Skip to content

Blacksmith v2.3.6

Choose a tag to compare

View all tags
@github-actions github-actions released this 11 Sep 12:57
· 40 commits to master since this release
v2.3.6
f17d951

Blacksmith BOSH Release v2.3.0

Security-focused release: bumps the Blacksmith service broker to v1.4.0 and swaps the bundled Vault binary from 1.14.10 to 1.21.4.

What's New in Blacksmith v1.4.0

Broker API library modernized (brokerapi v8 → v13) — The broker moves from the end-of-life pivotal-cf/brokerapi/v8 to the maintained code.cloudfoundry.org/brokerapi/v13. Service provisioning and binding behavior are unchanged; the one operator-visible effect is the broker's log output format (see Upgrade Notes).

Bundled Vault binary 1.14.10 → 1.21.4 — The embedded Vault server the broker uses for per-instance credential storage moves to 1.21.4, the terminal Vault 1.x Community Edition release, clearing the reachable Vault CVE set.

Go dependency and toolchain refresh — Rebuilt on Go 1.25.12 with refreshed security-sensitive dependencies (x/crypto, x/net, grpc, go-jose, circl, vault/api). The shipped broker binary scans clean for reachable vulnerabilities.

Upgrade Notes

Log format change (the one operator-visible change) — Broker-library log lines now emit standard-library structured JSON (slog) instead of Lager-format JSON. If you ship or alert on broker logs by parsing Lager fields (source, message, data), re-key those rules to the slog JSON shape before or alongside the upgrade. Provisioning, binding, and credential behavior are otherwise unchanged.

Ephemeral disk during the swap — The 1.21.4 Vault binary is larger than 1.14.10; the broker VM needs enough /var/vcap/data to extract the new package alongside the old one during the upgrade. Ensure the broker instance group has an adequately sized ephemeral disk.

No configuration changes are required, and there are no changes to service provisioning, binding, or credential formats.

Safe

  • Bumped Safe to v1.10.0

Safe

  • Bumped Safe to v1.20.0

Safe

  • Bumped Safe to v1.22.0

Safe

  • Bumped Safe to v1.23.0

Safe

  • Bumped Safe to v1.24.0

Blacksmith

  • Bumped Blacksmith to v1.4.2

Blacksmith

  • Bumped Blacksmith to v1.4.3, which lets the broker trust a private CA when it talks to the Cloud Foundry API.
  • Added broker.cf.ca_cert and broker.cf.skip_ssl_validation. They are rendered into every broker.cf.apis entry as cacert and skip_ssl_validation, and an entry may set its own ca_cert or skip_ssl_validation to override them.
  • Removed bosh.skip_ssl_validation. The broker's BOSH client never read it, so a director with a private CA has always needed bosh.ca_cert.

Blacksmith

  • Bumped Blacksmith to v1.4.4, which fixes the deprovision-during-provision race: a deprovision is now rejected with a concurrency error while the instance's provision task is still running, only a director 404 counts as a missing deployment (an in-flight first deploy with an empty manifest no longer does), and the reconciler reports deployments that have neither an index entry nor a CF instance instead of adopting them, while sweeping index entries whose deployment the director confirms gone.

Deployment

releases:
- name:    blacksmith
  version: 2.3.6
  url:     https://github.com/blacksmith-community/blacksmith-boshrelease/releases/download/v2.3.6/blacksmith-2.3.6.tgz
  sha1:    sha256:efc8f86b35017d7801f940b49deb69bb3ed0b356a5d626c4d14d68ac567b4d41
Assets 4
Loading