Release notes for Spring Cloud Services for VMware Tanzu

WARNING: If you install Spring Cloud Services (SCS) v3.1 alongside v2.x, deleting SCS v2.1.2 or earlier will delete the p-spring-cloud-services org used by both v2.x and v3.1. (See Known Issues.) For steps to migrate completely to SCS v3.1, see the Installing or Upgrading topics.

Known Issues

Spring Cloud Services 3.1.30+ has a breaking change regarding multi-document and profile-specific configuration files

Spring Cloud Service 3.1.30 upgraded to Spring Boot v2.5 and there are some breaking changes regarding the way Spring Boot v2.4+ handles multi-document and profile-specific configuration files. If you are using multi-document or profile-specific configuration files, you need to migrate them following Spring Boot Config Data Migration Guide.

Spring Cloud Services <v3.1.24 Config Server logs sensitive binding information

Sensitive binding information has been being logged since version 3.1.0. The impact of this would be that anyone who had access to the logs of the p.config-server backing application logs in the p-spring-cloud-services org, they could use these credentials to access service instance APIs.

Please upgrade to version 3.1.24 to resolve this issue.

Spring Cloud Services v3.1.20 introduced bug in Config Server host key verification

Spring Cloud Services v3.1.20 introduced a problem which can cause the Config Server's SSH host key verification check to incorrectly fail. This problem occurs in the Mirror Service on creation or update of mirrors when host key verification is enabled, and the repository being mirrored is served on SSH port 22.

To resolve this issue, upgrade to Spring Cloud Services version 3.1.21.

Spring Cloud Services v3.1.0-v3.1.19 fails on service broker commands with Tanzu Application Service v2.11.x

Tanzu Application Service deprecated the state field for service broker endpoints. This causes Spring Cloud Services v3.1.0 to v3.1.19 versions to fail on service broker commands for service instances including create-service, update-service and bind-service.

To resolve this issue, upgrade to Spring Cloud Services version 3.1.20 which now has Tanzu Application Service v2.11.x support.

Spring Cloud Services v3.1.15 introduced bug on Config Server dashboard mirrors synchronization display

Spring Cloud Services v3.1.15 introduced a change that causes existing Config Server instances that are not upgraded to 3.1.15 or above to not show the result of Synchronize Mirrors execution on the dashboard. This results in the commit hash not updating after the mirror has been synchronized. This does not affect the actual mirror synchronization and therefore refreshing the Config Server dashboard will show the current commit hash.

To resolve this issue, upgrade the Config Server instance using the cf update-service [NAME] -c '{"upgrade": true}' command. The Config Server instance dashboard should then behave as expected.

Spring Cloud Services v3.1 Shares Org Used by 2.x

Spring Cloud Services (SCS) v3.1 uses the p-spring-cloud-services org for deployment of backing apps for service instances. SCS v2.x, which is a separate tile, also uses this org. In SCS =< v2.0.10 and =< v2.1.2, the Broker Deregistrar pre-delete lifecycle errand deletes the p-spring-cloud-services org. Because of this, deleting the v2.x tile will also affect the v3.1 tile. Deletion of the p-spring-cloud-services org can result in loss of v3.1 service instance backing apps, potentially affecting client apps bound to the service instances.

If you have installed Spring Cloud Services v3.1 alongside =< v2.0.10 or =< v2.1.2, do NOT delete the v2.x tile. If you do wish to delete the 2.x tile, upgrade to SCS >= v3.0.4 or later and SCS >= v2.0.11 or >= v2.1.3, and then delete the v2.x tile.

Cannot Update Credentials for Git Repositories That Use HTTP(S) URLs

In Spring Cloud Services v3.1.0--v3.1.5, you cannot update credentials for a Git repository that was originally added to a Config Server service instance using a HTTP or HTTPS URL. This means that if the repository's credentials are rotated, the Config Server's mirror service will be unable to update its mirror of the repository.

To resolve this issue, you can update the Config Server to use SSH, rather than HTTP or HTTPS, to access the Git repository. See SSH Repository Access.

3.1.42

Release Date: 3 November 2022

  • Fixes the issue where dashboard URL was not updated when apps domain was changed.
  • Fixes the NPE in config-server dasbhoard when the label was a commit-sha.
  • Upgraded the JDK to 1.8.0_345-b01 for security patches.

Additionally this release upgraded the following bosh releases:

  • PXC (MySQL) to 0.47.0
  • Routing to 0.244.0
  • Backup and Restore SDK to 1.18.55
  • BPM to 1.1.19
  • Git to 2.24.4

3.1.40

Release Date: 16 August 2022

  • The upgrade-all-instances errand now ignores missing service instances during the upgrade. In foundations with many service instances, the errand may take a couple of hours to finish. In these foundations there might be situations where a service instance initially is listed for upgrade but it is removed before its turn to upgrade.
  • Changes the default log-level of Cloud Foundry Java Client in upgrade-all-instances errand to INFO.

3.1.38

Release Date: 4 August 2022

  • Fixed issue in service-registry dashboard where Space Developers and Space Auditors were not authorized to see shared service instances dashboard.

3.1.37

Release Date: 26 May 2022

  • Addresses CVE-2022-22970 and CVE-2022-22978 by upgrading the Spring Boot version

Dependency upgrades in this release:

  • Spring Boot to 2.5.14

3.1.36

Release Date: 4 May 2022

  • Resolved issue preventing encrypt.key from being passed to config service instances causing the /encrypt endpoint to fail.
  • Addresses CVE-2022-22968 by upgrading the Spring Boot version

Dependency upgrades in this release:

  • Spring Boot to 2.5.13

3.1.35

Release Date: 15 April 2022

  • Addresses CVE-2020-36518 by upgrading the jackson version.
  • Addresses CVE-2022-22965 by upgrading the Spring Boot version

Dependency upgrades in this release:

  • Jackson to 2.13.2
  • Spring Boot to 2.5.12

Note: Because Spring Cloud Services uses Java 8, it is not vulnerable to CVE-2022-22965, and this update is not necessary for secure operation. However, in the interest of avoiding false positives in security tools, and to enable maximum customer confidence, we have produced this maintenance release, which also updates the affected Spring libraries to alleviate any concern.

3.1.32

Release Date: 22 March 2022

This release:

  • Fixed the truststore permissions issue in the mirror-service post-backup by recreating the truststore.
  • Fixed issue in dashboard page where dashboard client-id was not loaded from CredHub.

3.1.31

Release Date: 22 March 2022

This release:

  • Added support for Tanzu Application Service version 2.13.x
  • upgraded the JDK to 1.8.0_322-b06 for security patches.

Additionally this release upgraded the following bosh releases:

  • PXC (MySQL) to 0.41.0
  • Routing to 0.230.0
  • Backup and Restore SDK to 1.8.35
  • BPM to 1.1.16

3.1.30

Release Date: 8th March 2022

  • Spring Boot has been upgraded to 2.5.9 and Spring Cloud has been upgraded to 2020.0.4.
  • Cloud Foundry Java Client has been upgraded to 5.7.0, resolving an issue in which UAA tokens become expired.
  • The upgrade-all-instances errand now excludes the failed or in progress service instances and only upgrades services in succeeded state.

Dependency upgrades in this release:

  • Spring Boot to 2.5.9
  • Spring Cloud Services to 2020.0.4
  • Spring Cloud App Broker to 1.4.0
  • Spring Cloud Open Service Broker to 3.4.1
  • Spring CredHub to 2.2.0
  • Cloud Foundry Java Client to 5.7.0

Note: Since upgrade-all-instances errand now excludes the failed or in progress service instances, those instances need to be upgraded manually afterwards.

Note: There are some breaking changes regarding the way Spring Boot v2.4+ handles multi-document and profile-specific configuration files. If you are using multi-document or profile-specific configuration files, you need to migrate them following Spring Boot Config Data Migration Guide.

3.1.29

Release Date: 3rd February 2022

  • Addresses CVE 2021-45105 and 2021-44832. Spring Cloud Services does not include log4j-core in supported versions, and all other log4j-related dependencies have been updated.
  • Limited the number of concurrent upgrades during the upgrade-all-instances errand to resolve several potential issues during the errand. This value is configurable through the "concurrent service instance upgrade" setting.
  • Errands now use the same service instance status timeout as the the SCS broker, improving resiliency of errands to timeouts.

Dependency upgrades in this release:

  • Apache log4j-api to 2.17.1
  • Apache log4j-to-slf4j to 2.17.1

Note: A tile configuration property called status-change-timeout-minutes has been renamed to service-completion-timeout-minutes in this release. If you are using CLI to upgrade SCS, you need to update your config files to use the new property name.

3.1.27

Release Date: 15th December 2021

  • Addresses CVE 2021-45046. Spring Cloud Services does not include log4j-core in supported versions, and all other log4j-related dependencies have been updated.

Dependency upgrades in this release:

  • Apache log4j-api to 2.16
  • Apache log4j-to-slf4j to 2.16

3.1.26

Release Date: 13th December 2021

  • Addresses CVE 2021-44228. Spring Cloud Services does not include log4j-core in supported versions, and all other log4j-related dependencies have been updated.

Dependency upgrades in this release:

  • Apache log4j-api to 2.15
  • Apache log4j-to-slf4j to 2.15

3.1.25

Release Date: 30th November 2021

  • Fixed issue in Mirror Service where connection-pull to UAA was getting exhausted because some connections were stuck in CLOSE-WAIT state.

3.1.24

Release Date: 10th November 2021

  • Fixed issue in Config Server where sensitive binding details were being logged.

3.1.23

Release Date: 14th October 2021

  • Added errand that can be turned on to upgrade all existing instances on the foundation

3.1.22

Release Date: 2nd September 2021

  • Resolved issue where some network connections were remaining in CLOSE_WAIT state

3.1.21

Release Date: 29th June 2021

  • Fixed Config Server host key verification for Git servers running on SSH port 22

3.1.20

Release Date: 13th May 2021

  • Added support for Tanzu Application Service version 2.11.x

3.1.19

Release Date: 17th February 2021

  • Enabled the ability to disable CredHub integration from the tile
  • Fixed an error where the mirror-service periodic refresh fails
  • Upgraded PXC (MySQL) release to enable TLS

3.1.18

Release Date: 8th December 2020

  • Added support for Spring Boot 2.3

3.1.17

Release Date: 27th October 2020

  • Added support for http(s) proxy in the mirror-service.

3.1.16

Release Date: 7th October 2020

  • Resolved issue with login to dashboard due to an invalid redirect URI being generated by the config server.
  • Now we support the configuration of Git SSH URL on the Config Server
  • Fixed regression of plaintext files not being served with default label in root of the repo
  • Enabled Vault token to renew when using composite Config Server configuration
  • Added in parameters to Vault health check for "perfstandbyok" and "standbyok"

3.1.15

Release Date: 25th August 2020

  • Resolved issue when a Git repository configuration in composite array for Config Server fails during refresh with periodic set to true then all subsequent Git repository refreshes fail.
  • Resolved issue with Config Server service instance dashboard responding with 500 internal server error when HashiCorp Vault is configured.

3.1.14

Release Date: 13th July 2020

  • Resolved issue with Git repository passwords not encoding some special characters appropriately leading to failed mirroring of the repository.

3.1.13

Release Date: 13th July 2020

  • Resolved issue with application-security-groups configuration not applying on cf create-service.

3.1.12

Release Date: 25th June 2020

  • Added ability to provide names of Application Security Groups (ASGs) to be used for a service instance. When creating or updating a service instance using the cf create-service or cf update-service commands, you can include an application-security-groups parameter listing the ASGs which should be applied for the service instance, and these ASGs will be added to the space used by the service instance's backing app.
  • The configuration shown on a Config Server service instance's dashboard now includes the list of ASGs applied for that service instance.
  • The Config Server is now compatible with the Service Instance Logging cf CLI plugin's cf service-logs (or cf sil) command, including the --recent flag.
  • The Service Registry is now compatible with the Service Instance Logging cf CLI plugin's cf service-logs (or cf sil) command, including the --recent flag.

3.1.11

Release Date: 29th May 2020

  • Added ability to enable off-platform service key access for service instances in tile configuration.
  • Fixed issue when Config Server Git repo is set to specific label and executing "Sync Mirrors" from dashboard was reporting the incorrect commit hash after the sync.
  • Fixed issue when Config Server uses Git repo with no master branch.
  • Fixed issue when Config Server is configured with multiple Git repos with same URL but different labels.

3.1.10

Release Date: 4th May 2020

  • Fixed issue for users with Space Developer role accessing dashboards when there a significant amount of spaces created on platform.

3.1.9

Release Date: 21st April 2020

  • Upgraded stemcell major version to Ubuntu Xenial 621.*.

3.1.8

Release Date: 14th April 2020

  • Fixed issue with periodic configuration view on service instance dashboard.

3.1.7

Release Date: 27th March 2020

  • Added ability to see that encrypt.key is configured via Config Server dashboard but redacted to ensure key token is not exposed.
  • Added back API support on Config Server service instances to encrypt values based on encrypt.key configured token.

3.1.6

Release Date: 13th March 2020

  • Removed ability to create service keys to ensure secure access for client applications.
  • Added the ability to set encrypt.key on Git repository configurations enabling hashed secrets in property files.
  • Fixed issue with updating credentials on Git repository defined with a HTTPS URI.
  • Fixed issue with custom domain not being used in dashboard URL.

3.1.5

Release Date: 22nd January 2020

  • Further improved fix for rotating Certificate Authorities while maintaining certificate uniqueness in errand JVM truststore.

3.1.4

Release Date: 15th January 2020

  • A periodic parameter added to Config Server service instance configuration updates Git repository mirrors on the Config Server's mirror service every five minutes.
  • Added tile configuration for the timeout used for pushing backing apps for a service instance.
  • Fixed an issue that could cause a server error to appear on the Config Server dashboard when using the HashiCorp Vault backend.
  • Fixed use of the default label configured per Config Server Git repository for client app property requests.

3.1.3

Release Date: 25th November 2019

  • Fixed issue when rotating Certificate Authorities while maintaining certificate uniqueness in errand JVM truststore.

3.1.2

Release Date: 14th November 2019

  • Fixed CredHub bootstrapper errand so that it can update client credential permissions when re-running after tile install failure.

3.1.1

Release Date: 28th October 2019

  • Resolved issue with accessing service instance dashboard when VMware Tanzu Application Service for VMs (TAS) tile is configured with "Authentication and Enterprise SSO" as SAML.

v3.1.0

Release Date: 7th October 2019

Enhancements included in this release:

  • The Spring Cloud Services broker has been upgraded to Spring Boot 2.1.8.RELEASE and Spring Cloud Greenwich.SR3.
  • Service Registry service has been added back with a new name: p.service-registry.
  • The existing Service Registry configuration options have not changed although there is now a new option named peer-timeout that can be set in milliseconds. This can alleviate issues with peer replication timing out when there is higher latency in the network between peers.
  • There is now a process for doing backup and restore of Spring Cloud Services stateful resources.

Important items to note:

  • Spring Cloud Services v3.1.0 does not include Circuit Breaker Dashboard services. To use these services, you can install Spring Cloud Services v2.0 alongside v3.1.0.

    Warning: You cannot upgrade to Ops Manager v2.7 if you are running Spring Cloud Services v2.0.

  • The Circuit Breaker Dashboard service will not return, as the underlying Netflix OSS Hystrix Dashboard project has been deprecated.
check-circle-line exclamation-circle-line close-line
Scroll to top icon