Target standard cf-deployment and isolate instant-bosh compatibility

.github/workflows/acceptance.yml

@@ -18,13 +18,11 @@ jobs:
     env:
       GOTOOLCHAIN: local
     steps:
-    - name: Add 8 GiB swap
+    - name: Disable runner swap
       run: |
-        sudo install -m 600 /dev/null /swapfile-juicefs
-        sudo fallocate -l 8G /swapfile-juicefs
-        sudo mkswap /swapfile-juicefs
-        sudo swapon /swapfile-juicefs
+        sudo swapoff --all
         swapon --show
+        test "$(swapon --show --noheadings | wc -l)" -eq 0
         free -h
         df -h /
     - uses: actions/checkout@v4
@@ -37,12 +35,18 @@ jobs:
         cache-dependency-path: |
           src/juicefs/go.sum
           src/juicefs-acceptance-tests/go.sum
+          deployment/tests/go.sum
     - name: Load pinned tool versions
       run: |
         source scripts/acceptance/versions.env
         echo "INSTANT_BOSH_REVISION=$INSTANT_BOSH_REVISION" >> "$GITHUB_ENV"
         echo "BOSH_CLI_VERSION=$BOSH_CLI_VERSION" >> "$GITHUB_ENV"
         echo "ACCEPTANCE_WORK_DIR=$RUNNER_TEMP/juicefs-acceptance" >> "$GITHUB_ENV"
+    - name: Start resource sampling
+      run: |
+        mkdir -p "$ACCEPTANCE_WORK_DIR/artifacts"
+        nohup bash scripts/acceptance/sample-resources > "$ACCEPTANCE_WORK_DIR/artifacts/resource-timeline.log" 2>&1 < /dev/null &
+        echo "$!" > "$ACCEPTANCE_WORK_DIR/resource-sampler.pid"
     - uses: actions/checkout@v4
       with:
         repository: rkoster/instant-bosh
@@ -60,6 +64,8 @@ jobs:
     - name: Run local acceptance component checks
       working-directory: src/juicefs-acceptance-tests
       run: go test -mod=vendor -race ./... -ginkgo.randomize-all
+    - name: Validate deployment configuration
+      run: scripts/test-deployment
     - name: Start instant-bosh Docker director
       timeout-minutes: 20
       run: |

AGENTS.md

@@ -14,7 +14,9 @@ Their build indexes in `.final_builds/` are tracked; package blobs are stored in
 the GCS release blobstore.
 Run `git submodule update --init --recursive` after cloning. Upstream Go submodules use
 `pre_packaging` hooks to run `go mod vendor` in BOSH's temporary source copy.
-Run `devbox run -- bosh create-release --force` so Go 1.25 is available locally.
+Use Go 1.25, Git, and OpenSSL for local release creation; Devbox can provide these
+tools but is optional. Run `bosh create-release --force` when they are already on
+`PATH`, or `devbox run -- bosh create-release --force` to use the declared versions.
 Release creation needs module network access or a populated module cache;
 compilation VMs receive the generated vendor trees and build offline.
 Release-owned Go modules check in their vendor directories, go.mod/go.sum,
@@ -24,9 +26,12 @@ run `scripts/generate-fakes` to regenerate fakes using the pinned vendored tool.
 `juicefs-acceptance-tests` packages a static test app and a compiled Ginkgo BOSH
 errand. Local checks include a TLS CF API fixture; the live suite requires
 `JUICEFS_ACCEPTANCE_CONFIG`. CI orchestration lives in `scripts/acceptance/run`;
+failure diagnostics are captured through `GinkgoWriter` before app cleanup;
 see `docs/acceptance-testing.md`. The workflow currently uses the standard
-GitHub-hosted `ubuntu-latest` runner. Keep instant-bosh CLI/image pins together
-in `scripts/acceptance/versions.env`. Run the orchestration only on disposable hosts.
+GitHub-hosted `ubuntu-latest` runner. CI currently disables swap and samples
+resource pressure; see the acceptance testing documentation for the diagnostic
+artifacts. Keep instant-bosh CLI/image pins together in
+`scripts/acceptance/versions.env`. Run the orchestration only on disposable hosts.
 Do not check generated vendor trees for upstream submodules into Git.
 `packages/juicefs` contains only the upstream client. Release-owned tools have
 separate packages and Go modules under matching `src/` directories; these compile
@@ -91,9 +96,9 @@ The JuiceFS deployment runs Postgres and WebDAV in `juicefs-backends`, separatel
 from the broker and full-root `juicefs-volume` mount in `juicefs-broker`.
 This allows bootstrap initialization to connect to the backends. The launcher
 also allows a colocated Azure PostgreSQL auth proxy to start concurrently.
-The CF runtime-config targets the
-live `compute` group for the isolated
-volume driver. `juicefs-volume` is a foreground FUSE client managed
+The default CF runtime-config targets upstream cf-deployment's `diego-cell` for
+the isolated volume driver; instant-bosh compatibility targets `compute`.
+`juicefs-volume` is a foreground FUSE client managed
 directly by Monit. Its
 launcher checks the host `/dev/fuse` device and logs under
 `/var/vcap/sys/log/juicefs-volume/`. JuiceFS enables go-fuse direct mounting, so
@@ -134,6 +139,8 @@ details. `scripts/deploy` is the source of truth for the instant-bosh deployment
 sequence. The CF runtime-config consumes the broker mounter's shared
 `juicefs_mount` link; the mounter defines the backend configuration and
 filesystem name. The driver mounts only the service-instance subdirectory.
+Deployment ops/runtime-config target coverage is in `deployment/tests`; run
+`go test ./...` there with BOSH CLI installed.
 
 Service bindings are synchronous and stateless; binding retrieval is not
 implemented. The optional `mount` binding parameter selects an absolute container

README.md

@@ -54,9 +54,10 @@ on `spec.bootstrap` when `juicefs.volume.initialize` is enabled.
 `juicefs format --no-update` leaves existing filesystems unchanged; backend errors
 fail startup.
 
-The CF runtime-config adds the volume driver to `compute`. It consumes the
-broker VM's shared `juicefs_mount` BOSH link for
-the filesystem name and all backend settings, credentials, and trust roots.
+The default CF runtime-config adds the volume driver to upstream cf-deployment's
+`diego-cell` group; an instant-bosh compatibility variant targets its consolidated
+`compute` group. The driver consumes the broker VM's shared `juicefs_mount` BOSH
+link for the filesystem name and all backend settings, credentials, and trust roots.
 The broker's volume mounter is the authoritative configuration source;
 registration errands are colocated on `juicefs-broker` in the JuiceFS deployment.
 
@@ -77,12 +78,15 @@ the endpoint, not the filesystem UUID or stored objects.
 
 - [BOSH CLI v2](https://bosh.io/docs/cli-v2/) and a reachable director with a config
   server for manifest variables.
-- [Devbox](https://www.jetify.com/devbox) for the local Go, Git, and OpenSSL tools.
+- Go 1.25, Git, and OpenSSL to build the release locally. They must be available
+  on `PATH`; Devbox is an optional convenience for providing these tools, not a
+  project requirement.
 - A director with an `ubuntu-noble` stemcell and cloud-config containing `z1`,
   network `default`, and VM type `default`.
-- An existing CF deployment named `cf`. The supplied configuration targets the
-  lab's `control` and `compute` groups; adapt the runtime-config and ops file to
-  your topology before using another deployment.
+- An existing CF deployment named `cf`. Default CF ops/runtime-configs target
+  upstream cf-deployment groups. Instant-bosh's consolidated group names are
+  isolated in `deployment/operations/cf/instant-bosh/` and
+  `deployment/runtime-configs/instant-bosh/`.
 - Local release blobs and vendored-package build indexes, as described below.
 - A CF CLI authenticated to the target organization and space for app testing.
 
@@ -91,18 +95,24 @@ the endpoint, not the filesystem UUID or stored objects.
 ```sh
 git clone --recurse-submodules https://github.com/cloudfoundry/juicefs-release.git
 cd juicefs-release
-devbox install
 ```
 
 If you cloned without submodules, run `git submodule update --init --recursive`.
 The pinned upstream source is in `src/juicefs`. Each upstream submodule package's `pre_packaging`
 hook runs `go mod vendor` against BOSH's temporary source copy before archiving
-the package. Run release creation inside Devbox so Go 1.25 is available:
+the package. Release creation requires Go 1.25, Git, OpenSSL, and the BOSH CLI.
+Install those prerequisites directly, or use [Devbox](https://www.jetify.com/devbox)
+to enter a shell with the repository's declared Go, Git, and OpenSSL versions:
 
 ```sh
+devbox install
 devbox run -- bosh create-release --force
 ```
 
+When the prerequisites are already on `PATH`, run `bosh create-release --force`
+directly. `devbox run deploy` is likewise a convenient wrapper around
+`scripts/deploy`; the deployment workflow itself does not require Devbox.
+
 Release creation needs access to the pinned Go modules (or a populated local
 module cache). Compilation VMs receive the generated vendor trees and compile
 with module downloads disabled. Upstream dependencies are not stored in Git
@@ -135,27 +145,29 @@ credentials. The development environment uses a copy from
 
 ## Deploy and register
 
-From the release root:
+For the **instant-bosh lab environment only**, run from the release root with
+the prerequisites above available:
 
 ```sh
-devbox run deploy
+./scripts/deploy
 ```
 
-This command:
+Alternatively, run `devbox run deploy` to use the same script inside the
+optional Devbox environment. `scripts/deploy` is the source of truth for the
+deployment sequence:
 
-1. Sources `bosh.env` and creates and uploads a development release.
-2. Reads CF's system domain and deploys `deployment/juicefs.yml` with
-   `deployment/operations/non-ha-validation.yml` and the instant-bosh DNS
-   workaround `deployment/operations/misc/ibosh-bosh-dns-fix.yml`. The
-   `misc/ibosh-cf-credentials.yml` ops reuses CF credentials in instant-bosh's
-   config server; `scripts/deploy` supplies the system domain from CF's manifest.
-3. Updates the named `juicefs` runtime-config with the built release's explicit
-   version and redeploys CF, applying
-   `deployment/operations/cf/non-ha-validation.yml`,
-   `deployment/operations/cf/enable-volume-services.yml`.
+This lab script reads credentials from `bosh.env`, builds and uploads the release, deploys
+JuiceFS with the non-HA validation configuration, updates the JuiceFS runtime
+config, and redeploys CF with the volume-service configuration. See the
+deployment and operations files for environment-specific settings. It uses
+instant-bosh's `control`/`compute` groups and credential/DNS compatibility ops.
+For upstream cf-deployment, use the standard
+[CF operations and runtime-config](deployment/runtime-configs/README.md#standard-cf-deployment-and-instant-bosh)
+with your deployment's backend, credential, and DNS configuration.
 
 The main JuiceFS manifest colocates `register-broker` and `deregister-broker`
-as errands on the broker VM. Registration is a separate step, also needed after catalog changes:
+as errands on the broker VM. Registration is a separate step, also needed after
+catalog changes:
 
 ```sh
 source bosh.env
@@ -274,8 +286,8 @@ retries do not reset quotas. Pre-quota instances retain the unlimited shared
 plan. Broker VM replacement does not lose these records.
 
 Plan configuration changes affect **new instances only**. Plan upgrades and
-downgrades are not supported. Run `devbox run deploy` and the registration
-errand after changing the catalog.
+downgrades are not supported. Run `./scripts/deploy` (or `devbox run deploy`)
+and the registration errand after changing the catalog.
 
 Quotas limit directory usage; they do not reserve backend disk space. Physical
 object consumption can differ because of compression, deleted objects, and
@@ -318,11 +330,13 @@ link. CF's volume driver consumes that link directly from deployment
 `juicefs`; they have no independent backend overrides. Broker quota operations
 reuse the mounter's rendered configuration, including its metadata engine.
 
-`deployment/operations/use-mysql-s3.yml` provides an example deployment ops file with
-external backend variables. PostgreSQL/WebDAV is selected by the non-HA validation ops file. Provision
+`deployment/operations/use-mysql-s3.yml` provides an example deployment ops file
+with external backend variables. PostgreSQL/WebDAV is selected by the non-HA
+validation ops file. Provision
 the external database, object bucket, and access credentials before initializing
 a new filesystem. External backend ops can be applied directly to the base
-manifest without deploying singleton backend jobs. Changing properties is not a data migration: `format --no-update` does
+manifest without deploying singleton backend jobs. Changing properties is not a
+data migration: `format --no-update` does
 not rewrite an existing filesystem's storage settings or copy metadata/objects.
 
 The linked PostgreSQL/WebDAV configuration is validated on the live POC;
@@ -395,11 +409,24 @@ Run all suites with race detection and randomized order, and report statement
 coverage excluding generated fakes:
 
 ```sh
-devbox run -- scripts/test-go
-GINKGO_SEED=8675309 devbox run -- scripts/test-go
-devbox run -- scripts/generate-fakes
+scripts/test-go
+GINKGO_SEED=8675309 scripts/test-go
+scripts/generate-fakes
 ```
 
+These commands require Go 1.25 on `PATH`; use `devbox run --` before a command
+if you want Devbox to provide the declared tool versions.
+
+Run the deployment configuration tests with:
+
+```sh
+scripts/test-deployment
+```
+
+The tests validate deployment operations and runtime-config targets against
+checked-in standard cf-deployment and instant-bosh fixtures. See
+[deployment tests](deployment/tests/README.md) for coverage and prerequisites.
+
 Coverage profiles default to `/tmp/juicefs-release-coverage`; override with
 `COVERAGE_DIR`. Tests and fake generation use the checked-in vendor trees with
 network downloads disabled. When updating a release-owned module's dependencies,

deployment/operations/cf/enable-juicefs-acceptance-tests.yml

@@ -6,7 +6,7 @@
     azs: [z1]
     instances: 1
     lifecycle: errand
-    vm_type: default
+    vm_type: minimal
     stemcell: default
     networks: [{name: default}]
     jobs:

deployment/operations/cf/enable-volume-services.yml

@@ -1,9 +1,9 @@
 - type: replace
-  path: /instance_groups/name=control/jobs/name=cloud_controller_ng/properties/cc/volume_services_enabled?
+  path: /instance_groups/name=api/jobs/name=cloud_controller_ng/properties/cc/volume_services_enabled?
   value: true
 - type: replace
-  path: /instance_groups/name=control/jobs/name=cloud_controller_worker/properties/cc/volume_services_enabled?
+  path: /instance_groups/name=cc-worker/jobs/name=cloud_controller_worker/properties/cc/volume_services_enabled?
   value: true
 - type: replace
-  path: /instance_groups/name=control/jobs/name=cloud_controller_clock/properties/cc/volume_services_enabled?
+  path: /instance_groups/name=scheduler/jobs/name=cloud_controller_clock/properties/cc/volume_services_enabled?
   value: true

deployment/operations/cf/instant-bosh/acceptance-errand-vm.yml

@@ -0,0 +1,4 @@
+# instant-bosh cloud-config exposes only the `default` VM type.
+- type: replace
+  path: /instance_groups/name=juicefs-acceptance-tests/vm_type
+  value: default

deployment/operations/cf/instant-bosh/enable-volume-services.yml

@@ -0,0 +1,11 @@
+# Instant-bosh only: cf-deployment's api, cc-worker, and scheduler jobs are
+# consolidated into the `control` instance group.
+- type: replace
+  path: /instance_groups/name=control/jobs/name=cloud_controller_ng/properties/cc/volume_services_enabled?
+  value: true
+- type: replace
+  path: /instance_groups/name=control/jobs/name=cloud_controller_worker/properties/cc/volume_services_enabled?
+  value: true
+- type: replace
+  path: /instance_groups/name=control/jobs/name=cloud_controller_clock/properties/cc/volume_services_enabled?
+  value: true

deployment/operations/cf/non-ha-validation.yml

@@ -1,4 +1,5 @@
-# Apply to CF when using the singleton backends in ../non-ha-validation.yml.
+# Adds validation backend DNS aliases to upstream cf-deployment. The alias
+# targets the JuiceFS deployment and is independent of CF instance-group names.
 - type: replace
   path: /addons/name=bosh-dns-aliases/jobs/name=bosh-dns-aliases/properties/aliases/domain=blobstore.service.juicefs.internal?
   value:

deployment/runtime-configs/README.md

@@ -2,9 +2,10 @@
 
 ## JuiceFS volume driver
 
-[`juicefs-volume-driver.yml`](juicefs-volume-driver.yml) installs the JuiceFS
-volume driver on Cloud Foundry Diego cells. It adds the `juicefs-volume-driver`
-job to the `compute` instance group in deployment `cf`, enabling cells to mount
+[`juicefs-volume-driver.yml`](juicefs-volume-driver.yml) is the default runtime-config
+for upstream `cf-deployment`. It installs the JuiceFS volume driver on Diego
+cells by adding the `juicefs-volume-driver` job to the `diego-cell` instance
+group in deployment `cf`, enabling cells to mount
 the service-instance directories provisioned by the JuiceFS broker. Adjust the
 addon's `include` filters if your CF deployment or cell group has another name.
 
@@ -43,3 +44,15 @@ For instant-bosh development environments, DNS is currently embedded only in CF.
 Apply [`../operations/misc/ibosh-bosh-dns-fix.yml`](../operations/misc/ibosh-bosh-dns-fix.yml)
 to JuiceFS to reuse CF's global DNS certificates. Omit this workaround when the
 director already supplies DNS through a runtime-config.
+
+## Standard cf-deployment and instant-bosh
+
+The default runtime-config and CF operations target upstream `cf-deployment`
+groups. For instant-bosh's consolidated manifest, use the matching files under
+`instant-bosh/`; its `api`, `cc-worker`, and `scheduler` groups are combined as
+`control`, while `diego-cell` becomes `compute`. Acceptance and Devbox scripts
+select the instant-bosh variants.
+
+Run `scripts/test-deployment` from the repository root to check deployment
+operations and runtime-config targets against the checked-in standard CF and
+instant-bosh fixtures.

deployment/runtime-configs/instant-bosh/juicefs-volume-driver.yml

@@ -0,0 +1,15 @@
+# Instant-bosh only: the upstream diego-cell group is consolidated as `compute`.
+releases:
+- name: juicefs
+  version: ((juicefs_release_version))
+
+addons:
+- name: juicefs-volume-driver
+  include:
+    deployments: [cf]
+    instance_groups: [compute]
+  jobs:
+  - name: juicefs-volume-driver
+    release: juicefs
+    consumes:
+      juicefs_volume: {from: juicefs_mount, deployment: juicefs}

deployment/runtime-configs/juicefs-volume-driver.yml

@@ -6,7 +6,7 @@ addons:
 - name: juicefs-volume-driver
   include:
     deployments: [cf]
-    instance_groups: [compute]
+    instance_groups: [diego-cell]
   jobs:
   - name: juicefs-volume-driver
     release: juicefs

deployment/runtime-configs/operations/use-azure-managed-identities.yml

@@ -1,4 +1,4 @@
-# Apply to deployment/runtime-configs/juicefs-volume-driver.yml; requires BPM on compute.
+# Apply to the selected JuiceFS volume-driver runtime-config; requires BPM on each targeted CF Diego cell.
 - type: replace
   path: /addons/name=juicefs-volume-driver/jobs/-
   value:

deployment/tests/README.md

@@ -0,0 +1,18 @@
+# Deployment configuration tests
+
+This Go test package checks the CF ops/runtime-config targets with
+`bosh interpolate`. Fixtures represent the standard upstream group names and
+instant-bosh's consolidated names. The tests verify that the default config
+targets `api`, `cc-worker`, `scheduler`, and `diego-cell`, while the explicit
+instant-bosh compatibility files target `control` and `compute`.
+
+Run the fixture-backed tests from the repository root with Go 1.25 and BOSH CLI installed:
+
+```sh
+scripts/test-deployment
+```
+
+The tests also verify the validation-backend DNS aliases, required acceptance
+errand properties, and VM types (`minimal` for standard cf-deployment, `default`
+for instant-bosh). The fixture files contain the CF and instant-bosh properties
+this release depends on and are the test inputs of record.