rkoster

RFC0055: App-to-App mTLS Routing — Acceptance Testing Guide

Tracking

Item	Link
Tracking Issue	cloudfoundry/community#1481
RFC	cloudfoundry/community#1438
routing-release	cloudfoundry/routing-release#535
cloud_controller_ng	cloudfoundry/cloud_controller_ng#4910

rkoster

Cloud Foundry XFCC Header Tester

A simple Go application to test X-Forwarded-Client-Cert (XFCC) header format in Cloud Foundry environments with mTLS app-to-app routing.

Purpose

This tool verifies that GoRouter correctly implements the Envoy XFCC format when routing requests over mTLS domains. It checks whether the XFCC header contains:

• ✅ Envoy format: Hash=<hash>;Subject="<subject>";URI=<uri>
• ❌ Raw PEM certificate (bug): Cert="-----BEGIN CERTIFICATE-----\n..."

rkoster

L7 Route Access Policies: API Design Alternatives

Context for TOC discussion (2026-04-14). The Identity-Aware Routing RFC introduces L7 route-level access policies ("access rules") that control which apps can reach a route through GoRouter using mTLS identity. This document compares two placement options for the external CRUD API that manages these access rules.

Background

Current Path-Based Routing on api.<system_domain>

Cloud Controller, the policy-server, and the routing-api are separate processes colocated on the api instance group. GoRouter routes requests to the correct backend using path-based prefix matching on api.<system_domain>. The current cf-deployment registers three overlapping prefixes:

rkoster

Meta

• Name: Domain-Scoped mTLS for GoRouter
• Start Date: 2026-02-16
• Author(s): @rkoster, @beyhan, @maxmoehl
• Status: Draft
• RFC Pull Request: community#1438

Summary

rkoster

Meta

• Name: Domain-Scoped mTLS for GoRouter
• Start Date: 2026-02-16
• Author(s): @rkoster, @beyhan, @maxmoehl
• Status: Draft
• RFC Pull Request: community#1438

Summary

rkoster

Experiment: GoRouter Route Tags with Shared Routes

Context

Cloud Foundry's RFC for Domain-Scoped mTLS on GoRouter proposes scope-based authorization that uses GoRouter's existing route-emitter tags (organization_id, space_id) to enforce "same org/space" boundary checks at the domain level. This experiment verifies that the tags carry the correct information when routes are shared across spaces.

Question

When a route is shared from Space A to Space B (and both spaces have apps mapped to it), do the GoRouter route table tags reflect:

• (a) The route owner's org/space (Space A for all endpoints), or

rkoster

Why use-compiled-releases.yml is Stuck on Stemcell 1.423

Summary

The operations/use-compiled-releases.yml file in cf-deployment references stemcell version 1.423 for all compiled releases, even though newer stemcells are available. This is due to how the CI pipeline is configured to only recompile all releases on major stemcell version bumps.

Root Cause

1. The update-stemcell-and-recompile-releases Job Only Triggers on Major Bumps

rkoster

Comparison: bosh-agent PR #396 vs PR #402

Overview

Both PRs address NVMe device discovery challenges but for different cloud providers with fundamentally different approaches.

Aspect	PR #396 (AWS)	PR #402 (Azure)
URL	cloudfoundry/bosh-agent#396	cloudfoundry/bosh-agent#402
Cloud Provider	AWS	Azure

rkoster

Meta

• Name: Domain-Scoped mTLS for GoRouter
• Start Date: 2026-02-16
• Author(s): @rkoster, @beyhan, @maxmoehl
• Status: Draft
• RFC Pull Request: community#1438

Summary

rkoster

use nix