Date   
Re: Security feed not updating

Emily Foster <efoster@...>
 

Hi Lee,

I'm forwarding your message along to the Pivotal security team to take a look.

Thanks,
Emily

On Tue, Jul 2, 2019 at 12:05 AM Lee Porte via Lists.Cloudfoundry.Org <lee.porte=digital.cabinet-office.gov.uk@...> wrote:
I've seen them on there too, but that's a bit more awkward to put automated monitoring in for.

On Tue, 2 Jul 2019 at 07:28, Dr Nic Williams <drnicwilliams@...> wrote:
Someone else may have a more comprehensive answer, but I’ve seen the CVEs announced on the #security channel on CF slack.

Nic

 

From: cf-dev@... on behalf of Lee Porte via Lists.Cloudfoundry.Org <lee.porte=digital.cabinet-office.gov.uk@...>
Sent: Monday, July 1, 2019 10:50 pm
To: Discussions about Cloud Foundry projects and the system overall.
Subject: [cf-dev] Security feed not updating
 
Hi,

Has anyone else noticed that https://www.cloudfoundry.org/foundryblog/security-advisory/feed/ is not being updated with new security issues? 

Has it moved? I've not spotted anything via the blog site to indicate either way. We use automated monitoring of this feed to alert us of potential CVEs we need to look at specifically on the platform.

Thanks

Lee

--
Lee Porte
Reliability Engineer 
GOV.UK PaaS Team
07785 449292



--
Lee Porte
Reliability Engineer 
GOV.UK PaaS Team
07785 449292

IMPORTANT NOTICE: [go-buildpack] End of support for Go versions 1.11.x after 2019-08-10

Elliott Shanks
 

The first release of the Go buildpack after August 10, 2019 will no longer include Go versions 1.11.x These Go versions will no longer be supported upstream. Please migrate your Go apps to supported versions of Go before that time.


Note: Unless you are manually specifying a version of Go for the buildpack to use, or you have customized your Go buildpack, no action is required.


Thanks,

Elliott Shanks, CF Buildpacks PM


IMPORTANT NOTICE: [php-buildpack] End of support for nginx versions 1.15.x after 2019-08-10

Elliott Shanks
 

The first release of the PHP buildpack after August 10, 2019 will no longer include nginx versions 1.15.x. These nginx versions are no longer supported upstream. Please migrate your PHP apps to supported versions of nginx before that time.


In addition, the default version of nginx will be bumped to 1.17.x at this time.


Note: Unless you are manually specifying a version of nginx for the buildpack to use, or you have customized your PHP buildpack, no action is required.


Thanks,

Elliott Shanks, CF Buildpacks PM


IMPORTANT NOTICE: [staticfile-buildpack] End of support for nginx versions 1.15.x after 2019-08-10

Elliott Shanks
 

The first release of the staticfile buildpack after August 10, 2019 will no longer include nginx versions 1.15.x. These nginx versions are no longer supported upstream. Please migrate your staticfile apps to supported versions of nginx before that time.


In addition, the default version of nginx will be bumped to 1.17.x at this time.


Note: Unless you are manually specifying a version of nginx for the buildpack to use, or you have customized your staticfile buildpack, no action is required.


Thanks,

Elliott Shanks, CF Buildpacks PM


IMPORTANT NOTICE: [r-buildpack] End of support for R versions 3.4.x and 3.5.x after 2019-08-10

Elliott Shanks
 

The first release of the R buildpack after August 10, 2019 will no longer include R versions 3.4.x and 3.5.x. These R versions are no longer supported upstream. Please migrate your R apps to supported versions of R before that time.


Note: Unless you are manually specifying a version of R for the buildpack to use, or you have customized your R buildpack, no action is required.


Thanks,

Elliott Shanks, CF Buildpacks PM

IMPORTANT NOTICE: [dotnet-core-buildpack] End of support for dotnet-runtime versions 1.0.x and 1.1.x after 2019-08-10

Elliott Shanks
 

The first release of the .NET Core buildpack after August 10, 2019 will no longer include dotnet-runtime versions 1.0.x and 1.1.x. These dotnet-runtime versions are no longer supported upstream. Please migrate your .NET Core apps to supported versions of dotnet-runtime before that time.


Note: Unless you are manually specifying a version of dotnet-runtime for the buildpack to use, or you have customized your .NET Core buildpack, no action is required.


Thanks,

Elliott Shanks, CF Buildpacks PM

REMINDER: CAB call for July is next week Wednesday 17th @ 8a Pacific

Michael Maximilien
 

Hi, all,
 
Reminder that the CAB call [0] for July 2019 is next Wednesday 17th @ 8a Pacific.
 
We will have regular highlights, QAs, as well as two planned talks:
 
1. External DNS Connector for Cloud Foundry [1] by David Grizzanti of Comcast
2. Stratos UI Update - now with Kubernetes support [2] by Neil MacDougall of SUSE
 
Please note that talk 1 was in previous agenda but had to be postponed.
 
All other info in agenda [0]. Zoom soon. Best,
 
[2] https://github.com/cloudfoundry-incubator/stratos-ui

CF CLI v6.46.0 Released

Alexander Berezovsky
 

Hey everyone,

The CF CLI team released cf CLI v6.46.0 ; please see release notes for full details.

Highlights Include


Service Instance Upgrade feature

Service authors that have built services using the On-Demand Broker want to allow Service Instances to be upgraded individually after a new version of their Service Broker has been deployed.

Now cf services will inform users that an upgrade is available; running cf service <name> provides additional details. To upgrade a service instance, run cf update-service <name> --upgrade. This flag is in experimental stage and may change without notice.

Users must be on CC API v2.135 to use this feature.

For questions, regarding this feature please reach out to #SAPI on Slack Cloud Foundry. Thank you, SAPI team (Aarti Kriplani, Alex Blease, George Blue, Georgi Lozev, Henry Stanley, Nikolay Maslarski, Will Martin) who all worked on this feature.

Bugs

  • Fixes cf push remove spin lock in PollStart(). This reduces the CPU time when waiting for apps to start. Also affects cf startcf restart and cf restage story
  • Fixes a documentation url in output story
  • Fixes an issue whereby if you are logged in as a client, the user name was not printed in the output story
  • Targeting a space for cf copy-source is no longer case sensitive story
  • Retry plugin uninstall attempt for windows story

Plugin Updates

  • Updated Log Stream to v0.4.0 story
  • Updated cf-puppeteer to v1.0.0 story

Release Contributors: Brendan Smith, Abby Chau, Andrew Crump, Alexander Berezovsky, Steve Taylor, Simon Seif, SAPI team (Aarti Kriplani, Alex Blease, George Blue, Georgi Lozev, Henry Stanley, Nikolay Maslarski, Will Martin)

Note: The minimum version of the CC API this CF CLI release is compatible with is CC API v2.100.0 (3.35). See our minimum supported version policy for more information.


Thanks,
CF CLI Team

Request for Feedback - Advanced Deployment Strategies support in CAPI

Scott Sisil
 

Hi CF Community,

The CAPI team has been working on a proposal for supporting more advanced deployment strategies in Cloud Foundry. We are looking for feedback from the Cloud Foundry Community on what we have proposed so far.

You can find the proposal here.

Looking forward to hearing from you.

Thanks

Scott Sisil 
CAPI PM 


Re: Security feed not updating

Guillaume Berche
 

Thanks Caitlyn for the fix! This is much appreciated.

Best regards,

Guillaume.


On Tue, Jul 9, 2019 at 9:10 AM Lee Porte via Lists.Cloudfoundry.Org <lee.porte=digital.cabinet-office.gov.uk@...> wrote:
Hi Caitlyn,

I can confirm that all is working at this end.

Thanks for resolving

Lee

On Mon, 8 Jul 2019 at 19:24, Caitlyn O'Connell <coconnell@...> wrote:
Hi folks,

Everything should be in working order now. Check out the link now (https://www.cloudfoundry.org/foundryblog/security-advisory/feed/). Note that you may need to click Shift + Reload to properly refresh the page.

Thanks again for flagging. This is a valuable resource for our community so we want to make sure it's in working order!

Thanks,
Caitlyn

On Mon, Jul 8, 2019 at 11:29 AM Caitlyn O'Connell via Lists.Cloudfoundry.Org <coconnell=cloudfoundry.org@...> wrote:
Hey folks,

Apologies for the delay on this -- I was on vacation. I'm consulting with our web team now to find out what happened to the RSS feed. Thanks for alerting us to this issue! Stay tuned for an update.

Many thanks,
Caitlyn

On Mon, Jul 8, 2019 at 4:30 AM Guillaume Berche <bercheg@...> wrote:
I was also relying on the CFF rss feed, and observed it is now returning an empty stream.

Copying the CFF content team and Dan Janhner from CFF security team in case this email thread got unnoticed and a recent wordpress update/config change broke the CSS feed.

Thanks in advance to them for their help,

Guillaume.


On Tue, Jul 2, 2019 at 9:05 AM Lee Porte via Lists.Cloudfoundry.Org <lee.porte=digital.cabinet-office.gov.uk@...> wrote:
I've seen them on there too, but that's a bit more awkward to put automated monitoring in for.

On Tue, 2 Jul 2019 at 07:28, Dr Nic Williams <drnicwilliams@...> wrote:
Someone else may have a more comprehensive answer, but I’ve seen the CVEs announced on the #security channel on CF slack.

Nic

 

From: cf-dev@... on behalf of Lee Porte via Lists.Cloudfoundry.Org <lee.porte=digital.cabinet-office.gov.uk@...>
Sent: Monday, July 1, 2019 10:50 pm
To: Discussions about Cloud Foundry projects and the system overall.
Subject: [cf-dev] Security feed not updating
 
Hi,

Has anyone else noticed that https://www.cloudfoundry.org/foundryblog/security-advisory/feed/ is not being updated with new security issues? 

Has it moved? I've not spotted anything via the blog site to indicate either way. We use automated monitoring of this feed to alert us of potential CVEs we need to look at specifically on the platform.

Thanks

Lee

--
Lee Porte
Reliability Engineer 
GOV.UK PaaS Team
07785 449292



--
Lee Porte
Reliability Engineer 
GOV.UK PaaS Team
07785 449292



--
Caitlyn O'Connell
Senior Marketing Manager
Pronouns: She/Her
Time Zone: Eastern Time

Register for Cloud Foundry EU Summit! September 11-12 in the Hague, Netherlands.



--
Caitlyn O'Connell
Senior Marketing Manager
Pronouns: She/Her
Time Zone: Eastern Time

Register for Cloud Foundry EU Summit! September 11-12 in the Hague, Netherlands.



--
Lee Porte
Reliability Engineer 
GOV.UK PaaS Team
07785 449292
‪020 3920 6036‬

Re: Security feed not updating

Lee Porte
 

Hi Caitlyn,

I can confirm that all is working at this end.

Thanks for resolving

Lee

On Mon, 8 Jul 2019 at 19:24, Caitlyn O'Connell <coconnell@...> wrote:
Hi folks,

Everything should be in working order now. Check out the link now (https://www.cloudfoundry.org/foundryblog/security-advisory/feed/). Note that you may need to click Shift + Reload to properly refresh the page.

Thanks again for flagging. This is a valuable resource for our community so we want to make sure it's in working order!

Thanks,
Caitlyn

On Mon, Jul 8, 2019 at 11:29 AM Caitlyn O'Connell via Lists.Cloudfoundry.Org <coconnell=cloudfoundry.org@...> wrote:
Hey folks,

Apologies for the delay on this -- I was on vacation. I'm consulting with our web team now to find out what happened to the RSS feed. Thanks for alerting us to this issue! Stay tuned for an update.

Many thanks,
Caitlyn

On Mon, Jul 8, 2019 at 4:30 AM Guillaume Berche <bercheg@...> wrote:
I was also relying on the CFF rss feed, and observed it is now returning an empty stream.

Copying the CFF content team and Dan Janhner from CFF security team in case this email thread got unnoticed and a recent wordpress update/config change broke the CSS feed.

Thanks in advance to them for their help,

Guillaume.


On Tue, Jul 2, 2019 at 9:05 AM Lee Porte via Lists.Cloudfoundry.Org <lee.porte=digital.cabinet-office.gov.uk@...> wrote:
I've seen them on there too, but that's a bit more awkward to put automated monitoring in for.

On Tue, 2 Jul 2019 at 07:28, Dr Nic Williams <drnicwilliams@...> wrote:
Someone else may have a more comprehensive answer, but I’ve seen the CVEs announced on the #security channel on CF slack.

Nic

 

From: cf-dev@... on behalf of Lee Porte via Lists.Cloudfoundry.Org <lee.porte=digital.cabinet-office.gov.uk@...>
Sent: Monday, July 1, 2019 10:50 pm
To: Discussions about Cloud Foundry projects and the system overall.
Subject: [cf-dev] Security feed not updating
 
Hi,

Has anyone else noticed that https://www.cloudfoundry.org/foundryblog/security-advisory/feed/ is not being updated with new security issues? 

Has it moved? I've not spotted anything via the blog site to indicate either way. We use automated monitoring of this feed to alert us of potential CVEs we need to look at specifically on the platform.

Thanks

Lee

--
Lee Porte
Reliability Engineer 
GOV.UK PaaS Team
07785 449292



--
Lee Porte
Reliability Engineer 
GOV.UK PaaS Team
07785 449292



--
Caitlyn O'Connell
Senior Marketing Manager
Pronouns: She/Her
Time Zone: Eastern Time

Register for Cloud Foundry EU Summit! September 11-12 in the Hague, Netherlands.



--
Caitlyn O'Connell
Senior Marketing Manager
Pronouns: She/Her
Time Zone: Eastern Time

Register for Cloud Foundry EU Summit! September 11-12 in the Hague, Netherlands.



--
Lee Porte
Reliability Engineer 
GOV.UK PaaS Team
07785 449292
‪020 3920 6036‬

Using X.509 certificates as a mechanism for OAuth client authentication #uaa

brian.sung@...
 

I do not think UAA currently supports the draft-ietf-oauth-mtls-04 to use a TLS client certificate instead of using client-id/client-secret to authenticate the OAuth client.

Is this or something similar on UAA's future roadmap? 

 

Re: Security feed not updating

Caitlyn O'Connell
 

Hi folks,

Everything should be in working order now. Check out the link now (https://www.cloudfoundry.org/foundryblog/security-advisory/feed/). Note that you may need to click Shift + Reload to properly refresh the page.

Thanks again for flagging. This is a valuable resource for our community so we want to make sure it's in working order!

Thanks,
Caitlyn

On Mon, Jul 8, 2019 at 11:29 AM Caitlyn O'Connell via Lists.Cloudfoundry.Org <coconnell=cloudfoundry.org@...> wrote:
Hey folks,

Apologies for the delay on this -- I was on vacation. I'm consulting with our web team now to find out what happened to the RSS feed. Thanks for alerting us to this issue! Stay tuned for an update.

Many thanks,
Caitlyn

On Mon, Jul 8, 2019 at 4:30 AM Guillaume Berche <bercheg@...> wrote:
I was also relying on the CFF rss feed, and observed it is now returning an empty stream.

Copying the CFF content team and Dan Janhner from CFF security team in case this email thread got unnoticed and a recent wordpress update/config change broke the CSS feed.

Thanks in advance to them for their help,

Guillaume.


On Tue, Jul 2, 2019 at 9:05 AM Lee Porte via Lists.Cloudfoundry.Org <lee.porte=digital.cabinet-office.gov.uk@...> wrote:
I've seen them on there too, but that's a bit more awkward to put automated monitoring in for.

On Tue, 2 Jul 2019 at 07:28, Dr Nic Williams <drnicwilliams@...> wrote:
Someone else may have a more comprehensive answer, but I’ve seen the CVEs announced on the #security channel on CF slack.

Nic

 

From: cf-dev@... on behalf of Lee Porte via Lists.Cloudfoundry.Org <lee.porte=digital.cabinet-office.gov.uk@...>
Sent: Monday, July 1, 2019 10:50 pm
To: Discussions about Cloud Foundry projects and the system overall.
Subject: [cf-dev] Security feed not updating
 
Hi,

Has anyone else noticed that https://www.cloudfoundry.org/foundryblog/security-advisory/feed/ is not being updated with new security issues? 

Has it moved? I've not spotted anything via the blog site to indicate either way. We use automated monitoring of this feed to alert us of potential CVEs we need to look at specifically on the platform.

Thanks

Lee

--
Lee Porte
Reliability Engineer 
GOV.UK PaaS Team
07785 449292



--
Lee Porte
Reliability Engineer 
GOV.UK PaaS Team
07785 449292



--
Caitlyn O'Connell
Senior Marketing Manager
Pronouns: She/Her
Time Zone: Eastern Time

Register for Cloud Foundry EU Summit! September 11-12 in the Hague, Netherlands.



--
Caitlyn O'Connell
Senior Marketing Manager
Pronouns: She/Her
Time Zone: Eastern Time

Register for Cloud Foundry EU Summit! September 11-12 in the Hague, Netherlands.

Re: Security feed not updating

Caitlyn O'Connell
 

Hey folks,

Apologies for the delay on this -- I was on vacation. I'm consulting with our web team now to find out what happened to the RSS feed. Thanks for alerting us to this issue! Stay tuned for an update.

Many thanks,
Caitlyn

On Mon, Jul 8, 2019 at 4:30 AM Guillaume Berche <bercheg@...> wrote:
I was also relying on the CFF rss feed, and observed it is now returning an empty stream.

Copying the CFF content team and Dan Janhner from CFF security team in case this email thread got unnoticed and a recent wordpress update/config change broke the CSS feed.

Thanks in advance to them for their help,

Guillaume.


On Tue, Jul 2, 2019 at 9:05 AM Lee Porte via Lists.Cloudfoundry.Org <lee.porte=digital.cabinet-office.gov.uk@...> wrote:
I've seen them on there too, but that's a bit more awkward to put automated monitoring in for.

On Tue, 2 Jul 2019 at 07:28, Dr Nic Williams <drnicwilliams@...> wrote:
Someone else may have a more comprehensive answer, but I’ve seen the CVEs announced on the #security channel on CF slack.

Nic

 

From: cf-dev@... on behalf of Lee Porte via Lists.Cloudfoundry.Org <lee.porte=digital.cabinet-office.gov.uk@...>
Sent: Monday, July 1, 2019 10:50 pm
To: Discussions about Cloud Foundry projects and the system overall.
Subject: [cf-dev] Security feed not updating
 
Hi,

Has anyone else noticed that https://www.cloudfoundry.org/foundryblog/security-advisory/feed/ is not being updated with new security issues? 

Has it moved? I've not spotted anything via the blog site to indicate either way. We use automated monitoring of this feed to alert us of potential CVEs we need to look at specifically on the platform.

Thanks

Lee

--
Lee Porte
Reliability Engineer 
GOV.UK PaaS Team
07785 449292



--
Lee Porte
Reliability Engineer 
GOV.UK PaaS Team
07785 449292



--
Caitlyn O'Connell
Senior Marketing Manager
Pronouns: She/Her
Time Zone: Eastern Time

Register for Cloud Foundry EU Summit! September 11-12 in the Hague, Netherlands.

Re: Security feed not updating

Guillaume Berche
 

I was also relying on the CFF rss feed, and observed it is now returning an empty stream.

Copying the CFF content team and Dan Janhner from CFF security team in case this email thread got unnoticed and a recent wordpress update/config change broke the CSS feed.

Thanks in advance to them for their help,

Guillaume.


On Tue, Jul 2, 2019 at 9:05 AM Lee Porte via Lists.Cloudfoundry.Org <lee.porte=digital.cabinet-office.gov.uk@...> wrote:
I've seen them on there too, but that's a bit more awkward to put automated monitoring in for.

On Tue, 2 Jul 2019 at 07:28, Dr Nic Williams <drnicwilliams@...> wrote:
Someone else may have a more comprehensive answer, but I’ve seen the CVEs announced on the #security channel on CF slack.

Nic

 

From: cf-dev@... on behalf of Lee Porte via Lists.Cloudfoundry.Org <lee.porte=digital.cabinet-office.gov.uk@...>
Sent: Monday, July 1, 2019 10:50 pm
To: Discussions about Cloud Foundry projects and the system overall.
Subject: [cf-dev] Security feed not updating
 
Hi,

Has anyone else noticed that https://www.cloudfoundry.org/foundryblog/security-advisory/feed/ is not being updated with new security issues? 

Has it moved? I've not spotted anything via the blog site to indicate either way. We use automated monitoring of this feed to alert us of potential CVEs we need to look at specifically on the platform.

Thanks

Lee

--
Lee Porte
Reliability Engineer 
GOV.UK PaaS Team
07785 449292



--
Lee Porte
Reliability Engineer 
GOV.UK PaaS Team
07785 449292

Discontinuation of the Bits-Service

Peter Goetz <peter.gtz@...>
 

Hello CF community,


The Bits-Service team has decided to discontinue the development of the Bits-Service.


The reasons for this are many-fold, but can be summarized by a major push towards container standards like Kubernetes in recent years. With this, we are seeing a shift from packages and buildpacks producing droplets, to new Cloud Native Buildpacks producing OCI images. The CF Buildpacks team is actively investigating options for integrating Cloud Native Buildpacks into Cloud Foundry to provide a next-generation build experience. We hope to have more information available about this shortly. 


Furthermore, there is currently no plan to implement direct communication between Bits-Service and the cf CLI. Without this direct communication, there is not much benefit in having the Bits-Service.


What do you need to do?

  • If you have never used the cf-deployment/operations/bits-service/use-bits-service.yml, there is nothing to do.

  • If you are using cf-deployment/operations/bits-service/use-bits-service.yml or any other file in that folder, we recommend you remove these operations from your deployment. Since the Bits-Service uses the same blobstore as Cloud Controller, the deactivation should be seamless.

Eirini OCI Image Registry

The Bits-Service currently still serves as an OCI image registry for Eirini, and for that reason, we will provide some basic maintenance support until Eirini has also migrated away from Bits-Service. For the time being, we’re happy to merge PRs and make releases where it is necessary to support Eirini.


If there is anyone in the community with an interest to continue active development of the Bits-Service, we’ll be happy to transfer ownership.


Thank you,

Peter Goetz, Bits-Service PM

Elliott Shanks, CF Buildpacks PM


Re: Security feed not updating

Lee Porte
 

I've seen them on there too, but that's a bit more awkward to put automated monitoring in for.


On Tue, 2 Jul 2019 at 07:28, Dr Nic Williams <drnicwilliams@...> wrote:
Someone else may have a more comprehensive answer, but I’ve seen the CVEs announced on the #security channel on CF slack.

Nic

 

From: cf-dev@... on behalf of Lee Porte via Lists.Cloudfoundry.Org <lee.porte=digital.cabinet-office.gov.uk@...>
Sent: Monday, July 1, 2019 10:50 pm
To: Discussions about Cloud Foundry projects and the system overall.
Subject: [cf-dev] Security feed not updating
 
Hi,

Has anyone else noticed that https://www.cloudfoundry.org/foundryblog/security-advisory/feed/ is not being updated with new security issues? 

Has it moved? I've not spotted anything via the blog site to indicate either way. We use automated monitoring of this feed to alert us of potential CVEs we need to look at specifically on the platform.

Thanks

Lee

--
Lee Porte
Reliability Engineer 
GOV.UK PaaS Team
07785 449292



--
Lee Porte
Reliability Engineer 
GOV.UK PaaS Team
07785 449292

Re: Security feed not updating

Dr Nic Williams
 

Someone else may have a more comprehensive answer, but I’ve seen the CVEs announced on the #security channel on CF slack.

Nic

 


From: cf-dev@... on behalf of Lee Porte via Lists.Cloudfoundry.Org <lee.porte=digital.cabinet-office.gov.uk@...>
Sent: Monday, July 1, 2019 10:50 pm
To: Discussions about Cloud Foundry projects and the system overall.
Subject: [cf-dev] Security feed not updating
 
Hi,

Has anyone else noticed that https://www.cloudfoundry.org/foundryblog/security-advisory/feed/ is not being updated with new security issues? 

Has it moved? I've not spotted anything via the blog site to indicate either way. We use automated monitoring of this feed to alert us of potential CVEs we need to look at specifically on the platform.

Thanks

Lee

--
Lee Porte
Reliability Engineer 
GOV.UK PaaS Team
07785 449292

Security feed not updating

Lee Porte
 

Hi,

Has anyone else noticed that https://www.cloudfoundry.org/foundryblog/security-advisory/feed/ is not being updated with new security issues? 

Has it moved? I've not spotted anything via the blog site to indicate either way. We use automated monitoring of this feed to alert us of potential CVEs we need to look at specifically on the platform.

Thanks

Lee

--
Lee Porte
Reliability Engineer 
GOV.UK PaaS Team
07785 449292

Re: Update from cf-networking

Shannon Coen
 

Hi Dan,

The scaling issues are primarily related to CF's use of Istio. 

Currently every Envoy sidecar in the platform receives configuration for all internal routes, regardless of whether there are C2C policies in place that enable apps to connect to one another directly via the overlay network. The sidecars memory utilization increases with the config it holds in memory, and this resource is constrained by a quota for the application container. With default configuration for container memory quota, at around 300 total internal routes all sidecars run out of memory and crash. We can be smarter about the configuration each sidecar receives. We are exploring options, including configuring the sidecars for a given app with routing configuration only for destinations for which a C2C security policy has been created. This would shift the scaling limit to 300 policies per app, which seems more than enough.

Looking further forward, as we explore networking investments in K8s as the orchestrator for CFAR (Eirini), we could explore leveraging pods to give the sidecar and apps independent resource limits. 

Best,
 
Shannon Coen
Product Lead, PCF Networking
Pivotal, Inc.


On Thu, Jun 27, 2019 at 8:50 AM Daniel Jones <daniel.jones@...> wrote:
Awesome, thanks!

Are the scaling issues intrinsic to Istio, or is it CF's use of Istio that's causing the scaling problem?

I'm just curious as to whether we can use this information to infer that no-one is using Istio beyond this scale, or perhaps they are, but they're using it differently.

Regards,
Daniel 'Deejay' Jones - CTO
+44 (0)79 8000 9153
EngineerBetter Ltd - More than cloud platform specialists


On Thu, 27 Jun 2019 at 03:27, Shannon Coen <scoen@...> wrote:
Thanks to Dan from Engineer Better for prompting this update. We (the CF-Networking team) haven't reached out in a while. 

Last October we shared that with our integration between and CF and Istio Pilot, we were able to offer weighted routing via a new Envoy-base ingress gateway and Cloud Controller APIs or a CLI plugin, enabling developers to have more control in shifting traffic from one version of their application to another. That thread is here: https://lists.cloudfoundry.org/g/cf-dev/message/8328

Since then we've been working on extending our integrations to the application-to-application data plane. Our target milestones are enabling developers to rely on the platform for client-side load balancing, timeouts, retries, and mTLS between applications over the C2C overlay network. These features will remove additional toil from developers for having to implement these behaviors, increasing productivity, and give platform operators and security teams confidence that intra-application traffic is secured in a consistent way.

We already support routing of traffic from apps to internal routes through the sidecars and have default policies set for load balancing, timeouts and retries. But this only works at a relatively low scale; 300 total internal routes. Scaling past this will likely require enhancing our integration with Istio to uniquely configure the sidecars for each application based on c2c security policies. 

We've successful spiked out having the consumer and provider sidecars negotiate mTLS, but we've set that down while we work on the scaling problem above. On this topic we want some feedback from the community on a rollout strategy. Look for a follow up email coming soon.

All this work has been happening in istio-release (https://github.com/cloudfoundry/istio-release), which you can deploy with BOSH alongside cf-deployment using an ops file. Documentation can be found on the README. Warning: our integration with Istio is not yet ready for production use cases. In addition to scaling concerns, the control plane is not yet HA nor is it sufficiently instrumented for monitoring. 

In parallel with the Networking team's efforts, other CF teams are doing great work toward the same vision:
  • A collaboration between CAPI and CLI teams, responsible for completing the v3 CC API and delivering the v7 CLI, have been working on the APIs and CLI commands to support declarative configuration of routing rules, starting with percentage-based traffic splitting for external routes. 
  • One engineer from the Windows team has been laboring to contribute Windows support to the Envoy Proxy OSS project, which will enable developers of .NET apps to achieve all the same outcomes planned for Linux apps, plus any outcomes delivered with service mesh in the future. Once the sidecars are in place, the operating system is abstracted. 
We'd love help with all of this. If you'd like to contribute please reply here or reach out to us in #networking.

At CF Summit in Philadelphia earlier this year, I gave a presentation at User Day sharing our journey from routing to service mesh in CF, with the ever present goal of delivering business outcomes for platform operators and the development teams they serve. I've attached the slides. I plan to attend CF Summit EU in The Hague in September, and SpringOne Platform in Austin October; reach out if you'd like to meet up. 

Best,

Shannon Coen
Product Lead, PCF Networking
Pivotal, Inc.