{"action":"created","issue":{"url":"https://api.github.com/repos/cf-tm-bot/diego/issues/184","repository_url":"https://api.github.com/repos/cf-tm-bot/diego","labels_url":"https://api.github.com/repos/cf-tm-bot/diego/issues/184/labels{/name}","comments_url":"https://api.github.com/repos/cf-tm-bot/diego/issues/184/comments","events_url":"https://api.github.com/repos/cf-tm-bot/diego/issues/184/events","html_url":"https://github.com/cf-tm-bot/diego/issues/184","id":177871471,"number":184,"title":"As a Diego operator, I expect the BBS and auctioneer cell clients to prefer communicating to the cells on their TLS-configurable ports if possible - Story Id: 130664747","user":{"login":"cf-tm-bot","id":20690070,"avatar_url":"https://avatars.githubusercontent.com/u/20690070?v=3","gravatar_id":"","url":"https://api.github.com/users/cf-tm-bot","html_url":"https://github.com/cf-tm-bot","followers_url":"https://api.github.com/users/cf-tm-bot/followers","following_url":"https://api.github.com/users/cf-tm-bot/following{/other_user}","gists_url":"https://api.github.com/users/cf-tm-bot/gists{/gist_id}","starred_url":"https://api.github.com/users/cf-tm-bot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cf-tm-bot/subscriptions","organizations_url":"https://api.github.com/users/cf-tm-bot/orgs","repos_url":"https://api.github.com/users/cf-tm-bot/repos","events_url":"https://api.github.com/users/cf-tm-bot/events{/privacy}","received_events_url":"https://api.github.com/users/cf-tm-bot/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/cf-tm-bot/diego/labels/feature","name":"feature","color":"ededed"},{"url":"https://api.github.com/repos/cf-tm-bot/diego/labels/finished","name":"finished","color":"172c51"},{"url":"https://api.github.com/repos/cf-tm-bot/diego/labels/secure-cell-api","name":"secure-cell-api","color":"ededed"}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":29,"created_at":"2016-09-19T19:15:30Z","updated_at":"2016-10-27T01:14:46Z","closed_at":null,"body":"As part of this, each cell will advertise the URL of its new server in a new `rep_url` field in its cell presence. This URL will use the Consul DNS domain name corresponding to that cell's ID, and the scheme will be set to HTTP or HTTPS depending on whether the rep is configured to require mutual TLS.\n\nSeparately, the cell clients in the auctioneer and BBS will change to prefer this field for communication to the cell if it is present. If they are configured to require mutual TLS, they will use the configured CA cert and client cert and key for that communication.\n\nNote: especially with the auctioneer, which has to communicate with each cell during the auction, make sure to cache TLS handshakes appropriately. See what we've done with the `tls.NewLRUClientSessionCache` on the BBS client TLS config.\n\nBOSH properties to add to rep job spec:\n\n```\n  diego.rep.advertise_domain:\n    description: \"base domain at which the rep should advertise its secure API\"\n    default: \"cell.service.cf.internal\"\n```\n\nBOSH properties to add to BBS job spec:\n\n```yaml\n  diego.bbs.rep.require_tls:\n    description: \"Whether to require TLS for communication to the securable rep API server\"\n    default: true\n\n  diego.bbs.rep.ca_cert:\n    description: \"CA cert for communication to the rep.\"\n\n  diego.bbs.rep.client_cert:\n    description: \"Client cert for communication to the rep.\"\n\n  diego.bbs.rep.client_key:\n    description: \"Client key for communication to the rep.\"\n```\n\n\nBOSH properties to add to auctioneer job spec:\n\n```yaml\n  diego.auctioneer.rep.require_tls:\n    description: \"Whether to require TLS for communication to the securable rep API server\"\n    default: true\n\n  diego.auctioneer.rep.ca_cert:\n    description: \"CA cert for communication to the rep.\"\n\n  diego.auctioneer.rep.client_cert:\n    description: \"Client cert for communication to the rep.\"\n\n  diego.auctioneer.rep.client_key:\n    description: \"Client key for communication to the rep.\"\n```\n\nCorresponding new property-overrides entries should be `property-overrides.rep.{client_cert,client_key}`.\n\n\n### Acceptance\n\n- Operator can follow documentation starting at the diego-release README to generate server-side certificates and keys with correct SAN values (domain `*.cell.service.cf.internal`) and client-side certificates and keys via a helper script (as we have for the BBS certs).\n- Operator can then supply this TLS configuration via the property-overrides stub in diego-release manifest generation.\n- If operator opts to enable TLS for the auctioneer and BBS cell clients, they must then supply non-null values for the rep CA-cert/server-cert/server-key properties in the manifest.\n- If operator opts to disable TLS, they may then supply null values for the rep CA-cert/server-cert/server-key properties in the manifest.\n- Cell presence record contains new `rep_url` field with expected `https://CELL-ID.cell.service.cf.internal:1801` value (this is the default, but scheme, domain, and port depend on rep config).\n- When BBS or auctioneer client is updated and when cell advertises new URL, client connects to that address; otherwise client falls back to connecting insecurely to `rep_address` value.\n- AWS operator can follow updated examples/aws documentation to generate new certs and to include in stubs automatically, as we do with the BBS certs.\n- Operator can follow documentation to update their existing insecure deployment via property-overrides to one using secure connections between clients and servers without downtime.\n\n---\n\nMirrors: [story 130664747](https://www.pivotaltracker.com/story/show/130664747) submitted on Sep 19, 2016 UTC\n- **Requester**: Eric Malm\n- **Owners**: Nima, Brandon Shroyer, James Myers\n- **Estimate**: 2.0"},"comment":{"url":"https://api.github.com/repos/cf-tm-bot/diego/issues/comments/256520975","html_url":"https://github.com/cf-tm-bot/diego/issues/184#issuecomment-256520975","issue_url":"https://api.github.com/repos/cf-tm-bot/diego/issues/184","id":256520975,"user":{"login":"cf-tm-bot","id":20690070,"avatar_url":"https://avatars.githubusercontent.com/u/20690070?v=3","gravatar_id":"","url":"https://api.github.com/users/cf-tm-bot","html_url":"https://github.com/cf-tm-bot","followers_url":"https://api.github.com/users/cf-tm-bot/followers","following_url":"https://api.github.com/users/cf-tm-bot/following{/other_user}","gists_url":"https://api.github.com/users/cf-tm-bot/gists{/gist_id}","starred_url":"https://api.github.com/users/cf-tm-bot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cf-tm-bot/subscriptions","organizations_url":"https://api.github.com/users/cf-tm-bot/orgs","repos_url":"https://api.github.com/users/cf-tm-bot/repos","events_url":"https://api.github.com/users/cf-tm-bot/events{/privacy}","received_events_url":"https://api.github.com/users/cf-tm-bot/received_events","type":"User","site_admin":false},"created_at":"2016-10-27T01:14:46Z","updated_at":"2016-10-27T01:14:46Z","body":"James Myers [commented](https://www.pivotaltracker.com/n/projects/1003146/stories/130664747/comments/153820327) on Oct 27, 2016, 12.30 AM UTC:\n\nCommit by James Myers\nhttps://github.com/cloudfoundry/diego-release/commit/b51ddb56ac6c0614c31a3174bc448472fa4e4a4c\n\ntemplates need certs in manifest in order to compile when tls is on\n\n[#130664747]\n\nSigned-off-by: Brandon Shroyer <*hidden mail*>\n\n<!--\nComment Id: 153820327\n-->"}}
{"actor":{"display_login":"cf-tm-bot"}}