Introduce on-stemcell-change variable strategy #2460
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This commit introduces a new `update` block under variable declarations, as well as a `strategy` key underneath it to control when BOSH retrieves the latest version of that variable. This feature allows better control over when new variable versions are rolled out to VMs during a deploy. Currently, when a manifest is deployed, the BOSH Director will query CredHub for the latest version of each variable in the manifest. This ensures that deployments always use the current configuration stored in CredHub. This is a problem for being able to automatically rotate certificates - if a new version of a certificate is in CredHub, the deploy will use it. Normally this would be desirable, but since the rotation is done without users taking a direct action, they may not be aware that there are updated certs and thus will be surprised by a longer-than-normal deploy if they have no other changes. Predicting when there's going to be a longer-than-normal deploy is important for strict change / maintenance windows. The new key on variables has two potential values: * on-deploy: BOSH will use the current behavior of looking up the latest variable value on each deploy (default) * on-stemcell-change: BOSH will only look up the latest variable value when a deploy is occuring that updates all stemcells for the deployment. If one or more stemcells is not being updated, then BOSH will continue to use the previously deployed value for the variable. The on-stemcell-change behavior can be overridden by passing the `force_latest_variables` parameter to the deploy API endpoint. This will ensure that the latest variable value is used, regardless of the variable's declared strategy. Co-authored-by: Long Nguyen <nguyenlo@vmware.com> Co-authored-by: Daniel Felipe Ochoa <danielfelipo@vmware.com> Co-authored-by: Brian Cunnie <bcunnie@vmware.com> Co-authored-by: Brian Upton <bupton@vmware.com>
selzoc
approved these changes
Aug 10, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This commit introduces a new
updateblock under variable declarations, as well as astrategykey underneath it to control when BOSH retrieves the latest version of that variable. This feature allows better control over when new variable versions are rolled out to VMs during a deploy.Currently, when a manifest is deployed, the BOSH Director will query CredHub for the latest version of each variable in the manifest. This ensures that deployments always use the current configuration stored in CredHub.
This is a problem for being able to automatically rotate certificates - if a new version of a certificate is in CredHub, the deploy will use it. Normally this would be desirable, but since the rotation is done without users taking a direct action, they may not be aware that there are updated certs and thus will be surprised by a longer-than-normal deploy if they have no other changes. Predicting when there's going to be a longer-than-normal deploy is important for strict change / maintenance windows.
The new key on variables has two potential values:
The on-stemcell-change behavior can be overridden by passing the
force_latest_variablesparameter to the deploy API endpoint. This will ensure that the latest variable value is used, regardless of the variable's declared strategy.Corresponding docs PR: cloudfoundry/docs-bosh#799