Add enable-identity-aware-routing ops-file (RFC0055)

operations/enable-identity-aware-routing-cflinuxfs5.yml

@@ -0,0 +1,15 @@
+---
+# Trust apps_identity_ca in cflinuxfs5 app containers.
+# Kept separate from enable-identity-aware-routing.yml because cflinuxfs5-rootfs-setup
+# is only present when add-cflinuxfs5.yml has been applied; merging into the main
+# ops-file would break deployments that don't use cflinuxfs5.
+#
+# Prerequisites (apply in this order):
+#   1. operations/experimental/add-cflinuxfs5.yml
+#   2. operations/enable-identity-aware-routing.yml
+#   3. this file
+# Note: no '?' on the path — a hard BOSH error is the intended signal if
+# add-cflinuxfs5.yml was not applied first.
+- type: replace
+  path: /instance_groups/name=diego-cell/jobs/name=cflinuxfs5-rootfs-setup/properties/cflinuxfs5-rootfs/trusted_certs/-
+  value: ((apps_identity_ca.certificate))

operations/enable-identity-aware-routing.yml

@@ -0,0 +1,68 @@
+---
+# BOSH DNS alias: *.apps.identity -> router instances
+# (BOSH DNS uses underscore prefix for wildcards; _.apps.identity matches *.apps.identity)
+- type: replace
+  path: /addons/name=bosh-dns-aliases/jobs/name=bosh-dns-aliases/properties/aliases/-
+  value:
+    domain: _.apps.identity
+    targets:
+    - deployment: cf
+      domain: bosh
+      instance_group: router
+      network: default
+      query: '*'
+
+# Configure mTLS domain on gorouter.
+# Gorouter verifies client certs against diego_instance_identity_ca (existing CF PKI).
+# sanitize_set: strips any incoming XFCC header (prevents spoofing) and sets a fresh one from the verified client cert.
+# xfcc_format: envoy format is required by Diego/Envoy sidecars consuming the header.
+- type: replace
+  path: /instance_groups/name=router/jobs/name=gorouter/properties/router/domains?
+  value:
+    - name: "*.apps.identity"
+      ca_certs: ((diego_instance_identity_ca.certificate))
+      forwarded_client_cert: sanitize_set
+      xfcc_format: envoy
+
+# Add *.apps.identity TLS cert to gorouter (served via SNI)
+- type: replace
+  path: /instance_groups/name=router/jobs/name=gorouter/properties/router/tls_pem/-
+  value:
+    cert_chain: ((apps_identity_router_tls.certificate))
+    private_key: ((apps_identity_router_tls.private_key))
+
+# Trust apps_identity_ca in cflinuxfs4 app containers so outbound TLS to
+# *.apps.identity succeeds.
+- type: replace
+  path: /instance_groups/name=diego-cell/jobs/name=cflinuxfs4-rootfs-setup/properties/cflinuxfs4-rootfs/trusted_certs/-
+  value: ((apps_identity_ca.certificate))
+
+# Trust apps_identity_ca in the Diego rep container trust store (Envoy sidecars).
+- type: replace
+  path: /instance_groups/name=diego-cell/jobs/name=rep/properties/containers/trusted_ca_certificates/-
+  value: ((apps_identity_ca.certificate))
+
+# Generate apps_identity_ca: self-signed CA that issues the router SNI cert and is
+# trusted by app containers.
+- type: replace
+  path: /variables/-
+  value:
+    name: apps_identity_ca
+    type: certificate
+    options:
+      common_name: apps-identity-ca
+      is_ca: true
+
+# Generate apps_identity_router_tls: server cert for *.apps.identity served via SNI.
+- type: replace
+  path: /variables/-
+  value:
+    name: apps_identity_router_tls
+    type: certificate
+    options:
+      ca: apps_identity_ca
+      common_name: "*.apps.identity"
+      alternative_names:
+        - "*.apps.identity"
+      extended_key_usage:
+        - server_auth

operations/example-vars-files/vars-use-operator-provided-identity-routing-domain.yml

@@ -0,0 +1 @@
+identity_routing_domain: apps.example.com

operations/use-operator-provided-identity-routing-domain.yml

@@ -0,0 +1,28 @@
+---
+# Override the hardcoded apps.identity domain set by enable-identity-aware-routing.yml.
+# Apply on top of that ops-file:
+#
+#   bosh deploy cf-deployment.yml \
+#     -o operations/enable-identity-aware-routing.yml \
+#     -o operations/use-operator-provided-identity-routing-domain.yml \
+#     -v identity_routing_domain=apps.example.com
+
+# Override BOSH DNS alias domain.
+- type: replace
+  path: /addons/name=bosh-dns-aliases/jobs/name=bosh-dns-aliases/properties/aliases/domain=_.apps.identity/domain
+  value: "_.((identity_routing_domain))"
+
+# Override gorouter mTLS domain name.
+- type: replace
+  path: /instance_groups/name=router/jobs/name=gorouter/properties/router/domains/name=*.apps.identity/name
+  value: "*.((identity_routing_domain))"
+
+# Override TLS cert common_name.
+- type: replace
+  path: /variables/name=apps_identity_router_tls/options/common_name
+  value: "*.((identity_routing_domain))"
+
+# Override TLS cert SAN (first and only entry).
+- type: replace
+  path: /variables/name=apps_identity_router_tls/options/alternative_names/0
+  value: "*.((identity_routing_domain))"