-
Notifications
You must be signed in to change notification settings - Fork 100
/
spec
1237 lines (1123 loc) · 53.2 KB
/
spec
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
---
name: cloud_controller_ng
description: "The Cloud Controller provides primary Cloud Foundry API that is by the CF CLI. The Cloud Controller uses a database to keep tables for organizations, spaces, apps, services, service instances, user roles, and more. Typically multiple instances of Cloud Controller are load balanced."
templates:
bin/cloud_controller_ng.erb: bin/cloud_controller_ng
bin/local_worker.erb: bin/local_worker
bin/nginx_newrelic_plugin.erb: bin/nginx_newrelic_plugin
bin/dns/healthy.sh.erb: bin/dns/healthy
bpm.yml.erb: config/bpm.yml
pre-backup-lock.sh.erb: bin/bbr/pre-backup-lock
post-backup-unlock.sh.erb: bin/bbr/post-backup-unlock
pre-restore-lock.sh.erb: bin/bbr/pre-restore-lock
post-restore-unlock.sh.erb: bin/bbr/post-restore-unlock
cloud_controller_ng.yml.erb: config/cloud_controller_ng.yml
blobstore_waiter.sh.erb: bin/blobstore_waiter.sh
buildpacks_ca_cert.pem.erb: config/certs/buildpacks_ca_cert.pem
cloud_controller_api_health_check.erb: bin/cloud_controller_ng_health_check
ccng_monit_http_healthcheck.sh.erb: bin/ccng_monit_http_healthcheck
console.erb: bin/console
dns_health_check.erb: bin/dns_health_check
drain.sh.erb: bin/drain
droplets_ca_cert.pem.erb: config/certs/droplets_ca_cert.pem
local_blobstore_downloads.conf.erb: config/local_blobstore_downloads.conf
logcache_tls.crt.erb: config/certs/logcache_tls.crt
logcache_tls.key.erb: config/certs/logcache_tls.key
logcache_tls_ca.crt.erb: config/certs/logcache_tls_ca.crt
nginx_external_endpoints.conf.erb: config/nginx_external_endpoints.conf
migrate_db.sh.erb: bin/migrate_db
mime.types: config/mime.types
nginx_server_mtls.conf: config/nginx_server_mtls.conf
prom_scraper_mtls.conf: config/prom_scraper_mtls.conf
nginx_server_public_tls.conf: config/nginx_server_public_tls.conf
mutual_tls.crt.erb: config/certs/mutual_tls.crt
mutual_tls.key.erb: config/certs/mutual_tls.key
mutual_tls_ca.crt.erb: config/certs/mutual_tls_ca.crt
scrape.crt.erb: config/certs/scrape.crt
scrape.key.erb: config/certs/scrape.key
scrape_ca.crt.erb: config/certs/scrape_ca.crt
public_tls.crt.erb: config/certs/public_tls.crt
public_tls.key.erb: config/certs/public_tls.key
newrelic.yml.erb: config/newrelic.yml
newrelic_plugin.yml.erb: config/newrelic_plugin.yml
nginx.conf.erb: config/nginx.conf
nginx_maintenance.conf.erb: config/nginx_maintenance.conf
packages_ca_cert.pem.erb: config/certs/packages_ca_cert.pem
perform_blobstore_benchmarks.erb: bin/perform_blobstore_benchmarks
post-start.sh.erb: bin/post-start
pre-start.sh.erb: bin/pre-start
public_upload.conf.erb: config/public_upload.conf
restart_drain.sh.erb: bin/restart_drain
resource_pool_ca_cert.pem.erb: config/certs/resource_pool_ca_cert.pem
shutdown_drain.rb.erb: bin/shutdown_drain
ruby_version.sh.erb: bin/ruby_version.sh
seed_db.sh.erb: bin/seed_db
setup_local_blobstore.sh.erb: bin/setup_local_blobstore.sh
stacks.yml.erb: config/stacks.yml
uaa_ca.crt.erb: config/certs/uaa_ca.crt
validate_encryption_keys.sh.erb: bin/validate_encryption_keys
db_ca.crt.erb: config/certs/db_ca.crt
credhub_ca.crt.erb: config/certs/credhub_ca.crt
prom_scraper_config.yml.erb: config/prom_scraper_config.yml
cloud_controller_local_worker_override.yml.erb: config/cloud_controller_local_worker_override.yml
packages:
- capi_utils
- cloud_controller_ng
- nginx
- nginx_newrelic_plugin
- libpq
- jemalloc
- mariadb_connector_c
- ruby-3.2
provides:
- name: cloud_controller
type: cloud_controller
properties:
- system_domain
- app_domains
- name: cloud_controller_db
type: cloud_controller_db
properties:
- ccdb
- ccdb.connection_validation_timeout
- ccdb.max_connections
- ccdb.pool_timeout
- ccdb.read_timeout
- ccdb.ssl_verify_hostname
- ccdb.ca_cert
- name: directories_to_backup
type: directories_to_backup
properties:
- cc.packages.app_package_directory_key
- cc.droplets.droplet_directory_key
- cc.buildpacks.buildpack_directory_key
- name: cloud_controller_https_endpoint
type: cloud_controller_https_endpoint
properties:
- cc.internal_service_hostname
- cc.public_tls.port
- cc.public_tls.ca_cert
- name: cloud_controller_mtls_endpoint
type: cloud_controller_mtls_endpoint
properties:
- cc.internal_service_hostname
- cc.tls_port
- cc.mutual_tls.ca_cert
- cc.prom_metrics_server_tls_port
- cc.prom_scraper_tls.ca_cert
- name: cloud_controller_container_networking_info
type: cloud_controller_container_networking_info
properties:
- cc.internal_route_vip_range
- name: cloud_controller_internal
type: cloud_controller_internal
properties:
- cc.buildpacks.blobstore_type
- cc.buildpacks.buildpack_directory_key
- cc.buildpacks.cdn.key_pair_id
- cc.buildpacks.cdn.private_key
- cc.buildpacks.cdn.uri
- cc.buildpacks.fog_aws_storage_options
- cc.buildpacks.fog_gcp_storage_options
- cc.buildpacks.fog_connection
- cc.buildpacks.webdav_config.blobstore_timeout
- cc.buildpacks.webdav_config.ca_cert
- cc.buildpacks.webdav_config.password
- cc.buildpacks.webdav_config.private_endpoint
- cc.buildpacks.webdav_config.public_endpoint
- cc.buildpacks.webdav_config.username
- cc.cpu_weight_min_memory
- cc.cpu_weight_max_memory
- cc.credential_references.interpolate_service_bindings
- cc.custom_metric_tag_prefix_list
- cc.database_encryption.current_key_label
- cc.database_encryption.experimental_pbkdf2_hmac_iterations
- cc.database_encryption.keys
- cc.db_encryption_key
- cc.db_logging_level
- cc.default_app_ssh_access
- cc.default_health_check_timeout
- cc.default_stack
- cc.disable_private_domain_cross_space_context_path_route_sharing
- cc.droplets.blobstore_type
- cc.droplets.cdn.key_pair_id
- cc.droplets.cdn.private_key
- cc.droplets.cdn.uri
- cc.droplets.droplet_directory_key
- cc.droplets.fog_aws_storage_options
- cc.droplets.fog_gcp_storage_options
- cc.droplets.fog_connection
- cc.droplets.webdav_config.blobstore_timeout
- cc.droplets.webdav_config.ca_cert
- cc.droplets.webdav_config.password
- cc.droplets.webdav_config.private_endpoint
- cc.droplets.webdav_config.public_endpoint
- cc.droplets.webdav_config.username
- cc.external_host
- cc.external_port
- cc.external_protocol
- cc.experimental.use_yjit_compiler
- cc.experimental.use_jemalloc_memory_allocator
- cc.internal_service_hostname
- cc.log_db_queries
- cc.logging.format.timestamp
- cc.logging_level
- cc.logging_max_retries
- cc.max_labels_per_resource
- cc.max_annotations_per_resource
- cc.maximum_health_check_timeout
- cc.packages.app_package_directory_key
- cc.packages.blobstore_type
- cc.packages.cdn.key_pair_id
- cc.packages.cdn.private_key
- cc.packages.cdn.uri
- cc.packages.fog_aws_storage_options
- cc.packages.fog_gcp_storage_options
- cc.packages.fog_connection
- cc.packages.max_package_size
- cc.packages.webdav_config.blobstore_timeout
- cc.packages.webdav_config.ca_cert
- cc.packages.webdav_config.password
- cc.packages.webdav_config.private_endpoint
- cc.packages.webdav_config.public_endpoint
- cc.packages.webdav_config.username
- cc.resource_pool.blobstore_type
- cc.resource_pool.cdn.key_pair_id
- cc.resource_pool.cdn.private_key
- cc.resource_pool.cdn.uri
- cc.resource_pool.fog_aws_storage_options
- cc.resource_pool.fog_gcp_storage_options
- cc.resource_pool.fog_connection
- cc.resource_pool.maximum_size
- cc.resource_pool.minimum_size
- cc.resource_pool.resource_directory_key
- cc.resource_pool.webdav_config.blobstore_timeout
- cc.resource_pool.webdav_config.ca_cert
- cc.resource_pool.webdav_config.password
- cc.resource_pool.webdav_config.private_endpoint
- cc.resource_pool.webdav_config.public_endpoint
- cc.resource_pool.webdav_config.username
- cc.stacks
- cc.staging_timeout_in_seconds
- cc.staging_upload_password
- cc.staging_upload_user
- cc.statsd_host
- cc.statsd_port
- cc.enable_statsd_metrics
- cc.system_hostnames
- cc.tls_port
- cc.uaa.client_timeout
- cc.internal_route_vip_range
- cc.volume_services_enabled
- credhub_api.ca_cert
- credhub_api.hostname
- release_level_backup
- router.route_services_secret
- routing_api.enabled
- ssl.skip_cert_verify
- system_domain
- uaa.clients.cc_routing.secret
- cc.experimental.use_puma_webserver
- cc.experimental.use_redis
consumes:
- name: database
type: database
optional: true
- name: cc_uploader
type: cc_uploader
optional: true
- name: credhub
type: credhub
optional: true
- name: log-cache
type: log-cache
optional: true
- name: file_server
type: file_server
optional: true
- name: cloud_controller
type: cloud_controller
optional: true
properties:
ssl.skip_cert_verify:
description: "specifies that the job is allowed to skip ssl cert verification"
default: false
system_domain:
description: "Domain reserved for CF operator, base URL where the login, uaa, and other non-user apps listen"
system_domain_organization:
description: "An organization that will be created as part of the seeding process. When the system_domain is not shared with (in the list of) app_domains, this is required as the system_domain will be created as a PrivateDomain in this organization."
default: "system"
app_domains:
description: "Array of domain hashes for user apps (example: 'user.app.space.foo', a user app called 'neat' will listen at 'http://neat.user.app.space.foo'). Domains specified as internal should be listed last to avoid interfering with default domain selection by old CLI versions."
example: |
- name: example.com
- name: tcp.example.com
router_group_name: default-tcp
- name: example.internal
internal: true
app_ssh.host_key_fingerprint:
description: >-
Fingerprint of the host key of the SSH proxy that brokers connections to
application instances.
Supported fingerprint formats: SHA256 (recommended), SHA1 and MD5
Example fingerprints by format:
SHA256: 0KmvfcwFCnwQRviOJEwZtnz5qoi76BVb8dm3/vgilCI
SHA1: b8:80:2c:8c:d7:25:ad:2a:b4:8c:02:34:52:06:f7:ba:1f:0d:02:de
MD5: d2:d6:b9:d7:f9:c4:15:70:de:af:c7:36:88:3a:60:12
default: ~
app_ssh.port:
description: "External port for SSH access to application instances"
default: 2222
app_ssh.oauth_client_id:
description: "The oauth client ID of the SSH proxy"
default: ssh-proxy
nfs_server.address:
description: "NFS server for droplets and apps (not used in an AWS deploy, use s3 instead)"
request_timeout_in_seconds:
description: "Timeout for requests in seconds."
default: 900
name:
description: "'name' attribute in the /v2/info endpoint"
default: ""
build:
description: "'build' attribute in the /v2/info endpoint"
default: ""
version:
description: "'version' attribute in the /v2/info endpoint"
default: 0
support_address:
description: "'support' attribute in the /v2/info endpoint"
default: ""
description:
description: "'description' attribute in the /v2/info endpoint"
default: ""
temporary_disable_non_tls_endpoints:
description: "nginx_cc and cc_uploader components disable non-TLS endpoints"
default: false
cc.info.custom:
description: "Custom attribute keys and values for /v2/info endpoint"
cc.nginx.ip:
description: "IP address for nginx"
default: ""
cc.external_port:
description: "External Cloud Controller port"
default: 9022
cc.tls_port:
description: "Port for internal TLS communication"
default: 9023
cc.public_tls.port:
description: "Port for TLS with gorouter"
default: 9024
cc.prom_metrics_server_tls_port:
description: "Port for internal TLS communication with prom_scraper"
default: 9025
cc.internal_service_hostname:
description: "Internal hostname used to resolve the address of the Cloud Controller"
default: "cloud-controller-ng.service.cf.internal"
cc.external_protocol:
default: "https"
description: "The protocol used to access the CC API from an external entity"
cc.external_host:
default: "api"
description: "Host part of the cloud_controller API URI, will be joined with value of 'domain'"
cc.api_post_start_healthcheck_timeout_in_seconds:
default: 60
description: "Maximum time (in seconds) for cloud_controller_ng to report healthy"
cc.post_bbr_healthcheck_timeout_in_seconds:
default: 60
description: "Maximum time (in seconds) for cloud_controller_ng to report healthy in backup and restore unlock"
cc.api_health_check_timeout_per_retry:
default: 2
description: "Maximum health check timeout (in seconds) for each retry attempt in the Cloud Controller's route registration health check"
cc.api_health_check_total_timeout:
default: 6
description: "Maximum health check timeout (in seconds). Health checks will be retried until this time limit is reached. This should be less than or equal to your route_registrar.routes.api.health_check.timeout"
cc.ccng_monit_http_healthcheck_retries:
default: 5
description: "Number of retries performed by the ccng_monit_http_healthcheck process"
cc.ccng_monit_http_healthcheck_timeout_per_retry:
default: 2
description: "The amount of time in seconds to wait before an HTTP request from the Cloud Controller monit health check is closed"
cc.jobs.global.timeout_in_seconds:
description: "The longest any job can take before it is cancelled unless overridden per job"
default: 14400 # 4 hours
cc.jobs.blobstore_delete.timeout_in_seconds:
description: "The longest this job can take before it is cancelled"
cc.jobs.droplet_upload.timeout_in_seconds:
description: "The longest this job can take before it is cancelled"
cc.jobs.priorities:
description: "List of hashes containing delayed jobs 'display_name' and its desired priority. This will overwrite the default priority of ccng"
cc.temporary_disable_deployments:
description: "Do not allow the API client to create app deployments (temporary)"
default: false
cc.temporary_enable_v2:
description: "Enable V2 endpoints"
default: true
cc.directories.tmpdir:
default: "/var/vcap/data/cloud_controller_ng/tmp"
description: "The directory to use for temporary files"
cc.directories.diagnostics:
default: "/var/vcap/data/cloud_controller_ng/diagnostics"
description: "The directory where operator requested diagnostic files should be placed"
cc.min_cli_version:
description: "Minimum version of the CF CLI to work with the API."
default: ~
cc.min_recommended_cli_version:
description: "Minimum recommended version of the CF CLI."
default: ~
cc.run_prestart_migrations:
description: "Run Cloud Controller DB migrations in BOSH pre-start script. Should be changed to false for deployments where the PostgreSQL job is deployed to the same VM as Cloud Controller. Otherwise, the default of true is preferable."
default: true
cc.uaa_resource_id:
default: "cloud_controller,cloud_controller_service_permissions"
description: "Name of service to register to UAA"
cc.logging_level:
default: "info"
description: "Log level for cc. Valid levels are listed here: https://github.com/cloudfoundry/steno#log-levels."
cc.logging_max_retries:
default: 1
description: "Passthru value for Steno logger"
cc.logging_anonymize_ips:
default: false
description: "Anonymizes IPs in request logs"
cc.logging.format.timestamp:
default: "rfc3339"
description: "Timestamp format for logs. Valid values are 'rfc3339' (for human-readable timestamp format) and 'deprecated' (for old timestamp format)"
cc.log_db_queries:
default: false
description: "Log database queries. WARNING: Setting this to true with cc.db_logging_level >= cc.logging_level will log all field values, including encrypted secrets."
cc.query_size_log_threshold:
description: "Log when SQL queries return more than this number of rows if cc.log_db_queries is set to true"
example: 1000
cc.db_logging_level:
default: "debug2"
description: "Level at which cc database operations will be logged if cc.log_db_queries is set to true."
cc.log_fog_requests:
default: false
description: "Log fog requests and responses."
cc.staging_timeout_in_seconds:
default: 900
description: "Timeout for staging a droplet"
cc.default_health_check_timeout:
default: 60
description: "Default health check timeout (in seconds) that can be set for the app"
cc.maximum_health_check_timeout:
default: 180
description: "Maximum health check timeout (in seconds) that can be set for the app"
cc.shared_isolation_segment_name:
default: "shared"
description: |
Name of the shared isolation segment created at startup.
This field can be updated, but subject to the following caveat:
Using the name of an existing IS will cause a deployment to fail.
To recover, redeploy using the last valid Shared Isolation Segment name.
cc.stacks:
default:
- name: "cflinuxfs4"
description: "Cloud Foundry Linux-based filesystem (Ubuntu 22.04)"
description: |
List of hashes describing stacks intended for developers to choose from when pushing apps.
A stack is a prebuilt root file system (rootfs) that supports a specific operating system.
Note: removing items in this list will not remove the records in the Cloud Controller's database.
cc.default_stack:
default: "cflinuxfs4"
description: "The default stack to use if no custom stack is specified for an app."
cc.staging_upload_user:
description: "User name used to access internal endpoints of Cloud Controller to upload files when staging"
cc.staging_upload_password:
description: "User's password used to access internal endpoints of Cloud Controller to upload files when staging"
cc.quota_definitions:
description: "Hash of default quota definitions to be seeded. This property can be used to add quotas with subsequent deploys, but not to update existing ones."
default:
default:
memory_limit: 102400
non_basic_services_allowed: true
total_routes: 1000
total_services: -1
total_reserved_route_ports: 100
cc.default_quota_definition:
default: default
description: "The name of the quota definition CC will fallback on for org and space limits from the list of quota definitions."
cc.resource_pool.blobstore_type:
description: "The type of blobstore backing to use. Valid values: ['fog', 'webdav']"
default: "fog"
cc.resource_pool.fog_aws_storage_options:
description: "Storage options passed to fog for aws blobstores. See http://docs.cloudfoundry.org/deploying/common/cc-blobstore-config.html#fog-aws-sse for example configuration."
default: {}
cc.resource_pool.fog_gcp_storage_options:
description: "Storage options passed to fog for gcp blobstores"
default: {}
cc.resource_pool.webdav_config.blobstore_timeout:
description: "The timeout in seconds for requests to the blobstore"
default: 5
cc.resource_pool.webdav_config.public_endpoint:
description: "The location of the webdav server eg: https://blobstore.com"
default: ""
cc.resource_pool.webdav_config.private_endpoint:
description: "The location of the webdav server eg: https://blobstore.internal"
default: "https://blobstore.service.cf.internal:4443"
cc.resource_pool.webdav_config.username:
description: "The basic auth user that CC uses to connect to the admin endpoint on webdav"
default: ""
cc.resource_pool.webdav_config.password:
description: "The basic auth password that CC uses to connect to the admin endpoint on webdav"
default: ""
cc.resource_pool.webdav_config.ca_cert:
description: "The ca cert to use when communicating with webdav"
default: ""
cc.resource_pool.minimum_size:
description: "Minimum size of a resource to add to the pool"
default: 65536
cc.resource_pool.maximum_size:
description: "Maximum size of a resource to add to the pool"
default: 536870912
cc.resource_pool.resource_directory_key:
description: "Directory (bucket) used store app resources. It does not have be pre-created."
default: "cc-resources"
cc.resource_pool.fog_connection:
description: "Fog connection hash"
cc.resource_pool.cdn.uri:
description: "URI for a CDN to used for resource pool downloads"
default: ""
cc.resource_pool.cdn.private_key:
description: "Private key for signing download URIs"
default: ""
cc.resource_pool.cdn.key_pair_id:
description: "Key pair name for signed download URIs"
default: ""
cc.packages.blobstore_type:
description: "The type of blobstore backing to use. Valid values: ['fog', 'webdav']"
default: "fog"
cc.packages.fog_aws_storage_options:
description: "Storage options passed to fog for aws blobstores. See http://docs.cloudfoundry.org/deploying/common/cc-blobstore-config.html#fog-aws-sse for example configuration."
default: {}
cc.packages.fog_gcp_storage_options:
description: "Storage options passed to fog for gcp blobstores"
default: {}
cc.packages.webdav_config.blobstore_timeout:
description: "The timeout in seconds for requests to the blobstore"
default: 5
cc.packages.webdav_config.public_endpoint:
description: "The location of the webdav server eg: https://blobstore.com"
default: ""
cc.packages.webdav_config.private_endpoint:
description: "The location of the webdav server eg: https://blobstore.internal"
default: "https://blobstore.service.cf.internal:4443"
cc.packages.webdav_config.username:
description: "The basic auth user that CC uses to connect to the admin endpoint on webdav"
default: ""
cc.packages.webdav_config.password:
description: "The basic auth password that CC uses to connect to the admin endpoint on webdav"
default: ""
cc.packages.webdav_config.ca_cert:
description: "The ca cert to use when communicating with webdav"
default: ""
cc.packages.app_package_directory_key:
description: "Directory (bucket) used store app packages. It does not have be pre-created. Should contain only alphanumeric characters, '-', '_', and '.'"
default: "cc-packages"
cc.packages.max_package_size:
description: "Maximum size of application package"
default: 1073741824
cc.packages.max_valid_packages_stored:
description: "Number of recent, valid packages stored per app (not including package for current droplet)"
default: 5
cc.packages.fog_connection:
description: "Fog connection hash"
cc.packages.cdn.uri:
description: "URI for a CDN to used for app package downloads"
default: ""
cc.packages.cdn.private_key:
description: "Private key for signing download URIs"
default: ""
cc.packages.cdn.key_pair_id:
description: "Key pair name for signed download URIs"
default: ""
cc.droplets.blobstore_type:
description: "The type of blobstore backing to use. Valid values: ['fog', 'webdav']"
default: "fog"
cc.droplets.fog_aws_storage_options:
description: "Storage options passed to fog for aws blobstores. See http://docs.cloudfoundry.org/deploying/common/cc-blobstore-config.html#fog-aws-sse for example configuration."
default: {}
cc.droplets.fog_gcp_storage_options:
description: "Storage options passed to fog for gcp blobstores"
default: {}
cc.droplets.webdav_config.blobstore_timeout:
description: "The timeout in seconds for requests to the blobstore"
default: 5
cc.droplets.webdav_config.public_endpoint:
description: "The location of the webdav server eg: https://blobstore.com"
default: ""
cc.droplets.webdav_config.private_endpoint:
description: "The location of the webdav server eg: https://blobstore.internal"
default: "https://blobstore.service.cf.internal:4443"
cc.droplets.webdav_config.username:
description: "The basic auth user that CC uses to connect to the admin endpoint on webdav"
default: ""
cc.droplets.webdav_config.password:
description: "The basic auth password that CC uses to connect to the admin endpoint on webdav"
default: ""
cc.droplets.webdav_config.ca_cert:
description: "The ca cert to use when communicating with webdav"
default: ""
cc.droplets.droplet_directory_key:
description: "Directory (bucket) used store droplets. It does not have be pre-created. Should contain only alphanumeric characters, '-', '_', and '.'"
default: "cc-droplets"
cc.droplets.max_staged_droplets_stored:
description: "Number of recent, staged droplets stored per app (not including current droplet)"
default: 5
cc.droplets.fog_connection:
description: "Fog connection hash"
cc.droplets.cdn.uri:
description: "URI for a CDN to used for droplet downloads"
default: ""
cc.droplets.cdn.private_key:
description: "Private key for signing download URIs"
default: ""
cc.droplets.cdn.key_pair_id:
description: "Key pair name for signed download URIs"
default: ""
cc.buildpacks.blobstore_type:
description: "The type of blobstore backing to use. Valid values: ['fog', 'webdav']"
default: "fog"
cc.buildpacks.fog_aws_storage_options:
description: "Storage options passed to fog for aws blobstores. See http://docs.cloudfoundry.org/deploying/common/cc-blobstore-config.html#fog-aws-sse for example configuration."
default: {}
cc.buildpacks.fog_gcp_storage_options:
description: "Storage options passed to fog for gcp blobstores"
default: {}
cc.buildpacks.webdav_config.blobstore_timeout:
description: "The timeout in seconds for requests to the blobstore"
default: 5
cc.buildpacks.webdav_config.public_endpoint:
description: "The location of the webdav server eg: https://blobstore.com"
default: ""
cc.buildpacks.webdav_config.private_endpoint:
description: "The location of the webdav server eg: https://blobstore.internal"
default: "https://blobstore.service.cf.internal:4443"
cc.buildpacks.webdav_config.username:
description: "The basic auth user that CC uses to connect to the admin endpoint on webdav"
default: ""
cc.buildpacks.webdav_config.password:
description: "The basic auth password that CC uses to connect to the admin endpoint on webdav"
default: ""
cc.buildpacks.webdav_config.ca_cert:
description: "The ca cert to use when communicating with webdav"
default: ""
cc.buildpacks.buildpack_directory_key:
description: "Directory (bucket) used store buildpacks. It does not have be pre-created. Should contain only alphanumeric characters, '-', '_', and '.'"
default: "cc-buildpacks"
cc.buildpacks.fog_connection:
description: "Fog connection hash"
cc.buildpacks.cdn.uri:
description: "URI for a CDN to used for buildpack downloads"
default: ""
cc.buildpacks.cdn.private_key:
description: "Private key for signing download URIs"
default: ""
cc.buildpacks.cdn.key_pair_id:
description: "Key pair name for signed download URIs"
default: ""
ccdb.databases:
description: "Contains the name of the database on the database server"
ccdb.roles:
description: "Users to create on the database when seeding"
ccdb.db_scheme:
description: "The type of database being used. mysql or postgres"
default: postgres
ccdb.address:
description: "The address of the database server"
ccdb.port:
description: "The port of the database server"
ccdb.max_connections:
default: 25
description: "Maximum connections for Sequel"
ccdb.pool_timeout:
default: 10
description: "The timeout for Sequel pooled connections"
ccdb.ca_cert:
default: ~
description: "The ca cert to use when communicating with the database over SSL"
ccdb.ssl_verify_hostname:
default: true
description: "Verify that the database SSL certificate matches the host to which the connection is attempted"
ccdb.read_timeout:
default: 3600
description: "The read timeout in seconds for query responses, passed directly to the Sequel gem - see https://github.com/jeremyevans/sequel/blob/master/doc/opening_databases.rdoc for details"
ccdb.connection_validation_timeout:
default: 3600
description: "The period in seconds after which idle connections are validated, passed directly to the Sequel gem - see http://sequel.jeremyevans.net/rdoc-plugins/files/lib/sequel/extensions/connection_validator_rb.html for details. Note that setting this to -1 results in an additional query whenever connections are checked out from the pool, which can have performance implications"
ccdb.max_migration_duration_in_minutes:
description: "the maximum time migrations should be allowed to run before job startup should error"
default: 20160
ccdb.connection_expiration_timeout:
description: "The period in seconds after which connections are expired (omit to never expire connections), passed directly to the Sequel gem - see https://sequel.jeremyevans.net/rdoc-plugins/files/lib/sequel/extensions/connection_expiration_rb.html for details"
ccdb.connection_expiration_random_delay:
description: "The random delay in seconds to the expiration timeout (to prevent all connections being recreated simultaneously), passed directly to the Sequel gem - see https://sequel.jeremyevans.net/rdoc-plugins/files/lib/sequel/extensions/connection_expiration_rb.html for details"
ccdb.max_connections_per_local_worker:
description: "Maximum database connections per cc local worker, if not set the ccng value is used (default)"
uaa.cc.token_secret:
description: "Symmetric secret used to decode uaa tokens."
uaa.cc.token_secret2:
description: "Second Symmetric secret used to decode uaa tokens. Used for secret rotation."
uaa.url:
description: "URL of the UAA server"
uaa.ca_cert:
description: "The certificate authority being used by UAA"
uaa.ssl.port:
description: "The port used by UAA for ssl connections"
default: 8443
uaa.port:
description: "The port used by UAA for non-ssl connections"
cc.uaa.client_timeout:
description: "The value, in seconds, used for all timeout values when communicating with UAA"
default: 60
cc.uaa.internal_url:
description: "The internal URL used by UAA"
default: "uaa.service.cf.internal"
login.protocol:
description: "http or https"
default: "https"
login.url:
description: "URL of the login server"
login.enabled:
default: true
description: "whether use login as the authorization endpoint or not"
metron_endpoint.host:
description: "The host used to emit messages to the Metron agent"
default: "127.0.0.1"
metron_endpoint.port:
description: "The port used to emit messages to the Metron agent"
default: 3457
doppler.use_ssl:
description: "Whether to use ssl for the doppler_logging_endpoint listed at /v2/info"
default: true
doppler.port:
description: "Port for doppler_logging_endpoint listed at /v2/info"
default: 443
cc.db_encryption_key:
default: ""
description: "key for encrypting sensitive values in the CC database"
cc.database_encryption.keys:
default: {}
description: "label-key pairs for encrypting sensitive values in the CC database; labels must be < 256 characters long"
cc.database_encryption.current_key_label:
default: ""
description: "current key label for encrypting values in the CC database"
cc.database_encryption.experimental_pbkdf2_hmac_iterations:
default: 2048
description: "Number of pbkdf2 hmac iterations (experimental)"
cc.database_encryption.skip_validation:
default: false
description: "Skip validations of database encryption properties"
cc.cpu_weight_min_memory:
default: 128
description: "The default minimum application instance memory used for the CPU weight calculation"
cc.cpu_weight_max_memory:
default: 8192
description: "The default maximum application instance memory used for the CPU weight calculation"
cc.default_app_memory:
default: 1024
description: "How much memory given to an app if not specified"
cc.default_app_disk_in_mb:
default: 1024
description: "The default disk space an app gets"
cc.maximum_app_disk_in_mb:
default: 2048
description: "The maximum amount of disk a user can request"
cc.allow_app_ssh_access:
default: true
description: "Allow users to change the value of the app-level allow_ssh attribute"
cc.default_app_ssh_access:
default: true
description: "When ssh is allowed and not explicitly set in the application, new applications will start with ssh service enabled"
cc.client_max_body_size:
default: "15M"
description: "Maximum body size for nginx"
cc.app_bits_max_body_size:
default: "2048M"
description: "Maximum body size for nginx bits uploads"
cc.default_app_log_rate_limit_in_bytes_per_second:
default: -1
description: "Default application log rate limit"
cc.disable_custom_buildpacks:
default: false
description: "Disable external (i.e. git) buildpacks? (Admin buildpacks and system buildpacks only.)"
cc.broker_client_timeout_seconds:
default: 60
description: "For requests to service brokers, this is the HTTP (open and read) timeout setting."
cc.broker_client_default_async_poll_interval_seconds:
default: 60
description: "Specifies interval on which the CC will poll a service broker for asynchronous actions. If the service broker provides a value, this value is the minimum accepted value the broker can provide."
cc.broker_client_max_async_poll_duration_minutes:
default: 10080
description: "The max duration the CC will fetch service instance state from a service broker (in minutes). Default is 1 week"
cc.broker_client_async_poll_exponential_backoff_rate:
default: 1.0
description: "Exponential backoff for service related polling jobs. Default is 1.0, which means there is no exponential backoff."
cc.broker_client_response_parser.log_errors:
default: false
description: "Log errors happening when parsing service broker responses."
cc.broker_client_response_parser.log_validators:
default: false
description: "Log the stack of validators used to process the service broker response, e.g. for a 202 response to a 'provision' request, the following is logged: [\"CommonErrorValidator\", \"JsonSchemaValidator[provision_response_schema]\", \"SuccessValidator[in progress]\"]"
cc.broker_client_response_parser.log_response_fields:
default: {}
description: "Specify service broker response fields to be logged. This configuration is a hash, where the key indicates the request type and the value is a list of fields in the response JSON that should be logged. The following request types exist: catalog, provision, update, deprovision, bind, unbind, fetch_service_instance_last_operation, fetch_service_binding_last_operation, fetch_service_instance, fetch_service_binding. The corresponding response fields can be taken from the Open Service Broker API Specification."
cc.development_mode:
default: false
description: "Enable development features for monitoring and insight"
cc.max_annotations_per_resource:
description: "Maximum number of annotations allowed on any single resource. Too many annotations may degrade performance of annotation selectors."
default: 200
cc.max_labels_per_resource:
description: "Maximum number of labels allowed on any single resource. Too many labels may degrade performance of label selectors."
default: 50
cc.custom_metric_tag_prefix_list:
description: "Allows users to apply custom metric tags to their apps by adding labels with the given key prefixes. The following key names are ignored: deployment, index, ip, job"
default: ["metric.tag.cloudfoundry.org"]
cc.newrelic.license_key:
default: ~
description: "The API key for NewRelic"
cc.newrelic.environment_name:
default: "development"
description: "The environment name used by NewRelic"
cc.newrelic.developer_mode:
default: false
description: "Activate NewRelic developer mode"
cc.newrelic.monitor_mode:
default: false
description: "Activate NewRelic monitor mode"
cc.newrelic.log_file_path:
default: "/var/vcap/sys/log/cloud_controller_ng/newrelic"
description: "The location for NewRelic to log to"
cc.newrelic.capture_params:
default: false
description: "Capture and send query params to NewRelic"
cc.newrelic.transaction_tracer.enabled:
default: false
description: "Enable transaction tracing in NewRelic"
cc.newrelic.transaction_tracer.record_sql:
default: "off"
description: "NewRelic's SQL statement recording mode: [off | obfuscated | raw]"
cc.nginx_access_log_destination:
description: "The nginx access log destination. This can be used to route access logs to a file, syslog, or a memory buffer."
default: "/var/vcap/sys/log/nginx_cc/nginx.access.log"
cc.nginx_access_log_format:
description: "The nginx log format string to use when writing to the access log."
default: >
$host - [$time_local] "$request" $status $bytes_sent "$http_referer" "$http_user_agent"
$proxy_add_x_forwarded_for vcap_request_id:$upstream_http_x_vcap_request_id response_time:$upstream_response_time
cc.nginx_access_log_escaping:
description: "The characters escaping used for logging variables: [default | json]"
default: default
cc.nginx_error_log_destination:
description: "The nginx error log destination. This can be used to route error logs to a file, syslog, or a memory buffer."
default: "/var/vcap/sys/log/nginx_cc/nginx.error.log"
cc.nginx_error_log_level:
description: "The lowest severity nginx log level to capture in the error log."
default: error
cc.nginx_rate_limit_general:
description: "The rate limiting and burst value to use for '/'"
example: |
limit: 100r/s
burst: 500
cc.nginx_rate_limit_zones:
description: "Array of zones to do rate limiting for. "
example: |
- name: apps
location: /v2/apps
limit: 10r/s
burst: 50
- name: spaces
location: ~ ^/v2/spaces/(.*)
limit: 10r/s
burst: 100
cc.nginx_drain_timeout:
description: "Timeout for nginx graceful shutdown in seconds. Default is 30"
default: 30
cc.server_keepalive_timeout:
description: "Configure keep alive timeout for connections to cloud controller. This is a temporary field used for testing."
default: 75
cc.jobs.local.number_of_workers:
default: 2
description: "Number of local cloud_controller_worker workers"
cc.thresholds.api.alert_if_above_mb:
description: "The cc will alert if memory remains above this threshold for 3 monit cycles"
default: 3500
cc.thresholds.api.restart_if_consistently_above_mb:
description: "The cc will restart if memory remains above this threshold for n monit cycles"
default: 3500
cc.thresholds.api.restart_if_consistently_above_mb_cycles:
description: "Monit cycles for 'restart_if_consistently_above_mb'. Default is 15 cycles"
default: 15
cc.thresholds.api.restart_if_above_mb:
description: "The cc will restart if memory remains above this threshold for 3 monit cycles"
default: 3750
cc.thresholds.api.restart_if_monit_connection_test_consistently_fails_cycles:
description: "Number of monit cycles until a failing unixsocket test triggers a restart. Default is 60 cycles (i.e. 10 minutes)"
default: 60
dea_next.staging_memory_limit_mb:
description: "Memory limit in MB for staging tasks"
default: 1024
dea_next.staging_disk_limit_mb:
description: "Disk limit in MB for staging tasks"
default: 4096
cc.staging_file_descriptor_limit:
description: "File descriptor limit for staging tasks"
default: 16384
dea_next.advertise_interval_in_seconds:
description: "Advertise interval for DEAs"
default: 5
cc.renderer.max_results_per_page:
description: "Maximum number of results returned per page"
default: 100
cc.renderer.default_results_per_page:
description: "Default number of results returned per page if user does not specify"
default: 50
cc.renderer.max_inline_relations_depth:
description: "Maximum depth of inlined relationships in the result"
default: 2
cc.renderer.max_total_results:
description: "Maximum number of total results (page * per_page)"
uaa.clients.cc-service-dashboards.secret:
description: "Used for generating SSO clients for service brokers."
uaa.clients.cc-service-dashboards.scope:
description: "Used to grant scope for SSO clients for service brokers"
default: "openid,cloud_controller_service_permissions.read"
uaa.clients.cloud_controller_username_lookup.secret:
description: "Used for fetching usernames from UAA"
uaa.clients.cc_service_key_client.secret:
description: "Used for fetching service key values from CredHub"
uaa.clients.cc_routing.secret:
description: "Used for fetching routing information from the Routing API"
cc.install_buildpacks:
description: "Set of buildpacks to install during deploy"
default: []
cc.app_bits_upload_grace_period_in_seconds:
description: "Extra token expiry time while uploading big apps"
default: 1200
cc.security_group_definitions:
description: "Array of security groups that will be seeded into CloudController. Note: security groups are only seeded on the first deploy, after which they should be managed via the API"
cc.default_running_security_groups:
description: "The default running security groups that will be seeded in CloudController. Note: security groups are only seeded on the first deploy, after which they should be managed via the API"
cc.default_staging_security_groups:
description: "The default staging security groups that will be seeded in CloudController. Note: security groups are only seeded on the first deploy, after which they should be managed via the API"
cc.allowed_cors_domains:
description: "List of domains (including scheme) from which Cross-Origin requests will be accepted, a * can be used as a wildcard for any part of a domain"
default: []
cc.instance_file_descriptor_limit:
description: "The file descriptors made available to each app instance"
default: 16384
cc.statsd_host:
description: "The host for the statsd server, defaults to the local metron agent"
default: "127.0.0.1"
cc.statsd_port:
description: "The port for the statsd server, defaults to the local metron agent"
default: 8125
cc.enable_statsd_metrics:
description: "Use statsd metrics on api vms."
default: true
router.route_services_secret:
description: "Support for route services is disabled when no value is configured."