diego/0.1471.0

Changes from v0.1470.0 to v0.1471.0

• Verified with garden-linux-release v0.337.0.
• Verified with etcd-release v49.
• Verified with cflinuxfs2-rootfs-release v1.5.0.

Significant changes

IMPORTANT: This version of Diego fixes CVE-2016-3091, a vulnerability related to the Diego executor’s parsing of log output at UTF-8 boundaries. We strongly recommend that all operators on Diego 0.1468.0 through 0.1470.0 upgrade to Diego 0.1471.0 or later. Diego 0.1472.0 is recommended for use with the recently released CF v237.

IMPORTANT: This version of Diego removes the -r flag from its manifest-generation script entirely, causing the script to fail if provided. Operators using the manifest-generation script should remove that flag. We also realize that this removal is inconsistent with how other flags to that script have been deprecated, so it will be accepted again with a deprecation notice in the forthcoming Diego v0.1472.0 release.

IMPORTANT: The Garden team has recently renamed ‘guardian’ to ‘garden-runc’, so the -g flag to the manifest-generation script now opts the operator into using the garden-runc release instead of opting into using the guardian release. This change also requires users of the guardian release to upload the garden-runc release to their BOSH directors instead.

BBS Relational Datastore (Experimental)

• BBS can be configured to communicate to the relational store over SSL (in flight)

Routing

• Investigate route-emitter hanging forever in sync
• route-emitter should use MinimumRegisterInterval to determine how frequently it emits routes to the RouteEmitter

Volume Support (Experimental)

• Volman can discover docker drivers in an ordered list of folders

Garden-RunC Integration

• Change Diego-release manifest-generation and CI environments to use garden-runc-release instead of guardian-release

Rootfs Release Extraction

• Remove -r flag from diego manifest generation script

Component Logging and Metrics

• cloudfoundry-incubator/cf-lager #2: Remove dead variables

Test Suites and Tooling

• Run volman tests by default

BOSH job changes

None.

BOSH property changes

• Added diego.bbs.sql.ca_cert: CA certificate to use when connecting to a relational store via TLS.
• Added diego.executor.volman.driver_paths: Path string containing the directories volman will look in for voldriver specs.

- name: "diego"
  version: "0.1471.0"
  url: "https://bosh.io/d/github.com/cloudfoundry/diego-release?v=0.1471.0"
  sha1: "32d45625cd9f0bbfcda16e43e67f227d8a7ac8e5"

bosh upload-release --sha1 32d45625cd9f0bbfcda16e43e67f227d8a7ac8e5 \
  "https://bosh.io/d/github.com/cloudfoundry/diego-release?v=0.1471.0"