|
Removing ParentRequestID property from dropsonde's HttpStartStop event
Warren Fernandes
Hey CF-Dev,
We are making the following changes to the Dropsonde interface library used by GoRouter to handle managing http headers to build the HttpStartStop event: - We replaced the X-CF-RequestID with X-Vcap-Request-ID to be more consistent with other components. - We're now using the same UUID X-Vcap-Request-ID that comes into the InstrumentedRoundTripper rather than regenerating another requestId and saving the original one as the ParentRequestID for Dropsonde-handled requests. - We're removing the ParentRequestID since its no longer necessary and requests are further distinguishable by the appID. This could be a backwards-incompatible change for anyone relying on Dropsonde's behavior surrounding the passing of requestID headers. This story <https://www.pivotaltracker.com/story/show/113195829> tracks its progress. Thanks. CF-Loggregator |
|
|
|
Making UAA work with Openstack Keystone
Noburou TANIGUCHI
Hi team,
We've recently been trying to make UAA work with OpenStack Keystone. With UAA 2.7.0.3 (used by cf-release v222) or before, they works fine together, by setting `uaa.keystone.enabled` and `uaa.keystone.authenticationUrl` properties in BOSH deployment manifest. However, with UAA 2.7.1 (used by cf-release v223) or after, UAA doesn't work properly with Keystone. It outputs logs on startup such like: ``` YamlConfigurationValidator: Failed to load YAML validation bean. Your YAML file may be invalid. Can't construct a java object for tag:yaml.org,2002:org.cloudfoundry.identity.uaa.UaaConfiguration; exception=Cannot create property=keystone for JavaBean=org.cloudfoundry.identity.uaa.UaaConfiguration(a)4b0efc0d; Unable to find property 'keystone' on class: org.cloudfoundry.identity.uaa.UaaConfiguration ``` then become running. But when we try to authenticate a user only in the Keystone server, simply it fails. Finally we've found the reason why authentication fails. In UAA 2.7.0.3, DynamicZoneAwareAuthenticationManager#authenticate is: https://github.com/cloudfoundry/uaa/blob/2.7.0.3/login/src/main/java/org/cloudfoundry/identity/uaa/authentication/manager/DynamicZoneAwareAuthenticationManager.java#L61-L71 ``` 61 @Override 62 public Authentication authenticate(Authentication authentication) throws AuthenticationException { 63 IdentityZone zone = IdentityZoneHolder.get(); 64 //if zone==uaa just use the authzAuthenticationMgr bean 65 if (zone.equals(IdentityZone.getUaa())) { 66 return authzAuthenticationMgr.authenticate(authentication); 67 } else { 68 //chain it exactly like the UAA 69 return getChainedAuthenticationManager(zone).authenticate(authentication); 70 } 71 } ``` And when the uaa.keystone properties exist in BOSH deployment manifest, the zone of Keystone identity provider becomes `uaa`, so the first `if` (l.65) falls `true` and `authzAuthenticationMgr.authenticate(authentication)` is called. But UAA v2.7.1, the same method is: https://github.com/cloudfoundry/uaa/blob/2.7.1/login/src/main/java/org/cloudfoundry/identity/uaa/authentication/manager/DynamicZoneAwareAuthenticationManager.java#L58-L63 ``` 58 @Override 59 public Authentication authenticate(Authentication authentication) throws AuthenticationException { 60 IdentityZone zone = IdentityZoneHolder.get(); 61 //chain it exactly like the UAA 62 return getChainedAuthenticationManager(zone).authenticate(authentication); 63 } ``` There is no `if` and always calling `getChainedAuthenticationManager(zone).authenticate(authentication)`. And DynamicZoneAwareAuthenticationManager#getChainedAuthenticationManager is: https://github.com/cloudfoundry/uaa/blob/2.7.1/login/src/main/java/org/cloudfoundry/identity/uaa/authentication/manager/DynamicZoneAwareAuthenticationManager.java#L65-L94 ``` 65 protected ChainedAuthenticationManager getChainedAuthenticationManager(IdentityZone zone) { 66 IdentityProvider ldapProvider = getProvider(Origin.LDAP, zone); 67 IdentityProvider uaaProvider = getProvider(Origin.UAA, zone); 68 69 List<AuthenticationManagerConfiguration> delegates = new LinkedList<>(); 70 71 if (uaaProvider.isActive()) { 72 AuthenticationManagerConfiguration uaaConfig = new AuthenticationManagerConfiguration(internalUaaAuthenticationManager, null); 73 uaaConfig.setStopIf(AccountNotVerifiedException.class, AuthenticationPolicyRejectionException.class); 74 delegates.add(uaaConfig); 75 } 76 77 if (ldapProvider.isActive()) { 78 //has LDAP IDP config changed since last time? 79 DynamicLdapAuthenticationManager existing = getLdapAuthenticationManager(zone, ldapProvider); 80 if (!existing.getDefinition().equals(ldapProvider.getConfigValue(LdapIdentityProviderDefinition.class))) { 81 ldapAuthManagers.remove(zone); 82 existing.destroy(); 83 } 84 DynamicLdapAuthenticationManager ldapAuthenticationManager = getLdapAuthenticationManager(zone, ldapProvider); 85 AuthenticationManagerConfiguration ldapConfig = 86 new AuthenticationManagerConfiguration(ldapAuthenticationManager, 87 delegates.size()>0 ? ChainedAuthenticationManager.IF_PREVIOUS_FALSE : null); 88 delegates.add(ldapConfig); 89 } 90 91 ChainedAuthenticationManager result = new ChainedAuthenticationManager(); 92 result.setDelegates(delegates.toArray(new AuthenticationManagerConfiguration[delegates.size()])); 93 return result; 94 } ``` So it seems only aware of providers whose origin is `Origin.LDAP` or `Origin.UAA`, not aware of the Keystone provider whose origin is `Origin.KEYSTONE`. So my questions are below: Q1: The change between 2.7.0.3 and 2.7.1 seems excluding the Keystone support. Is this done intentiolnally? I mean, is the Keystone support intentionally excluded after 2.7.1? (One thing that makes tracing the change's intention harder is that the commit of UAA v2.7.1 is a root commit abruptly emerges in the Git log graph. I think it's not like the "Git way".) If Q1 is "No", Q2: Is this a bug? or, Q3: Is there any way to use UAA (after 2.7.1) with Keystone? Thanks in advance. ----- I'm not a ... noburou taniguchi -- View this message in context: http://cf-dev.70369.x6.nabble.com/Making-UAA-work-with-Openstack-Keystone-tp3706.html Sent from the CF Dev mailing list archive at Nabble.com. |
|
|
|
Re: Dc4cities-project post from hsiliev@gmail.com requires approval
Corentin Dupont <corentin.dupont@...>
Thanks Hristo.
toggle quoted message
Show quoted text
I'm trying to retrieve the info from the API: curl "https://api.[your-domain.com]/v2/app_usage_events?results-per-page=1&after_guid=5f9db08a-3e18-4b1e-a09b-14be78eb3dab" -X GET \ -H "Authorization: bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoidWFhLWlkLTQ2MSIsImVtYWlsIjoiZW1haWwtMzMyQHNvbWVkb21haW4uY29tIiwic2NvcGUiOlsiY2xvdWRfY29udHJvbGxlci5hZG1pbiJdLCJhdWQiOlsiY2xvdWRfY29udHJvbGxlciJdLCJleHAiOjE0NTQ0NTE2Mzl9.4MWgEkbhuyG21w9vyZ_p8UhkY_YU0UoiGdscbqvr5bM" \ -H "Host: example.org" \ -H "Cookie: " But how can I get my authorization token? ---------- Forwarded message ---------- From: Hristo Iliev <hsiliev(a)gmail.com> --
Corentin Dupont Researcher @ Create-Netwww.corentindupont.info |
|
|
|
Re: apps logs
Hi,
toggle quoted message
Show quoted text
You can check the the App Usage Events API [1]. They are discarded after some time (default: a month), so you should move the info to a dedicated DB if you need audit events. Regards, Hristo Iliev [1] http://apidocs.cloudfoundry.org/230/app_usage_events/list_all_app_usage_events.html 2016-02-09 16:26 GMT+02:00 Corentin Dupont <corentin.dupont(a)create-net.org>: Hi guys, |
|
|
|
Re: Memory settings on the java buildpack
Noburou TANIGUCHI
Amishi,
Please give us more information about your question. 1. What is "the memory settings in the java buildpack"? 2. What is "memory sizes"? 3. What did you do with changing "memory sizes", and how did you confirm they were successfully changed? 4. What is "the memory heuristics"? 5. What did you do with changing "the memory heuristics", and how did you confirm they failed? Basically, java-buildpack configures an app memory with java-buildpack-memory-calculator [1]. It divides the total memory assigned to an app to heap, metaspace, native, permgen, and stack, depending on its "containers" (you may find the list of containers at [2]) determined by the `detect` script in java-buildpack. [1] https://github.com/cloudfoundry/java-buildpack-memory-calculator [2] https://github.com/cloudfoundry/java-buildpack/tree/5ceccb103a41c20644a64d74cae8c8f4332598c9/config Amishi Shah (amishish) wrote Hey team, ----- I'm not a ... noburou taniguchi -- View this message in context: http://cf-dev.70369.x6.nabble.com/cf-dev-Memory-settings-on-the-java-buildpack-tp3606p3702.html Sent from the CF Dev mailing list archive at Nabble.com. |
|
|
|
apps logs
Corentin Dupont <corentin.dupont@...>
Hi guys,
I would like to know if there is a log somewhere containing the number of apps in CF (result of cf apps)? Or a log of the scale up/down commands? I need to make an analysis of all the scaling up/down operations that happened on the infrastructure. Thanks a lot, Corentin -- Corentin Dupont Researcher @ Create-Netwww.corentindupont.info |
|
|
|
Re: app auto-scaling in OSS CF contribution
Darren Ratcliffe
Hi Dies,
Have your thoughts on this moved on any since you posted this. We would be really interested to see this in the OSS release Thanks Darren |
|
|
|
Application failed to stage with Error: 'No such file or directory [STG/0] ERR /usr/bin/env: ruby'
nitin padalia
Hi,
I am trying to deploy my app on cloudfoundry using a custom offline buildpack. Buildpack creation goes fine but when I push an app referring that buildpack application fails to stage at compilation step with below error: No such file or directory [STG/0] ERR /usr/bin/env: ruby Any pointer, what I am missing here? Thanks! -Nitin |
|
|
|
Re: Issue in deploying Docker images on Cloud Foundry via Diego
Daniel Mikusa
You are correct. PWS is a shared platform and so user account do not and
cannot obtain admin privileges. If you have any additional questions, please email support(a)run.pivotal.io as this forum is specifically for the open source projects around CF. On that note, if you want to play around with Docker support you might check out bosh-lite [1]. It's a way that you can deploy your own CF installation on your local machine in a VM. You can then get admin control and do whatever you want with the system. [1] - https://github.com/cloudfoundry/bosh-lite Dan On Mon, Feb 8, 2016 at 6:01 PM, Nanduni Nimalsiri <nandunibw(a)gmail.com> wrote: Thank you. |
|
|
|
Re: ERR Failed to stage application: insufficient resources
Amit Kumar Gupta
Hey Stanley,
toggle quoted message
Show quoted text
Looks like you have a zombie (Z) process with 99.9% CPU shares, which sounds like this issue: https://lists.cloudfoundry.org/archives/list/cf-dev(a)lists.cloudfoundry.org/thread/VNFKTVQN42SMDNXHA7PWP2K37JQD2I3I/#VNFKTVQN42SMDNXHA7PWP2K37JQD2I3I This is an issue in the kernel and an official stemcell with the fix is making its way through the pipelines. In the mean time, you can try the 3146.7 version of the stemcells: http://bosh.io/stemcells/bosh-aws-xen-ubuntu-trusty-go_agent But please note that version has not gone through the main CF and Diego integration test pipelines. The next officially released stemcell should have the fix for this bug and it will go through the integration test pipelines tomorrow or the day after. Best, Amit On Thu, Feb 4, 2016 at 11:52 PM, Stanley Shen <meteorping(a)gmail.com> wrote:
Hello, all |
|
|
|
Re: Auto Mysql Database Creation
Raymond J Steele
Thanks! The documentation seems to imply that this can only be done if you have a spring application. Is this true?
“Cloud Foundry provides extensive support for connecting a Spring application to services such as MySQL, PostgreSQL, MongoDB, Redis, and RabbitMQ.” http://docs.cloudfoundry.org/buildpacks/java/spring-service-bindings.html |
|
|
|
Re: Issue with crashing Windows apps on Diego
Aaron Huber
It will totally depend on the app/buildpack. For example, the static file
buildpack and PHP buildpack just launch Nginx and then host the application inside it. As soon as the web server is up it will accept connections so they would work identically to IIS HWC with just a TCP healthcheck. For others the framework would still likely start up and accept connections before the app itself is ready, and again it would be very possible that the app itself would crash the first time you actually hit it but the healthcheck would still think the container is healthy. Again, I'm not arguing that any of that is "good", just that is how the platform is expected to work with a port check and it should work consistently. I also agree that the (annoying) 30-60 second app warmup on .NET makes this even uglier. Assuming you do eventually make the port healthcheck for Windows work by checking the port, it should be made to work. My understanding right now is you do the following (high level): * Spin up the "container" via the app lifecycle (create user, set quota, create FW rules, etc.) * Start up the HWC process * Start running the healthcheck which hits the root of the app and checks for 200-299 with a 1s timeout * Add it to the router once the healthcheck passes What if you did something like this: * Spin up the container * Start up the HWC process * Hit the app once via HTTP as part of the startup to get the app going * Put in a hard coded delay like 30 seconds to give the app time to start (.NET penalty) * Start the healthcheck after the delay * Add it to the router when passing Just brainstorming. :-) Aaron -- View this message in context: http://cf-dev.70369.x6.nabble.com/Issue-with-crashing-Windows-apps-on-Diego-tp3586p3695.html Sent from the CF Dev mailing list archive at Nabble.com. |
|
|
|
Re: Issue with crashing Windows apps on Diego
Steven Benario
My understanding is that because the app droplet itself typically includes
toggle quoted message
Show quoted text
the webserver (as opposed to Windows where the server is run by the host), it would be rare for the web server to be available before the app is up and running. On Windows, it would be the common case for the web server to start accepting TCP connections almost immediately, and you could wait a long time before the app is ready. Hence the discrepancy. Thanks for understanding and weighing in. Looking forward to hearing more about how disabling the checks works in your environment -- and of course keep an eye out here for the proposal and updated timeline on the more robust checks. Cheers, Steven On Mon, Feb 8, 2016 at 4:49 PM, aaron_huber <aaron.m.huber(a)intel.com> wrote:
I understand what you're trying to avoid, I just think that is actually the |
|
|
|
Re: Issue in deploying Docker images on Cloud Foundry via Diego
Nanduni Nimalsiri
Thank you.
In that case, I am running the 60 days trial version of Pivotal.io. So I have no administrator as I suppose. Can I set my account to get admin privileges or can I set me as an admin? |
|
|
|
Re: Issue with crashing Windows apps on Diego
Aaron Huber
I understand what you're trying to avoid, I just think that is actually the
normal case for the port healthchecks. Nothing on the Linux or Docker side ever touches the app so it's entirely possible it will be added to the router without it actually working and that is what I expect the platform to do. Hopefully the more generic HTTP check can be added quickly to all the right places so that we'll at least have more sensible options. Now we just have to decide if we hang onto Iron Foundry that just uses a port check until then, or try to explain to my users that most of their apps won't work unless they turn off the healthcheck. I'm expecting most of them won't RTFM and we'll get constant complaints about how our .NET support is broken because their apps won't start up. Aaron -- View this message in context: http://cf-dev.70369.x6.nabble.com/Issue-with-crashing-Windows-apps-on-Diego-tp3586p3690.html Sent from the CF Dev mailing list archive at Nabble.com. |
|
|
|
Re: Auto Mysql Database Creation
Steele, Raymond <raymond.steele@...>
Thanks! The documentation seems to imply that this can only be done if you have a spring application. Is this true?
"Cloud Foundry provides extensive support for connecting a Spring application to services such as MySQL, PostgreSQL, MongoDB, Redis, and RabbitMQ." http://docs.cloudfoundry.org/buildpacks/java/spring-service-bindings.html |
|
|
|
Re: Auto Mysql Database Creation
Steele, Raymond <raymond.steele@...>
Thanks! The documentation seems to imply that this can only be done if you have a spring application. Is this true?
"Cloud Foundry provides extensive support for connecting a Spring application to services such as MySQL, PostgreSQL, MongoDB, Redis, and RabbitMQ." http://docs.cloudfoundry.org/buildpacks/java/spring-service-bindings.html |
|
|
|
Re: Need help for diego deployment
Amit Kumar Gupta
Hi Kinjal,
toggle quoted message
Show quoted text
Sorry for the delayed response. Are you still hitting compilation timeouts? I cannot access the gist you linked to with the debug output of your failed BOSH task. Amit On Tue, Feb 2, 2016 at 10:50 AM, Kinjal Doshi <kindoshi(a)gmail.com> wrote:
Sorry, for the typo I meant 6868 |
|
|
|
Re: - CC configuration in deployment manifest
Amit Kumar Gupta
Hi Kinjal,
toggle quoted message
Show quoted text
You are mixing the minimal deployment instructions with the "standard" deployment instructions. When using the "standard" instructions (where you create a stub), both cf1 and cf2 networks are generally expected to be private, and separate from any subnets you create for BOSH itself. In the minimal setup, I think you create a public and private subnet, I'm not sure what would happen if using the public subnet as your second cf2 subnet? You could try it, but this isn't a combination we test, so I can't make any guarantees. If you do try it, I'd be interested to hear your results. Best, Amit On Tue, Feb 2, 2016 at 12:00 PM, Kinjal Doshi <kindoshi(a)gmail.com> wrote:
Thanks a lot Dieu, that answers my question. |
|
|
|
Re: Issue with crashing Windows apps on Diego
Steven Benario
Hi Aaron,
toggle quoted message
Show quoted text
You can track the progress of the story for DiegoWindows here on the public tracker [1]. As it stands, we don't yet have a solution that we could do within the DiegoWindows codebase that wouldn't break existing applications by allowing them to return "healthy" before the app has even started up. I absolutely agree that have an inconsistent pattern between Linux and Windows is something to avoid (and something that is mis-labeled is even worse), but I can totally see how this decision was made originally, and I don't yet have any ideas for something that could fix it in the short term. I think long term, we'd like to see a general healthcheck that looks like some combination or user-selection of: - Process monitoring - Port check - HTTP check (with configuration options previously discussed) ...with some "sane" settings selected by default. For the short term, until we have a strong proposal of what to do to significantly improve the state of the world without breaking existing applications, we will probably not make any changes. Thanks, Steven Benario PM for Windows Support [1] https://www.pivotaltracker.com/story/show/112914163 On Mon, Feb 8, 2016 at 1:21 PM, aaron_huber <aaron.m.huber(a)intel.com> wrote:
Based on this discussion, where are we on the priority of switching the |
|
|