A simple Go application to test X-Forwarded-Client-Cert (XFCC) header format in Cloud Foundry environments with mTLS app-to-app routing.
This tool verifies that GoRouter correctly implements the Envoy XFCC format when routing requests over mTLS domains. It checks whether the XFCC header contains:
Hash=<hash>;Subject="<subject>";URI=<uri>Cert="-----BEGIN CERTIFICATE-----\n..."
Context for TOC discussion (2026-04-14). The Identity-Aware Routing RFC introduces L7 route-level access policies ("access rules") that control which apps can reach a route through GoRouter using mTLS identity. This document compares two placement options for the external CRUD API that manages these access rules.
Cloud Controller, the policy-server, and the routing-api are separate processes colocated on the api instance group. GoRouter routes requests to the correct backend using path-based prefix matching on api.<system_domain>. The current cf-deployment registers three overlapping prefixes:
Cloud Foundry's RFC for Domain-Scoped mTLS on GoRouter proposes scope-based authorization that uses GoRouter's existing route-emitter tags (organization_id, space_id) to enforce "same org/space" boundary checks at the domain level. This experiment verifies that the tags carry the correct information when routes are shared across spaces.
When a route is shared from Space A to Space B (and both spaces have apps mapped to it), do the GoRouter route table tags reflect:
The operations/use-compiled-releases.yml file in cf-deployment references stemcell version 1.423 for all compiled releases, even though newer stemcells are available. This is due to how the CI pipeline is configured to only recompile all releases on major stemcell version bumps.
Both PRs address NVMe device discovery challenges but for different cloud providers with fundamentally different approaches.
| Aspect | PR #396 (AWS) | PR #402 (Azure) |
|---|---|---|
| URL | cloudfoundry/bosh-agent#396 | cloudfoundry/bosh-agent#402 |
| Cloud Provider | AWS | Azure |
| use nix |
| https://packages.ubuntu.com/xenial/linux-aws-source-4.4.0 ixgbevf 2.12.1-k | |
| ❯ diff ubuntu/linux-4.4/drivers/net/ethernet/intel/ixgbevf upstream/ixgbevf-2.12.1/src | wc -l | |
| 3424 | |
| ❯ diff ubuntu/linux-4.4/drivers/net/ethernet/intel/ixgbevf upstream/ixgbevf-4.1.2/src | wc -l | |
| 3897 | |
| ❯ diff ubuntu/linux-4.4/drivers/net/ethernet/intel/ixgbevf upstream/ixgbevf-4.6.3/src | wc -l | |
| 5348 | |
| ❯ diff ubuntu/linux-4.4/drivers/net/ethernet/intel/ixgbevf upstream/ixgbevf-4.8.1/src | wc -l | |
| 5475 |