diff --git a/jobs/cc_deployment_updater/templates/cloud_controller_ng.yml.erb b/jobs/cc_deployment_updater/templates/cloud_controller_ng.yml.erb index a5af130b13..1a0a67ed25 100644 --- a/jobs/cc_deployment_updater/templates/cloud_controller_ng.yml.erb +++ b/jobs/cc_deployment_updater/templates/cloud_controller_ng.yml.erb @@ -181,9 +181,6 @@ deployment_updater: staging: timeout_in_seconds: <%= link("cloud_controller_internal").p("cc.staging_timeout_in_seconds") %> - auth: - user: <%= link("cloud_controller_internal").p("cc.staging_upload_user") %> - password: <%= yaml_escape(link("cloud_controller_internal").p("cc.staging_upload_password")) %> default_health_check_timeout: <%= link("cloud_controller_internal").p("cc.default_health_check_timeout") %> maximum_health_check_timeout: <%= link("cloud_controller_internal").p("cc.maximum_health_check_timeout") %> diff --git a/jobs/cloud_controller_clock/spec b/jobs/cloud_controller_clock/spec index 8d77fb16db..b89d6147dc 100644 --- a/jobs/cloud_controller_clock/spec +++ b/jobs/cloud_controller_clock/spec @@ -192,11 +192,6 @@ properties: default: 60 description: "Default health check timeout (in seconds) that can be set for the app" - cc.staging_upload_user: - description: "User name used to access internal endpoints of Cloud Controller to upload files when staging" - cc.staging_upload_password: - description: "User's password used to access internal endpoints of Cloud Controller to upload files when staging" - cc.storage_cli_optional_flags: description: "Storage Cli extra flags string" diff --git a/jobs/cloud_controller_clock/templates/cloud_controller_ng.yml.erb b/jobs/cloud_controller_clock/templates/cloud_controller_ng.yml.erb index 127d7a7dd4..0c6513939e 100644 --- a/jobs/cloud_controller_clock/templates/cloud_controller_ng.yml.erb +++ b/jobs/cloud_controller_clock/templates/cloud_controller_ng.yml.erb @@ -221,9 +221,6 @@ uaa: # App staging parameters staging: timeout_in_seconds: <%= p("cc.staging_timeout_in_seconds") %> - auth: - user: <%= p("cc.staging_upload_user") %> - password: <%= yaml_escape(p("cc.staging_upload_password")) %> default_health_check_timeout: <%= p("cc.default_health_check_timeout") %> diff --git a/jobs/cloud_controller_ng/spec b/jobs/cloud_controller_ng/spec index 39856a6499..3acd4f5961 100644 --- a/jobs/cloud_controller_ng/spec +++ b/jobs/cloud_controller_ng/spec @@ -161,8 +161,6 @@ provides: - cc.resource_pool.resource_directory_key - cc.stacks - cc.staging_timeout_in_seconds - - cc.staging_upload_password - - cc.staging_upload_user - cc.statsd_host - cc.statsd_port - cc.enable_statsd_metrics @@ -464,11 +462,6 @@ properties: If a stack in this list exists in the database, the Cloud Controller bootstrap VM will fail to start. The only exception to this behavior occurs when the deprecated stack is explicitly listed in cc.stacks. - cc.staging_upload_user: - description: "User name used to access internal endpoints of Cloud Controller to upload files when staging" - cc.staging_upload_password: - description: "User's password used to access internal endpoints of Cloud Controller to upload files when staging" - cc.quota_definitions: description: "Hash of default quota definitions to be seeded. This property can be used to add quotas with subsequent deploys, but not to update existing ones." default: diff --git a/jobs/cloud_controller_ng/templates/cloud_controller_ng.yml.erb b/jobs/cloud_controller_ng/templates/cloud_controller_ng.yml.erb index 341190dc73..b88dd744dd 100644 --- a/jobs/cloud_controller_ng/templates/cloud_controller_ng.yml.erb +++ b/jobs/cloud_controller_ng/templates/cloud_controller_ng.yml.erb @@ -320,9 +320,6 @@ staging: minimum_staging_memory_mb: <%= p("cc.minimum_staging_memory_mb") %> minimum_staging_disk_mb: <%= p("cc.minimum_staging_disk_mb") %> minimum_staging_file_descriptor_limit: <%= p("cc.staging_file_descriptor_limit") %> - auth: - user: <%= p("cc.staging_upload_user") %> - password: <%= yaml_escape(p("cc.staging_upload_password")) %> default_health_check_timeout: <%= p("cc.default_health_check_timeout") %> maximum_health_check_timeout: <%= p("cc.maximum_health_check_timeout") %> diff --git a/jobs/cloud_controller_ng/templates/nginx_external_endpoints.conf.erb b/jobs/cloud_controller_ng/templates/nginx_external_endpoints.conf.erb index 12c853f46e..96e6f93707 100644 --- a/jobs/cloud_controller_ng/templates/nginx_external_endpoints.conf.erb +++ b/jobs/cloud_controller_ng/templates/nginx_external_endpoints.conf.erb @@ -1,6 +1,4 @@ <% - local_blobstore = %w[packages droplets buildpacks resource_pool].any? { |type| p("cc.#{type}.blobstore_type") == 'local' } - # Allowlist: only the locations below proxy to CC; everything else 404s via the catch-all. # Allow blocks are plain-prefix / exact (never ^~) so the upload/ssh_access regex locations # keep precedence over them. @@ -110,12 +108,6 @@ location ~ ^/internal/apps/[^/]+/ssh_access/ { <%= proxy_body -%> } -<% if local_blobstore %> -location /staging/ { - <%= proxy_body -%> -} -<% end %> - location = /healthz { <%= proxy_body -%> } diff --git a/jobs/cloud_controller_worker/spec b/jobs/cloud_controller_worker/spec index 447fab534e..d17239b54f 100644 --- a/jobs/cloud_controller_worker/spec +++ b/jobs/cloud_controller_worker/spec @@ -137,10 +137,6 @@ properties: description: "Maximum health check timeout (in seconds) that can be set for the app" cc.jobs.priorities: description: "List of hashes containing delayed jobs 'display_name' and its desired priority. This will overwrite the default priority of ccng" - cc.staging_upload_user: - description: "User name used to access internal endpoints of Cloud Controller to upload files when staging" - cc.staging_upload_password: - description: "User's password used to access internal endpoints of Cloud Controller to upload files when staging" cc.storage_cli_optional_flags: description: "Storage Cli extra flags string" diff --git a/jobs/cloud_controller_worker/templates/cloud_controller_ng.yml.erb b/jobs/cloud_controller_worker/templates/cloud_controller_ng.yml.erb index ea31b5c424..1b3595fb51 100644 --- a/jobs/cloud_controller_worker/templates/cloud_controller_ng.yml.erb +++ b/jobs/cloud_controller_worker/templates/cloud_controller_ng.yml.erb @@ -170,9 +170,6 @@ uaa: # App staging parameters staging: timeout_in_seconds: <%= p("cc.staging_timeout_in_seconds") %> - auth: - user: <%= p("cc.staging_upload_user") %> - password: <%= yaml_escape(p("cc.staging_upload_password")) %> default_health_check_timeout: <%= p("cc.default_health_check_timeout") %> maximum_health_check_timeout: <%= p("cc.maximum_health_check_timeout") %> diff --git a/spec/cc_deployment_updater/cc_deployment_updater_spec.rb b/spec/cc_deployment_updater/cc_deployment_updater_spec.rb index f227affcad..763a02007a 100644 --- a/spec/cc_deployment_updater/cc_deployment_updater_spec.rb +++ b/spec/cc_deployment_updater/cc_deployment_updater_spec.rb @@ -20,8 +20,6 @@ module Test 'cc' => { 'db_logging_level' => 100, - 'staging_upload_user' => 'staging_user', - 'staging_upload_password' => 'hunter2', 'database_encryption' => { 'experimental_pbkdf2_hmac_iterations' => 123, 'skip_validation' => false, @@ -64,8 +62,6 @@ module Test 'external_protocol' => 'https', 'external_host' => 'api', 'staging_timeout_in_seconds' => 900, - 'staging_upload_user' => 'staging_user', - 'staging_upload_password' => 'staging_user_password', 'default_health_check_timeout' => 60, 'maximum_health_check_timeout' => 180, 'resource_pool' => { diff --git a/spec/cloud_controller_clock/cloud_controller_clock_spec.rb b/spec/cloud_controller_clock/cloud_controller_clock_spec.rb index 12c9e24361..ff6cf77b4a 100644 --- a/spec/cloud_controller_clock/cloud_controller_clock_spec.rb +++ b/spec/cloud_controller_clock/cloud_controller_clock_spec.rb @@ -20,8 +20,6 @@ module Test 'cc' => { 'db_logging_level' => 100, - 'staging_upload_user' => 'staging_user', - 'staging_upload_password' => 'hunter2', 'database_encryption' => { 'experimental_pbkdf2_hmac_iterations' => 123, 'skip_validation' => false, diff --git a/spec/cloud_controller_ng/cloud_controller_ng_spec.rb b/spec/cloud_controller_ng/cloud_controller_ng_spec.rb index 76402e2393..a57226114d 100644 --- a/spec/cloud_controller_ng/cloud_controller_ng_spec.rb +++ b/spec/cloud_controller_ng/cloud_controller_ng_spec.rb @@ -80,8 +80,6 @@ module Test 'stacks' => [{ 'description' => 'Cloud Foundry Linux-based filesystem', 'name' => 'cflinuxfs4' }], - 'staging_upload_password' => '((cc_staging_upload_password))', - 'staging_upload_user' => 'staging_user', 'temporary_enable_v2' => false }, 'ccdb' => { 'databases' => [{ 'name' => 'cloud_controller', 'tag' => 'cc' }], diff --git a/spec/cloud_controller_ng/nginx_spec.rb b/spec/cloud_controller_ng/nginx_spec.rb index a728c6d65e..5309e4a294 100644 --- a/spec/cloud_controller_ng/nginx_spec.rb +++ b/spec/cloud_controller_ng/nginx_spec.rb @@ -125,21 +125,6 @@ module Test @rendered_file = template.render(manifest_properties, consumes: {}) end - context 'when local blobstore is configured' do - let(:manifest_properties) { { 'cc' => { 'packages' => { 'blobstore_type' => 'local' } } } } - - it 'allows staging endpoints through to cloud controller' do - expect(@rendered_file).to match(%r(location /staging/\s*\{[^}]*proxy_pass\s+http://cloud_controller;)) - end - end - - context 'when no local blobstore is configured' do - it 'does not allow staging endpoints through to cloud controller' do - # No staging allow block is rendered; staging is denied by the catch-all 404. - expect(@rendered_file).not_to match(%r(location /staging/\s*\{[^}]*proxy_pass)) - end - end - describe 'allowlist routing' do it 'proxies the v3 API' do expect(@rendered_file).to match(%r(location = /v3\s*\{[^}]*proxy_pass\s+http://cloud_controller;)) diff --git a/spec/cloud_controller_worker/cloud_controller_worker_spec.rb b/spec/cloud_controller_worker/cloud_controller_worker_spec.rb index 7de3da9dd2..9c49521027 100644 --- a/spec/cloud_controller_worker/cloud_controller_worker_spec.rb +++ b/spec/cloud_controller_worker/cloud_controller_worker_spec.rb @@ -20,8 +20,6 @@ module Test 'cc' => { 'db_logging_level' => 100, - 'staging_upload_user' => 'staging_user', - 'staging_upload_password' => 'hunter2', 'database_encryption' => { 'experimental_pbkdf2_hmac_iterations' => 123, 'skip_validation' => false,