From 82b0b712a9cf7fd048b65fb672d7f1c7d404dd28 Mon Sep 17 00:00:00 2001 From: Deniz Tas Date: Wed, 23 Sep 2026 10:17:06 +0200 Subject: [PATCH 1/4] Add identity-aware-routing to experimental pipeline --- ci/pipelines/cf-deployment.yml | 38 ++++++++++++++++++++++++++++++++++ 1 file changed, 38 insertions(+) diff --git a/ci/pipelines/cf-deployment.yml b/ci/pipelines/cf-deployment.yml index b111a71e4..650f4742b 100644 --- a/ci/pipelines/cf-deployment.yml +++ b/ci/pipelines/cf-deployment.yml @@ -1164,6 +1164,7 @@ jobs: operations/increase-doppler-vm-type-from-minimal-to-small.yml operations/scale-diego-cell-to-8.yml operations/test/speed-up-dynamic-asgs.yml + operations/enable-identity-aware-routing.yml VARS_FILES: | environments/test/hermione/bbl-state/vars/director-vars-file.yml environments/test/hermione/vars-use-operator-provided-router-tls-certificates.yml @@ -1220,6 +1221,7 @@ jobs: operations/increase-doppler-vm-type-from-minimal-to-small.yml operations/scale-diego-cell-to-8.yml operations/test/speed-up-dynamic-asgs.yml + operations/enable-identity-aware-routing.yml VARS_FILES: | environments/test/hermione/bbl-state/vars/director-vars-file.yml environments/test/hermione/vars-use-operator-provided-router-tls-certificates.yml @@ -1240,6 +1242,15 @@ jobs: INSTANCE_GROUP_NAME: uaa SYSTEM_DOMAIN: cf.hermione.env.wg-ard.ci.cloudfoundry.org SECURITY_GROUP_NAME: uaa + - task: open-asgs-for-router + file: cf-deployment-concourse-tasks/open-asgs-for-bosh-instance-group/task.yml + input_mapping: + bbl-state: relint-envs + params: + BBL_STATE_DIR: environments/test/hermione/bbl-state + INSTANCE_GROUP_NAME: router + SYSTEM_DOMAIN: cf.hermione.env.wg-ard.ci.cloudfoundry.org + SECURITY_GROUP_NAME: identity-aware-routing-router - task: set-feature-flags file: cf-deployment-concourse-tasks/set-feature-flags/task.yml input_mapping: @@ -1251,6 +1262,33 @@ jobs: diego_docker task_creation service_instance_sharing + - task: create-identity-aware-domain + config: + platform: linux + image_resource: + type: registry-image + source: + repository: cloudfoundry/cf-deployment-concourse-tasks + inputs: + - name: bbl-state + - name: cf-deployment-concourse-tasks + input_mapping: + bbl-state: relint-envs + params: + BBL_STATE_DIR: environments/test/hermione/bbl-state + SYSTEM_DOMAIN: cf.hermione.env.wg-ard.ci.cloudfoundry.org + run: + path: bash + args: + - -euc + - | + source cf-deployment-concourse-tasks/shared-functions + setup_bosh_env_vars + setup_password_from_credhub cf_admin_password + cf api --skip-ssl-validation "api.${SYSTEM_DOMAIN}" + set +x; cf auth admin "${cf_admin_password}"; set -x + cf create-shared-domain apps.identity --enforce-route-policies --scope org || true + - name: experimental-ops-files public: true From f9393a3d5fc3c1ec12129d879c0b79fc2a288d21 Mon Sep 17 00:00:00 2001 From: Deniz Tas Date: Wed, 23 Sep 2026 15:02:46 +0200 Subject: [PATCH 2/4] remove parameter --skip-ssl-validation --- ci/pipelines/cf-deployment.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ci/pipelines/cf-deployment.yml b/ci/pipelines/cf-deployment.yml index 650f4742b..3c39fe127 100644 --- a/ci/pipelines/cf-deployment.yml +++ b/ci/pipelines/cf-deployment.yml @@ -1285,7 +1285,7 @@ jobs: source cf-deployment-concourse-tasks/shared-functions setup_bosh_env_vars setup_password_from_credhub cf_admin_password - cf api --skip-ssl-validation "api.${SYSTEM_DOMAIN}" + cf api "api.${SYSTEM_DOMAIN}" set +x; cf auth admin "${cf_admin_password}"; set -x cf create-shared-domain apps.identity --enforce-route-policies --scope org || true From 8c29a33a61a956c28dcc84370bd1b8893a9b9296 Mon Sep 17 00:00:00 2001 From: Deniz Tas Date: Mon, 5 Oct 2026 14:53:39 +0200 Subject: [PATCH 3/4] change ops file order --- ci/pipelines/cf-deployment.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ci/pipelines/cf-deployment.yml b/ci/pipelines/cf-deployment.yml index 3c39fe127..5404dbe0d 100644 --- a/ci/pipelines/cf-deployment.yml +++ b/ci/pipelines/cf-deployment.yml @@ -1155,6 +1155,7 @@ jobs: operations/use-s3-blobstore.yml operations/scale-database-cluster.yml operations/stop-skipping-tls-validation.yml + operations/enable-identity-aware-routing.yml operations/use-operator-provided-router-tls-certificates.yml operations/experimental/colocate-smoke-tests-on-cc-worker.yml operations/experimental/enable-oci-phase-1.yml @@ -1164,7 +1165,6 @@ jobs: operations/increase-doppler-vm-type-from-minimal-to-small.yml operations/scale-diego-cell-to-8.yml operations/test/speed-up-dynamic-asgs.yml - operations/enable-identity-aware-routing.yml VARS_FILES: | environments/test/hermione/bbl-state/vars/director-vars-file.yml environments/test/hermione/vars-use-operator-provided-router-tls-certificates.yml @@ -1212,6 +1212,7 @@ jobs: operations/use-s3-blobstore.yml operations/scale-database-cluster.yml operations/stop-skipping-tls-validation.yml + operations/enable-identity-aware-routing.yml operations/use-operator-provided-router-tls-certificates.yml operations/experimental/colocate-smoke-tests-on-cc-worker.yml operations/experimental/enable-oci-phase-1.yml @@ -1221,7 +1222,6 @@ jobs: operations/increase-doppler-vm-type-from-minimal-to-small.yml operations/scale-diego-cell-to-8.yml operations/test/speed-up-dynamic-asgs.yml - operations/enable-identity-aware-routing.yml VARS_FILES: | environments/test/hermione/bbl-state/vars/director-vars-file.yml environments/test/hermione/vars-use-operator-provided-router-tls-certificates.yml From 5244cfe961f2cda7b1f9ec494af9792a04e10003 Mon Sep 17 00:00:00 2001 From: Deniz Tas Date: Tue, 6 Oct 2026 08:21:30 +0200 Subject: [PATCH 4/4] fix input mapping --- ci/pipelines/cf-deployment.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ci/pipelines/cf-deployment.yml b/ci/pipelines/cf-deployment.yml index 5404dbe0d..857e96461 100644 --- a/ci/pipelines/cf-deployment.yml +++ b/ci/pipelines/cf-deployment.yml @@ -1263,6 +1263,8 @@ jobs: task_creation service_instance_sharing - task: create-identity-aware-domain + input_mapping: + bbl-state: relint-envs config: platform: linux image_resource: @@ -1272,8 +1274,6 @@ jobs: inputs: - name: bbl-state - name: cf-deployment-concourse-tasks - input_mapping: - bbl-state: relint-envs params: BBL_STATE_DIR: environments/test/hermione/bbl-state SYSTEM_DOMAIN: cf.hermione.env.wg-ard.ci.cloudfoundry.org