app-autoscaler.yml

---
name: ((deployment_name))

releases:
- name: app-autoscaler
  version: latest
- name: postgres
  version: latest
- name: bosh-dns-aliases
  version: latest
- name: routing
  version: latest
- name: loggregator-agent
  version: latest
- name: bpm
  version: latest

domains:
  postgres: &postgres_domain ((deployment_name)).autoscalerpostgres.service.cf.internal
  api: &api_domain ((deployment_name)).apiserver.service.cf.internal
  scheduler: &scheduler_domain ((deployment_name)).autoscalerscheduler.service.cf.internal
  servicebroker: &servicebroker_domain ((deployment_name)).servicebroker.service.cf.internal
  eventgenerator: &eventgenerator_domain ((deployment_name)).eventgenerator.service.cf.internal
  scalingengine: &scalingengine_domain ((deployment_name)).scalingengine.service.cf.internal

public_domains:
  metricsforwarder: &metricsforwarder_public_domain ((deployment_name))metrics.((system_domain))
  metricsforwarder_mtls: &metricsforwarder_mtls_public_domain ((deployment_name))-metricsforwarder-mtls.((system_domain))
  servicebroker: &servicebroker_public_domain ((deployment_name))servicebroker.((system_domain))

features:
  use_dns_addresses: true

addons:
- name: bosh-dns-aliases
  jobs:
  - name: bosh-dns-aliases
    release: bosh-dns-aliases
    properties:
      aliases:
      - domain: *postgres_domain
        targets:
          - query: '*'
            instance_group: postgres
            deployment: ((deployment_name))
            network: default
            domain: bosh
      - domain: *api_domain
        targets:
          - query: '*'
            instance_group: apiserver
            deployment: ((deployment_name))
            network: default
            domain: bosh
      - domain: *scheduler_domain
        targets:
          - query: '*'
            instance_group: scheduler
            deployment: ((deployment_name))
            network: default
            domain: bosh
      - domain: *servicebroker_domain
        targets:
          - query: '*'
            instance_group: apiserver
            deployment: ((deployment_name))
            network: default
            domain: bosh
      - domain: *eventgenerator_domain
        targets:
          - query: '*'
            instance_group: eventgenerator
            deployment: ((deployment_name))
            network: default
            domain: bosh
      - domain: *scalingengine_domain
        targets:
          - query: '*'
            instance_group: scalingengine
            deployment: ((deployment_name))
            network: default
            domain: bosh
      # Cf internal names
      - domain: nats.service.cf.internal
        targets:
          - deployment: cf
            domain: bosh
            instance_group: nats
            network: default
            query: '*'
      - domain: reverse-log-proxy.service.cf.internal
        targets:
          - query: '*'
            instance_group: log-api
            deployment: cf
            network: default
            domain: bosh
      - domain: _.nats.service.cf.internal
        targets:
          - deployment: cf
            domain: bosh
            instance_group: nats
            network: default
            query: _
      - domain: logcache
        targets:
          - deployment: cf
            domain: bosh
            instance_group: log-cache
            network: default
            query: '*'
      - domain: log-cache.service.cf.internal
        targets:
          - deployment: cf
            domain: bosh
            instance_group: log-cache
            network: default
            query: '*'
- name: bpm
  jobs:
    - name: bpm
      release: bpm

### Stemcells ###
stemcells:
- alias: default
  os: ubuntu-jammy
  version: latest

instance_groups:
# Postgres Instance Group
- name: postgres
  azs:
    - z1
  instances: 1
  update:
    serial: true
  stemcell: default
  vm_type: small
  networks:
    - name: default
  jobs:
    - name: postgres
      release: postgres
      properties:
        databases: &database
          sslmode: verify-full
          tls: &db_tls
            ca: ((postgres_ca.ca))
            certificate: ((postgres_server.certificate))
            private_key: ((postgres_server.private_key))
          databases:
            - name: autoscaler
              tag: default
          db_scheme: postgres
          address: *postgres_domain
          port: 5432
          roles:
            - name: postgres
              password: "((database_password))"
              tag: default
          connection_config: &databaseConnectionConfig
            max_open_connections: 100
            max_idle_connections: 10
            connection_max_lifetime: 60s

# Scalingengine Instance Group
- name: scalingengine
  azs:
    - z1
  instances: 1
  vm_type: minimal
  stemcell: default
  networks:
    - name: default
  jobs:
    - name: scalingengine
      release: app-autoscaler
      properties:
        autoscaler:
          scalingengine_db: *database
          scalingengine_db_connection_config: *databaseConnectionConfig
          scheduler_db: *database
          scheduler_db_connection_config: *databaseConnectionConfig
          policy_db: *database
          policy_db_connection_config: *databaseConnectionConfig
          cf: &cf_credentials
            api: "https://api.((system_domain))"
            grant_type: client_credentials
            client_id: "((cf_client_id))"
            secret: "((cf_client_secret))"
            skip_ssl_validation: "((skip_ssl_validation))"
          scalingengine:
            health:
              port: &scalingEngineHealthPort 6204
              username: scalingengine
              password: ((autoscaler_scalingengine_health_password))
            logging:
              level: info
            ca_cert: ((app_autoscaler_ca_cert.ca))
            server_cert: ((scalingengine_server_cert.certificate))
            server_key: ((scalingengine_server_cert.private_key))
    - name: route_registrar
      release: routing
      consumes:
        nats: { from: nats, deployment: cf }
      properties:
        route_registrar:
          routes:
            - name: autoscaler_scalingengine_health
              registration_interval: 20s
              port: *scalingEngineHealthPort
              tags:
                component: autoscaler_scalingengine_health
              uris:
                - ((deployment_name))-scalingengine.((system_domain))

  # APIServer Instance Group
- name: apiserver
  azs:
   - z1
  instances: 1
  vm_type: minimal
  stemcell: default
  networks:
  - name: default
  jobs:
  - name: golangapiserver
    release: app-autoscaler
    properties:
      autoscaler:
        apiserver:
          public_api:
            server:
              port: &publicApiServerPort 6101
          use_buildin_mode: false
          scheduler:
            ca_cert: ((!scheduler_client_cert.ca))
            client_cert: ((!scheduler_client_cert.certificate))
            client_key: ((!scheduler_client_cert.private_key))
            host: *scheduler_domain
          scaling_engine:
            ca_cert: ((!scalingengine_client_cert.ca))
            client_cert: ((!scalingengine_client_cert.certificate))
            client_key: ((!scalingengine_client_cert.private_key))
            host: *scalingengine_domain
          event_generator:
            ca_cert: ((!eventgenerator_client_cert.ca))
            client_cert: ((!eventgenerator_client_cert.certificate))
            client_key: ((!eventgenerator_client_cert.private_key))
            host: *eventgenerator_domain
          metrics_forwarder:
            host: *metricsforwarder_public_domain
            mtls_host: *metricsforwarder_mtls_public_domain
          broker:
            broker_credentials:
              - broker_username: 'autoscaler-broker-user'
                broker_password: ((!service_broker_password))
              - broker_username: 'autoscaler-broker-user-blue'
                broker_password: ((!service_broker_password_blue))
            server:
              port: &brokerServerPort 6102
              catalog:
                services:
                - id: autoscaler-guid
                  name: ((deployment_name))
                  description: Automatically increase or decrease the number of application instances based on a policy you define.
                  bindable: true
                  instances_retrievable: true
                  bindings_retrievable: true
                  tags:
                    - app-autoscaler
                  plans:
                    - id: autoscaler-free-plan-id
                      name: autoscaler-free-plan
                      description: This is the free service plan for the Auto-Scaling service.

              dashboard_redirect_uri: ""
        cf: *cf_credentials
        binding_db: *database
        policy_db: *database
        policy_db_connection_config: *databaseConnectionConfig
  - name: route_registrar
    release: routing
    consumes:
      nats: { from: nats, deployment: cf }
    properties:
      route_registrar:
        routes:
        - name: api_server
          registration_interval: 20s
          port: *publicApiServerPort
          tags:
            component: api_server
          uris:
            - ((deployment_name)).((system_domain))
        - name: autoscaler_service_broker
          registration_interval: 20s
          port: *brokerServerPort
          tags:
            component: autoscaler_service_broker
          uris:
            - *servicebroker_public_domain

  # Scheduler Instance Group
- name: scheduler
  azs:
    - z1
  instances: 1
  vm_type: minimal
  stemcell: default
  networks:
  - name: default
  jobs:
  - name: scheduler
    release: app-autoscaler
    properties:
      autoscaler:
        policy_db: *database
        scheduler_db: *database
        scheduler:
          health:
            port: &schedulerHealthPort 6202
            basicAuthEnabled: true
            username: scheduler
            password: ((autoscaler_scheduler_health_password))
          job_reschedule_interval_millisecond: 10000
          job_reschedule_maxcount: 6
          notification_reschedule_maxcount: 3
          ca_cert: ((!scheduler_server_cert.ca))
          server_cert: ((!scheduler_server_cert.certificate))
          server_key: ((!scheduler_server_cert.private_key))
          scaling_engine:
            ca_cert: ((!scalingengine_client_cert.ca))
            client_cert: ((!scalingengine_client_cert.certificate))
            client_key: ((!scalingengine_client_cert.private_key))
            host: *scalingengine_domain
  - name: route_registrar
    release: routing
    consumes:
      nats: {from: nats, deployment: cf}
    properties:
      route_registrar:
        routes:
        - name: autoscaler_scheduler_health
          registration_interval: 20s
          port: *schedulerHealthPort
          tags:
            component: autoscaler_scheduler_health
          uris:
            - ((deployment_name))-scheduler.((system_domain))

# Operator Instance Group
- name: operator
  azs:
  - z1
  instances: 1
  vm_type: minimal
  update:
    serial: true
  stemcell: default
  networks:
  - name: default
  jobs:
  - name: operator
    release: app-autoscaler
    properties:
      autoscaler:
        appmetrics_db: *database
        appmetrics_db_connection_config: *databaseConnectionConfig
        scalingengine_db: *database
        scalingengine_db_connection_config: *databaseConnectionConfig
        lock_db: *database
        policy_db: *database
        policy_db_connection_config: *databaseConnectionConfig
        scheduler.host: *scheduler_domain
        cf: *cf_credentials
        operator:
          enable_db_lock: true
          health:
            port: &operatorHealthPort 6208
            username: operator
            password: ((autoscaler_operator_health_password))
          scaling_engine:
            ca_cert: ((!scalingengine_client_cert.ca))
            client_cert: ((!scalingengine_client_cert.certificate))
            client_key: ((!scalingengine_client_cert.private_key))
            host: *scalingengine_domain
          scheduler:
            ca_cert: ((!scheduler_client_cert.ca))
            client_cert: ((!scheduler_client_cert.certificate))
            client_key: ((!scheduler_client_cert.private_key))
            host: *scheduler_domain
          logging:
            level: info
  - name: route_registrar
    release: routing
    consumes:
      nats: {from: nats, deployment: cf}
    properties:
      route_registrar:
        routes:
          - name: autoscaler_operator_health
            registration_interval: 20s
            port: *operatorHealthPort
            tags:
              component: autoscaler_operator_health
            uris:
              - ((deployment_name))-operator.((system_domain))

# Eventgenerator Instance Group
- name: eventgenerator
  azs:
  - z1
  instances: 1
  vm_type: minimal
  stemcell: default
  networks:
  - name: default
  jobs:
  - name: eventgenerator
    release: app-autoscaler
    properties:
      autoscaler:
        appmetrics_db: *database
        appmetrics_db_connection_config: *databaseConnectionConfig
        policy_db: *database
        policy_db_connection_config: *databaseConnectionConfig
        lock_db: *database
        eventgenerator:
          health:
            port: &eventGeneratorHealthPort 6205
            username: eventgenerator
            password: ((autoscaler_eventgenerator_health_password))
          logging:
            level: info
          ca_cert: ((!eventgenerator_server_cert.ca))
          server_cert: ((!eventgenerator_server_cert.certificate))
          server_key: ((!eventgenerator_server_cert.private_key))
          enable_db_lock: false
          scaling_engine:
            ca_cert: ((!scalingengine_client_cert.ca))
            client_cert: ((!scalingengine_client_cert.certificate))
            client_key: ((!scalingengine_client_cert.private_key))
            host: *scalingengine_domain
          metricscollector:
            ca_cert: ((metricscollector_ca_cert))
            client_cert: ((metricscollector_client_cert))
            client_key: ((metricscollector_client_key))
            port: 8080
            host: logcache
  - name: route_registrar
    release: routing
    consumes:
      nats: {from: nats, deployment: cf}
    properties:
      route_registrar:
        routes:
          - name: autoscaler_eventgenerator_health
            registration_interval: 20s
            port: *eventGeneratorHealthPort
            tags:
              component: autoscaler_eventgenerator_health
            uris:
              - ((deployment_name))-eventgenerator.((system_domain))

# Metricsforwarder Instance Group
- name: metricsforwarder
  azs:
    - z1
  instances: 1
  vm_type: minimal
  stemcell: default
  networks:
  - name: default
  jobs:
  - name: metricsforwarder
    release: app-autoscaler
    properties:
      autoscaler:
        policy_db: *database
        policy_db_connection_config: *databaseConnectionConfig
        metricsforwarder:
          health:
            port: &metricsforwarderHealthPort 6403
            username: metricsforwarder
            password: ((autoscaler_metricsforwarder_health_password))
          logging:
            level: info
          server:
            port: &metricsforwarderServerPort 6201
          loggregator:
            tls:
              ca_cert: ((!metricsforwarder_autoscaler_metricsforwarder_loggregator_tls.ca))
              cert: ((!metricsforwarder_autoscaler_metricsforwarder_loggregator_tls.certificate))
              key: ((!metricsforwarder_autoscaler_metricsforwarder_loggregator_tls.private_key))
        storedprocedure_db: *database
  - name: loggr-syslog-agent
    release: loggregator-agent
    properties:
      tls: # connection to syslog-agent
        ca_cert: ((!loggr_syslog_agent_tls.ca))
        cert: ((!loggr_syslog_agent_tls.certificate))
        key: ((!loggr_syslog_agent_tls.private_key))
      cache: # connection to syslog-binding-cache
        tls:
          ca_cert: ((!loggr_syslog_agent_cache_tls.ca))
          cert: ((!loggr_syslog_agent_cache_tls.certificate))
          key: ((!loggr_syslog_agent_cache_tls.private_key))
          cn: loggr_syslog_binding_cache
          # url: the value is automatically being generated if syslog-binding-cache is deployed https://github.com/cloudfoundry/loggregator-agent-release/blob/a5366d6d7c490417d12f990c1af0437a1feb067f/jobs/loggr-syslog-agent/templates/bpm.yml.erb#L60
      metrics: # connection for metric scrapers, here are dummy values configured since the /metrics endpoint can't be disabled via configuration
        ca_cert: ((!loggr_syslog_agent_metrics.ca))
        cert: ((!loggr_syslog_agent_metrics.certificate))
        key: ((!loggr_syslog_agent_metrics.private_key))
        server_name: metrics.config.is.required.by.job.specification.but.not.needed.in.our.case
  - name: loggr-syslog-binding-cache
    release: loggregator-agent
    consumes:
      cloud_controller: { from: cloud_controller, deployment: cf } # required by job to resolve API URL https://github.com/cloudfoundry/loggregator-agent-release/blob/0e3340f17f94d06cb3d4c11d1553a9a2a5bfb891/jobs/loggr-syslog-binding-cache/templates/bpm.yml.erb#L4
    properties:
      tls: # connection to syslog-binding-cache api, e.g. /v2/aggregate & /v2/bindings
        ca_cert: ((!loggr_syslog_binding_cache_tls.ca))
        cert: ((!loggr_syslog_binding_cache_tls.certificate))
        key: ((!loggr_syslog_binding_cache_tls.private_key))
        cn: loggr_syslog_agent_tls
      external_port: 9000
      aggregate_drains: # connection to log-cache
        - url: "syslog-tls://log-cache.service.cf.internal:6067?include-metrics-deprecated=true&ssl-strict-internal=true"
          # reusing these certificates here is a workaround so that we don't need to generate own ones.
          # the problem is that when we generate own certificates (see variables section of app-autoscaler.yml),
          # we have no possibility to reuse the CA from CF to issue new certificates.
          ca: ((log_cache_syslog_tls_ca))
          cert: ((syslog_agent_log_cache_tls_certificate))
          key: ((syslog_agent_log_cache_tls_key))
      metrics: # connection for metric scrapers, here are dummy values configured since the /metrics endpoint can't be disabled via configuration
        ca_cert: ((!loggr_syslog_binding_cache_metrics.ca))
        cert: ((!loggr_syslog_binding_cache_metrics.certificate))
        key: ((!loggr_syslog_binding_cache_metrics.private_key))
        server_name: metrics.config.is.required.by.job.specification.but.not.needed.in.our.case
      api: # connection to CF cloud controller
        # here are dummy values configured since there is no need to query the CC API for all bindings.
        # if a customer wants to ever receive their own custom metrics in their own syslog-drain, we would need to configure this properly.
        tls:
          cn: api.tls.config.is.required.by.job.specification.but.not.needed.in.our.case
          ca_cert: ((!loggr_syslog_binding_cache_api_tls.ca))
          cert: ((!loggr_syslog_binding_cache_api_tls.certificate))
          key: ((!loggr_syslog_binding_cache_api_tls.private_key))
        polling_interval: 876000h # 100 years, workaround to basically never poll the cloud controller API
  - name: route_registrar
    release: routing
    consumes:
      nats: { from: nats, deployment: cf }
    properties:
      route_registrar:
        routes:
          - name: autoscaler_metrics_forwarder
            registration_interval: 20s
            port: *metricsforwarderServerPort
            tags:
              component: autoscaler_metrics_forwarder
            uris:
              - *metricsforwarder_public_domain
          - name: autoscaler_metrics_forwarder_mtls
            registration_interval: 20s
            port: *metricsforwarderServerPort
            tags:
              component: autoscaler_metrics_forwarder
            uris:
              - *metricsforwarder_mtls_public_domain
          - name: autoscaler_metricsforwarder_health
            registration_interval: 20s
            port: *metricsforwarderServerPort
            tags:
              component: autoscaler_metricsforwarder_health
            uris:
              - ((deployment_name))-metricsforwarder.((system_domain))

update:
  canaries: 1
  canary_watch_time: 1000-300000
  max_in_flight: 3
  update_watch_time: 1000-300000
  serial: true

variables:
- name: database_password
  type: password
- name: uaa_secret
  type: password
  options:
    length: 128
- name: uaa_client_id
  type: password
  options:
    length: 128
- name: autoscaler_eventgenerator_health_password
  type: password
- name: service_broker_password
  type: password
  options:
    length: 128
- name: service_broker_password_blue
  type: password
  options:
    length: 128
- name: autoscaler_metricsforwarder_health_password
  type: password
- name: app_autoscaler_sbss_restricted_dbuser_password
  type: password
  options:
    length: 128
- name: autoscaler_operator_health_password
  type: password
- name: app_autoscaler_sbss_restricted_dbuser_password_blue
  type: password
  options:
    length: 128
- name: dashboard_client_id
  type: password
  options:
    length: 128
- name: dashboard_client_secret
  type: password
  options:
    length: 128
- name: api_client_id
  type: password
  options:
    length: 128
- name: api_client_secret
  type: password
  options:
    length: 128
- name: auditlog_monitor_basic_auth_password
  type: password
  options:
    length: 128
- name: dashboard_monitor_basic_auth_password
  type: password
  options:
    length: 128
- name: autoscaler_scheduler_health_password
  type: password
- name: ratelimiter_monitor_basic_auth_password
  type: password
  options:
    length: 128
- name: metriccollector_monitor_basic_auth_password
  type: password
  options:
    length: 128
- name: scalingengine_monitor_basic_auth_password
  type: password
  options:
    length: 128
- name: eventgenerator_monitor_basic_auth_password
  type: password
  options:
    length: 128
- name: scheduler_monitor_basic_auth_password
  type: password
  options:
    length: 128
- name: apiserver_monitor_basic_auth_password
  type: password
  options:
    length: 128
- name: metricsforwarder_monitor_basic_auth_password
  type: password
  options:
    length: 128
- name: autoscaler_scalingengine_health_password
  type: password
- name: operator_monitor_basic_auth_password
  type: password
  options:
    length: 128
- name: app_autoscaler_ca_cert
  type: certificate
  update_mode: converge
  options:
    is_ca: true
    common_name: autoscalerCA
    key_length: 4096
    duration: 180
- name: apiserver_server_cert
  type: certificate
  update_mode: converge
  options:
    ca: app_autoscaler_ca_cert
    common_name: *api_domain
    alternative_names:
    - *api_domain
    extended_key_usage:
    - client_auth
    - server_auth
    key_length: 4096
    duration: 180
- name: servicebroker_server_cert
  type: certificate
  update_mode: converge
  options:
    ca: app_autoscaler_ca_cert
    common_name: *servicebroker_domain
    alternative_names:
    - *servicebroker_domain
    extended_key_usage:
    - client_auth
    - server_auth
    key_length: 4096
    duration: 180
- name: scheduler_server_cert
  type: certificate
  update_mode: converge
  options:
    ca: app_autoscaler_ca_cert
    common_name: *scheduler_domain
    alternative_names:
    - *scheduler_domain
    extended_key_usage:
    - client_auth
    - server_auth
    key_length: 4096
    duration: 180
- name: scheduler_client_cert
  type: certificate
  update_mode: converge
  options:
    ca: app_autoscaler_ca_cert
    common_name: scheduler_client
    extended_key_usage:
    - client_auth
    key_length: 4096
    duration: 180
- name: eventgenerator_server_cert
  type: certificate
  update_mode: converge
  options:
    ca: app_autoscaler_ca_cert
    common_name: *eventgenerator_domain
    alternative_names:
    - *eventgenerator_domain
    extended_key_usage:
    - client_auth
    - server_auth
    key_length: 4096
    duration: 180
- name: eventgenerator_client_cert
  type: certificate
  update_mode: converge
  options:
    ca: app_autoscaler_ca_cert
    common_name: eventgenerator_client
    extended_key_usage:
    - client_auth
    key_length: 4096
    duration: 180
- name: scalingengine_server_cert
  type: certificate
  update_mode: converge
  options:
    ca: app_autoscaler_ca_cert
    common_name: *scalingengine_domain
    alternative_names:
    - *scalingengine_domain
    extended_key_usage:
    - client_auth
    - server_auth
    key_length: 4096
    duration: 180
- name: scalingengine_client_cert
  type: certificate
  update_mode: converge
  options:
    ca: app_autoscaler_ca_cert
    common_name: scalingengine_client
    extended_key_usage:
    - client_auth
    key_length: 4096
    duration: 180

  # metricsforwarder loggregator certificates
- name: metricsforwarder_autoscaler_metricsforwarder_loggregator_tls
  type: certificate
  update_mode: converge
  options:
    ca: app_autoscaler_ca_cert
    common_name: metricsforwarder_autoscaler_metricsforwarder_loggregator_tls
    alternative_names:
      - metricsforwarder_autoscaler_metricsforwarder_loggregator_tls
    extended_key_usage:
      - server_auth
      - client_auth
    key_length: 4096
    duration: 180

  # loggr-syslog-agent certificates
- name: loggr_syslog_agent_tls
  type: certificate
  update_mode: converge
  options:
    ca: app_autoscaler_ca_cert
    common_name: loggr_syslog_agent_tls
    alternative_names:
      - loggr_syslog_agent_tls
      - metron # the client in metricsforwarder which connects to syslog-agent requires this https://github.com/cloudfoundry/go-loggregator/blob/a52b61896b6f971d5c47f1008a1eaa279223c7c5/tls.go#L12
    extended_key_usage:
      - server_auth
      - client_auth
    key_length: 4096
    duration: 180
- name: loggr_syslog_agent_metrics
  type: certificate
  update_mode: converge
  options:
    ca: app_autoscaler_ca_cert
    common_name: loggr_syslog_agent_metrics
    alternative_names:
      - loggr_syslog_agent_metrics
    extended_key_usage:
      - server_auth
      - client_auth
    key_length: 4096
    duration: 180
- name: loggr_syslog_agent_cache_tls
  type: certificate
  update_mode: converge
  options:
    ca: app_autoscaler_ca_cert
    common_name: loggr_syslog_agent_cache_tls
    alternative_names:
      - loggr_syslog_agent_cache_tls
    extended_key_usage:
      - server_auth
      - client_auth
    key_length: 4096
    duration: 180

  # loggr-syslog-agent-binding-cache certificates
- name: loggr_syslog_binding_cache_tls
  type: certificate
  update_mode: converge
  options:
    ca: app_autoscaler_ca_cert
    common_name: loggr_syslog_binding_cache
    alternative_names:
      - loggr_syslog_binding_cache
    extended_key_usage:
      - server_auth
      - client_auth
    key_length: 4096
    duration: 180
- name: loggr_syslog_binding_cache_metrics
  type: certificate
  update_mode: converge
  options:
    ca: app_autoscaler_ca_cert
    common_name: loggr_syslog_binding_cache_metrics
    alternative_names:
      - loggr_syslog_binding_cache_metrics
    extended_key_usage:
      - server_auth
      - client_auth
    key_length: 4096
    duration: 180
- name: loggr_syslog_binding_cache_api_tls
  type: certificate
  update_mode: converge
  options:
    ca: app_autoscaler_ca_cert
    common_name: loggr_syslog_binding_cache_api_tls
    alternative_names:
      - loggr_syslog_binding_cache_api_tls
    extended_key_usage:
      - server_auth
      - client_auth
    key_length: 4096
    duration: 180