name: etcd

stemcells:
- alias: default
  os: ubuntu-trusty
  version: latest

releases:
- name: cfcr-etcd
  version: 1.3.1
- name: bpm
  sha1: 5a03b988c725c6b5a1aed247c8c23c2bff9d421b
  url: https://bosh.io/d/github.com/cloudfoundry-incubator/bpm-release?v=0.4.0
  version: 0.4.0
- name: bosh-dns
  sha1: 9231b7c7d2f6aa85e0cb77fdeef7add54fdb3f1a
  url: https://bosh.io/d/github.com/cloudfoundry/bosh-dns-release?v=0.2.0
  version: 1.6.0

instance_groups:
- name: etcd
  # CHANGEME Use availibility zones in your director tile
  azs: [az-1,az-2,az-3]
  instances: 3
  persistent_disk_type: 10240
  vm_type: medium
  stemcell: default
  networks:
  # CHANGEME Use the networks configured in the director tile
  - name: pks-services
  jobs:
  - name: etcd
    release: cfcr-etcd
    provides:
      etcd: {as: etcd}
    properties:
      tls:
        etcd:
          ca: ((tls_etcd.ca))
          certificate: ((tls_etcd.certificate))
          private_key: ((tls_etcd.private_key))
        etcdctl:
          ca: ((tls_etcdctl.ca))
          certificate: ((tls_etcdctl.certificate))
          private_key: ((tls_etcdctl.private_key))
        peer:
          ca: ((tls_etcd_peer.ca))
          certificate: ((tls_etcd_peer.certificate))
          private_key: ((tls_etcd_peer.private_key))
  - name: bpm
    release: bpm

- name: acceptance
  # CHANGEME
  azs: [az-1]
  instances: 1
  lifecycle: errand
  vm_type: small
  stemcell: default
  networks:
  - name: pks-services
  jobs:
  - name: acceptance-tests
    release: cfcr-etcd
    consumes:
      etcd: {from: etcd}
  properties:
    tls:
      etcd_client:
        ca: ((tls_etcdctl.ca))
        certificate: ((tls_etcdctl.certificate))
        private_key: ((tls_etcdctl.private_key))

update:
  serial: true
  canaries: 1
  max_in_flight: 1
  canary_watch_time: 1000-60000
  update_watch_time: 1000-60000

variables:
- name: /dns_healthcheck_tls_ca
  opsname: global_dns_healthcheck_tls_ca
  type: certificate
  options:
    is_ca: true
    common_name: dns-healthcheck-tls-ca

- name: /dns_healthcheck_server_tls
  opsname: global_dns_healthcheck_server_tls
  type: certificate
  options:
    ca: /dns_healthcheck_tls_ca
    common_name: health.bosh-dns
    extended_key_usage:
    - server_auth

- name: /dns_healthcheck_client_tls
  opsname: global_dns_healthcheck_client_tls
  type: certificate
  options:
    ca: /dns_healthcheck_tls_ca
    common_name: health.bosh-dns
    extended_key_usage:
    - client_auth

- name: /dns_api_tls_ca
  opsname: global_dns_api_tls_ca
  type: certificate
  options:
    is_ca: true
    common_name: dns-api-tls-ca

- name: /dns_api_server_tls
  opsname: global_dns_api_server_tls
  type: certificate
  options:
    ca: /dns_api_tls_ca
    common_name: api.bosh-dns
    extended_key_usage:
    - server_auth

- name: /dns_api_client_tls
  opsname: global_dns_api_client_tls
  type: certificate
  options:
    ca: /dns_api_tls_ca
    common_name: api.bosh-dns
    extended_key_usage:
    - client_auth

- name: etcd_ca
  type: certificate
  options:
    is_ca: true
    common_name: ca

- name: tls_etcd
  type: certificate
  options:
    ca: etcd_ca
    common_name: etcd.pks-services.etcd.bosh
    alternative_names:
    - "etcd.pks-services.etcd.bosh"
    - "*.etcd.pks-services.etcd.bosh"
    extended_key_usage:
    - server_auth
    - client_auth

- name: tls_etcd_peer
  type: certificate
  options:
    ca: etcd_ca
    common_name: etcd.pks-services.etcd.bosh
    alternative_names:
    - "etcd.pks-services.etcd.bosh"
    - "*.etcd.pks-services.etcd.bosh"
    extended_key_usage:
    - server_auth
    - client_auth

- name: tls_etcdctl
  type: certificate
  options:
    ca: etcd_ca
    common_name: etcd_acceptance_client
    extended_key_usage:
    - client_auth

features:
  converge_variables: true
  use_dns_addresses: true
