Skip to content

improve startup scripts and logs #1236

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
fhanik wants to merge 4 commits into
base: develop
Choose a base branch
from
Open

improve startup scripts and logs #1236

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
76be6b2
Use mktemp for temporary files in perform-release.sh
fhanik May 7, 2026
e68f332
Change redirect_uri.matching_mode default to exact
fhanik May 7, 2026
7cb571b
Change logging_level default to INFO; extend log redaction
fhanik May 7, 2026
acbf4c0
Restore cert-cache ownership to root after configure_tomcat
fhanik May 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 5 additions & 2 deletions jobs/uaa/spec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -203,7 +203,7 @@ properties:
description: "The url to use as the issuer URI"
uaa.logging_level:
description: Set UAA logging level. (e.g. TRACE, DEBUG, INFO)
default: DEBUG
default: INFO
uaa.logging.format.timestamp:
Comment on lines 204 to 207
description: "Format for timestamp in component logs. Valid values are 'rfc3339', 'rfc3339-legacy', and 'deprecated'. 'rfc3339' sets the format to be {yyyy-MM-dd'T'HH:mm:ss.nnnnnn}{GMT+0}Z which is rfc3339 compliant but additionally has microsecond precision and is set to UTC timezone. 'rfc3339-legacy' sets the time format to be yyyy-MM-dd'T'HH:mm:ss.SSSXXX. 'deprecated' sets the time format to be yyyy-MM-dd HH:mm:ss.SSS."
default: rfc3339
Expand Down Expand Up @@ -580,7 +580,10 @@ properties:
When set to `legacy`, allow unsafe matching of redirect URIs.
For example, https://example.com would also match all subdomains and all paths of https://example.com.
When set to `exact`, will provide OAuth2 spec-compliant (RFC6749) exact redirect URI matching.
default: legacy
NOTE: changing this from `legacy` to `exact` is a breaking change for clients that rely on
wildcard or subdomain redirect URI matching. Review all registered client redirect URIs before
enabling `exact` mode in existing deployments.
default: exact

# Clients
uaa.clients:
Expand Down
13 changes: 13 additions & 0 deletions jobs/uaa/templates/bin/pre-start.erb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -176,6 +176,17 @@ function configure_tomcat {
chown -R vcap:vcap /var/vcap/data/uaa/
}

function resecure_cert_cache {
# configure_tomcat hands all of /var/vcap/data/uaa/ to vcap via chown -R.
# Re-secure cert-cache so that the vcap process cannot tamper with the
# truststore between deploys. vcap retains read-only access via the
# execute bit on the directory and world-readable mode on the files.
chown root:root "${PERSISTENT_CERTS_DIR}"
chmod 0711 "${PERSISTENT_CERTS_DIR}"
find "${PERSISTENT_CERTS_DIR}" -maxdepth 1 -type f -exec chown root:root {} +
find "${PERSISTENT_CERTS_DIR}" -maxdepth 1 -type f -exec chmod 0644 {} +
}

function configure_spring_boot {
# When run with bpm, the vcap user does not have permissions to read
# files in the jobs and packages directories. Consequently, we move
Expand Down Expand Up @@ -213,6 +224,8 @@ configure_tomcat

configure_spring_boot

resecure_cert_cache

rm -rf $TMP_DIR

log "Completed"
2 changes: 1 addition & 1 deletion jobs/uaa/templates/config/log4j2.properties.erb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,7 @@ case logging_format_timestamp_value
end
%>
property.log_directory = /var/vcap/sys/log/uaa
property.log_pattern=[<%= timestamp_format %>] uaa%X{context} - %pid [%t] - [%X{traceId},%X{spanId}] .... %5p --- %c{1}: %replace{%m}{(?<=password=|client_secret=)([^&]*)}{<redacted>}%n
property.log_pattern=[<%= timestamp_format %>] uaa%X{context} - %pid [%t] - [%X{traceId},%X{spanId}] .... %5p --- %c{1}: %replace{%m}{(?<=password=|client_secret=|code=|access_token=|refresh_token=|id_token=)([^&\s]*)}{<redacted>}%n

appender.uaaDefaultAppender.type = File
appender.uaaDefaultAppender.name = UaaDefaultAppender
Expand Down
17 changes: 10 additions & 7 deletions scripts/perform-release.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,8 +7,7 @@ CYAN='\033[0;36m'
BOLD='\033[0;1m'
NC='\033[0m' # No Color

TMPDIR=/tmp
SAVEDIR=$TMPDIR/uaa-release-save
SAVEDIR=$(mktemp -d)
RELEASES=$SAVEDIR/releases
FINAL_BUILDS=$SAVEDIR/.final_builds
Comment on lines +10 to 12

Expand Down Expand Up @@ -123,12 +122,16 @@ git fetch --all --prune > /dev/null

echo -e "${CYAN}Creating bosh UAA-release ${GREEN} ${1} ${NC} using `bosh -v`"

# we save private.yml to a temp directory
# just in case it gets deleted during branch switch
# we save private.yml to a secure temp file so it survives branch switches
# and is cleaned up automatically on exit.
PRIVATE_YML_COPY=$(mktemp)
chmod 0600 "${PRIVATE_YML_COPY}"
trap 'rm -f "${PRIVATE_YML_COPY}"' EXIT
Comment on lines +126 to +129

Comment on lines +125 to +130
if [ "$#" -ge 3 ]; then
cp $3 /tmp/private.yml
cp "$3" "${PRIVATE_YML_COPY}"
elif [ -f config/private.yml ]; then
cp config/private.yml /tmp/private.yml
cp config/private.yml "${PRIVATE_YML_COPY}"
else
echo -e "${RED}ERROR:${NC} Missing private.yml file" >&2
usage
Expand All @@ -140,7 +143,7 @@ git checkout $branch_to_release_from
sub_update

# restore private.yml in case it got deleted
cp /tmp/private.yml config/
cp "${PRIVATE_YML_COPY}" config/

echo -e "${CYAN}Building tarball ${GREEN}${1}${NC} and tag with ${GREEN}v${1}${NC}"
# create a release tar ball - and a dev release
Expand Down