gorouter job from cf/282

Gorouter maintains a dynamic routing table based on updates received from NATS and (when enabled) the Routing API. This routing table maps URLs to backends. The router finds the URL in the routing table that most closely matches the host header of the request and load balances across the associated backends.

Github source: 1e794f7e or master branch

Properties¶

`metron`¶

port¶

The port used to emit dropsonde messages to the Metron agent.
Default
3457

`nats`¶

machines¶

IPs of each NATS cluster member
Example
|+
  - 192.168.50.123
  - 192.168.52.123
password¶

Password for NATS authentication
Example
natSpa55w0rd
port¶

TCP port of NATS servers
Example
4222
user¶

User name for NATS authentication
Example
nats

`request_timeout_in_seconds`¶

Timeout in seconds for Router -> Endpoint roundtrip.

Default

`router`¶

backends¶
cert_chain¶

Certificate chain used for client authentication to TLS-registered backends. In PEM format.

enable_tls¶

(optional, boolean) By default, Gorouter forwards requests to backends over unencrypted connections and will ignore routes registered with a TLS port, preferring a non-tls port when both are present. When this property is set to true, Gorouter will connect to backends using TLS when routes are registered with a TLS port, ignoring non-tls ports when both are present.
Default
false
max_conns¶

Maximum concurrent TCP connections per backend. When set to 0 there is no limit
Default
0
private_key¶

Private key used for client authentication to TLS-registered backends. In PEM format.
balancing_algorithm¶

Algorithm used to distribute requests for a route across backends. Supported values are round-robin and least-connection
Default
round-robin
ca_certs¶

String of concatenated certificate authorities in PEM format, used to validate certificates provided by remote systems. By default, Gorouter will trust certificates signed by well-known CAs and by CA certificates installed on the filesystem.

cipher_suites¶

An ordered, colon-delimited list of golang supported TLS cipher suites in OpenSSL or RFC format. The selected cipher suite will be negotiated according to the order of this list during a TLS handshake. See https://github.com/golang/go/blob/release-branch.go1.9/src/crypto/tls/cipher_suites.go#L369-L390 for golang supported cipher suites. The first four of these are supported for TLSv1.0/1.1 only. See https://www.openssl.org/docs/man1.1.0/apps/ciphers.html for a mapping of OpenSSL and RFC suite names.
Default
ECDHE-RSA-AES128-GCM-SHA256:TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
client_cert_validation¶

none - Gorouter will not request client certificates in TLS handshakes, and will ignore them if presented. Incompatible with forwarded_client_cert: forward or sanitize_set. request - Gorouter will request client certificates in TLS handshakes, and will validate them when presented, but will not require them. require - Gorouter will fail a TLS handshake if the client does not provide a certificate signed by a CA it trusts.
Default
none
debug_address¶

Address at which to serve debug info
Default
127.0.0.1:17002
disable_http¶

Disables the http listener on port specified by router.port. This cannot be set to true if enable_ssl is false.
Default
false
dns_health_check_host¶

Host to ping for confirmation of DNS resolution, only used when Routing API is enabled
Default
uaa.service.cf.internal
drain_wait¶

Delay in seconds after shut down is initiated before server stops listening. During this time the server will reject requests to the /health endpoint. This accommodates requests forwarded by a load balancer until it considers the router unhealthy.
Default
20
enable_access_log_streaming¶

Enables streaming of access log to syslog.
Default
false
enable_proxy¶

Enables support for the popular PROXY protocol, allowing downstream load balancers that do not support HTTP to pass along client information.
Default
false
enable_ssl¶

When enabled, Gorouter will listen on port 443 and terminate TLS for requests received on this port.
Default
false
extra_headers_to_log¶

An array of headers that access log events will be annotated with
Default
[]
force_forwarded_proto_https¶

Enables setting X-Forwarded-Proto header if SSL termination happened upstream and incorrectly set the header value. When this property is set to true gorouter sets the header X-Forwarded-Proto to https. When this value set to false, gorouter set the header X-Forwarded-Proto to the protocol of the incoming request
Default
false
forwarded_client_cert¶

How to handle the x-forwarded-client-cert (XFCC) HTTP header. Possible values are: - always_forward: Always forward the XFCC header in the request, regardless of whether the client connection is mTLS. Use this value when your load balancer is forwarding the client certificate and requests are not forwarded to Gorouter over mTLS. In the case where the connection between load balancer and Gorouter is mTLS, the client certificate received by Gorouter in the TLS handshake will not be forwarded. - forward: Forward the XFCC header received from the client only when the client connection is mTLS. This is a more secure version of always_forward. The client certificate received by Gorouter in the TLS handshake will not be forwarded. Requires client_cert_validation: request or require. - sanitize_set: Strip any instances of XFCC headers from the client request. When the client connection is mTLS, the client certificate received by Gorouter in the TLS handshake will be forwarded in this header. Values will be base64 encoded PEM. Use this value when Gorouter is the first component to terminate TLS. Requires client_cert_validation: request or require.
Default
always_forward
frontend_idle_timeout¶

(optional, integer) Duration in seconds to maintain an open connection when client supports keep-alive. This property must be configured with regards to how an IaaS-provided load balancer behaves in order to prevent connections from being closed prematurely. Generally, this timeout must be greater than that of the load balancer. As examples, GCP has a default timeout of 600 seconds so a value greater than 600 is recommended and AWS ELB has a default timeout of 60 seconds so a value greater than 60 is recommended. However, depending on the IaaS, this timeout may need to be shorter than the load balancer’s timeout, e.g., Azure’s load balancer times out at 240 seconds (by default) without sending a TCP RST to clients, so a value lower than this is recommended in order to force it to send the TCP RST.
Default
900
healthcheck_user_agent¶

DEPRECATED. Use /health endpoint on port specified by status.port. User-Agent for the health check agent (usually the Load Balancer).
Default
HTTP-Monitor/1.1
Example
ELB-HealthChecker/1.0
isolation_segments¶

Routes with these isolation segments will be registered. Used in combination with routing_table_sharding_mode.
Default
[]
load_balancer_healthy_threshold¶

Time period in seconds to wait until declaring the router instance started after starting the listener socket. This allows an external load balancer time to register the instance as healthy.
Default
20
logging_level¶

Log level for router
Default
info
max_idle_connections¶

Maximum total idle keepalive connections to backends. When 0, support for keepalive connections is disabled. Maximum idle connections per backend is 100.
Default
0
min_tls_version¶

Minimum accepted version of TLS protocol. All versions above this will also be accepted. Valid values are TLSv1.0, TLSv1.1, and TLSv1.2.
Default
TLSv1.2
number_of_cpus¶

Number of CPUs to utilize, the default (-1) will equal the number of available CPUs
Default
-1
offset¶
Default
0
port¶

Listening Port for Router.
Default
80
requested_route_registration_interval_in_seconds¶

On startup, the router will delay listening for requests by this duration to increase likelihood that it has a complete routing table before serving requests. The router also broadcasts the same duration as a recommended interval to registering clients via NATS. This must be less than 60, otherwise monit will mark the process as failed.
Default
20
route_services_recommend_https¶

Route Services are told where to send requests after processing using the X-CF-Forwarded-Url header. When this property is true, the scheme for this URL is https. When false, the scheme is http. As requests from Route Services to applications on CF transit load balancers and gorouter, disable this property for deployments that have TLS termination disabled.
Default
true
route_services_secret¶

Support for route services is disabled when no value is configured. A robust passphrase is recommended.
Default
""
route_services_secret_decrypt_only¶

To rotate keys, add your new key here and deploy. Then swap this key with the value of route_services_secret and deploy again.
Default
""
route_services_timeout¶

Expiry time of a route service signature in seconds
Default
60
routing_table_sharding_mode¶

all: all routes will be registered. shared-and-segments: both routes for the configured isolation segments and those that do not have an isolation segment specified will be registered. segments: only routes for the configured isolation segments will be registered.
Default
all
secure_cookies¶

Set secure flag on http cookies
Default
false
ssl_skip_validation¶

Skip validation of TLS certificates received from route services and UAA
Default
false
status¶
password¶

Password for HTTP basic auth to the /varz and /routes endpoints.

port¶

Port for the /health, /varz, and /routes endpoints.
Default
8080
user¶

Username for HTTP basic auth to the /varz and /routes endpoints.
Default
router-status
suspend_pruning_if_nats_unavailable¶

Suspend pruning of routes when NATs is unavailable and maintain the current routing table. WARNING: This strategy favors availability over consistency and there is a possibility of routing to an incorrect endpoint in the case of port re-use. To be used with caution.”
Default
false
tls_pem¶

Array of private keys and certificates used for TLS handshakes with downstream clients. Each element in the array is an object containing fields ‘private_key’ and ‘cert_chain’, each of which supports a PEM block. Required if router.enable_ssl is true.
Example
|+
  tls_pem:
  - cert_chain: |
    -----BEGIN CERTIFICATE-----
    -----END CERTIFICATE-----
    -----BEGIN CERTIFICATE-----
    -----END CERTIFICATE-----
    private_key: |
    -----BEGIN RSA PRIVATE KEY-----
    -----END RSA PRIVATE KEY-----
trace_key¶

If the X-Vcap-Trace request header is set and has this value, trace headers are added to the response.
Default
22
tracing¶
enable_zipkin¶

Enables the addition of the X-B3-Trace-Id header to incoming requests. If the header already exists on the incoming request, it will not be overwritten.
Default
false
write_access_logs_locally¶

Enables writing access log to local disk.
Default
true

`routing_api`¶

auth_disabled¶

When false, Routing API requires OAuth tokens for authentication.
Default
false
enabled¶

When enabled, GoRouter will fetch HTTP routes from the Routing API in addition to routes obtained via NATS.
Default
false
port¶

Port on which Routing API is running.
Default
3000
uri¶

URL where the routing API can be reached internally
Default
http://routing-api.service.cf.internal

`uaa`¶

ca_cert¶

Certificate authority for communication between clients and uaa.
Default
""
clients¶

gorouter¶

secret¶

Password for UAA client for the gorouter.

ssl¶

port¶

Secure Port on which UAA is running.

token_endpoint¶

UAA token endpoint host name. Do not include a scheme in this value; TCP Router will always use TLS to connect to UAA.
Default
uaa.service.cf.internal

Templates¶

Templates are rendered and placed onto corresponding instances during the deployment process. This job's templates will be placed into /var/vcap/jobs/gorouter/ directory (learn more).

bin/dns_health_check (from dns_health_check.erb)
bin/drain (from drain)
bin/gorouter_ctl (from gorouter_ctl)
bin/post-start (from post-start.erb)
bin/publish_to_nats (from publish_to_nats.erb)
bin/run_gorouter (from run_gorouter.erb)
config/certs/uaa/ca.crt (from uaa_ca.crt.erb)
config/gorouter.yml (from gorouter.yml.erb)

Packages¶

Packages are compiled and placed onto corresponding instances during the deployment process. Packages will be placed into /var/vcap/packages/ directory.

gorouter job from cf/282

Properties¶

metron¶

port¶

nats¶

machines¶

password¶

port¶

user¶

request_timeout_in_seconds¶

router¶

backends¶

cert_chain¶

enable_tls¶

max_conns¶

private_key¶

balancing_algorithm¶

ca_certs¶

cipher_suites¶

client_cert_validation¶

debug_address¶

disable_http¶

dns_health_check_host¶

drain_wait¶

enable_access_log_streaming¶

enable_proxy¶

enable_ssl¶

extra_headers_to_log¶

force_forwarded_proto_https¶

forwarded_client_cert¶

frontend_idle_timeout¶

healthcheck_user_agent¶

isolation_segments¶

load_balancer_healthy_threshold¶

logging_level¶

max_idle_connections¶

min_tls_version¶

number_of_cpus¶

offset¶

port¶

requested_route_registration_interval_in_seconds¶

route_services_recommend_https¶

route_services_secret¶

route_services_secret_decrypt_only¶

route_services_timeout¶

routing_table_sharding_mode¶

secure_cookies¶

ssl_skip_validation¶

status¶

password¶

port¶

user¶

suspend_pruning_if_nats_unavailable¶

tls_pem¶

trace_key¶

tracing¶

enable_zipkin¶

write_access_logs_locally¶

routing_api¶

auth_disabled¶

enabled¶

port¶

uri¶

uaa¶

ca_cert¶

clients¶

gorouter¶

secret¶

ssl¶

port¶

token_endpoint¶

Templates¶

Packages¶

`metron`¶

`port`¶

`nats`¶

`machines`¶

`password`¶

`port`¶

`user`¶

`request_timeout_in_seconds`¶

`router`¶

`backends`¶

`cert_chain`¶

`enable_tls`¶

`max_conns`¶

`private_key`¶

`balancing_algorithm`¶

`ca_certs`¶

`cipher_suites`¶

`client_cert_validation`¶

`debug_address`¶

`disable_http`¶

`dns_health_check_host`¶

`drain_wait`¶

`enable_access_log_streaming`¶

`enable_proxy`¶

`enable_ssl`¶

`extra_headers_to_log`¶

`force_forwarded_proto_https`¶

`forwarded_client_cert`¶

`frontend_idle_timeout`¶

`healthcheck_user_agent`¶

`isolation_segments`¶

`load_balancer_healthy_threshold`¶

`logging_level`¶

`max_idle_connections`¶

`min_tls_version`¶

`number_of_cpus`¶

`offset`¶

`port`¶

`requested_route_registration_interval_in_seconds`¶

`route_services_recommend_https`¶

`route_services_secret`¶

`route_services_secret_decrypt_only`¶

`route_services_timeout`¶

`routing_table_sharding_mode`¶

`secure_cookies`¶

`ssl_skip_validation`¶

`status`¶

`password`¶

`port`¶

`user`¶

`suspend_pruning_if_nats_unavailable`¶

`tls_pem`¶

`trace_key`¶

`tracing`¶

`enable_zipkin`¶

`write_access_logs_locally`¶

`routing_api`¶

`auth_disabled`¶

`enabled`¶

`port`¶

`uri`¶

`uaa`¶

`ca_cert`¶

`clients`¶

`gorouter`¶

`secret`¶

`ssl`¶

`port`¶

`token_endpoint`¶