From c8953a7b5c632396330d9ed718dbe1bedd29d3bd Mon Sep 17 00:00:00 2001 From: Katharina Przybill <30441792+kathap@users.noreply.github.com> Date: Thu, 22 Oct 2026 10:30:48 +0200 Subject: [PATCH 1/3] wrap the auth: block in if_p("cc.staging_upload_user" --- .../templates/cloud_controller_ng.yml.erb | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/jobs/cloud_controller_ng/templates/cloud_controller_ng.yml.erb b/jobs/cloud_controller_ng/templates/cloud_controller_ng.yml.erb index 341190dc73..4e0ec69a4b 100644 --- a/jobs/cloud_controller_ng/templates/cloud_controller_ng.yml.erb +++ b/jobs/cloud_controller_ng/templates/cloud_controller_ng.yml.erb @@ -320,9 +320,11 @@ staging: minimum_staging_memory_mb: <%= p("cc.minimum_staging_memory_mb") %> minimum_staging_disk_mb: <%= p("cc.minimum_staging_disk_mb") %> minimum_staging_file_descriptor_limit: <%= p("cc.staging_file_descriptor_limit") %> +<% if_p("cc.staging_upload_user", "cc.staging_upload_password") do |user, password| %> auth: - user: <%= p("cc.staging_upload_user") %> - password: <%= yaml_escape(p("cc.staging_upload_password")) %> + user: <%= user %> + password: <%= yaml_escape(password) %> +<% end %> default_health_check_timeout: <%= p("cc.default_health_check_timeout") %> maximum_health_check_timeout: <%= p("cc.maximum_health_check_timeout") %> From 70becfec87d4e712e3f4216c6569660216f5282c Mon Sep 17 00:00:00 2001 From: Katharina Przybill <30441792+kathap@users.noreply.github.com> Date: Thu, 22 Oct 2026 10:55:57 +0200 Subject: [PATCH 2/3] Remove obsolete cc.staging_upload_user/password --- .../templates/cloud_controller_ng.yml.erb | 3 --- jobs/cloud_controller_clock/spec | 5 ----- .../templates/cloud_controller_ng.yml.erb | 3 --- jobs/cloud_controller_ng/spec | 7 ------- .../templates/cloud_controller_ng.yml.erb | 5 ----- jobs/cloud_controller_worker/spec | 4 ---- .../templates/cloud_controller_ng.yml.erb | 3 --- spec/cc_deployment_updater/cc_deployment_updater_spec.rb | 4 ---- spec/cloud_controller_clock/cloud_controller_clock_spec.rb | 2 -- spec/cloud_controller_ng/cloud_controller_ng_spec.rb | 2 -- .../cloud_controller_worker_spec.rb | 2 -- 11 files changed, 40 deletions(-) diff --git a/jobs/cc_deployment_updater/templates/cloud_controller_ng.yml.erb b/jobs/cc_deployment_updater/templates/cloud_controller_ng.yml.erb index a5af130b13..1a0a67ed25 100644 --- a/jobs/cc_deployment_updater/templates/cloud_controller_ng.yml.erb +++ b/jobs/cc_deployment_updater/templates/cloud_controller_ng.yml.erb @@ -181,9 +181,6 @@ deployment_updater: staging: timeout_in_seconds: <%= link("cloud_controller_internal").p("cc.staging_timeout_in_seconds") %> - auth: - user: <%= link("cloud_controller_internal").p("cc.staging_upload_user") %> - password: <%= yaml_escape(link("cloud_controller_internal").p("cc.staging_upload_password")) %> default_health_check_timeout: <%= link("cloud_controller_internal").p("cc.default_health_check_timeout") %> maximum_health_check_timeout: <%= link("cloud_controller_internal").p("cc.maximum_health_check_timeout") %> diff --git a/jobs/cloud_controller_clock/spec b/jobs/cloud_controller_clock/spec index 8d77fb16db..b89d6147dc 100644 --- a/jobs/cloud_controller_clock/spec +++ b/jobs/cloud_controller_clock/spec @@ -192,11 +192,6 @@ properties: default: 60 description: "Default health check timeout (in seconds) that can be set for the app" - cc.staging_upload_user: - description: "User name used to access internal endpoints of Cloud Controller to upload files when staging" - cc.staging_upload_password: - description: "User's password used to access internal endpoints of Cloud Controller to upload files when staging" - cc.storage_cli_optional_flags: description: "Storage Cli extra flags string" diff --git a/jobs/cloud_controller_clock/templates/cloud_controller_ng.yml.erb b/jobs/cloud_controller_clock/templates/cloud_controller_ng.yml.erb index 127d7a7dd4..0c6513939e 100644 --- a/jobs/cloud_controller_clock/templates/cloud_controller_ng.yml.erb +++ b/jobs/cloud_controller_clock/templates/cloud_controller_ng.yml.erb @@ -221,9 +221,6 @@ uaa: # App staging parameters staging: timeout_in_seconds: <%= p("cc.staging_timeout_in_seconds") %> - auth: - user: <%= p("cc.staging_upload_user") %> - password: <%= yaml_escape(p("cc.staging_upload_password")) %> default_health_check_timeout: <%= p("cc.default_health_check_timeout") %> diff --git a/jobs/cloud_controller_ng/spec b/jobs/cloud_controller_ng/spec index 39856a6499..3acd4f5961 100644 --- a/jobs/cloud_controller_ng/spec +++ b/jobs/cloud_controller_ng/spec @@ -161,8 +161,6 @@ provides: - cc.resource_pool.resource_directory_key - cc.stacks - cc.staging_timeout_in_seconds - - cc.staging_upload_password - - cc.staging_upload_user - cc.statsd_host - cc.statsd_port - cc.enable_statsd_metrics @@ -464,11 +462,6 @@ properties: If a stack in this list exists in the database, the Cloud Controller bootstrap VM will fail to start. The only exception to this behavior occurs when the deprecated stack is explicitly listed in cc.stacks. - cc.staging_upload_user: - description: "User name used to access internal endpoints of Cloud Controller to upload files when staging" - cc.staging_upload_password: - description: "User's password used to access internal endpoints of Cloud Controller to upload files when staging" - cc.quota_definitions: description: "Hash of default quota definitions to be seeded. This property can be used to add quotas with subsequent deploys, but not to update existing ones." default: diff --git a/jobs/cloud_controller_ng/templates/cloud_controller_ng.yml.erb b/jobs/cloud_controller_ng/templates/cloud_controller_ng.yml.erb index 4e0ec69a4b..b88dd744dd 100644 --- a/jobs/cloud_controller_ng/templates/cloud_controller_ng.yml.erb +++ b/jobs/cloud_controller_ng/templates/cloud_controller_ng.yml.erb @@ -320,11 +320,6 @@ staging: minimum_staging_memory_mb: <%= p("cc.minimum_staging_memory_mb") %> minimum_staging_disk_mb: <%= p("cc.minimum_staging_disk_mb") %> minimum_staging_file_descriptor_limit: <%= p("cc.staging_file_descriptor_limit") %> -<% if_p("cc.staging_upload_user", "cc.staging_upload_password") do |user, password| %> - auth: - user: <%= user %> - password: <%= yaml_escape(password) %> -<% end %> default_health_check_timeout: <%= p("cc.default_health_check_timeout") %> maximum_health_check_timeout: <%= p("cc.maximum_health_check_timeout") %> diff --git a/jobs/cloud_controller_worker/spec b/jobs/cloud_controller_worker/spec index 447fab534e..d17239b54f 100644 --- a/jobs/cloud_controller_worker/spec +++ b/jobs/cloud_controller_worker/spec @@ -137,10 +137,6 @@ properties: description: "Maximum health check timeout (in seconds) that can be set for the app" cc.jobs.priorities: description: "List of hashes containing delayed jobs 'display_name' and its desired priority. This will overwrite the default priority of ccng" - cc.staging_upload_user: - description: "User name used to access internal endpoints of Cloud Controller to upload files when staging" - cc.staging_upload_password: - description: "User's password used to access internal endpoints of Cloud Controller to upload files when staging" cc.storage_cli_optional_flags: description: "Storage Cli extra flags string" diff --git a/jobs/cloud_controller_worker/templates/cloud_controller_ng.yml.erb b/jobs/cloud_controller_worker/templates/cloud_controller_ng.yml.erb index ea31b5c424..1b3595fb51 100644 --- a/jobs/cloud_controller_worker/templates/cloud_controller_ng.yml.erb +++ b/jobs/cloud_controller_worker/templates/cloud_controller_ng.yml.erb @@ -170,9 +170,6 @@ uaa: # App staging parameters staging: timeout_in_seconds: <%= p("cc.staging_timeout_in_seconds") %> - auth: - user: <%= p("cc.staging_upload_user") %> - password: <%= yaml_escape(p("cc.staging_upload_password")) %> default_health_check_timeout: <%= p("cc.default_health_check_timeout") %> maximum_health_check_timeout: <%= p("cc.maximum_health_check_timeout") %> diff --git a/spec/cc_deployment_updater/cc_deployment_updater_spec.rb b/spec/cc_deployment_updater/cc_deployment_updater_spec.rb index f227affcad..763a02007a 100644 --- a/spec/cc_deployment_updater/cc_deployment_updater_spec.rb +++ b/spec/cc_deployment_updater/cc_deployment_updater_spec.rb @@ -20,8 +20,6 @@ module Test 'cc' => { 'db_logging_level' => 100, - 'staging_upload_user' => 'staging_user', - 'staging_upload_password' => 'hunter2', 'database_encryption' => { 'experimental_pbkdf2_hmac_iterations' => 123, 'skip_validation' => false, @@ -64,8 +62,6 @@ module Test 'external_protocol' => 'https', 'external_host' => 'api', 'staging_timeout_in_seconds' => 900, - 'staging_upload_user' => 'staging_user', - 'staging_upload_password' => 'staging_user_password', 'default_health_check_timeout' => 60, 'maximum_health_check_timeout' => 180, 'resource_pool' => { diff --git a/spec/cloud_controller_clock/cloud_controller_clock_spec.rb b/spec/cloud_controller_clock/cloud_controller_clock_spec.rb index 12c9e24361..ff6cf77b4a 100644 --- a/spec/cloud_controller_clock/cloud_controller_clock_spec.rb +++ b/spec/cloud_controller_clock/cloud_controller_clock_spec.rb @@ -20,8 +20,6 @@ module Test 'cc' => { 'db_logging_level' => 100, - 'staging_upload_user' => 'staging_user', - 'staging_upload_password' => 'hunter2', 'database_encryption' => { 'experimental_pbkdf2_hmac_iterations' => 123, 'skip_validation' => false, diff --git a/spec/cloud_controller_ng/cloud_controller_ng_spec.rb b/spec/cloud_controller_ng/cloud_controller_ng_spec.rb index 76402e2393..a57226114d 100644 --- a/spec/cloud_controller_ng/cloud_controller_ng_spec.rb +++ b/spec/cloud_controller_ng/cloud_controller_ng_spec.rb @@ -80,8 +80,6 @@ module Test 'stacks' => [{ 'description' => 'Cloud Foundry Linux-based filesystem', 'name' => 'cflinuxfs4' }], - 'staging_upload_password' => '((cc_staging_upload_password))', - 'staging_upload_user' => 'staging_user', 'temporary_enable_v2' => false }, 'ccdb' => { 'databases' => [{ 'name' => 'cloud_controller', 'tag' => 'cc' }], diff --git a/spec/cloud_controller_worker/cloud_controller_worker_spec.rb b/spec/cloud_controller_worker/cloud_controller_worker_spec.rb index 7de3da9dd2..9c49521027 100644 --- a/spec/cloud_controller_worker/cloud_controller_worker_spec.rb +++ b/spec/cloud_controller_worker/cloud_controller_worker_spec.rb @@ -20,8 +20,6 @@ module Test 'cc' => { 'db_logging_level' => 100, - 'staging_upload_user' => 'staging_user', - 'staging_upload_password' => 'hunter2', 'database_encryption' => { 'experimental_pbkdf2_hmac_iterations' => 123, 'skip_validation' => false, From 984acd644262fc89a42f50a3133a261b9a3e9178 Mon Sep 17 00:00:00 2001 From: Katharina Przybill <30441792+kathap@users.noreply.github.com> Date: Thu, 5 Nov 2026 14:21:57 +0100 Subject: [PATCH 3/3] Remove local blobstore nginx routing from capi-releas --- .../templates/nginx_external_endpoints.conf.erb | 8 -------- spec/cloud_controller_ng/nginx_spec.rb | 15 --------------- 2 files changed, 23 deletions(-) diff --git a/jobs/cloud_controller_ng/templates/nginx_external_endpoints.conf.erb b/jobs/cloud_controller_ng/templates/nginx_external_endpoints.conf.erb index 12c853f46e..96e6f93707 100644 --- a/jobs/cloud_controller_ng/templates/nginx_external_endpoints.conf.erb +++ b/jobs/cloud_controller_ng/templates/nginx_external_endpoints.conf.erb @@ -1,6 +1,4 @@ <% - local_blobstore = %w[packages droplets buildpacks resource_pool].any? { |type| p("cc.#{type}.blobstore_type") == 'local' } - # Allowlist: only the locations below proxy to CC; everything else 404s via the catch-all. # Allow blocks are plain-prefix / exact (never ^~) so the upload/ssh_access regex locations # keep precedence over them. @@ -110,12 +108,6 @@ location ~ ^/internal/apps/[^/]+/ssh_access/ { <%= proxy_body -%> } -<% if local_blobstore %> -location /staging/ { - <%= proxy_body -%> -} -<% end %> - location = /healthz { <%= proxy_body -%> } diff --git a/spec/cloud_controller_ng/nginx_spec.rb b/spec/cloud_controller_ng/nginx_spec.rb index a728c6d65e..5309e4a294 100644 --- a/spec/cloud_controller_ng/nginx_spec.rb +++ b/spec/cloud_controller_ng/nginx_spec.rb @@ -125,21 +125,6 @@ module Test @rendered_file = template.render(manifest_properties, consumes: {}) end - context 'when local blobstore is configured' do - let(:manifest_properties) { { 'cc' => { 'packages' => { 'blobstore_type' => 'local' } } } } - - it 'allows staging endpoints through to cloud controller' do - expect(@rendered_file).to match(%r(location /staging/\s*\{[^}]*proxy_pass\s+http://cloud_controller;)) - end - end - - context 'when no local blobstore is configured' do - it 'does not allow staging endpoints through to cloud controller' do - # No staging allow block is rendered; staging is denied by the catch-all 404. - expect(@rendered_file).not_to match(%r(location /staging/\s*\{[^}]*proxy_pass)) - end - end - describe 'allowlist routing' do it 'proxies the v3 API' do expect(@rendered_file).to match(%r(location = /v3\s*\{[^}]*proxy_pass\s+http://cloud_controller;))