = ReleaseDir.new(release_path) - job = release.job('blobstore') - job.template('bin/bbr/restore') - end - - let(:links) do - [ - Link.new(name: 'directories_to_backup', properties: { - 'cc' => { - 'droplets' => { - 'droplet_directory_key' => 'some_droplets_directory_key' - }, - 'buildpacks' => { - 'buildpack_directory_key' => 'some_buildpacks_directory_key' - }, - 'packages' => { - 'app_package_directory_key' => 'some_packages_directory_key' - } - } - }) - ] - end - - it 'templates all the restore commands' do - expect(template.render({}, consumes: links)).to( - include( - 'rm --recursive --force /var/vcap/store/shared/some_droplets_directory_key', - 'rm --recursive --force /var/vcap/store/shared/some_buildpacks_directory_key', - 'rm --recursive --force /var/vcap/store/shared/some_packages_directory_key', - 'cp --recursive --link $BBR_ARTIFACT_DIRECTORY/shared/some_droplets_directory_key', - 'cp --recursive --link $BBR_ARTIFACT_DIRECTORY/shared/some_buildpacks_directory_key', - 'cp --recursive --link $BBR_ARTIFACT_DIRECTORY/shared/some_packages_directory_key', - 'chown --recursive vcap:vcap /var/vcap/store/shared' - ) - ) - end - - context 'when release_level_backup is set to false' do - it 'does not template the restore commands' do - expect(template.render({ 'release_level_backup' => false }, consumes: links)).not_to( - include( - 'some_droplets_directory_key', - 'some_packages_directory_key', - 'some_buildpacks_directory_key', - 'chown' - ) - ) - end - end - - context 'when select_directories_to_backup are set' do - it 'templates the restore commands for the selected directories' do - restore_script = template.render({ 'select_directories_to_backup' => ['buildpacks'] }, consumes: links) - expect(restore_script).to( - include( - 'rm --recursive --force /var/vcap/store/shared/some_buildpacks_directory_key', - 'cp --recursive --link $BBR_ARTIFACT_DIRECTORY/shared/some_buildpacks_directory_key', - 'chown --recursive vcap:vcap /var/vcap/store/shared' - ) - ) - - expect(restore_script).not_to( - include( - 'some_droplets_directory_key', - 'some_packages_directory_key' - ) - ) - end - end - - context 'when select_directories_to_backup contains an unknown directory' do - it 'fails to render' do - expect do - template.render({ 'select_directories_to_backup' => ['some-unknown-directory'] }, consumes: links) - end.to raise_error("Unknown directory in select_directories_to_backup: 'some-unknown-directory'") - end - end - end - end - end -end diff --git a/spec/cc_deployment_updater/cc_deployment_updater_spec.rb b/spec/cc_deployment_updater/cc_deployment_updater_spec.rb index ad61a5820c..f227affcad 100644 --- a/spec/cc_deployment_updater/cc_deployment_updater_spec.rb +++ b/spec/cc_deployment_updater/cc_deployment_updater_spec.rb @@ -49,15 +49,6 @@ module Test } end - let(:webdav_config) do - { 'blobstore_timeout' => 5, - 'ca_cert' => '((service_cf_internal_ca.certificate))', - 'password' => '((blobstore_admin_users_password))', - 'private_endpoint' => 'https://blobstore.service.cf.internal:4443', - 'public_endpoint' => 'https://blobstore.brook-sentry.capi.land', - 'username' => 'blobstore-user' } - end - let(:properties) do { 'router' => { 'route_services_secret' => '((router_route_services_secret))' }, @@ -81,25 +72,25 @@ module Test 'minimum_size' => 65_536, 'maximum_size' => 536_870_912, 'resource_directory_key' => 'cc-resources', - 'blobstore_type' => 'webdav', - 'webdav_config' => webdav_config + 'blobstore_type' => 'storage-cli', + 'blobstore_provider' => 'azurebs' }, 'packages' => { 'min_package_size' => 65_536, 'max_package_size' => 536_870_912, 'app_package_directory_key' => 'cc-packages', - 'blobstore_type' => 'webdav', - 'webdav_config' => webdav_config + 'blobstore_type' => 'storage-cli', + 'blobstore_provider' => 'azurebs' }, 'droplets' => { 'droplet_directory_key' => 'cc-droplets', - 'blobstore_type' => 'webdav', - 'webdav_config' => webdav_config + 'blobstore_type' => 'storage-cli', + 'blobstore_provider' => 'azurebs' }, 'buildpacks' => { 'buildpack_directory_key' => 'cc-buildpacks', - 'blobstore_type' => 'webdav', - 'webdav_config' => webdav_config + 'blobstore_type' => 'storage-cli', + 'blobstore_provider' => 'azurebs' }, 'credential_references' => { diff --git a/spec/cloud_controller_ng/cloud_controller_ng_spec.rb b/spec/cloud_controller_ng/cloud_controller_ng_spec.rb index b1d749ef75..7b1b24cacf 100644 --- a/spec/cloud_controller_ng/cloud_controller_ng_spec.rb +++ b/spec/cloud_controller_ng/cloud_controller_ng_spec.rb @@ -23,14 +23,8 @@ module Test '((diego_ssh_proxy_host_key.public_key_fingerprint))' }, 'cc' => { 'buildpacks' => - { 'blobstore_type' => 'webdav', - 'webdav_config' => - { 'blobstore_timeout' => 5, - 'ca_cert' => '((service_cf_internal_ca.certificate))', - 'password' => '((blobstore_admin_users_password))', - 'private_endpoint' => 'https://blobstore.service.cf.internal:4443', - 'public_endpoint' => 'https://blobstore.brook-sentry.capi.land', - 'username' => 'blobstore-user' } }, + { 'blobstore_type' => 'storage-cli', + 'blobstore_provider' => 'azurebs' }, 'diego' => { 'file_server_url' => 'http://somewhere' @@ -45,14 +39,8 @@ module Test %w[public_networks dns load_balancer], 'default_staging_security_groups' => %w[public_networks dns], 'droplets' => - { 'blobstore_type' => 'webdav', - 'webdav_config' => - { 'blobstore_timeout' => 5, - 'ca_cert' => '((service_cf_internal_ca.certificate))', - 'password' => '((blobstore_admin_users_password))', - 'private_endpoint' => 'https://blobstore.service.cf.internal:4443', - 'public_endpoint' => 'https://blobstore.brook-sentry.capi.land', - 'username' => 'blobstore-user' } }, + { 'blobstore_type' => 'storage-cli', + 'blobstore_provider' => 'azurebs' }, 'experimental' => {}, 'install_buildpacks' => [{ 'name' => 'staticfile_buildpack', 'package' => 'staticfile-buildpack' }, @@ -69,24 +57,12 @@ module Test 'private_key' => '((cc_tls.private_key))', 'public_cert' => '((cc_tls.certificate))' }, 'packages' => - { 'blobstore_type' => 'webdav', - 'webdav_config' => - { 'blobstore_timeout' => 5, - 'ca_cert' => '((service_cf_internal_ca.certificate))', - 'password' => '((blobstore_admin_users_password))', - 'private_endpoint' => 'https://blobstore.service.cf.internal:4443', - 'public_endpoint' => 'https://blobstore.brook-sentry.capi.land', - 'username' => 'blobstore-user' } }, + { 'blobstore_type' => 'storage-cli', + 'blobstore_provider' => 'azurebs' }, 'rate_limiter' => {}, 'resource_pool' => - { 'blobstore_type' => 'webdav', - 'webdav_config' => - { 'blobstore_timeout' => 5, - 'ca_cert' => '((service_cf_internal_ca.certificate))', - 'password' => '((blobstore_admin_users_password))', - 'private_endpoint' => 'https://blobstore.service.cf.internal:4443', - 'public_endpoint' => 'https://blobstore.brook-sentry.capi.land', - 'username' => 'blobstore-user' } }, + { 'blobstore_type' => 'storage-cli', + 'blobstore_provider' => 'azurebs' }, 'security_group_definitions' => [{ 'name' => 'public_networks', 'rules' => diff --git a/src/github.com/cloudfoundry/blobstore_url_signer b/src/github.com/cloudfoundry/blobstore_url_signer deleted file mode 160000 index 21272a29b6..0000000000 --- a/src/github.com/cloudfoundry/blobstore_url_signer +++ /dev/null @@ -1 +0,0 @@ -Subproject commit 21272a29b631a86ce8756a0efe1568e499e4b19d From 0a1bb03388f372089ea4f043e7998691ac01340b Mon Sep 17 00:00:00 2001 From: Wei Quan Date: Fri, 2 Oct 2026 09:52:29 +0200 Subject: [PATCH 2/6] Remove blobstore_waiter, orphaned blobs, and add webdav_config absence spec - Remove blobstore_waiter.sh.erb and all source/wait_for_blobstore calls - Remove nginx-dav-ext-module and ngx_http_hmac_secure_link_module from blobs.yml - Add spec verifying webdav_config no longer renders in CC templates --- config/blobs.yml | 8 -------- jobs/cloud_controller_ng/spec | 1 - .../templates/bin/cloud_controller_ng.erb | 3 --- .../templates/bin/local_worker.erb | 3 --- .../templates/blobstore_waiter.sh.erb | 1 - jobs/cloud_controller_worker/spec | 1 - .../templates/bin/cloud_controller_worker.erb | 3 --- .../templates/blobstore_waiter.sh.erb | 1 - shared_job_templates/blobstore_waiter.sh.erb | 3 --- spec/cloud_controller_ng/cloud_controller_ng_spec.rb | 11 +++++++++++ 10 files changed, 11 insertions(+), 24 deletions(-) delete mode 120000 jobs/cloud_controller_ng/templates/blobstore_waiter.sh.erb delete mode 120000 jobs/cloud_controller_worker/templates/blobstore_waiter.sh.erb delete mode 100644 shared_job_templates/blobstore_waiter.sh.erb diff --git a/config/blobs.yml b/config/blobs.yml index 001f62ec5c..87baea2139 100644 --- a/config/blobs.yml +++ b/config/blobs.yml @@ -78,18 +78,10 @@ nginx/nginx-1.30.5.tar.gz: size: 1328600 object_id: 02154bc2-8774-4713-5740-e866cf6190c1 sha: sha256:6c20565aa2325cb82216ae804f4a4ff1875179014759a381c42ddc8e11c4906d -nginx/nginx-dav-ext-module-3.0.0.tar.gz: - size: 14558 - object_id: 44648d53-c24b-45e4-4434-007713aa5fe7 - sha: sha256:d2499d94d82d4e4eac8425d799e52883131ae86a956524040ff2fd230ef9f859 nginx/nginx-upload-module-2.3.0.tar.gz: size: 40139 object_id: 2f8f59a7-8e90-4bf5-67d8-1637924ab331 sha: sha256:c86e318addb9c88d70fdbd58ff1f6ef6f404a93070f6db8017a1f880c97946c4 -nginx/ngx_http_hmac_secure_link_module-0.3.tar.gz: - size: 5452 - object_id: ede41169-975a-4873-5a9e-d2d1aac3e865 - sha: sha256:0d4a69f39b513a3427f5fb41a7503844e703395ca04517d0a55400e4a3150927 nginx/pcre-8.45.tar.gz: size: 2096552 object_id: a90f9f20-e23b-4755-59c7-101197325dab diff --git a/jobs/cloud_controller_ng/spec b/jobs/cloud_controller_ng/spec index 58a33e96af..4070f8ceaf 100644 --- a/jobs/cloud_controller_ng/spec +++ b/jobs/cloud_controller_ng/spec @@ -15,7 +15,6 @@ templates: post-restore-unlock.sh.erb: bin/bbr/post-restore-unlock cloud_controller_ng.yml.erb: config/cloud_controller_ng.yml - blobstore_waiter.sh.erb: bin/blobstore_waiter.sh cloud_controller_api_health_check.erb: bin/cloud_controller_ng_health_check ccng_monit_http_healthcheck.sh.erb: bin/ccng_monit_http_healthcheck console.erb: bin/console diff --git a/jobs/cloud_controller_ng/templates/bin/cloud_controller_ng.erb b/jobs/cloud_controller_ng/templates/bin/cloud_controller_ng.erb index f1ee374aab..e50c145b5e 100644 --- a/jobs/cloud_controller_ng/templates/bin/cloud_controller_ng.erb +++ b/jobs/cloud_controller_ng/templates/bin/cloud_controller_ng.erb @@ -1,9 +1,6 @@ #!/usr/bin/env bash source /var/vcap/jobs/cloud_controller_ng/bin/ruby_version.sh -source /var/vcap/jobs/cloud_controller_ng/bin/blobstore_waiter.sh - -wait_for_blobstore cd /var/vcap/packages/cloud_controller_ng/cloud_controller_ng diff --git a/jobs/cloud_controller_ng/templates/bin/local_worker.erb b/jobs/cloud_controller_ng/templates/bin/local_worker.erb index f7ba28477c..7afb5e8624 100644 --- a/jobs/cloud_controller_ng/templates/bin/local_worker.erb +++ b/jobs/cloud_controller_ng/templates/bin/local_worker.erb @@ -1,9 +1,6 @@ #!/usr/bin/env bash source /var/vcap/jobs/cloud_controller_ng/bin/ruby_version.sh -source /var/vcap/jobs/cloud_controller_ng/bin/blobstore_waiter.sh - -wait_for_blobstore <% if p('cc.experimental.use_yjit_compiler') %> export RUBYOPT='--yjit' diff --git a/jobs/cloud_controller_ng/templates/blobstore_waiter.sh.erb b/jobs/cloud_controller_ng/templates/blobstore_waiter.sh.erb deleted file mode 120000 index f1d48cc475..0000000000 --- a/jobs/cloud_controller_ng/templates/blobstore_waiter.sh.erb +++ /dev/null @@ -1 +0,0 @@ -../../../shared_job_templates/blobstore_waiter.sh.erb \ No newline at end of file diff --git a/jobs/cloud_controller_worker/spec b/jobs/cloud_controller_worker/spec index 1b9a59b5a0..5f14a8dd4b 100644 --- a/jobs/cloud_controller_worker/spec +++ b/jobs/cloud_controller_worker/spec @@ -17,7 +17,6 @@ templates: stacks.yml.erb: config/stacks.yml ruby_version.sh.erb: bin/ruby_version.sh console.erb: bin/console - blobstore_waiter.sh.erb: bin/blobstore_waiter.sh post-start.sh.erb: bin/post-start pre-start.sh.erb: bin/pre-start buildpacks_ca_cert.pem.erb: config/certs/buildpacks_ca_cert.pem diff --git a/jobs/cloud_controller_worker/templates/bin/cloud_controller_worker.erb b/jobs/cloud_controller_worker/templates/bin/cloud_controller_worker.erb index 03ae14eff2..fdfac2989e 100644 --- a/jobs/cloud_controller_worker/templates/bin/cloud_controller_worker.erb +++ b/jobs/cloud_controller_worker/templates/bin/cloud_controller_worker.erb @@ -1,9 +1,6 @@ #!/usr/bin/env bash source /var/vcap/jobs/cloud_controller_worker/bin/ruby_version.sh -source /var/vcap/jobs/cloud_controller_worker/bin/blobstore_waiter.sh - -wait_for_blobstore <% if link("cloud_controller_internal").p('cc.experimental.use_yjit_compiler') %> export RUBYOPT='--yjit' diff --git a/jobs/cloud_controller_worker/templates/blobstore_waiter.sh.erb b/jobs/cloud_controller_worker/templates/blobstore_waiter.sh.erb deleted file mode 120000 index f1d48cc475..0000000000 --- a/jobs/cloud_controller_worker/templates/blobstore_waiter.sh.erb +++ /dev/null @@ -1 +0,0 @@ -../../../shared_job_templates/blobstore_waiter.sh.erb \ No newline at end of file diff --git a/shared_job_templates/blobstore_waiter.sh.erb b/shared_job_templates/blobstore_waiter.sh.erb deleted file mode 100644 index 2c00ecedf5..0000000000 --- a/shared_job_templates/blobstore_waiter.sh.erb +++ /dev/null @@ -1,3 +0,0 @@ -function wait_for_blobstore { - : # no-op: blobstore availability check is not required for storage-cli providers -} diff --git a/spec/cloud_controller_ng/cloud_controller_ng_spec.rb b/spec/cloud_controller_ng/cloud_controller_ng_spec.rb index 7b1b24cacf..dd281e4e5a 100644 --- a/spec/cloud_controller_ng/cloud_controller_ng_spec.rb +++ b/spec/cloud_controller_ng/cloud_controller_ng_spec.rb @@ -920,6 +920,17 @@ module Test expect(yaml['storage_cli_config_file_resource_pool']).to eq('/var/vcap/jobs/cloud_controller_ng/config/storage_cli_config_resource_pool.json') end end + + describe 'webdav_config removal' do + let(:template) { job.template('config/cloud_controller_ng.yml') } + + it 'does not render webdav_config for any blobstore scope' do + yaml = YAML.safe_load(template.render(merged_manifest_properties, consumes: links)) + %w[packages droplets buildpacks resource_pool].each do |scope| + expect(yaml[scope]).not_to have_key('webdav_config') + end + end + end end end end From 49d7e1adbf5e2fc48ae4af021425c99b44d3d7c8 Mon Sep 17 00:00:00 2001 From: Wei Quan Date: Mon, 5 Oct 2026 09:39:41 +0200 Subject: [PATCH 3/6] Restore blobstore job without url_signer; fix worker spec - Restore jobs/blobstore (nginx DAV server): still needed by cf-deployment as the singleton-blobstore backend; only CC's blobstore_type: webdav provider is removed, not the server itself - Remove url_signer process from bpm.yml.erb: package no longer exists, storage-cli generates signed URLs locally and never calls /sign - Remove upstream blob_url_signer and location /sign from blobstore.conf.erb: unix socket never exists without the process; keep /signed/ and secure_link_hmac directives which nginx still needs - Remove blobstore_url_signer from jobs/blobstore/spec packages list - Restore packages/nginx_webdav: still needed by jobs/blobstore - Restore nginx-dav-ext-module and ngx_http_hmac_secure_link_module blobs in config/blobs.yml: still used by nginx_webdav package - Remove broken *_ca_cert.pem.erb symlinks from cloud_controller_worker templates and their entries in cloud_controller_worker/spec --- config/blobs.yml | 8 + jobs/blobstore/monit | 17 ++ jobs/blobstore/spec | 104 +++++++ jobs/blobstore/templates/backup.erb | 27 ++ .../templates/bin/blobstore_nginx.erb | 9 + jobs/blobstore/templates/blobstore.conf.erb | 262 ++++++++++++++++++ jobs/blobstore/templates/blobstore.crt.erb | 1 + jobs/blobstore/templates/blobstore.key.erb | 1 + .../templates/blobstore_public.crt.erb | 1 + .../templates/blobstore_public.key.erb | 1 + jobs/blobstore/templates/bpm.yml.erb | 9 + jobs/blobstore/templates/mime.types | 73 +++++ jobs/blobstore/templates/nginx.conf.erb | 40 +++ jobs/blobstore/templates/pre-start.sh.erb | 37 +++ jobs/blobstore/templates/restore.erb | 24 ++ jobs/blobstore/templates/write_users.erb | 3 + jobs/cloud_controller_worker/spec | 4 - .../templates/buildpacks_ca_cert.pem.erb | 1 - .../templates/droplets_ca_cert.pem.erb | 1 - .../templates/packages_ca_cert.pem.erb | 1 - .../templates/resource_pool_ca_cert.pem.erb | 1 - packages/nginx_webdav/README.md | 10 + packages/nginx_webdav/packaging | 47 ++++ packages/nginx_webdav/spec | 8 + 24 files changed, 682 insertions(+), 8 deletions(-) create mode 100644 jobs/blobstore/monit create mode 100644 jobs/blobstore/spec create mode 100644 jobs/blobstore/templates/backup.erb create mode 100644 jobs/blobstore/templates/bin/blobstore_nginx.erb create mode 100644 jobs/blobstore/templates/blobstore.conf.erb create mode 100644 jobs/blobstore/templates/blobstore.crt.erb create mode 100644 jobs/blobstore/templates/blobstore.key.erb create mode 100644 jobs/blobstore/templates/blobstore_public.crt.erb create mode 100644 jobs/blobstore/templates/blobstore_public.key.erb create mode 100644 jobs/blobstore/templates/bpm.yml.erb create mode 100644 jobs/blobstore/templates/mime.types create mode 100644 jobs/blobstore/templates/nginx.conf.erb create mode 100644 jobs/blobstore/templates/pre-start.sh.erb create mode 100644 jobs/blobstore/templates/restore.erb create mode 100644 jobs/blobstore/templates/write_users.erb delete mode 120000 jobs/cloud_controller_worker/templates/buildpacks_ca_cert.pem.erb delete mode 120000 jobs/cloud_controller_worker/templates/droplets_ca_cert.pem.erb delete mode 120000 jobs/cloud_controller_worker/templates/packages_ca_cert.pem.erb delete mode 120000 jobs/cloud_controller_worker/templates/resource_pool_ca_cert.pem.erb create mode 100644 packages/nginx_webdav/README.md create mode 100644 packages/nginx_webdav/packaging create mode 100644 packages/nginx_webdav/spec diff --git a/config/blobs.yml b/config/blobs.yml index 87baea2139..001f62ec5c 100644 --- a/config/blobs.yml +++ b/config/blobs.yml @@ -78,10 +78,18 @@ nginx/nginx-1.30.5.tar.gz: size: 1328600 object_id: 02154bc2-8774-4713-5740-e866cf6190c1 sha: sha256:6c20565aa2325cb82216ae804f4a4ff1875179014759a381c42ddc8e11c4906d +nginx/nginx-dav-ext-module-3.0.0.tar.gz: + size: 14558 + object_id: 44648d53-c24b-45e4-4434-007713aa5fe7 + sha: sha256:d2499d94d82d4e4eac8425d799e52883131ae86a956524040ff2fd230ef9f859 nginx/nginx-upload-module-2.3.0.tar.gz: size: 40139 object_id: 2f8f59a7-8e90-4bf5-67d8-1637924ab331 sha: sha256:c86e318addb9c88d70fdbd58ff1f6ef6f404a93070f6db8017a1f880c97946c4 +nginx/ngx_http_hmac_secure_link_module-0.3.tar.gz: + size: 5452 + object_id: ede41169-975a-4873-5a9e-d2d1aac3e865 + sha: sha256:0d4a69f39b513a3427f5fb41a7503844e703395ca04517d0a55400e4a3150927 nginx/pcre-8.45.tar.gz: size: 2096552 object_id: a90f9f20-e23b-4755-59c7-101197325dab diff --git a/jobs/blobstore/monit b/jobs/blobstore/monit new file mode 100644 index 0000000000..cd18d38a50 --- /dev/null +++ b/jobs/blobstore/monit @@ -0,0 +1,17 @@ +<% if spec.bootstrap %> +check process blobstore_nginx + with pidfile /var/vcap/sys/run/bpm/blobstore/nginx.pid + start program "/var/vcap/jobs/bpm/bin/bpm start blobstore -p nginx" + stop program "/var/vcap/jobs/bpm/bin/bpm stop blobstore -p nginx" + group vcap + + check process blobstore_url_signer + with pidfile /var/vcap/sys/run/bpm/blobstore/url_signer.pid + start program "/var/vcap/jobs/bpm/bin/bpm start blobstore -p url_signer" + stop program "/var/vcap/jobs/bpm/bin/bpm stop blobstore -p url_signer" + group vcap + +<% else %> +# This file intentionally left blank +# Blobstore job is only run on the bootstrap instance +<% end %> diff --git a/jobs/blobstore/spec b/jobs/blobstore/spec new file mode 100644 index 0000000000..01efaace32 --- /dev/null +++ b/jobs/blobstore/spec @@ -0,0 +1,104 @@ +--- +name: blobstore + +templates: + bpm.yml.erb: config/bpm.yml + bin/blobstore_nginx.erb: bin/blobstore_nginx + + nginx.conf.erb: config/nginx.conf + blobstore.conf.erb: config/sites/blobstore.conf + mime.types: config/mime.types + write_users.erb: config/write_users + blobstore.crt.erb: ssl/blobstore.crt + blobstore.key.erb: ssl/blobstore.key + blobstore_public.crt.erb: ssl/blobstore_public.crt + blobstore_public.key.erb: ssl/blobstore_public.key + pre-start.sh.erb: bin/pre-start + backup.erb: bin/bbr/backup + restore.erb: bin/bbr/restore + +packages: +- nginx_webdav +- capi_utils + +consumes: +- name: directories_to_backup + type: directories_to_backup + +properties: + select_directories_to_backup: + description: | + The list of directories to backup using BBR. Valid values are: buildpacks, droplets, packages. + Remove directories that you do not want to backup. + default: + - "buildpacks" + - "droplets" + - "packages" + + blobstore.internal_access_rules: + description: >- + List of allow / deny rules for the blobstore internal server. Defaults + to RFC 1918 Private Networks. Will be followed by 'deny all'. See + http://nginx.org/en/docs/http/ngx_http_access_module.html for valid rules + default: + - "allow 10.0.0.0/8;" + - "allow 172.16.0.0/12;" + - "allow 192.168.0.0/16;" + + temporary_disable_non_tls_endpoints: + description: "nginx_cc and cc_uploader components disable non-TLS endpoints" + default: false + + blobstore.port: + description: TCP port on which the blobstore server (nginx) listens + default: 8080 + blobstore.public_tls_port: + description: TCP port on which the blobstore server (nginx) listens + default: 8081 + blobstore.tls.port: + description: The TCP port on which the internal blobstore server listens + default: 4443 + + blobstore.tls.cert: + description: The PEM-encoded certificate (optionally as a certificate chain) for serving blobs over TLS/SSL + + blobstore.tls.private_key: + description: The PEM-encoded private key for signing TLS/SSL traffic + + blobstore.public_tls.cert: + description: The PEM-encoded certificate (optionally as a certificate chain) for serving blobs over TLS/SSL + + blobstore.public_tls.private_key: + description: The PEM-encoded private key for signing TLS/SSL traffic + + + blobstore.admin_users: + description: | + List of Username and Password pairs that have admin access to the blobstore. Cloud Controller must use one of these to access the blobstore via HTTP Basic Auth. + Example: + users: + - username: user1 + password: password1 + - username: user2 + password: password2 + + blobstore.secure_link.secret: + description: "The secret used for signing URLs. Must not contain $, or any other variables that are used by and cannot be escaped in the Nginx config." + + blobstore.max_upload_size: + description: "Max allowed file size for upload" + default: "0" + + blobstore.nginx_workers_per_core: + description: "Number of NGINX worker processes per CPU core" + default: 2 + + release_level_backup: + description: "toggle to enable backups of the blobstore with bbr" + default: true + + system_domain: + description: "The system domain. The public server will listen on host 'blobstore.system-domain.tld'" + + domain: + description: "DEPRECATED: The system domain. The public server will listen on host 'blobstore.system-domain.tld'" diff --git a/jobs/blobstore/templates/backup.erb b/jobs/blobstore/templates/backup.erb new file mode 100644 index 0000000000..783be6edd0 --- /dev/null +++ b/jobs/blobstore/templates/backup.erb @@ -0,0 +1,27 @@ +#!/usr/bin/env bash + +set -eux + +<% + dirs = link('directories_to_backup') + dir_to_key = { + "droplets" => dirs.p("cc.droplets.droplet_directory_key"), + "buildpacks" => dirs.p("cc.buildpacks.buildpack_directory_key"), + "packages" => dirs.p("cc.packages.app_package_directory_key") + } +%> + +<% if p('release_level_backup') %> + mkdir -p $BBR_ARTIFACT_DIRECTORY/shared + + <% p('select_directories_to_backup').each do |directory| %> + <% key = dir_to_key.fetch(directory) { raise "Unknown directory in select_directories_to_backup: '#{directory}'" } %> + if [ -d /var/vcap/store/shared/<%= key %> ]; then + cp --recursive --link /var/vcap/store/shared/<%= key %> $BBR_ARTIFACT_DIRECTORY/shared + fi + + <% if directory.eql? "droplets" %> + rm --force --recursive $BBR_ARTIFACT_DIRECTORY/shared/<%= key %>/buildpack_cache + <% end %> + <% end %> +<% end %> diff --git a/jobs/blobstore/templates/bin/blobstore_nginx.erb b/jobs/blobstore/templates/bin/blobstore_nginx.erb new file mode 100644 index 0000000000..25280622c6 --- /dev/null +++ b/jobs/blobstore/templates/bin/blobstore_nginx.erb @@ -0,0 +1,9 @@ +#!/usr/bin/env bash + +source /var/vcap/packages/capi_utils/cpu_utils.sh + +cpu_count=$(( $(cpu_count) * <%= p('blobstore.nginx_workers_per_core') %> )) + +exec /var/vcap/packages/nginx_webdav/sbin/nginx \ +-c /var/vcap/jobs/blobstore/config/nginx.conf \ +-g "worker_processes ${cpu_count};" diff --git a/jobs/blobstore/templates/blobstore.conf.erb b/jobs/blobstore/templates/blobstore.conf.erb new file mode 100644 index 0000000000..237390e572 --- /dev/null +++ b/jobs/blobstore/templates/blobstore.conf.erb @@ -0,0 +1,262 @@ +<% +# /signed/ location pair — emitted once per server block (internal, public HTTP, public TLS). +# Split into two locations to avoid nginx's regex+alias+dav_methods collision on large PUTs: +# the verify location checks HMAC and rewrites; the internal location does the actual file I/O. +signed_location = <<~NGINX + # ensure the contents of this location block always match the other server /signed/ location blocks + location ~ ^/signed/(?.+)$ { + if ( $request_method !~ ^(GET|HEAD|PUT)$ ) { + return 405; + } + + secure_link_hmac $arg_st,$arg_ts,$arg_e; + secure_link_hmac_secret #{p('blobstore.secure_link.secret')}; + secure_link_hmac_message $request_method$blob_path$arg_ts$arg_e; + secure_link_hmac_algorithm sha256; + + if ($secure_link_hmac != "1") { + return 403; + } + + rewrite ^/signed/(.*)$ /signed-internal/$1 last; + } + + location /signed-internal/ { + internal; + + dav_methods PUT DELETE; + create_full_put_path on; + send_timeout 600s; + + alias /var/vcap/store/shared/; + } +NGINX +%> +# Default server +# + +<% unless p('temporary_disable_non_tls_endpoints') %> + +server { + listen <%= p('blobstore.port') %>; + return 404; +} +<% end %> + +server { + listen <%= p('blobstore.public_tls_port') %> ssl; + + ssl_certificate /var/vcap/jobs/blobstore/ssl/blobstore_public.crt; + ssl_certificate_key /var/vcap/jobs/blobstore/ssl/blobstore_public.key; + + ssl_ciphers DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384; + ssl_protocols TLSv1.2 TLSv1.3; + ssl_session_cache shared:SSL:10m; + ssl_session_timeout 10m; + return 404; +} + +# Internal server +server { + listen <%= p('blobstore.tls.port') %> ssl; + server_name blobstore.service.cf.internal; + ssl_certificate /var/vcap/jobs/blobstore/ssl/blobstore.crt; + ssl_certificate_key /var/vcap/jobs/blobstore/ssl/blobstore.key; + + ssl_ciphers DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384; + ssl_protocols TLSv1.2 TLSv1.3; + ssl_session_cache shared:SSL:10m; + ssl_session_timeout 10m; + + root /var/vcap/store/shared/; + + <%= p('blobstore.internal_access_rules').join("\n ") %> + deny all; + + access_log /var/vcap/sys/log/blobstore/internal_access.log; + error_log /var/vcap/sys/log/blobstore/internal_error.log; + + client_max_body_size <%= p('blobstore.max_upload_size') %>; + + location /admin/ { + auth_basic "Blobstore Admin"; + auth_basic_user_file write_users; + + dav_methods DELETE PUT COPY; + dav_ext_methods PROPFIND; + + create_full_put_path on; + + alias /var/vcap/store/shared/; + } + +<%= signed_location %> + + # ensure the contents of this location block always match the public server /read/ location block + location /read/ { + if ( $request_method !~ ^(GET|HEAD)$ ) { + return 405; + } + + secure_link $arg_md5,$arg_expires; + secure_link_md5 "$secure_link_expires$uri <%= p('blobstore.secure_link.secret') %>"; + + if ($secure_link = "") { + return 403; + } + + if ($secure_link = "0") { + return 410; + } + + alias /var/vcap/store/shared/; + } + + # ensure the contents of this location block always match the public server /write/ location block + location /write/ { + dav_methods PUT; + create_full_put_path on; + + if ( $request_method !~ ^(PUT)$ ) { + return 405; + } + + secure_link $arg_md5,$arg_expires; + secure_link_md5 "$secure_link_expires$uri <%= p('blobstore.secure_link.secret') %>"; + + if ($secure_link = "") { + return 403; + } + + if ($secure_link = "0") { + return 410; + } + + alias /var/vcap/store/shared/; + } +} + +# Public server +# + +<% unless p('temporary_disable_non_tls_endpoints') %> +server { + server_name blobstore.<%= p('system_domain') %>; + + listen <%= p('blobstore.port') %>; + + root /var/vcap/store/shared/; + + access_log /var/vcap/sys/log/blobstore/public_access.log; + error_log /var/vcap/sys/log/blobstore/public_error.log; + +<%= signed_location %> + + # ensure the contents of this location block always match the internal server /read/ location block + location /read/ { + if ( $request_method !~ ^(GET|HEAD)$ ) { + return 405; + } + + secure_link $arg_md5,$arg_expires; + secure_link_md5 "$secure_link_expires$uri <%= p('blobstore.secure_link.secret') %>"; + + if ($secure_link = "") { + return 403; + } + + if ($secure_link = "0") { + return 410; + } + + alias /var/vcap/store/shared/; + } + + # ensure the contents of this location block always match the internal server /write/ location block + location /write/ { + dav_methods PUT; + create_full_put_path on; + + if ( $request_method !~ ^(PUT)$ ) { + return 405; + } + + secure_link $arg_md5,$arg_expires; + secure_link_md5 "$secure_link_expires$uri <%= p('blobstore.secure_link.secret') %>"; + + if ($secure_link = "") { + return 403; + } + + if ($secure_link = "0") { + return 410; + } + + alias /var/vcap/store/shared/; + } +} + +<% end %> + +server { + listen <%= p('blobstore.public_tls_port') %> ssl; + server_name blobstore.<%= p('system_domain') %>; + + ssl_certificate /var/vcap/jobs/blobstore/ssl/blobstore_public.crt; + ssl_certificate_key /var/vcap/jobs/blobstore/ssl/blobstore_public.key; + + ssl_ciphers DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384; + ssl_protocols TLSv1.2 TLSv1.3; + ssl_session_cache shared:SSL:10m; + ssl_session_timeout 10m; + + root /var/vcap/store/shared/; + + access_log /var/vcap/sys/log/blobstore/public_access.log; + error_log /var/vcap/sys/log/blobstore/public_error.log; + +<%= signed_location %> + + # ensure the contents of this location block always match the internal server /read/ location block + location /read/ { + if ( $request_method !~ ^(GET|HEAD)$ ) { + return 405; + } + + secure_link $arg_md5,$arg_expires; + secure_link_md5 "$secure_link_expires$uri <%= p('blobstore.secure_link.secret') %>"; + + if ($secure_link = "") { + return 403; + } + + if ($secure_link = "0") { + return 410; + } + + alias /var/vcap/store/shared/; + } + + # ensure the contents of this location block always match the internal server /write/ location block + location /write/ { + dav_methods PUT; + create_full_put_path on; + + if ( $request_method !~ ^(PUT)$ ) { + return 405; + } + + secure_link $arg_md5,$arg_expires; + secure_link_md5 "$secure_link_expires$uri <%= p('blobstore.secure_link.secret') %>"; + + if ($secure_link = "") { + return 403; + } + + if ($secure_link = "0") { + return 410; + } + + alias /var/vcap/store/shared/; + } +} diff --git a/jobs/blobstore/templates/blobstore.crt.erb b/jobs/blobstore/templates/blobstore.crt.erb new file mode 100644 index 0000000000..413ef54e75 --- /dev/null +++ b/jobs/blobstore/templates/blobstore.crt.erb @@ -0,0 +1 @@ +<%= p('blobstore.tls.cert') %> diff --git a/jobs/blobstore/templates/blobstore.key.erb b/jobs/blobstore/templates/blobstore.key.erb new file mode 100644 index 0000000000..eb8e0bf3f8 --- /dev/null +++ b/jobs/blobstore/templates/blobstore.key.erb @@ -0,0 +1 @@ +<%= p('blobstore.tls.private_key') %> diff --git a/jobs/blobstore/templates/blobstore_public.crt.erb b/jobs/blobstore/templates/blobstore_public.crt.erb new file mode 100644 index 0000000000..ebbbe12dde --- /dev/null +++ b/jobs/blobstore/templates/blobstore_public.crt.erb @@ -0,0 +1 @@ +<%= p('blobstore.public_tls.cert') %> diff --git a/jobs/blobstore/templates/blobstore_public.key.erb b/jobs/blobstore/templates/blobstore_public.key.erb new file mode 100644 index 0000000000..c99e4a2823 --- /dev/null +++ b/jobs/blobstore/templates/blobstore_public.key.erb @@ -0,0 +1 @@ +<%= p('blobstore.public_tls.private_key') %> diff --git a/jobs/blobstore/templates/bpm.yml.erb b/jobs/blobstore/templates/bpm.yml.erb new file mode 100644 index 0000000000..86233fdb8a --- /dev/null +++ b/jobs/blobstore/templates/bpm.yml.erb @@ -0,0 +1,9 @@ +--- +processes: +- name: nginx + executable: /var/vcap/jobs/blobstore/bin/blobstore_nginx + additional_volumes: + - path: /var/vcap/store/shared + writable: true + ephemeral_disk: true + persistent_disk: true diff --git a/jobs/blobstore/templates/mime.types b/jobs/blobstore/templates/mime.types new file mode 100644 index 0000000000..9fafe7093d --- /dev/null +++ b/jobs/blobstore/templates/mime.types @@ -0,0 +1,73 @@ +types { + text/html html htm shtml; + text/css css; + text/xml xml; + image/gif gif; + image/jpeg jpeg jpg; + application/x-javascript js; + application/atom+xml atom; + application/rss+xml rss; + + text/mathml mml; + text/plain txt; + text/vnd.sun.j2me.app-descriptor jad; + text/vnd.wap.wml wml; + text/x-component htc; + + image/png png; + image/tiff tif tiff; + image/vnd.wap.wbmp wbmp; + image/x-icon ico; + image/x-jng jng; + image/x-ms-bmp bmp; + image/svg+xml svg; + + application/java-archive jar war ear; + application/mac-binhex40 hqx; + application/msword doc; + application/pdf pdf; + application/postscript ps eps ai; + application/rtf rtf; + application/vnd.ms-excel xls; + application/vnd.ms-powerpoint ppt; + application/vnd.wap.wmlc wmlc; + application/vnd.wap.xhtml+xml xhtml; + application/vnd.google-earth.kml+xml kml; + application/vnd.google-earth.kmz kmz; + application/x-7z-compressed 7z; + application/x-cocoa cco; + application/x-java-archive-diff jardiff; + application/x-java-jnlp-file jnlp; + application/x-makeself run; + application/x-perl pl pm; + application/x-pilot prc pdb; + application/x-rar-compressed rar; + application/x-redhat-package-manager rpm; + application/x-sea sea; + application/x-shockwave-flash swf; + application/x-stuffit sit; + application/x-tcl tcl tk; + application/x-x509-ca-cert der pem crt; + application/x-xpinstall xpi; + application/zip zip; + + application/octet-stream bin exe dll; + application/octet-stream deb; + application/octet-stream dmg; + application/octet-stream eot; + application/octet-stream iso img; + application/octet-stream msi msp msm; + + audio/midi mid midi kar; + audio/mpeg mp3; + audio/x-realaudio ra; + + video/3gpp 3gpp 3gp; + video/mpeg mpeg mpg; + video/quicktime mov; + video/x-flv flv; + video/x-mng mng; + video/x-ms-asf asx asf; + video/x-ms-wmv wmv; + video/x-msvideo avi; +} diff --git a/jobs/blobstore/templates/nginx.conf.erb b/jobs/blobstore/templates/nginx.conf.erb new file mode 100644 index 0000000000..082e668114 --- /dev/null +++ b/jobs/blobstore/templates/nginx.conf.erb @@ -0,0 +1,40 @@ +daemon off; + +error_log /var/vcap/sys/log/blobstore/error.log; +pid /var/vcap/data/blobstore/nginx.pid; + +events { + worker_connections 8192; +} + +http { + server_names_hash_bucket_size 128; + include /var/vcap/jobs/blobstore/config/mime.types; + default_type text/html; + + log_format timed_combined '$remote_addr - $remote_user [$time_local] ' + '"$request" $status $body_bytes_sent ' + '"$http_referer" "$http_user_agent" ' + '$request_time $upstream_response_time $pipe'; + + access_log /var/vcap/sys/log/blobstore/access.log timed_combined; + server_tokens off; + + client_body_temp_path /var/vcap/data/blobstore/tmp/client_body_temp; + proxy_temp_path /var/vcap/data/blobstore/tmp/proxy_temp; + fastcgi_temp_path /var/vcap/data/blobstore/tmp/fastcgi_temp; + uwsgi_temp_path /var/vcap/data/blobstore/tmp/uwsgi_temp; + scgi_temp_path /var/vcap/data/blobstore/tmp/scgi_temp; + + sendfile on; + sendfile_max_chunk 1M; # Make sure not to block on fast clients reading large files + tcp_nopush on; + tcp_nodelay on; + read_ahead 1; # Enable read_ahead. On Linux the actual value is ignored (as long as it is > 0) + + keepalive_timeout 75 20; + + gzip off; + + include /var/vcap/jobs/blobstore/config/sites/*; +} diff --git a/jobs/blobstore/templates/pre-start.sh.erb b/jobs/blobstore/templates/pre-start.sh.erb new file mode 100644 index 0000000000..708910407a --- /dev/null +++ b/jobs/blobstore/templates/pre-start.sh.erb @@ -0,0 +1,37 @@ +#!/usr/bin/env bash + +set -ex + +function setup_blobstore_directories { + local run_dir=/var/vcap/sys/run/blobstore + local log_dir=/var/vcap/sys/log/blobstore + local store_dir=/var/vcap/store/shared + local data_dir=/var/vcap/data/blobstore + local store_tmp_dir=$store_dir/tmp/uploads + local data_tmp_dir=$data_dir/tmp/uploads + local nginx_webdav_dir=/var/vcap/packages/nginx_webdav + + mkdir -p $run_dir + mkdir -p $log_dir + mkdir -p $store_dir + mkdir -p $store_tmp_dir + mkdir -p $data_dir + mkdir -p $data_tmp_dir + + chown vcap:vcap $store_dir + local dirs="$run_dir $log_dir $store_tmp_dir $data_dir $data_tmp_dir $nginx_webdav_dir ${nginx_webdav_dir}/.." + local num_needing_chown=$(find $dirs -not -user vcap -or -not -group vcap | wc -l) + + if [ $num_needing_chown -gt 0 ]; then + echo "chowning ${num_needing_chown} files to vcap:vcap" + find $dirs -not -user vcap -or -not -group vcap | xargs chown vcap:vcap + else + echo "no chowning needed, all relevant files are vcap:vcap already" + fi +} + +<% if spec.bootstrap %> +setup_blobstore_directories +<% else %> +echo "Blobstore job is only run on the bootstrap instance" +<% end %> diff --git a/jobs/blobstore/templates/restore.erb b/jobs/blobstore/templates/restore.erb new file mode 100644 index 0000000000..9f906264d4 --- /dev/null +++ b/jobs/blobstore/templates/restore.erb @@ -0,0 +1,24 @@ +#!/usr/bin/env bash + +set -eux + +<% + dirs = link('directories_to_backup') + dir_to_key = { + "droplets" => dirs.p("cc.droplets.droplet_directory_key"), + "buildpacks" => dirs.p("cc.buildpacks.buildpack_directory_key"), + "packages" => dirs.p("cc.packages.app_package_directory_key") + } +%> + +<% if p('release_level_backup') %> + <% p('select_directories_to_backup').each do |directory| %> + <% key = dir_to_key.fetch(directory) { raise "Unknown directory in select_directories_to_backup: '#{directory}'" } %> + rm --recursive --force /var/vcap/store/shared/<%= key %> + if [ -d $BBR_ARTIFACT_DIRECTORY/shared/<%= key %> ]; then + cp --recursive --link $BBR_ARTIFACT_DIRECTORY/shared/<%= key %> /var/vcap/store/shared + fi + <% end %> + + chown --recursive vcap:vcap /var/vcap/store/shared +<% end %> diff --git a/jobs/blobstore/templates/write_users.erb b/jobs/blobstore/templates/write_users.erb new file mode 100644 index 0000000000..b3f569d8ed --- /dev/null +++ b/jobs/blobstore/templates/write_users.erb @@ -0,0 +1,3 @@ +<% p('blobstore.admin_users').each do |user| %> +<%= user['username'] %>:{PLAIN}<%= user['password'] %> +<% end %> diff --git a/jobs/cloud_controller_worker/spec b/jobs/cloud_controller_worker/spec index 5f14a8dd4b..0532b8a6a9 100644 --- a/jobs/cloud_controller_worker/spec +++ b/jobs/cloud_controller_worker/spec @@ -19,10 +19,6 @@ templates: console.erb: bin/console post-start.sh.erb: bin/post-start pre-start.sh.erb: bin/pre-start - buildpacks_ca_cert.pem.erb: config/certs/buildpacks_ca_cert.pem - droplets_ca_cert.pem.erb: config/certs/droplets_ca_cert.pem - packages_ca_cert.pem.erb: config/certs/packages_ca_cert.pem - resource_pool_ca_cert.pem.erb: config/certs/resource_pool_ca_cert.pem shutdown_drain.rb.erb: bin/shutdown_drain mutual_tls_ca.crt.erb: config/certs/mutual_tls_ca.crt mutual_tls.crt.erb: config/certs/mutual_tls.crt diff --git a/jobs/cloud_controller_worker/templates/buildpacks_ca_cert.pem.erb b/jobs/cloud_controller_worker/templates/buildpacks_ca_cert.pem.erb deleted file mode 120000 index 9c9bc307ac..0000000000 --- a/jobs/cloud_controller_worker/templates/buildpacks_ca_cert.pem.erb +++ /dev/null @@ -1 +0,0 @@ -../../../shared_job_templates/buildpacks_ca_cert.pem.erb \ No newline at end of file diff --git a/jobs/cloud_controller_worker/templates/droplets_ca_cert.pem.erb b/jobs/cloud_controller_worker/templates/droplets_ca_cert.pem.erb deleted file mode 120000 index d19041ffde..0000000000 --- a/jobs/cloud_controller_worker/templates/droplets_ca_cert.pem.erb +++ /dev/null @@ -1 +0,0 @@ -../../../shared_job_templates/droplets_ca_cert.pem.erb \ No newline at end of file diff --git a/jobs/cloud_controller_worker/templates/packages_ca_cert.pem.erb b/jobs/cloud_controller_worker/templates/packages_ca_cert.pem.erb deleted file mode 120000 index 1d24977063..0000000000 --- a/jobs/cloud_controller_worker/templates/packages_ca_cert.pem.erb +++ /dev/null @@ -1 +0,0 @@ -../../../shared_job_templates/packages_ca_cert.pem.erb \ No newline at end of file diff --git a/jobs/cloud_controller_worker/templates/resource_pool_ca_cert.pem.erb b/jobs/cloud_controller_worker/templates/resource_pool_ca_cert.pem.erb deleted file mode 120000 index 25569fb402..0000000000 --- a/jobs/cloud_controller_worker/templates/resource_pool_ca_cert.pem.erb +++ /dev/null @@ -1 +0,0 @@ -../../../shared_job_templates/resource_pool_ca_cert.pem.erb \ No newline at end of file diff --git a/packages/nginx_webdav/README.md b/packages/nginx_webdav/README.md new file mode 100644 index 0000000000..44037f1b33 --- /dev/null +++ b/packages/nginx_webdav/README.md @@ -0,0 +1,10 @@ +nginx_webdav +============ +This is the nginx we use to front our blobstore. + +This file can be downloaded from the following locations: + +| Filename | Homepage | Download URL | +|-----------------------------------------| -------- | ------------ | +| expat/expat-2.5.0.tar.bz2 | https://github.com/libexpat/libexpat/releases/download/R_2_5_0/expat-2.5.0.tar.gz | +| nginx/nginx-dav-ext-module-3.0.0.tar.gz | https://github.com/arut/nginx-dav-ext-module | https://github.com/arut/nginx-dav-ext-module/archive/v3.0.0.tar.gz | diff --git a/packages/nginx_webdav/packaging b/packages/nginx_webdav/packaging new file mode 100644 index 0000000000..6ab0072153 --- /dev/null +++ b/packages/nginx_webdav/packaging @@ -0,0 +1,47 @@ +set -e -x +# enable secure_link_hmac (SHA256 signed URLs) + +echo "Extracting expat..." +tar xvf expat/expat-2.5.0.tar.bz2 + +pushd expat-2.5.0 + ./configure + + make + make install + make check +popd + +echo "Extracting pcre..." +tar xzvf nginx/pcre-8.45.tar.gz + +echo "Extracting nginx..." +tar xzvf nginx/nginx-1.30.5.tar.gz + +echo "Extracting webdav extensions" +tar xzvf nginx/nginx-dav-ext-module-3.0.0.tar.gz + +echo "Extracting HMAC secure link module" +tar xzvf nginx/ngx_http_hmac_secure_link_module-0.3.tar.gz + +sed -i 's@"nginx/"@"-/"@g' nginx-1.30.5/src/core/nginx.h +sed -i 's@r->headers_out.server == NULL@0@g' nginx-1.30.5/src/http/ngx_http_header_filter_module.c +sed -i 's@r->headers_out.server == NULL@0@g' nginx-1.30.5/src/http/v2/ngx_http_v2_filter_module.c +sed -i 's@
nginx
@@g' nginx-1.30.5/src/http/ngx_http_special_response.c + +echo "Building nginx..." +pushd nginx-1.30.5 + ./configure \ + --prefix=${BOSH_INSTALL_TARGET} \ + --with-ld-opt="-L /usr/local/lib" \ + --with-cc-opt="-I /usr/local/include" \ + --with-pcre=../pcre-8.45 \ + --with-http_dav_module \ + --with-http_secure_link_module \ + --with-http_ssl_module \ + --add-module=../nginx-dav-ext-module-3.0.0 \ + --add-module=../ngx_http_hmac_secure_link_module-0.3 + + make + make install +popd diff --git a/packages/nginx_webdav/spec b/packages/nginx_webdav/spec new file mode 100644 index 0000000000..23edb28b6e --- /dev/null +++ b/packages/nginx_webdav/spec @@ -0,0 +1,8 @@ +--- +name: nginx_webdav +files: + - expat/expat-2.5.0.tar.bz2 + - nginx/nginx-1.30.5.tar.gz + - nginx/pcre-8.45.tar.gz + - nginx/nginx-dav-ext-module-3.0.0.tar.gz + - nginx/ngx_http_hmac_secure_link_module-0.3.tar.gz From 5fc209bdebdff6edb87e7c72ba94af12007e3d2a Mon Sep 17 00:00:00 2001 From: Wei Quan Date: Mon, 5 Oct 2026 12:34:56 +0200 Subject: [PATCH 4/6] Fix blobstore monit and restore BBR specs - Remove url_signer process from jobs/blobstore/monit: process no longer exists in bpm.yml.erb so monit would fail to start it - Restore spec/blobstore/backup_spec.rb and restore_spec.rb: backup.erb and restore.erb are still shipped in the blobstore job and still need tests --- jobs/blobstore/monit | 6 --- spec/blobstore/backup_spec.rb | 90 ++++++++++++++++++++++++++++++++ spec/blobstore/restore_spec.rb | 94 ++++++++++++++++++++++++++++++++++ 3 files changed, 184 insertions(+), 6 deletions(-) create mode 100644 spec/blobstore/backup_spec.rb create mode 100644 spec/blobstore/restore_spec.rb diff --git a/jobs/blobstore/monit b/jobs/blobstore/monit index cd18d38a50..718605bdc6 100644 --- a/jobs/blobstore/monit +++ b/jobs/blobstore/monit @@ -5,12 +5,6 @@ check process blobstore_nginx stop program "/var/vcap/jobs/bpm/bin/bpm stop blobstore -p nginx" group vcap - check process blobstore_url_signer - with pidfile /var/vcap/sys/run/bpm/blobstore/url_signer.pid - start program "/var/vcap/jobs/bpm/bin/bpm start blobstore -p url_signer" - stop program "/var/vcap/jobs/bpm/bin/bpm stop blobstore -p url_signer" - group vcap - <% else %> # This file intentionally left blank # Blobstore job is only run on the bootstrap instance diff --git a/spec/blobstore/backup_spec.rb b/spec/blobstore/backup_spec.rb new file mode 100644 index 0000000000..808475fe87 --- /dev/null +++ b/spec/blobstore/backup_spec.rb @@ -0,0 +1,90 @@ +# frozen_string_literal: true + +require 'rspec' +require 'bosh/template/test' +require 'yaml' +require 'json' + +module Bosh + module Template + module Test + describe 'blobstore BBR backup script' do + def template + release_path = File.join(File.dirname(__FILE__), '../..') + release = ReleaseDir.new(release_path) + job = release.job('blobstore') + job.template('bin/bbr/backup') + end + + let(:links) do + [ + Link.new(name: 'directories_to_backup', properties: { + 'cc' => { + 'droplets' => { + 'droplet_directory_key' => 'some_droplets_directory_key' + }, + 'buildpacks' => { + 'buildpack_directory_key' => 'some_buildpacks_directory_key' + }, + 'packages' => { + 'app_package_directory_key' => 'some_packages_directory_key' + } + } + }) + ] + end + + it 'templates all the backup commands' do + expect(template.render({}, consumes: links)).to( + include( + 'mkdir -p $BBR_ARTIFACT_DIRECTORY/shared', + 'cp --recursive --link /var/vcap/store/shared/some_droplets_directory_key', + 'cp --recursive --link /var/vcap/store/shared/some_buildpacks_directory_key', + 'cp --recursive --link /var/vcap/store/shared/some_packages_directory_key', + 'rm --force --recursive $BBR_ARTIFACT_DIRECTORY/shared/some_droplets_directory_key/buildpack_cache' + ) + ) + end + + context 'when release_level_backup is false' do + it 'does not template any commands' do + expect(template.render({ 'release_level_backup' => false }, consumes: links)).not_to( + include( + 'mkdir -p', + 'cp --recursive', + 'rm --force' + ) + ) + end + end + + context 'when select_directories_to_backup are set' do + it 'templates the backup command for the selected directories' do + backup_script = template.render({ 'select_directories_to_backup' => ['buildpacks'] }, consumes: links) + expect(backup_script).to( + include( + 'mkdir -p $BBR_ARTIFACT_DIRECTORY/shared', + 'cp --recursive --link /var/vcap/store/shared/some_buildpacks_directory_key' + ) + ) + + expect(backup_script).not_to( + include( + 'some_droplets_directory_key', + 'some_packages_directory_key' + ) + ) + end + end + + context 'when select_directories_to_backup contains an unknown directory' do + it 'fails to render' do + expect do + template.render({ 'select_directories_to_backup' => ['some-unknown-directory'] }, consumes: links) + end.to raise_error("Unknown directory in select_directories_to_backup: 'some-unknown-directory'") + end + end + end + end + end +end diff --git a/spec/blobstore/restore_spec.rb b/spec/blobstore/restore_spec.rb new file mode 100644 index 0000000000..18ad21db7e --- /dev/null +++ b/spec/blobstore/restore_spec.rb @@ -0,0 +1,94 @@ +# frozen_string_literal: true + +require 'rspec' +require 'bosh/template/test' +require 'yaml' +require 'json' + +module Bosh + module Template + module Test + describe 'blobstore BBR restore script' do + def template + release_path = File.join(File.dirname(__FILE__), '../..') + release = ReleaseDir.new(release_path) + job = release.job('blobstore') + job.template('bin/bbr/restore') + end + + let(:links) do + [ + Link.new(name: 'directories_to_backup', properties: { + 'cc' => { + 'droplets' => { + 'droplet_directory_key' => 'some_droplets_directory_key' + }, + 'buildpacks' => { + 'buildpack_directory_key' => 'some_buildpacks_directory_key' + }, + 'packages' => { + 'app_package_directory_key' => 'some_packages_directory_key' + } + } + }) + ] + end + + it 'templates all the restore commands' do + expect(template.render({}, consumes: links)).to( + include( + 'rm --recursive --force /var/vcap/store/shared/some_droplets_directory_key', + 'rm --recursive --force /var/vcap/store/shared/some_buildpacks_directory_key', + 'rm --recursive --force /var/vcap/store/shared/some_packages_directory_key', + 'cp --recursive --link $BBR_ARTIFACT_DIRECTORY/shared/some_droplets_directory_key', + 'cp --recursive --link $BBR_ARTIFACT_DIRECTORY/shared/some_buildpacks_directory_key', + 'cp --recursive --link $BBR_ARTIFACT_DIRECTORY/shared/some_packages_directory_key', + 'chown --recursive vcap:vcap /var/vcap/store/shared' + ) + ) + end + + context 'when release_level_backup is set to false' do + it 'does not template the restore commands' do + expect(template.render({ 'release_level_backup' => false }, consumes: links)).not_to( + include( + 'some_droplets_directory_key', + 'some_packages_directory_key', + 'some_buildpacks_directory_key', + 'chown' + ) + ) + end + end + + context 'when select_directories_to_backup are set' do + it 'templates the restore commands for the selected directories' do + restore_script = template.render({ 'select_directories_to_backup' => ['buildpacks'] }, consumes: links) + expect(restore_script).to( + include( + 'rm --recursive --force /var/vcap/store/shared/some_buildpacks_directory_key', + 'cp --recursive --link $BBR_ARTIFACT_DIRECTORY/shared/some_buildpacks_directory_key', + 'chown --recursive vcap:vcap /var/vcap/store/shared' + ) + ) + + expect(restore_script).not_to( + include( + 'some_droplets_directory_key', + 'some_packages_directory_key' + ) + ) + end + end + + context 'when select_directories_to_backup contains an unknown directory' do + it 'fails to render' do + expect do + template.render({ 'select_directories_to_backup' => ['some-unknown-directory'] }, consumes: links) + end.to raise_error("Unknown directory in select_directories_to_backup: 'some-unknown-directory'") + end + end + end + end + end +end From 1c0a5bc184b8f608e3b877668b83333fa1e1ebfa Mon Sep 17 00:00:00 2001 From: Wei Quan Date: Tue, 6 Oct 2026 13:36:28 +0200 Subject: [PATCH 5/6] Restore blobstore_waiter for DAV provider Address review feedback. --- jobs/cloud_controller_ng/spec | 1 + .../templates/bin/cloud_controller_ng.erb | 3 ++ .../templates/bin/local_worker.erb | 3 ++ jobs/cloud_controller_worker/spec | 1 + .../templates/bin/cloud_controller_worker.erb | 3 ++ shared_job_templates/blobstore_waiter.sh.erb | 37 +++++++++++++++++++ 6 files changed, 48 insertions(+) create mode 100644 shared_job_templates/blobstore_waiter.sh.erb diff --git a/jobs/cloud_controller_ng/spec b/jobs/cloud_controller_ng/spec index 4070f8ceaf..a7ea80eff6 100644 --- a/jobs/cloud_controller_ng/spec +++ b/jobs/cloud_controller_ng/spec @@ -4,6 +4,7 @@ name: cloud_controller_ng description: "The Cloud Controller provides primary Cloud Foundry API that is by the CF CLI. The Cloud Controller uses a database to keep tables for organizations, spaces, apps, services, service instances, user roles, and more. Typically multiple instances of Cloud Controller are load balanced." templates: + bin/blobstore_waiter.sh.erb: bin/blobstore_waiter.sh bin/cloud_controller_ng.erb: bin/cloud_controller_ng bin/local_worker.erb: bin/local_worker bin/nginx_newrelic_plugin.erb: bin/nginx_newrelic_plugin diff --git a/jobs/cloud_controller_ng/templates/bin/cloud_controller_ng.erb b/jobs/cloud_controller_ng/templates/bin/cloud_controller_ng.erb index e50c145b5e..f1ee374aab 100644 --- a/jobs/cloud_controller_ng/templates/bin/cloud_controller_ng.erb +++ b/jobs/cloud_controller_ng/templates/bin/cloud_controller_ng.erb @@ -1,6 +1,9 @@ #!/usr/bin/env bash source /var/vcap/jobs/cloud_controller_ng/bin/ruby_version.sh +source /var/vcap/jobs/cloud_controller_ng/bin/blobstore_waiter.sh + +wait_for_blobstore cd /var/vcap/packages/cloud_controller_ng/cloud_controller_ng diff --git a/jobs/cloud_controller_ng/templates/bin/local_worker.erb b/jobs/cloud_controller_ng/templates/bin/local_worker.erb index 7afb5e8624..f7ba28477c 100644 --- a/jobs/cloud_controller_ng/templates/bin/local_worker.erb +++ b/jobs/cloud_controller_ng/templates/bin/local_worker.erb @@ -1,6 +1,9 @@ #!/usr/bin/env bash source /var/vcap/jobs/cloud_controller_ng/bin/ruby_version.sh +source /var/vcap/jobs/cloud_controller_ng/bin/blobstore_waiter.sh + +wait_for_blobstore <% if p('cc.experimental.use_yjit_compiler') %> export RUBYOPT='--yjit' diff --git a/jobs/cloud_controller_worker/spec b/jobs/cloud_controller_worker/spec index 0532b8a6a9..cb6625e888 100644 --- a/jobs/cloud_controller_worker/spec +++ b/jobs/cloud_controller_worker/spec @@ -4,6 +4,7 @@ name: cloud_controller_worker description: "Cloud Controller worker processes background tasks submitted via the." templates: + bin/blobstore_waiter.sh.erb: bin/blobstore_waiter.sh bpm.yml.erb: config/bpm.yml bin/cloud_controller_worker.erb: bin/cloud_controller_worker pre-backup-lock.sh.erb: bin/bbr/pre-backup-lock diff --git a/jobs/cloud_controller_worker/templates/bin/cloud_controller_worker.erb b/jobs/cloud_controller_worker/templates/bin/cloud_controller_worker.erb index fdfac2989e..03ae14eff2 100644 --- a/jobs/cloud_controller_worker/templates/bin/cloud_controller_worker.erb +++ b/jobs/cloud_controller_worker/templates/bin/cloud_controller_worker.erb @@ -1,6 +1,9 @@ #!/usr/bin/env bash source /var/vcap/jobs/cloud_controller_worker/bin/ruby_version.sh +source /var/vcap/jobs/cloud_controller_worker/bin/blobstore_waiter.sh + +wait_for_blobstore <% if link("cloud_controller_internal").p('cc.experimental.use_yjit_compiler') %> export RUBYOPT='--yjit' diff --git a/shared_job_templates/blobstore_waiter.sh.erb b/shared_job_templates/blobstore_waiter.sh.erb new file mode 100644 index 0000000000..69a18625b8 --- /dev/null +++ b/shared_job_templates/blobstore_waiter.sh.erb @@ -0,0 +1,37 @@ +function try_to_curl { + local url=$1 + local max_attempts=$2 + local interval_in_seconds=$3 + + curl -s -k "$url" >/dev/null + + found=$? + blobstore_check_attempts=0 + + while [ $found -ne 0 ] + do + sleep $interval_in_seconds + blobstore_check_attempts=$((blobstore_check_attempts+1)) + + curl -s -k "$url" >/dev/null + found=$? + + if [[ blobstore_check_attempts -eq $max_attempts ]]; then + echo "Blobstore is not available" + exit 1 + fi + done +} + +function wait_for_blobstore { + max_attempts=30 + sleep_length=1 + + <% if p('cc.buildpacks.blobstore_provider', nil) == 'dav' %> + + echo "Checking for blobstore availability" + try_to_curl "<%= p('cc.buildpacks.connection_config')['private_endpoint'] %>" $max_attempts $sleep_length + echo "Blobstore is available" + + <% end %> +} From f0201c25fb2995d4ad9d4c95c2782100cf54a768 Mon Sep 17 00:00:00 2001 From: Wei Quan Date: Wed, 7 Oct 2026 13:50:32 +0200 Subject: [PATCH 6/6] Refine blobstore_waiter to only wait for internal singleton DAV blobstore Address review feedback. --- jobs/blobstore/spec | 4 ++ jobs/blobstore/templates/blobstore.conf.erb | 2 +- jobs/cloud_controller_ng/spec | 6 ++- .../templates/blobstore_waiter.sh.erb | 1 + jobs/cloud_controller_worker/spec | 6 ++- .../templates/blobstore_waiter.sh.erb | 1 + shared_job_templates/blobstore_waiter.sh.erb | 7 ++- spec/blobstore/blobstore_spec.rb | 42 ++++++++++++++++ .../cloud_controller_ng_spec.rb | 50 +++++++++++++++++++ .../cloud_controller_worker_spec.rb | 50 +++++++++++++++++++ 10 files changed, 164 insertions(+), 5 deletions(-) create mode 120000 jobs/cloud_controller_ng/templates/blobstore_waiter.sh.erb create mode 120000 jobs/cloud_controller_worker/templates/blobstore_waiter.sh.erb create mode 100644 spec/blobstore/blobstore_spec.rb diff --git a/jobs/blobstore/spec b/jobs/blobstore/spec index 01efaace32..10ff0ad362 100644 --- a/jobs/blobstore/spec +++ b/jobs/blobstore/spec @@ -59,6 +59,10 @@ properties: description: The TCP port on which the internal blobstore server listens default: 4443 + blobstore.internal_hostname: + description: Internal hostname used by the singleton blobstore + default: "blobstore.service.cf.internal" + blobstore.tls.cert: description: The PEM-encoded certificate (optionally as a certificate chain) for serving blobs over TLS/SSL diff --git a/jobs/blobstore/templates/blobstore.conf.erb b/jobs/blobstore/templates/blobstore.conf.erb index 237390e572..46126fd42b 100644 --- a/jobs/blobstore/templates/blobstore.conf.erb +++ b/jobs/blobstore/templates/blobstore.conf.erb @@ -59,7 +59,7 @@ server { # Internal server server { listen <%= p('blobstore.tls.port') %> ssl; - server_name blobstore.service.cf.internal; + server_name <%= p('blobstore.internal_hostname', 'blobstore.service.cf.internal') %>; ssl_certificate /var/vcap/jobs/blobstore/ssl/blobstore.crt; ssl_certificate_key /var/vcap/jobs/blobstore/ssl/blobstore.key; diff --git a/jobs/cloud_controller_ng/spec b/jobs/cloud_controller_ng/spec index a7ea80eff6..3312c9ac54 100644 --- a/jobs/cloud_controller_ng/spec +++ b/jobs/cloud_controller_ng/spec @@ -4,7 +4,7 @@ name: cloud_controller_ng description: "The Cloud Controller provides primary Cloud Foundry API that is by the CF CLI. The Cloud Controller uses a database to keep tables for organizations, spaces, apps, services, service instances, user roles, and more. Typically multiple instances of Cloud Controller are load balanced." templates: - bin/blobstore_waiter.sh.erb: bin/blobstore_waiter.sh + blobstore_waiter.sh.erb: bin/blobstore_waiter.sh bin/cloud_controller_ng.erb: bin/cloud_controller_ng bin/local_worker.erb: bin/local_worker bin/nginx_newrelic_plugin.erb: bin/nginx_newrelic_plugin @@ -219,6 +219,10 @@ properties: description: "specifies that the job is allowed to skip ssl cert verification" default: false + blobstore.internal_hostname: + description: "Internal hostname used by the singleton blobstore" + default: "blobstore.service.cf.internal" + system_domain: description: "Domain reserved for CF operator, base URL where the login, uaa, and other non-user apps listen" system_domain_organization: diff --git a/jobs/cloud_controller_ng/templates/blobstore_waiter.sh.erb b/jobs/cloud_controller_ng/templates/blobstore_waiter.sh.erb new file mode 120000 index 0000000000..f1d48cc475 --- /dev/null +++ b/jobs/cloud_controller_ng/templates/blobstore_waiter.sh.erb @@ -0,0 +1 @@ +../../../shared_job_templates/blobstore_waiter.sh.erb \ No newline at end of file diff --git a/jobs/cloud_controller_worker/spec b/jobs/cloud_controller_worker/spec index cb6625e888..447fab534e 100644 --- a/jobs/cloud_controller_worker/spec +++ b/jobs/cloud_controller_worker/spec @@ -4,7 +4,7 @@ name: cloud_controller_worker description: "Cloud Controller worker processes background tasks submitted via the." templates: - bin/blobstore_waiter.sh.erb: bin/blobstore_waiter.sh + blobstore_waiter.sh.erb: bin/blobstore_waiter.sh bpm.yml.erb: config/bpm.yml bin/cloud_controller_worker.erb: bin/cloud_controller_worker pre-backup-lock.sh.erb: bin/bbr/pre-backup-lock @@ -68,6 +68,10 @@ properties: description: "specifies that the job is allowed to skip ssl cert verification" default: false + blobstore.internal_hostname: + description: "Internal hostname used by the singleton blobstore" + default: "blobstore.service.cf.internal" + system_domain: description: "Domain reserved for CF operator, base URL where the login, uaa, and other non-user apps listen" diff --git a/jobs/cloud_controller_worker/templates/blobstore_waiter.sh.erb b/jobs/cloud_controller_worker/templates/blobstore_waiter.sh.erb new file mode 120000 index 0000000000..f1d48cc475 --- /dev/null +++ b/jobs/cloud_controller_worker/templates/blobstore_waiter.sh.erb @@ -0,0 +1 @@ +../../../shared_job_templates/blobstore_waiter.sh.erb \ No newline at end of file diff --git a/shared_job_templates/blobstore_waiter.sh.erb b/shared_job_templates/blobstore_waiter.sh.erb index 69a18625b8..76fe62bbaf 100644 --- a/shared_job_templates/blobstore_waiter.sh.erb +++ b/shared_job_templates/blobstore_waiter.sh.erb @@ -27,10 +27,13 @@ function wait_for_blobstore { max_attempts=30 sleep_length=1 - <% if p('cc.buildpacks.blobstore_provider', nil) == 'dav' %> + <% endpoint = (p('cc.buildpacks.connection_config', nil) || {}).fetch('private_endpoint', '').to_s %> + <% internal_hostname = p('blobstore.internal_hostname', 'blobstore.service.cf.internal').to_s %> + <% internal_singleton_blobstore = endpoint.match?(%r{\Ahttps?://#{Regexp.escape(internal_hostname)}(?::\d+)?(?:/.*|\z)}) %> + <% if p('cc.buildpacks.blobstore_provider', nil) == 'dav' && internal_singleton_blobstore %> echo "Checking for blobstore availability" - try_to_curl "<%= p('cc.buildpacks.connection_config')['private_endpoint'] %>" $max_attempts $sleep_length + try_to_curl "<%= endpoint %>" $max_attempts $sleep_length echo "Blobstore is available" <% end %> diff --git a/spec/blobstore/blobstore_spec.rb b/spec/blobstore/blobstore_spec.rb new file mode 100644 index 0000000000..ed7806e28c --- /dev/null +++ b/spec/blobstore/blobstore_spec.rb @@ -0,0 +1,42 @@ +# frozen_string_literal: true + +require 'rspec' +require 'bosh/template/test' + +module Bosh + module Template + module Test + describe 'blobstore job template rendering' do + let(:release_path) { File.join(File.dirname(__FILE__), '../..') } + let(:release) { ReleaseDir.new(release_path) } + let(:job) { release.job('blobstore') } + let(:template) { job.template('config/sites/blobstore.conf') } + + let(:manifest_properties) do + { + 'system_domain' => 'example.com', + 'blobstore' => { + 'secure_link' => { + 'secret' => 'super-secret' + } + } + } + end + + it 'uses the default internal singleton hostname' do + rendered_template = template.render(manifest_properties) + + expect(rendered_template).to include('server_name blobstore.service.cf.internal;') + end + + it 'uses the configured internal singleton hostname' do + manifest_properties['blobstore']['internal_hostname'] = 'blobstore.service.custom.internal' + + rendered_template = template.render(manifest_properties) + + expect(rendered_template).to include('server_name blobstore.service.custom.internal;') + end + end + end + end +end diff --git a/spec/cloud_controller_ng/cloud_controller_ng_spec.rb b/spec/cloud_controller_ng/cloud_controller_ng_spec.rb index dd281e4e5a..41f83daac7 100644 --- a/spec/cloud_controller_ng/cloud_controller_ng_spec.rb +++ b/spec/cloud_controller_ng/cloud_controller_ng_spec.rb @@ -171,6 +171,56 @@ module Test end end + describe 'bin/blobstore_waiter.sh' do + let(:template) { job.template('bin/blobstore_waiter.sh') } + + it 'does not wait for non-DAV blobstores' do + rendered_template = template.render(merged_manifest_properties, consumes: links) + + expect(rendered_template).not_to include('Checking for blobstore availability') + expect(rendered_template).not_to include('blobstore.service.cf.internal') + end + + it 'waits for the internal singleton DAV blobstore endpoint' do + merged_manifest_properties['cc']['buildpacks']['blobstore_provider'] = 'dav' + merged_manifest_properties['cc']['buildpacks']['connection_config'] = { + 'private_endpoint' => 'https://blobstore.service.cf.internal:4443' + } + + rendered_template = template.render(merged_manifest_properties, consumes: links) + + expect(rendered_template).to include('Checking for blobstore availability') + expect(rendered_template).to include('try_to_curl "https://blobstore.service.cf.internal:4443" $max_attempts $sleep_length') + end + + it 'waits for the configured internal singleton DAV blobstore hostname' do + merged_manifest_properties['blobstore'] = { + 'internal_hostname' => 'blobstore.service.custom.internal' + } + merged_manifest_properties['cc']['buildpacks']['blobstore_provider'] = 'dav' + merged_manifest_properties['cc']['buildpacks']['connection_config'] = { + 'private_endpoint' => 'https://blobstore.service.custom.internal:4443' + } + + rendered_template = template.render(merged_manifest_properties, consumes: links) + + expect(rendered_template).to include('Checking for blobstore availability') + expect(rendered_template).to include('try_to_curl "https://blobstore.service.custom.internal:4443" $max_attempts $sleep_length') + end + + it 'does not wait for an external DAV blobstore endpoint' do + merged_manifest_properties['cc']['buildpacks']['blobstore_provider'] = 'dav' + merged_manifest_properties['cc']['buildpacks']['connection_config'] = { + 'private_endpoint' => 'https://external-blobstore.example.com:4443' + } + + rendered_template = template.render(merged_manifest_properties, consumes: links) + + expect(rendered_template).not_to include('Checking for blobstore availability') + expect(rendered_template).not_to include('external-blobstore.example.com:4443') + end + end + describe 'database_encryption block' do context 'when the database_encryption block is not present' do before do diff --git a/spec/cloud_controller_worker/cloud_controller_worker_spec.rb b/spec/cloud_controller_worker/cloud_controller_worker_spec.rb index 7927ea28ab..7de3da9dd2 100644 --- a/spec/cloud_controller_worker/cloud_controller_worker_spec.rb +++ b/spec/cloud_controller_worker/cloud_controller_worker_spec.rb @@ -376,6 +376,56 @@ module Test expect(template_hash['default_app_lifecycle']).to eq('cnb') end end + + describe 'bin/blobstore_waiter.sh' do + let(:template) { job.template('bin/blobstore_waiter.sh') } + + it 'does not wait for non-DAV blobstores' do + rendered_template = template.render(manifest_properties, consumes: links) + + expect(rendered_template).not_to include('Checking for blobstore availability') + expect(rendered_template).not_to include('blobstore.service.cf.internal') + end + + it 'waits for the internal singleton DAV blobstore endpoint' do + manifest_properties['cc']['buildpacks']['blobstore_provider'] = 'dav' + manifest_properties['cc']['buildpacks']['connection_config'] = { + 'private_endpoint' => 'https://blobstore.service.cf.internal:4443' + } + + rendered_template = template.render(manifest_properties, consumes: links) + + expect(rendered_template).to include('Checking for blobstore availability') + expect(rendered_template).to include('try_to_curl "https://blobstore.service.cf.internal:4443" $max_attempts $sleep_length') + end + + it 'waits for the configured internal singleton DAV blobstore hostname' do + manifest_properties['blobstore'] = { + 'internal_hostname' => 'blobstore.service.custom.internal' + } + manifest_properties['cc']['buildpacks']['blobstore_provider'] = 'dav' + manifest_properties['cc']['buildpacks']['connection_config'] = { + 'private_endpoint' => 'https://blobstore.service.custom.internal:4443' + } + + rendered_template = template.render(manifest_properties, consumes: links) + + expect(rendered_template).to include('Checking for blobstore availability') + expect(rendered_template).to include('try_to_curl "https://blobstore.service.custom.internal:4443" $max_attempts $sleep_length') + end + + it 'does not wait for an external DAV blobstore endpoint' do + manifest_properties['cc']['buildpacks']['blobstore_provider'] = 'dav' + manifest_properties['cc']['buildpacks']['connection_config'] = { + 'private_endpoint' => 'https://external-blobstore.example.com:4443' + } + + rendered_template = template.render(manifest_properties, consumes: links) + + expect(rendered_template).not_to include('Checking for blobstore availability') + expect(rendered_template).not_to include('external-blobstore.example.com:4443') + end + end end end end