1. Cf-Dev
  2. Messages

Expanded

Topics Messages
   Date   
Bi-weekly Round-Up: Technical + Ecosystem Updates from Cloud Foundry

Chris Clark
 

Happy New Year! Pretty slow news week out there in the wider world, so here are some Cloud Foundry happenings to occupy your stimulation-deprived brains.

From the Last Few Weeks:

Notable Releases:

  • Stratos v4.4.0, with many new features, including:

    • updates to visible Kubernetes resource types

    • application deployment from private repositories

    • an improved homepage 

    • Read more here.

  • Routing-release v0.211.0

    • adds support for sticky sessions when CF-deployed reverse proxy is used

(see: https://github.com/cloudfoundry/routing-release/issues/170)


Dates To Remember (All times U.S. Pacific):

  • CF Technical Governance meeting - January 15 at 10 am 

  • CF for Kubernetes SIG meeting - January 19 at 8:30 am

  • Bi-Weekly CF App Runtime PMC meeting - January 19 at 10:30 am

  • Office Hours: Logging and Metrics - January 19 at 11 am

  • CAB call - January 20 at 8 am

  • CF Technical Governance meeting - January 22 at 10 am

  • CF Extensions PMC meeting - January 25 at 11 am

  • “cf push for Modern Observability” Webinar with DataDog - January 26 at 10 am

Check the community calendar for updates and meeting details here. 

Ecosystem and General News:

Community Updates:

  • Have a question for the staff at Cloud Foundry Foundation? Want to stay current with updates for the Foundation? Join the #cff-forum channel on the community Slack.

  • Looking for a job? Check out the jobs board and the #jobs channel in our community slack; folks are sharing job openings in our community there. (And if you are hiring, please do share that in that channel.)


--
Chris Clark
Technical Operations Manager
Cloud Foundry Foundation
Migration of cf-deployment concourse images

pollardja@...
 

Hi everyone,


Release Integration team here.

We’ve moved the homes of several of our images (such as cf-deployment-concourse-tasks) from relintdockerhubpushbot to the cloudfoundry dockerhub to avoid potential rate-limiting.

We’ll no longer be updating the images in the old location so please switch your pipelines over if they're using any images from relintdockerhubpushbot/<image>.

 

Best,
relint
Re: New CFF Contributor License Agreement will need to be signed

Chris Clark
 

We'll be making the switch on Monday Jan 11, at 12 noon pacific time, in order to give a bit more time for contributing companies to get set up with the new CLA (and avoid breaking things on a Friday).  

Apologies in advance for any chaos that may ensue, hopefully minimal. Please reach out as needed!  

On Wed, Jan 6, 2021 at 2:19 PM Chris Clark via lists.cloudfoundry.org <cclark=cloudfoundry.org@...> wrote:
:)

One thing to clarify... for anyone looking to sign the new CCLA on behalf of their company, here are explicit instructions. We'd emailed all previous "CLA managers" who'd signed the old CLA, but I realize some of those folks might no longer be an active contact:  

· Please log in with, or create your Linux Foundation Account, and go to the corporate CLA dashboard here: https://corporate.v1.easycla.lfx.linuxfoundation.org/

· Click "Get Started" and select your company from the list or create a new company

· On the next screen, click "Sign New CLA" at the top.

· Select "Cloud Foundry - Series LLCs" from the list.

· You may click "Yes" to sign the CCLA, or "No" to send it to someone in your company with corporate authority.

· Once signed, please re-add your GitHub organization or individual contributors to the approved list for the new "Cloud Foundry - Series LLCs" CLA. 


On Tue, Jan 5, 2021 at 11:36 AM Chris Clark via lists.cloudfoundry.org <cclark=cloudfoundry.org@...> wrote:

Hello all,


On January 1, 2021, the Cloud Foundry Foundation changed the corporate structure used to support the organization, and is now a directed fund within the Linux Foundation. This means we’ve had to make some small revisions to our Contributor License Agreement (CLA).


This new agreement is substantively very similar to the last one, except for these minor changes: 

  • updates to references to the legal entities receiving the contributions

  • removal of extraneous schedules at the end of the CCLA

  • clearer references to the use of EasyCLA and process for each company to maintain the list of their authorized contributors

You will likely want to consult with your legal department if you have any questions about the CCLA text itself.


If you are a CLA manager for your respective company, we’ve already reached out to you directly, with instructions asking you to sign the new Corporate Contributor License Agreement (CCLA), and add the same people and groups you had previously added to the approved list for your company. This should just take a few minutes, and, given the minor change to the previous agreement should hopefully be quickly approved by your legal department as needed :)


If you are covered under an existing Corporate Contributor License Agreement (CCLA), your company will need to take the steps outlined above before your pull requests go through.  


If you have signed an Individual Contributor License Agreement (ICLA), you’ll be prompted to resign the next time a pull request goes into a Cloud Foundry repository. This only takes a minute or two. 


We’ll be crossing over to the new CLA later this week; please reach out if you have any questions or concerns.



--
Chris Clark
Technical Operations Manager
Cloud Foundry Foundation



--
Chris Clark
Technical Operations Manager
Cloud Foundry Foundation



--
Chris Clark
Technical Operations Manager
Cloud Foundry Foundation
Re: New CFF Contributor License Agreement will need to be signed

Chris Clark
 

:)

One thing to clarify... for anyone looking to sign the new CCLA on behalf of their company, here are explicit instructions. We'd emailed all previous "CLA managers" who'd signed the old CLA, but I realize some of those folks might no longer be an active contact:  

· Please log in with, or create your Linux Foundation Account, and go to the corporate CLA dashboard here: https://corporate.v1.easycla.lfx.linuxfoundation.org/

· Click "Get Started" and select your company from the list or create a new company

· On the next screen, click "Sign New CLA" at the top.

· Select "Cloud Foundry - Series LLCs" from the list.

· You may click "Yes" to sign the CCLA, or "No" to send it to someone in your company with corporate authority.

· Once signed, please re-add your GitHub organization or individual contributors to the approved list for the new "Cloud Foundry - Series LLCs" CLA. 


On Tue, Jan 5, 2021 at 11:36 AM Chris Clark via lists.cloudfoundry.org <cclark=cloudfoundry.org@...> wrote:

Hello all,


On January 1, 2021, the Cloud Foundry Foundation changed the corporate structure used to support the organization, and is now a directed fund within the Linux Foundation. This means we’ve had to make some small revisions to our Contributor License Agreement (CLA).


This new agreement is substantively very similar to the last one, except for these minor changes: 

  • updates to references to the legal entities receiving the contributions

  • removal of extraneous schedules at the end of the CCLA

  • clearer references to the use of EasyCLA and process for each company to maintain the list of their authorized contributors

You will likely want to consult with your legal department if you have any questions about the CCLA text itself.


If you are a CLA manager for your respective company, we’ve already reached out to you directly, with instructions asking you to sign the new Corporate Contributor License Agreement (CCLA), and add the same people and groups you had previously added to the approved list for your company. This should just take a few minutes, and, given the minor change to the previous agreement should hopefully be quickly approved by your legal department as needed :)


If you are covered under an existing Corporate Contributor License Agreement (CCLA), your company will need to take the steps outlined above before your pull requests go through.  


If you have signed an Individual Contributor License Agreement (ICLA), you’ll be prompted to resign the next time a pull request goes into a Cloud Foundry repository. This only takes a minute or two. 


We’ll be crossing over to the new CLA later this week; please reach out if you have any questions or concerns.



--
Chris Clark
Technical Operations Manager
Cloud Foundry Foundation



--
Chris Clark
Technical Operations Manager
Cloud Foundry Foundation
Stratos 4.4.0

Richard Cox
 

Hi All,

It gives me great pleasure to announce Stratos 4.4.0. Here's the highlights...

- Show more meaningful data on the Home page
- Show more resource types in Kubernetes Cluster and Workload views
- Deploy CF Applications from Private Repos in Github and Gitlab
- Deploy CF Applications from Public and Private Repos in Enterprise GitHub and GitLab
- Persist list settings over browser refresh
- Upgrade to Angular 10

Full release notes are available from https://github.com/cloudfoundry/stratos/blob/master/CHANGELOG.md#440

We welcome your feedback, comments and bug reports. Please feel free to raise them in github (https://github.com/cloudfoundry/stratos) or reach out directly to us in slack (#stratos)

Regards,

Richard Cox
on behalf of the Stratos team
Re: New CFF Contributor License Agreement will need to be signed

Steve Taylor <sttaylor@...>
 

Two points to Gryffindor! Well played.

________________________________________
From: cf-dev@... <cf-dev@...> on behalf of Dr Nic Williams <drnicwilliams@...>
Sent: Tuesday, January 5, 2021 12:47 PM
To: cf-dev@...
Subject: Re: [cf-dev] New CFF Contributor License Agreement will need to be signed

LOL

On Wed, 6 Jan 2021 at 6:36 am, Jonathan Matthews <contact+cfdev@...<mailto:contact%2Bcfdev@...>> wrote:
On Tue, 5 Jan 2021 at 21:36, Chris Clark <cclark@...<mailto:cclark@...>> wrote:
you’ll be prompted to resign the next time a pull request goes into a Cloud Foundry repository.
But what if I *like* my job? Plus, my code’s not /that/ bad :-(
--
Jonathan Matthews
https://jpluscplusm.com<https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fjpluscplusm.com%2F&data=04%7C01%7Csttaylor%40vmware.com%7C8356505ba5c94cd1f4bd08d8b1bb2dde%7Cb39138ca3cee4b4aa4d6cd83d9dd62f0%7C0%7C0%7C637454764779235940%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=Kr4QKfn0sWq%2BpQ6Tdi2dtPI7zMVURWCGf%2FVbIdJ5bBM%3D&reserved=0>

--
Dr Nic Williams
+61 437 276 076
twitter @drnic
Re: New CFF Contributor License Agreement will need to be signed

Dr Nic Williams <drnicwilliams@...>
 

LOL

On Wed, 6 Jan 2021 at 6:36 am, Jonathan Matthews <contact+cfdev@...> wrote:
On Tue, 5 Jan 2021 at 21:36, Chris Clark <cclark@...> wrote:
> you’ll be prompted to resign the next time a pull request goes into a Cloud Foundry repository.

But what if I *like* my job? Plus, my code’s not /that/ bad :-(
--
Jonathan Matthews
https://jpluscplusm.com

--
Dr Nic Williams
+61 437 276 076
twitter @drnic
Re: New CFF Contributor License Agreement will need to be signed

Jonathan Matthews <contact+cfdev@...>
 

On Tue, 5 Jan 2021 at 21:36, Chris Clark <cclark@...> wrote:
> you’ll be prompted to resign the next time a pull request goes into a Cloud Foundry repository.

But what if I *like* my job? Plus, my code’s not /that/ bad :-(
--
Jonathan Matthews
https://jpluscplusm.com
New CFF Contributor License Agreement will need to be signed

Chris Clark
 

Hello all,


On January 1, 2021, the Cloud Foundry Foundation changed the corporate structure used to support the organization, and is now a directed fund within the Linux Foundation. This means we’ve had to make some small revisions to our Contributor License Agreement (CLA).


This new agreement is substantively very similar to the last one, except for these minor changes: 

  • updates to references to the legal entities receiving the contributions

  • removal of extraneous schedules at the end of the CCLA

  • clearer references to the use of EasyCLA and process for each company to maintain the list of their authorized contributors

You will likely want to consult with your legal department if you have any questions about the CCLA text itself.


If you are a CLA manager for your respective company, we’ve already reached out to you directly, with instructions asking you to sign the new Corporate Contributor License Agreement (CCLA), and add the same people and groups you had previously added to the approved list for your company. This should just take a few minutes, and, given the minor change to the previous agreement should hopefully be quickly approved by your legal department as needed :)


If you are covered under an existing Corporate Contributor License Agreement (CCLA), your company will need to take the steps outlined above before your pull requests go through.  


If you have signed an Individual Contributor License Agreement (ICLA), you’ll be prompted to resign the next time a pull request goes into a Cloud Foundry repository. This only takes a minute or two. 


We’ll be crossing over to the new CLA later this week; please reach out if you have any questions or concerns.



--
Chris Clark
Technical Operations Manager
Cloud Foundry Foundation

CF CCLA.pdf

CF CCLA.pdf
CF ICLA.pdf

CF ICLA.pdf

Routing Release 0.211.0 now available

Amin Jamali <ajamali@...>
 

Hey cf-eng!

 Routing release 0.211.0 is now available.

 Release Highlights
CAB call! Wednesday December 16 @8am (Pacific)

Troy Topnik
 

Once again James Hunt from Stark & Wayne has something cool to show us at the Community Advisory Board call.

Join us this Wednesday for a demonstration of deploying CF-for-K8s using Helm, as well as all the usual project updates and some open discussion.

TT
----------
Chat room: go to slack.cloudfoundry.org and then join the #cab channel


Join from PC, Mac, Linux, iOS or Android: https://zoom.us/j/757994996

Or iPhone one-tap :
    US: +16468769923,,757994996# or +16699006833,,757994996#
Or Telephone:
    Dial(for higher quality, dial a number based on your current location):
        US: +1 646 876 9923 or +1 669 900 6833 or +1 408 638 0968
    Meeting ID: 757 994 996
    International numbers available: https://zoom.us/zoomconference?m=BbM_MZowkH08pdKycQk10at13V5cLneM

Agenda doc: https://docs.google.com/document/d/1SCOlAquyUmNM-AQnekCOXiwhLs6gveTxAcduvDcW_xI
 

--
Troy Topnik
 
 
Re: Cloud Service Broker in the Extensions PMC

Guillaume Berche
 

+1

The Open Service Broker api (OSB) is a very powerful standard. The cloud service broker now enables authors to leverage the large ecosystem of terraform providers in order to easily surface associated underlying services to OSB clients (cloudfoundry and kubernetes). This further strengthens the existing rich OSB ecosystem (see related recent PR at [1] as an attempt to make this ecosystem more easily discoverable by the community).

Orange had already a great experience with the cloud service broker for internal use cases. We're very happy that the CSB project joined the CFF and are eager to further contribute to the project in various ways (documentation, product ideas, as well as new features and bug fixes). Thanks to Google and Vmware for this great community contribution!

On Mon, Dec 7, 2020 at 5:50 PM Eric Malm <emalm@...> wrote:
Congratulations to Omer and the rest of the CSB project team!

Best,
Eric

From: cf-dev@... <cf-dev@...> on behalf of Troy Topnik via lists.cloudfoundry.org <troy.topnik=suse.com@...>
Sent: Friday, December 4, 2020 4:06 PM
To: cf-dev@... <cf-dev@...>
Subject: [Suspected Spam] [cf-dev] Cloud Service Broker in the Extensions PMC
 

Let's warmly welcome the Cloud Service Broker project into the Cloud Foundry Extensions PMC!

https://github.com/pivotal/cloud-service-broker

Cloud Service Broker is an OSBAPI broker that uses Brokerpaks to expose services via Terraform. The project is led by Omer Bensaadon from VMware. We didn't get any feedback during the (admittedly short) proposal phase for this, so if any Extensions PMC project leads have any objections, please contact me directly on Slack or via email.

TT

--
Troy Topnik
Senior Product Manager, 
SUSE Cloud Application Platform 
 
Re: Feature Narrative: Fine-granular & custom platform roles for Cloud Foundry

Guillaume Berche
 

Thanks Stephan for this proposal. I'm concerned that adding new roles will further increase complexity and degrade UX. This will likely increase the current feeling of combinatorial explosion when reading the role reference table [1]. I've contributed detailed comments in the documents to proceed as a community with analysing related use-cases and try to converge to a better proposal from the UX perspective.

Hope this helps,

Guillaume.


On Wed, Dec 2, 2020 at 5:26 PM Klevenz, Stephan <stephan.klevenz@...> wrote:

Hi CF,

 

Here is a feature narrative and it is called "Fine-granular & custom platform roles for Cloud Foundry".

 

https://docs.google.com/document/d/1isfsSWvF8xDU0G69k4MqB3o5c2vB0P3Vbi79W0yvqFQ/edit?usp=sharing

 

This proposal is the result of direct feedback we have received from many CF users. It addresses the problem that every space developer can delete a service. And there may be important data attached to this service. Oops.

Comments, feedback, suggestions, and questions very welcome and appreciated!

 

Regards,

Stephan

 

 
Re: Thoughts on cf-for-k8s Use Cases

Eric Malm
 

Hi, Bernd,

Thanks very much for the detailed write-up about future directions for cf-for-k8s, and for your elaboration on relevant operator segments, which matches our perspective on the community landscape. The specific needs and objectives you've expressed also align to feedback and questions we have received so far about how cf-for-k8s can achieve the same security and scale outcomes that CF has on BOSH, as well as how it could improve its operational flexibility, reliability, and interoperability with existing K8s clusters and their workloads. Sounds like a great roadmap for ongoing collaboration as we keep bringing CF outcomes to K8s!

Best,
Eric

From: cf-dev@... <cf-dev@...> on behalf of Daniel Jones via lists.cloudfoundry.org <daniel.jones=engineerbetter.com@...>
Sent: Monday, November 16, 2020 7:04 AM
To: Discussions about Cloud Foundry projects and the system overall. <cf-dev@...>
Subject: Re: [cf-dev] Thoughts on cf-for-k8s Use Cases
 
Thanks for the clarifications! I think in my narrow perspective I forgot that y'all probably have a lot of other things to manage, so you really do get economies of scale from internal Kubernetes knowledge.

Regards,
Daniel 'Deejay' Jones - CEO
+44 (0)79 8000 9153
EngineerBetter Ltd - More than cloud platform specialists


On Mon, 16 Nov 2020 at 07:58, Simon D Moser <smoser@...> wrote:
+1 to what Bernd wrote - this exactly echoes my thinking as well on the points made

Mit freundlichen Grüßen / Kind regards

Simon Moser

Senior Technical Staff Member / IBM Master Inventor
Bluemix Application Platform Lead Architect
Dept. C727, IBM Research & Development Boeblingen

-------------------------------------------------------------------------------------------------------------------------------------------
IBM Deutschland Research & Development GmbH
Schoenaicher Str. 220
71032 Boeblingen
Phone: +49-7031-16-4304
Fax: +49-7031-16-4890
E-Mail: smoser@...
-------------------------------------------------------------------------------------------------------------------------------------------
Vorsitzender des Aufsichtsrats: Gregor Pillen
Geschäftsführung: Dirk Wittkopp
Sitz der Gesellschaft: Böblingen
Registergericht: Amtsgericht Stuttgart, HRB 243294

*******

ITIL has led people to think in siloes ("go fix change management").
Project Management has led people to think in finite units of work instead of streams of product.
Both are fundamental dysfunctions of the framework model, not failures of execution.
⁃ Rob England



From:        "Krannich, Bernd" <bernd.krannich@...>
To:        "cf-dev@..." <cf-dev@...>
Date:        16/11/2020 08:15
Subject:        [EXTERNAL] Re: [cf-dev] Thoughts on cf-for-k8s Use Cases
Sent by:        cf-dev@...



Hi Daniel, Thank you very much for your additional questions....                                                                                                                                                                                      
This Message Is From an External Sender
This message came from outside your organization.

Hi Daniel,

 

Thank you very much for your additional questions. Let me try and answer some of them from my perspective (this is me talking, not necessarily the “official voice” of my employer):

 

> It sounds like there are a lot of overheads for SAP in adopting cf-for-k8s. More operational complexity managing many clusters, and then the effort of migrating from cf-for-VMs to the new world. Is this all worth it?

 

We actually approach the topic from a different angle: We have much more to manage than „just“ CF – but many other services – and so the question for us is which common layers we establish as basis for our offering. One decision SAP has taken (and I hear that VMware, IBM, and Suse aren’t maybe that much different) is to use Kubernetes as one such layer. And taking that decision at our scale means a huge task in managing many clusters anyways. Our answer for this is Gardener (shameless advertisement for an SAP-initiated Open Source project: https://gardener.cloud/), but YMMV.

 

> Are end-users clamouring to be able to deploy things to Kubernetes alongside their CF apps?

> […]

> I wonder if all the migration efforts required to adopt cf-for-k8s are worthwhile to existing users.

 

I believe I referred to this topic during our CF Summit panel discussion: I think there’s more than one group of end-users to consider:

  • People using CF today that are happy with it: I think they are in the “let me continue to `cf push` my apps” camp and I believe they require feature parity to the BOSH-managed world to continue doing what they do. I also think they don’t care about Kubernetes as an underlay similar to how they didn’t care about BOSH managing CF’s lifecycle before.
  • People that tried using CF but couldn’t build their scenarios. Some of these people have what I would call a “mixed workload”: Things that could run on CF and things that can’t. For them, the question is if they want a “hybrid” model where they `cf push` their stateless apps to one system and `kubectl apply` the other parts of their workload to a different system or if they – once they have taken on the more difficult part of learning Kubernetes anyways – also move over their stateless workloads to Kubernetes directly. For this group of people, I feel, a value prop of “just having the CF API next to kubectl” as an access point to their cluster is a good thing. That’s also part of the reason why I’m suggesting to remove as much of the CF control plane from the “workload cluster” in my document. It’s their cluster and probably they want to do non-CF stuff with it as well.
  • People that approach the topic coming from a Kubernetes background: Here, we keep seeing projects over projects essentially re-inventing PaaS (some of them with an added Git-Ops flavor on top). Things that are non-Kubernetes or things that can be deployed on Kubernetes but “feel” non-K8s-native will not get them engaged. Which is why a Cloud Foundry on Kubernetes will need to feel K8s-native to be successful with this – probably very big – group.
 

> The notion of specifying different target runtime environments per isolation segment is intriguing. If this were possible, would it be simpler to stick with cf-for-VMs, and have a Kubernetes cluster for each tenant that runs apps and user workloads?

 

Not for us, because it would still leave us with both BOSH-based deployments as well as having to manage a huge fleet of K8s-clusters, so all of the work with none of the benefits.

 

Regards,

Bernd

 

From: cf-dev@... <cf-dev@...>
Date: Friday, 13. November 2020 at 10:26
To: Discussions about Cloud Foundry projects and the system overall. <cf-dev@...>
Subject: Re: [cf-dev] Thoughts on cf-for-k8s Use Cases

Hey all!

 

Thanks for sharing your thoughts, Bernd.

 

It sounds like there are a lot of overheads for SAP in adopting cf-for-k8s. More operational complexity managing many clusters, and then the effort of migrating from cf-for-VMs to the new world. Is this all worth it? Are end-users clamouring to be able to deploy things to Kubernetes alongside their CF apps?

 

The notion of specifying different target runtime environments per isolation segment is intriguing. If this were possible, would it be simpler to stick with cf-for-VMs, and have a Kubernetes cluster for each tenant that runs apps and user workloads? This would be exactly the same as running Eirini on cf-for-VMs (which VMware published as an offering), except there'd be the option for one-Kubernetes-per-tenant.

 

As an aside, I do sincerely hope that the large CF vendors are intending to heavily market CF as the easy mode for Kubernetes. I wonder if all the migration efforts required to adopt cf-for-k8s are worthwhile to existingusers.

 

Regards,

Daniel 'Deejay' Jones - CEO

+44 (0)79 8000 9153

@DanielJonesEB

EngineerBetterLtd- More than cloud platform specialists

 

 

On Thu, 12 Nov 2020 at 17:34, Wayne E. Seguin <wayneeseguin@...> wrote:

Bernd,

 

Fantastic! I'm looking forward to reading it over, thank you for putting your thoughts down!

Thanks,

 

  ~Wayne

 

Wayne E. Seguin

CTO, Stark & Wayne LLC

wayneeseguin@...

 

 

 

On Thu, Nov 12, 2020 at 11:37 AM Krannich, Bernd <bernd.krannich@...> wrote:

Hello all,

 

With cf-for-k8s turning 1.0, I started putting my thoughts around “what’s next after what’s next for cf-for-k8s?” in writing.

 

I wanted to share the resulting document with the community to get feedback, additional perspectives and maybe even to inspire thinking around the topics I collected:

https://docs.google.com/document/d/1Hk19MkUOGQmP_dkoCwkogRQqlBwGE0Bpgr2U96JhW3I/edit?usp=sharing

 

Thanks,

Bernd

 

Bernd Krannich

SAP Cloud Platform

SAP SE

Dietmar-Hopp-Allee 16, 69190 Walldorf, Germany

 

E bernd.krannich@...

 

Pflichtangaben/Mandatory Disclosure Statement: www.sap.com/impressum

 

Diese E-Mail kann Betriebs- oder Geschäftsgeheimnisse oder sonstige vertrauliche Informationen enthalten. Sollten Sie diese E-Mail irrtümlich erhalten haben, ist Ihnen eine Kenntnisnahme des Inhalts, eine Vervielfältigung oder Weitergabe der E-Mail ausdrücklich untersagt. Bitte benachrichtigen Sie uns und vernichten Sie die empfangene E-Mail. Vielen Dank.

 

This e-mail may contain trade secrets or privileged, undisclosed, or otherwise confidential information. If you have received this e-mail in error, you are hereby notified that any review, copying, or distribution of it is strictly prohibited. Please inform us immediately and destroy the original transmittal. Thank you for your cooperation.
Re: Feature Narrative: Fine-granular & custom platform roles for Cloud Foundry

Duncan Mcintyre <mcintyredu@...>
 

I’m all for anything which gives finer grained control. At present customers like RBS wrap the cf api with their own tooling in order to limit who can do what – which is obviously not optimal.

 

Shame we never implemented the ability to define custom roles in the database rather than have them hard-coded.

 

D

 

Duncan McIntyre
Advisory Solutions Engineer

mcintyredu@...
Mobile: +44 7917 580 118

VMware

VMware

 

 

From: cf-dev@... <cf-dev@...>
Date: Wednesday, December 2, 2020 at 5:29 PM
To: cf-dev@... <cf-dev@...>
Subject: Re: [cf-dev] Feature Narrative: Fine-granular & custom platform roles for Cloud Foundry

This is really a promising step. cloud.gov uses "service accounts", https://cloud.gov/docs/services/cloud-gov-service-account/, which are implemented with: https://github.com/cloudfoundry-community/uaa-credentials-broker.  Usually these are used in CI/CD systems for deployments.

The service accounts are way too over-powered using the Developer role, so this is a great step to scoping deployer accounts to, well, deployments in a CD system. However, I think the Operator account is too restrictive for any real human operator, and too expansive for a CI deployer account.

I'd like to see Operator renamed to Deployer and have some further rights removed, like viewing other spaces or or other users and roles, perhaps.

 

Or if there's a real need for the Operator role, then maybe add yet another role for Deployers (but that seems to be getting into IAM-level scope creep).

 

--Peter

 

On Wed, Dec 2, 2020 at 11:27 AM Klevenz, Stephan <stephan.klevenz@...> wrote:

Hi CF,

 

Here is a feature narrative and it is called "Fine-granular & custom platform roles for Cloud Foundry".

 

https://docs.google.com/document/d/1isfsSWvF8xDU0G69k4MqB3o5c2vB0P3Vbi79W0yvqFQ/edit?usp=sharing

 

This proposal is the result of direct feedback we have received from many CF users. It addresses the problem that every space developer can delete a service. And there may be important data attached to this service. Oops.

Comments, feedback, suggestions, and questions very welcome and appreciated!

 

Regards,

Stephan

 

 



--

- 

Peter Burkholder |  cloud.gov compliance & security

please use cloud-gov-compliance@... for cloud.gov matters

 
Routing Release 0.210.0 now available

Josh Russett
 

Hey y’all,

 

Routing Release 0.210.0 is now available.

 

Release Highlights

  • Operators can limit CAs that the gorouter trusts when validating client certs to a specified list (fixes #181 )
  • Bumps to golang 1.15.6

 

 

🌟🌲 Warm regards ❄️⛄️

CF for VMs Networking
CF Contributor Survey - last call!

Chris Clark
 

Hi all, 

If you haven't already, here's a quick reminder to please fill out this very brief survey for the CFF.  Thank you!

https://www.surveymonkey.com/r/ZGS7BNW 
Re: Cloud Service Broker in the Extensions PMC

Eric Malm
 

Congratulations to Omer and the rest of the CSB project team!

Best,
Eric

From: cf-dev@... <cf-dev@...> on behalf of Troy Topnik via lists.cloudfoundry.org <troy.topnik=suse.com@...>
Sent: Friday, December 4, 2020 4:06 PM
To: cf-dev@... <cf-dev@...>
Subject: [Suspected Spam] [cf-dev] Cloud Service Broker in the Extensions PMC
 

Let's warmly welcome the Cloud Service Broker project into the Cloud Foundry Extensions PMC!

https://github.com/pivotal/cloud-service-broker

Cloud Service Broker is an OSBAPI broker that uses Brokerpaks to expose services via Terraform. The project is led by Omer Bensaadon from VMware. We didn't get any feedback during the (admittedly short) proposal phase for this, so if any Extensions PMC project leads have any objections, please contact me directly on Slack or via email.

TT

--
Troy Topnik
Senior Product Manager, 
SUSE Cloud Application Platform 
troy.topnik@...
 
Cloud Service Broker in the Extensions PMC

Troy Topnik
 

Let's warmly welcome the Cloud Service Broker project into the Cloud Foundry Extensions PMC!

https://github.com/pivotal/cloud-service-broker

Cloud Service Broker is an OSBAPI broker that uses Brokerpaks to expose services via Terraform. The project is led by Omer Bensaadon from VMware. We didn't get any feedback during the (admittedly short) proposal phase for this, so if any Extensions PMC project leads have any objections, please contact me directly on Slack or via email.

TT

--
Troy Topnik
Senior Product Manager, 
SUSE Cloud Application Platform 
troy.topnik@...
 
CF Bi-Weekly Roundup 12/2

Chris Clark
 

Hi, all. As the year comes to an end, there are a few exciting things coming up I’d like to highlight: 

From the Last Few Weeks:

Dates To Remember (All times US Pacific):

Check the community calendar for updates and meeting details!

Ecosystem and General News:

Community Updates:

  • Have a question for the staff at Cloud Foundry Foundation? Want to stay current with updates for the Foundation? Join the #cff-forum channel on the community Slack.
  • Looking for a job? Check out the jobs board and the #jobs channel in our community slack; folks are sharing the job openings in our community.  

(And if you are hiring, please do share the info in that channel.)


--
Chris Clark
Technical Operations Manager
Cloud Foundry Foundation
201 - 220 of 9441