Enable dynamic ASGs by default

[mariash]

Enable dynamic ASGs by default

• Add an ops file to disable dynamic asgs

Please take a moment to review the questions before submitting the PR

🚫 We only accept PRs to develop branch. If this is an exception, please specify why 🚫

WHAT is this change about?

Dynamic ASGs are enabled by default in cf-networking release (3.0.0) and silk release (3.0.0), but they need policy-server-asg-syncer job to be added to the cf-deployment.yml. There is a separate ops file disable-dynamic-asgs.yml to disable dynamic asgs if needed.

What customer problem is being addressed? Use customer persona to define the problem e.g. Alana is unable to...

Now customers are not required to restart all their applications that might be affected by the updates to security groups.

Please provide any contextual information.

cloudfoundry/cf-networking-release#110

Has a cf-deployment including this change passed cf-acceptance-tests?

• YES
• NO

Does this PR introduce a breaking change? Please take a moment to read through the examples before answering the question.

• YES - please choose the category from below. Feel free to provide additional details.
• NO

How should this change be described in cf-deployment release notes?

Manifest Updates:

• Added new job policy-server-asg-syncer for dynamic ASG updates

Ops Files:

• New ops-file disable-dynamic-asgs.yml to disable dynamic ASG updates

Does this PR introduce a new BOSH release into the base cf-deployment.yml manifest or any ops-files?

• YES - new ops-file operations/disable-dynamic-asgs.yml
• NO

Does this PR make a change to an experimental or GA'd feature/component?

• experimental feature/component
• GA'd feature/component

Please provide Acceptance Criteria for this change?

With default cf-deployment.yml:

1. Push an application cf push dora
2. SSH to dora cf ssh dora
3. Validate it cannot talk to curl bbs.service.cf.internal results in connection refused
4. Follow https://docs.cloudfoundry.org/concepts/asg.html#asg-individual to create an ASG with destination as diego-api IP and port 8889
5. Bind security group to dora space cf bind-security-group ASG ORG SPACE
6. curl bbs.service.cf.internal should now work without restarting dora.

With operations/disable-dynamic-asgs.yml (6) won't work until dora is restarted.

What is the level of urgency for publishing this change?

• Urgent - unblocks current or future work
• Slightly Less than Urgent

Tag your pair, your PM, and/or team!

@cloudfoundry/cf-diego

[cf-rel-int-status-bot]

Hello friend, it looks like your pull request has failed one or more of our checks. Please take a look! 👀

[cf-rel-int-status-bot]

Hello friend, it looks like your pull request has failed one or more of our checks. Please take a look! 👀

[geofffranks]

This should be ready for merging once CI pulls in cf-networking/silk 3.1.0 to cf-deployment

[davewalter]

Per a Slack conversation with @ameowlia, this is blocked on the consumption of v3.2.0 of cf-networking-release and silk-release.

[geofffranks]

@davewalter v3.2.0 of cf-networking/silk are now out. I suspect this will need to be merged for ci to be able to bump silk-release to v3.2.0, but require cf-networking to have been bumped to 3.0.0 before the changes in this PR will work.

[geofffranks]

@davewalter we found another issue, this time in 3.2.0 of silk, but have bumped to 3.3.0. Can you pull that in as well before a final cf-deployment release?

[mariash]

Hi @davewalter let us know if there is an issue with this PR please. For some reason I don't see silk and cf-networking releases bumped to 3.3.0

[ctlong]

@mariash cf-networking has been successfully bumped to 3.3.0, but silk 3.3.0 failed to pass CI.

I'm going to rerun the silk job so that it runs with cf-networking 3.3.0.

[geofffranks]

I'm not sure if silk 3.3.0 will succeed without this PR merged