kathap · Oct 22, 2026 · Oct 22, 2026 · Nov 5, 2026
diff --git a/jobs/cc_deployment_updater/templates/cloud_controller_ng.yml.erb b/jobs/cc_deployment_updater/templates/cloud_controller_ng.yml.erb
@@ -181,9 +181,6 @@ deployment_updater:
 
 staging:
   timeout_in_seconds: <%= link("cloud_controller_internal").p("cc.staging_timeout_in_seconds") %>
-  auth:
-    user: <%= link("cloud_controller_internal").p("cc.staging_upload_user") %>
-    password: <%= yaml_escape(link("cloud_controller_internal").p("cc.staging_upload_password")) %>
 
 default_health_check_timeout: <%= link("cloud_controller_internal").p("cc.default_health_check_timeout") %>
 maximum_health_check_timeout: <%= link("cloud_controller_internal").p("cc.maximum_health_check_timeout") %>

diff --git a/jobs/cloud_controller_clock/spec b/jobs/cloud_controller_clock/spec
@@ -192,11 +192,6 @@ properties:
     default: 60
     description: "Default health check timeout (in seconds) that can be set for the app"
 
-  cc.staging_upload_user:
-    description: "User name used to access internal endpoints of Cloud Controller to upload files when staging"
-  cc.staging_upload_password:
-    description: "User's password used to access internal endpoints of Cloud Controller to upload files when staging"
-
   cc.storage_cli_optional_flags:
     description: "Storage Cli extra flags string"
 

diff --git a/jobs/cloud_controller_clock/templates/cloud_controller_ng.yml.erb b/jobs/cloud_controller_clock/templates/cloud_controller_ng.yml.erb
@@ -221,9 +221,6 @@ uaa:
 # App staging parameters
 staging:
   timeout_in_seconds: <%= p("cc.staging_timeout_in_seconds") %>
-  auth:
-    user: <%= p("cc.staging_upload_user") %>
-    password: <%= yaml_escape(p("cc.staging_upload_password")) %>
 
 default_health_check_timeout: <%= p("cc.default_health_check_timeout") %>
 

diff --git a/jobs/cloud_controller_ng/spec b/jobs/cloud_controller_ng/spec
@@ -161,8 +161,6 @@ provides:
   - cc.resource_pool.resource_directory_key
   - cc.stacks
   - cc.staging_timeout_in_seconds
-  - cc.staging_upload_password
-  - cc.staging_upload_user
   - cc.statsd_host
   - cc.statsd_port
   - cc.enable_statsd_metrics
@@ -464,11 +462,6 @@ properties:
       If a stack in this list exists in the database, the Cloud Controller bootstrap VM will fail to start. 
       The only exception to this behavior occurs when the deprecated stack is explicitly listed in cc.stacks.
 
-  cc.staging_upload_user:
-    description: "User name used to access internal endpoints of Cloud Controller to upload files when staging"
-  cc.staging_upload_password:
-    description: "User's password used to access internal endpoints of Cloud Controller to upload files when staging"
-
   cc.quota_definitions:
     description: "Hash of default quota definitions to be seeded. This property can be used to add quotas with subsequent deploys, but not to update existing ones."
     default:

diff --git a/jobs/cloud_controller_ng/templates/cloud_controller_ng.yml.erb b/jobs/cloud_controller_ng/templates/cloud_controller_ng.yml.erb
@@ -320,9 +320,6 @@ staging:
   minimum_staging_memory_mb: <%= p("cc.minimum_staging_memory_mb") %>
   minimum_staging_disk_mb: <%= p("cc.minimum_staging_disk_mb") %>
   minimum_staging_file_descriptor_limit: <%= p("cc.staging_file_descriptor_limit") %>
-  auth:
-    user: <%= p("cc.staging_upload_user") %>
-    password: <%= yaml_escape(p("cc.staging_upload_password")) %>
 
 default_health_check_timeout: <%= p("cc.default_health_check_timeout") %>
 maximum_health_check_timeout: <%= p("cc.maximum_health_check_timeout") %>

diff --git a/jobs/cloud_controller_ng/templates/nginx_external_endpoints.conf.erb b/jobs/cloud_controller_ng/templates/nginx_external_endpoints.conf.erb
@@ -1,6 +1,4 @@
 <%
-  local_blobstore = %w[packages droplets buildpacks resource_pool].any? { |type| p("cc.#{type}.blobstore_type") == 'local' }
-
   # Allowlist: only the locations below proxy to CC; everything else 404s via the catch-all.
   # Allow blocks are plain-prefix / exact (never ^~) so the upload/ssh_access regex locations
   # keep precedence over them.
@@ -110,12 +108,6 @@ location ~ ^/internal/apps/[^/]+/ssh_access/ {
   <%= proxy_body -%>
 }
 
-<% if local_blobstore %>
-location /staging/ {
-  <%= proxy_body -%>
-}
-<% end %>
-
 location = /healthz {
   <%= proxy_body -%>
 }

diff --git a/jobs/cloud_controller_worker/spec b/jobs/cloud_controller_worker/spec
@@ -137,10 +137,6 @@ properties:
     description: "Maximum health check timeout (in seconds) that can be set for the app"
   cc.jobs.priorities:
     description: "List of hashes containing delayed jobs 'display_name' and its desired priority. This will overwrite the default priority of ccng"
-  cc.staging_upload_user:
-    description: "User name used to access internal endpoints of Cloud Controller to upload files when staging"
-  cc.staging_upload_password:
-    description: "User's password used to access internal endpoints of Cloud Controller to upload files when staging"
 
   cc.storage_cli_optional_flags:
     description: "Storage Cli extra flags string"

diff --git a/jobs/cloud_controller_worker/templates/cloud_controller_ng.yml.erb b/jobs/cloud_controller_worker/templates/cloud_controller_ng.yml.erb
@@ -170,9 +170,6 @@ uaa:
 # App staging parameters
 staging:
   timeout_in_seconds: <%= p("cc.staging_timeout_in_seconds") %>
-  auth:
-    user: <%= p("cc.staging_upload_user") %>
-    password: <%= yaml_escape(p("cc.staging_upload_password")) %>
 
 default_health_check_timeout: <%= p("cc.default_health_check_timeout") %>
 maximum_health_check_timeout: <%= p("cc.maximum_health_check_timeout") %>

diff --git a/spec/cc_deployment_updater/cc_deployment_updater_spec.rb b/spec/cc_deployment_updater/cc_deployment_updater_spec.rb
@@ -20,8 +20,6 @@ module Test
             'cc' => {
 
               'db_logging_level' => 100,
-              'staging_upload_user' => 'staging_user',
-              'staging_upload_password' => 'hunter2',
               'database_encryption' => {
                 'experimental_pbkdf2_hmac_iterations' => 123,
                 'skip_validation' => false,
@@ -64,8 +62,6 @@ module Test
               'external_protocol' => 'https',
               'external_host' => 'api',
               'staging_timeout_in_seconds' => 900,
-              'staging_upload_user' => 'staging_user',
-              'staging_upload_password' => 'staging_user_password',
               'default_health_check_timeout' => 60,
               'maximum_health_check_timeout' => 180,
               'resource_pool' => {

diff --git a/spec/cloud_controller_clock/cloud_controller_clock_spec.rb b/spec/cloud_controller_clock/cloud_controller_clock_spec.rb
@@ -20,8 +20,6 @@ module Test
             'cc' => {
 
               'db_logging_level' => 100,
-              'staging_upload_user' => 'staging_user',
-              'staging_upload_password' => 'hunter2',
               'database_encryption' => {
                 'experimental_pbkdf2_hmac_iterations' => 123,
                 'skip_validation' => false,

diff --git a/spec/cloud_controller_ng/cloud_controller_ng_spec.rb b/spec/cloud_controller_ng/cloud_controller_ng_spec.rb
@@ -80,8 +80,6 @@ module Test
                 'stacks' =>
                   [{ 'description' => 'Cloud Foundry Linux-based filesystem',
                      'name' => 'cflinuxfs4' }],
-                'staging_upload_password' => '((cc_staging_upload_password))',
-                'staging_upload_user' => 'staging_user',
                 'temporary_enable_v2' => false },
             'ccdb' =>
               { 'databases' => [{ 'name' => 'cloud_controller', 'tag' => 'cc' }],

diff --git a/spec/cloud_controller_ng/nginx_spec.rb b/spec/cloud_controller_ng/nginx_spec.rb
@@ -125,21 +125,6 @@ module Test
             @rendered_file = template.render(manifest_properties, consumes: {})
           end
 
-          context 'when local blobstore is configured' do
-            let(:manifest_properties) { { 'cc' => { 'packages' => { 'blobstore_type' => 'local' } } } }
-
-            it 'allows staging endpoints through to cloud controller' do
-              expect(@rendered_file).to match(%r(location /staging/\s*\{[^}]*proxy_pass\s+http://cloud_controller;))
-            end
-          end
-
-          context 'when no local blobstore is configured' do
-            it 'does not allow staging endpoints through to cloud controller' do
-              # No staging allow block is rendered; staging is denied by the catch-all 404.
-              expect(@rendered_file).not_to match(%r(location /staging/\s*\{[^}]*proxy_pass))
-            end
-          end
-
           describe 'allowlist routing' do
             it 'proxies the v3 API' do
               expect(@rendered_file).to match(%r(location = /v3\s*\{[^}]*proxy_pass\s+http://cloud_controller;))

diff --git a/spec/cloud_controller_worker/cloud_controller_worker_spec.rb b/spec/cloud_controller_worker/cloud_controller_worker_spec.rb
@@ -20,8 +20,6 @@ module Test
             'cc' => {
 
               'db_logging_level' => 100,
-              'staging_upload_user' => 'staging_user',
-              'staging_upload_password' => 'hunter2',
               'database_encryption' => {
                 'experimental_pbkdf2_hmac_iterations' => 123,
                 'skip_validation' => false,