{"id":13562275,"url":"https://github.com/cloudfoundry/cf-deployment","last_synced_at":"2026-04-02T23:44:45.358Z","repository":{"id":36379908,"uuid":"40684777","full_name":"cloudfoundry/cf-deployment","owner":"cloudfoundry","description":"The canonical open source deployment manifest for Cloud Foundry","archived":false,"fork":false,"pushed_at":"2026-02-21T03:03:26.000Z","size":12688,"stargazers_count":312,"open_issues_count":15,"forks_count":309,"subscribers_count":105,"default_branch":"main","last_synced_at":"2026-02-21T06:27:46.521Z","etag":null,"topics":["cff-wg-app-runtime-deployments"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/cloudfoundry.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":"NOTICE","maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2015-08-13T22:35:14.000Z","updated_at":"2026-02-13T13:54:48.000Z","dependencies_parsed_at":"2025-12-16T17:06:40.816Z","dependency_job_id":null,"html_url":"https://github.com/cloudfoundry/cf-deployment","commit_stats":null,"previous_names":[],"tags_count":511,"template":false,"template_full_name":null,"purl":"pkg:github/cloudfoundry/cf-deployment","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cloudfoundry%2Fcf-deployment","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cloudfoundry%2Fcf-deployment/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cloudfoundry%2Fcf-deployment/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cloudfoundry%2Fcf-deployment/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/cloudfoundry","download_url":"https://codeload.github.com/cloudfoundry/cf-deployment/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/cloudfoundry%2Fcf-deployment/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":29786978,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-02-24T10:45:18.109Z","status":"ssl_error","status_checked_at":"2026-02-24T10:45:09.911Z","response_time":75,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cff-wg-app-runtime-deployments"],"created_at":"2024-08-01T13:01:06.600Z","updated_at":"2026-04-02T23:44:45.350Z","avatar_url":"https://github.com/cloudfoundry.png","language":"Go","funding_links":[],"categories":["Go"],"sub_categories":[],"readme":"# cf-deployment\n\n### Table of Contents\n* \u003ca href='#purpose'\u003ePurpose\u003c/a\u003e\n* \u003ca href='#tls'\u003eTLS validation\u003c/a\u003e\n* \u003ca href='#deploying-cf'\u003eDeploying CF\u003c/a\u003e\n* \u003ca href='#versioning'\u003eRelease Versioning\u003c/a\u003e\n* \u003ca href='#contributing'\u003eContributing\u003c/a\u003e\n* \u003ca href='#setup'\u003eSetup and Prerequisites\u003c/a\u003e\n* \u003ca href='#ops-files'\u003eOps Files\u003c/a\u003e\n* \u003ca href='#ci'\u003eCI\u003c/a\u003e\n* \u003ca href='#vars-store'\u003eMigrating from Vars-Store to CredHub\u003c/a\u003e\n* \u003ca href='#migrating'\u003eMigrating from cf-release to cf-deployment\u003c/a\u003e\n\n## \u003ca name='purpose'\u003e\u003c/a\u003ePurpose\nThis repo contains a canonical [BOSH](https://bosh.io/docs) deployment manifest\nfor deploying the Cloud Foundry Application Runtime by relying individual component releases.\nIt uses several newer features\nof the BOSH director and CLI.\nOlder directors may need to be upgraded\nand have their configurations extended\nin order to support `cf-deployment`.\n\n`cf-deployment` embodies several opinions\nabout the CF Application Runtime.\nIt:\n- prioritizes readability and meaning to a human operator.\n  For instance, only necessary configuration is included.\n- emphasizes security by default.\n  - CredHub is used to generate strong passwords, certs, and keys.\n  There are no default credentials, even in bosh-lite.\n  - TLS/SSL features are enabled on every job which supports TLS.\n- uses two AZs to provide redundancy for most instance groups.\n- uses [Diego](https://docs.cloudfoundry.org/concepts/diego/diego-architecture.html) ([source code](https://github.com/cloudfoundry/diego-release)) by default.\n- deploys jobs to handle platform data persistence\nusing singleton versions of the `PXC` release for databases\nand the CAPI release's singleton WebDAV job for blob storage.\nSee the  [database](texts/deployment-guide.md#databases) and [blobstore](texts/deployment-guide.md#blobstore) sections\nof the deployment guide\nfor more information.\n- assumes load-balancing will be handled by the IaaS\nor an external deployment.\n\n## \u003ca name='tls'\u003e\u003c/a\u003e TLS validation\n\nMany test, development, and \"getting started\" environments\ndo not have valid `TLS` certificates\ninstalled in their load balancers. For ease of use in such environments,\n`cf-deployment` skips `TLS` validation\non some components\nthat access each other via the \"front door\"\nof the Cloud Foundry load balancer.\n\nDeployers who have valid\nor otherwise trusted\nload balancer certificates should use the\n[stop-skipping-tls-validation.yml](operations/stop-skipping-tls-validation.yml) opsfile\nto force the validation of `TLS` certificates\nfor all components.\n\n## \u003ca name='deploying-cf'\u003e\u003c/a\u003eDeploying CF\nDeployment instructions are verbose so we've moved them into a [dedicated deployment guide here](texts/deployment-guide.md).\n\n## \u003ca name='versioning'\u003e\u003c/a\u003eRelease Versioning\nThe Semantic Versioning scheme has been adopted by cf-deployment.\nA detailed description of how [Semantic Versioning is applied to CF-Deployment can be found here](texts/versioning.md).\n\n## \u003ca name='contributing'\u003e\u003c/a\u003eContributing to CF-Deployment\nAlthough the default branch for the repository is [`main`](https://github.com/cloudfoundry/cf-deployment/tree/main),\nwe ask that all pull requests be made against\nthe [`develop`](https://github.com/cloudfoundry/cf-deployment/tree/develop) branch. \n- **Please fill out the [PR Template](https://github.com/cloudfoundry/cf-deployment/blob/main/PULL_REQUEST_TEMPLATE.md)** when submitting pull requests. The information requested in the PR form provides important context for the team responsible for evaluating your submission.\n- Please also take a look at the [\"style guide\"](texts/style-guide.md),\nwhich lays out some guidelines for adding properties or jobs\nto the deployment manifest.\n\n**Before submitting a pull request\nor pushing to the develop branch of cf-deployment, please:**\n1. run `./units/test`\n   which interpolates all of our ops files\n   with the `bosh` cli.\n    - By default, the test suite omits `semantic` tests,\nwhich require both [jq](https://stedolan.github.io/jq/)\nand [yq](https://github.com/mikefarah/yq) installed.\n    - If you wish to run them,\nplease install these requirements and\nset `RUN_SEMANTIC=true` in your environment.\n    - **Note:** it is necessary to run the tests\nfrom the root of the repo.\n1. confirm your changes can be successfully deployed with \n   the [latest release of cf-deployment](https://github.com/cloudfoundry/cf-deployment/releases) \n   and tested with the latest version of [CAT's](https://github.com/cloudfoundry/cf-acceptance-tests/releases).\n1. If modifying backup and restore, run `./scripts/test`\n   which runs a legacy bash suite for backup and restore ops.\n**If you're adding an Ops-file, you will need to:** \n1. document it in its corresponding README.\n1. add it to the ops file tests in `units/test`.\n\n**If you're promoting or deprecating Ops-file, please follow [Ops-file workflows](https://github.com/cloudfoundry/cf-deployment/blob/main/ops-file-promotion-workflow.md)** \n\n\n## \u003ca name='setup'\u003e\u003c/a\u003eSetup and Prerequisites\n`cf-deployment` requires a bosh director with a valid cloud-config that has been configured with a certificate authority.\nIt also requires the `bosh` CLI,\nwhich it relies on to generate and fill-in needed variables.\n\n### BOSH director and stemcells\n`cf-deployment` requires both [BOSH](https://github.com/cloudfoundry/bosh/releases) and [Linux stemcells](https://bosh.io/stemcells/).\n\n### BOSH CLI\n`cf-deployment` requires the [BOSH CLI](https://github.com/cloudfoundry/bosh-cli).\n\n### BOSH `cloud-config`\n`cf-deployment` assumes that\nyou've uploaded a compatible [cloud-config](https://bosh.io/docs/cloud-config.html) to the BOSH director prior to deploying your foundation.\n\nThe cloud-config produced by `bbl` covers GCP, AWS, and Azure, and is compatible by default.\n\nThe [`iaas-support`](https://github.com/cloudfoundry/cf-deployment/tree/main/iaas-support) directory includes tools and templates for building cloud-configs for other IaaSes,\nincluding bosh-lite, vSphere, Openstack, and Alibaba Cloud.\n\nFor other IaaSes,\nyou may need to do some engineering work to figure out the right cloud config (and possibly ops files)\nto get it working for `cf-deployment`.\n\n### BOSH `runtime-config`\n`cf-deployment` requires that you have uploaded\na [runtime-config](https://bosh.io/docs/runtime-config/) for [BOSH DNS](https://bosh.io/docs/dns/) prior to deploying your foundation.\nWe recommended that you use the one provided by the\n[bosh-deployment](https://github.com/cloudfoundry/bosh-deployment/blob/master/runtime-configs/dns.yml) repo:\n\n```\nbosh update-runtime-config bosh-deployment/runtime-configs/dns.yml --name dns\n```\n\n**Note:** [BBL v6.10.0](https://github.com/cloudfoundry/bosh-bootloader/releases/tag/v6.10.0) or later will set a runtime config including BOSH DNS when you `bbl up`.\n\n### Deployment variables and CredHub\n`cf-deployment.yml` requires additional information\nto provide environment-specific or sensitive configuration\nsuch as the system domain and various credentials.\n\nTo do this in the default configuration,\nwe use [CredHub](https://github.com/pivotal-cf/credhub-release),\nwhich is deployed on your BOSH director by default if you are using `bbl`.\n\nWhere necessary credential values are not present,\nCredHub will generate new values\nbased on the type information stored in `cf-deployment.yml`.\n\n**Note:** Since [`cf-deployment` v3.0](https://github.com/cloudfoundry/cf-deployment/releases/tag/v3.0.0), CredHub has replaced the now deprecated BOSH `vars-store` as the default way to store\nand generate credentials.\n\nNecessary variables that BOSH can't ask CredHub to generate\nneed to be supplied as well.\n\nIf the deployment includes only the base manifest (cf-deployment.yml), this is just the system domain.\nHowever, some ops files introduce additional variables.\nSee the README summary for the particular ops files you're using\nfor any additional necessary variables.\n\nThere are three ways to supply\nsuch additional variables:\n\n1. They can be provided by passing individual `-v` arguments.\n   The syntax for `-v` arguments is\n   `-v \u003cvariable-name\u003e=\u003cvariable-value\u003e`.\n   This is the recommended method for supplying\n   the system domain.\n2. They can be provided in a yaml file\n   accessed from the command line with the\n   `-l` or `--vars-file` flag.\n   This is the recommended method for configuring\n   external persistence services.\n3. They can be stored in CredHub directly\n   with the [CredHub CLI](https://docs.cloudfoundry.org/api/credhub/).\n   If you do this, then you need follow variable namespacing\n   rules respected by BOSH described [here](https://github.com/cloudfoundry/credhub/blob/master/docs/operator-quick-start.md#variable-namespacing).\n\n## \u003ca name='ops-files'\u003e\u003c/a\u003eOps Files\nThe configuration of CF represented by `cf-deployment.yml` is a workable, secure, fully-featured default.\nWhen the need arises to make different configuration choices for your foundation,\nyou can accomplish this with the `-o`/`--ops-file` flags.\nThese flags read a single `.yml` file that details operations to be performed on the manifest\nbefore variables are generated and filled.\nWe've supplied some common manifest modifications in the `operations` directory.\nMore details can be found in the [Ops-file README](operations/README.md).\n\n### The `operations` subdirectories\n\n#### [Addons](operations/addons)\nThese ops-files make changes to\nmost or all instance groups.\nThey can be applied to the BOSH Director's\nruntime config,\nor directly to an individual deployment manifest.\n\nThe ops-file to configure platform component logging\nwith rsyslog is such an add-on.\nPlease see the [Addon Ops-file README](operations/addons/README.md)\nfor details.\n\n#### [Community](operations/community)\n\"Community\" ops-files are contributed by the Cloud Foundry community. They are not maintained or supported by the Release Integration team. For details, see the [Community Ops-file README](operations/community/README.md)\n\n#### [Experimental](operations/experimental)\n\"Experimental\" ops-files represent configurations\nthat are in the process of being developed and/or validated.\nOnce the configurations have been sufficiently validated,\nthey will become part of cf-deployment.yml\nand the ops-files will be removed.\nFor details, see the [Experimental Ops-file README](operations/experimental/README.md).\n\n#### [Test](operations/test)\n\"Test\" ops-files are configurations\nthat we run in our testing pipeline\nto enable certain features.\n\n#### [Backup and Restore](operations/backup-and-restore)\nContains all the ops files utilized to enable and configure [BOSH Backup and Restore](https://github.com/cloudfoundry/bosh-backup-and-restore) (BBR).\nBBR is a CLI utility for orchestrating the backup and restore of [BOSH](https://bosh.io/) deployments and BOSH directors. It orchestrates triggering the backup or restore process on the deployment or director, and transfers the backup artifact to and from the deployment or director.\n\n## \u003ca name='ci'\u003e\u003c/a\u003eCI\nThe [ci](https://concourse.wg-ard.ci.cloudfoundry.org) for `cf-deployment`\nautomatically bumps to the latest versions of its component releases on the `develop` branch.\nThese bumps, along with any other changes made to `develop`, are deployed to a single long-running environment\nand tested with CATs before being merged to main if CATs goes green.\n\nEach version of cf-deployment is given a corresponding branch in the CATs repo,\nso that users can discover which version of CATs to run against their deployments.\nFor example, if you've deployed cf-deployment v6.10.0,\ncheck out the `cf6.10` branch in cf-acceptance-tests to run CATs.\n\nThe configuration for our pipeline can be found [here](https://github.com/cloudfoundry/cf-deployment/blob/develop/ci/pipelines/cf-deployment.yml).\n\n[cf-deployment-concourse-url]: https://concourse.wg-ard.ci.cloudfoundry.org\n\n## \u003ca name='vars-store'\u003e\u003c/a\u003eMigrating from Vars Store to CredHub\nCredHub is default as of cf-deployment release v\nIf you've got a long running foundation running a release of cf-deployment that relies on `vars-store` and want to upgrade to a version that's backed by CredHub, you will need to migrate your credentials from `vars-store` to CredHub.\nWe have a [utility](https://github.com/ishustava/migrator) to help you migrate.\n\n## \u003ca name='migrating'\u003e\u003c/a\u003eCan I Transition from `cf-release`?\nCF-Deployment replaces the [manifest generation scripts in cf-release][cf-release-url] which have been deprecated and are no longer supported by the Release Integration team.\nAlthough the team is no longer working on or supporting migrations from `cf-release` to `cf-deployment`, you can still find the tooling and documentation in the [cf-deployment-transition repo](https://github.com/cloudfoundry/cf-deployment-transition).\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcloudfoundry%2Fcf-deployment","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fcloudfoundry%2Fcf-deployment","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fcloudfoundry%2Fcf-deployment/lists"}