PAS for Windows v2.5 Release Notes

Page last updated:

This topic contains release notes for Pivotal Application Service (PAS) for Windows.

How to Upgrade

The PAS for Windows v2.5 tile is available with the release of Pivotal Cloud Foundry (PCF) version v2.5. To use the PAS for Windows v2.5 tile, you must install Ops Manager v2.5 or later and PAS v2.5 or later.

Releases

2.5.11

Release Date: 12/02/2019

  • Bump windows2019 stemcell to version 2019.13
  • Bump cf-windows-smoke-tests to version 40.0.123
Component Version
windows2019 stemcell2019.13
cf-windows-smoke-tests40.0.123
diego2.27.12
event-log0.7.0
garden-runc1.19.8
hwc-offline-buildpack3.1.10
loggregator-agent2.3.4
loggregator103.4.3
winc2.0.0
windows-utilities0.11.0
windowsfs-release2.1.0

2.5.10

Release Date: 10/31/2019

  • [Security Fix] Upgrade Go, runc and containerd to latest to include security fixes
  • [Security Fix] CVE-2019-17596 bump Go
  • Bump windows2019 stemcell to version 2019.12
  • Bump garden-runc to version 1.19.8
  • Bump loggregator-agent to version 2.3.4
  • Bump loggregator to version 103.4.3
Component Version
windows2019 stemcell2019.12
cf-windows-smoke-tests40.0.119
diego2.27.12
event-log0.7.0
garden-runc1.19.8
hwc-offline-buildpack3.1.10
loggregator-agent2.3.4
loggregator103.4.3
winc2.0.0
windows-utilities0.11.0
windowsfs-release2.1.0

2.5.9

Release Date: 10/16/2019

  • [Security Fix] Bump Go to address CVE-2019-16276
  • Bump loggregator-agent to version 2.3.2
  • Bump loggregator to version 103.4.2
  • Bump windowsfs-release to version 2.1.0
Component Version
windows2019 stemcell2019.11
cf-windows-smoke-tests40.0.119
diego2.27.12
event-log0.7.0
garden-runc1.19.7
hwc-offline-buildpack3.1.10
loggregator-agent2.3.2
loggregator103.4.2
winc2.0.0
windows-utilities0.11.0
windowsfs-release2.1.0

2.5.8

Release Date: 10/08/2019

  • [Security Fix] Upgrade Diego Components to Use grpc v1.23.0 and Go 1.12.9 to Fix HTTP2 CVEs
  • [Security Fix] Bump garden-runc release to take Go HTTP/2 and containerd gRPC fixes
  • [Feature Improvement] Set maximum database connection lifetime to 1 hour for Diego Locket component to reduce resource contention on PAS database
  • Bump windows2019 stemcell to version 2019.11
  • Bump cf-windows-smoke-tests to version 40.0.119
  • Bump diego to version 2.27.12
  • Bump garden-runc to version 1.19.7
  • Bump winc to version 2.0.0
  • Bump windowsfs-release to version 2.0.0
Component Version
windows2019 stemcell2019.11
cf-windows-smoke-tests40.0.119
diego2.27.12
event-log0.7.0
garden-runc1.19.7
hwc-offline-buildpack3.1.10
loggregator-agent2.3
loggregator103.4
winc2.0.0
windows-utilities0.11.0
windowsfs-release2.0.0

2.5.7

Release Date: 09/17/2019

  • [Bug Fix] Keep resending route unregistration message to prevent application misrouting in case of NATS routing tier instability
  • Bump windows2019 stemcell to version 2019.9
  • Bump cf-windows-smoke-tests to version 40.0.118
  • Bump diego to version 2.27.9
Component Version
windows2019 stemcell2019.9
cf-windows-smoke-tests40.0.118
diego2.27.9
event-log0.7.0
garden-runc1.19.5
hwc-offline-buildpack3.1.10
loggregator-agent2.3
loggregator103.4
winc1.14.0
windows-utilities0.11.0
windowsfs-release1.8.0

2.5.6

Release Date: 08/15/2019

  • [Feature Improvement] Windows Smoke Tests Errand uses windows stack instead of windows2016.
  • Bump cf-windows-smoke-tests to version 40.0.116
  • Bump garden-runc to version 1.19.5
  • Bump windowsfs-release to version 1.8.0
Component Version
windows2019 stemcell2019.8
cf-windows-smoke-tests40.0.116
diego2.27.6
event-log0.7.0
garden-runc1.19.5
hwc-offline-buildpack3.1.10
loggregator-agent2.3
loggregator103.4
winc1.14.0
windows-utilities0.11.0
windowsfs-release1.8.0

2.5.5

Release Date: 07/30/2019

  • Bump windows2019 stemcell to version 2019.8
  • Bump cf-windows-smoke-tests to version 40.0.113
  • Bump hwc-offline-buildpack to version 3.1.10
  • Bump windowsfs-release to version 1.7.0
Component Version
windows2019 stemcell2019.8
cf-windows-smoke-tests40.0.113
diego2.27.6
event-log0.7.0
garden-runc1.19.0
hwc-offline-buildpack3.1.10
loggregator-agent2.3
loggregator103.4
winc1.14.0
windows-utilities0.11.0
windowsfs-release1.7.0

2.5.4

  • [Feature Improvement] Apps get 10 seconds of graceful shutdown time in PASW
  • Bump windows2019 stemcell to version 2019.7
  • Bump cf-windows-smoke-tests to version 40.0.109
  • Bump winc to version 1.14.0
  • Bump windowsfs-release to version 1.6.0
Component Version
windows2019 stemcell2019.7
cf-windows-smoke-tests40.0.109
diego2.27.6
event-log0.7.0
garden-runc1.19.0
hwc-offline-buildpack3.1.9
loggregator-agent2.3
loggregator103.4
winc1.14.0
windows-utilities0.11.0
windowsfs-release1.6.0

2.5.3

  • [Feature] App developers can gracefully shutdown their .NET applications in PASW.
  • Bump windows2019 stemcell to version 2019.5
  • Bump hwc-offline-buildpack to version 3.1.9
  • Bump winc to version 1.13.0
  • Bump windowsfs-release to version 1.5.0
Component Version
windows2019 stemcell2019.5
cf-windows-smoke-tests40.0.40
diego2.27.6
event-log0.7.0
garden-runc1.19.0
hwc-offline-buildpack3.1.9
loggregator-agent2.3
loggregator103.4
winc1.13.0
windows-utilities0.11.0
windowsfs-release1.5.0

2.5.2

  • No release bumps
Component Version
windows2019 stemcell2019.3
cf-windows-smoke-tests40.0.40
diego2.27.6
event-log0.7.0
garden-runc1.19.0
hwc-offline-buildpack3.1.8
loggregator-agent2.3
loggregator103.4
winc1.9.0
windows-utilities0.11.0
windowsfs-release1.3.0

2.5.1

  • [Feature Improvement] Allow vcap WriteKey access to ODBC registry entry.
  • Bump windows2019 stemcell to version 2019.3
  • Bump diego to version 2.27.6
  • Bump garden-runc to version 1.19.0
  • Bump hwc-offline-buildpack to version 3.1.8
  • Bump windowsfs-release to version 1.3.0
Component Version
windows2019 stemcell2019.3
cf-windows-smoke-tests40.0.40
diego2.27.6
event-log0.7.0
garden-runc1.19.0
hwc-offline-buildpack3.1.8
loggregator-agent2.3
loggregator103.4
winc1.9.0
windows-utilities0.11.0
windowsfs-release1.3.0

2.5.0

  • [Feature Improvement] Enable SMB net use-style mounting with FQDN paths on Windows 2016 cells
  • [Security Fix] Rotate Diego intermediate CA before current certificate expires
Component Version
windows2019 stemcell2019.3
cf-windows-smoke-tests40.0.40
diego2.27.0
event-log0.7.0
garden-runc1.18.0
hwc-offline-buildpack3.1.6
loggregator-agent2.3
loggregator103.4
winc1.9.0
windows-utilities0.11.0
windowsfs-release1.0.0

New Features in PAS for Windows v2.5

PAS for Windows v2.5 includes the following major features:

Support for Windows Server 2019

PAS for Windows v2.5 requires Windows Server 2019. This means developers can deploy .NET and Windows applications on Windows Server 2019 in PAS. Moving to Windows Server 2019 adds stability and enhances a number of container APIs used in the Garden Windows implementation (winc) of PAS for Windows.

Windows Server 2019 stemcells for supported public cloud providers are available for download on Pivotal Network. For vSphere stemcells, see the documentation on producing them from a Windows image provided by your Microsoft VLSC account. For more information, see Creating a vSphere Windows Stemcell.

Note: PAS for Windows v2.5 supports Windows Server 2019-based stemcells only.

.NET Apps Trust CA Certificates Configured in BOSH Director

Applications deployed on PAS for Windows now automatically trust your certificate authority (CA) certificates configured in the Security pane of the BOSH Director tile. To enable .NET apps to trust these CA certificates, PAS for Windows includes them in the system trust store of Windows containers.

For instructions on configuring trusted certificates in the BOSH Director tile, see Setting Trusted Certificates.

Pre-Installed Visual C++ Redistributables

PAS for Windows v2.5.5 and later includes Microsoft Visual C++ Redistributables for Visual Studio 2010, 2015, 2017 and 2019. This change is backported to PAS for Windows v2.2 and later.

This update improves the developer experience by making Visual C++ Redistributables readily available for .NET apps. Developers no longer have to manually bin deploy to reference C++ or C++ based libraries.

Deprecation of the windows2016 Stack

In PAS for Windows v2.5, the windows2016 stack is deprecated in favor of the windows stack. PAS for Windows v2.8 removes the windows2016 stack completely.

You can migrate your apps from windows2016 to windows using Stack Auditor, a Cloud Foundry CLI plugin. For more information, see Using the Stack Auditor Plugin.

Known Issues

This section includes known issues with PAS for Windows v2.5.

Removed Option to Override Deployment Name to CF

PAS v2.4 introduced the use of cf-GUID as the value for the deployment in metrics. For more information, see Uniquely Identify Metrics by Tile.

PAS v2.4 also included the option to override this value back to cf, which was used in previous versions. However, PAS v2.5 removes this override option.

To upgrade successfully, the Use “cf” as deployment name in emitted metrics instead of unique name option in the Advanced Features pane of the PAS tile must be deselected.

If you have scripts that rely on metrics with cf as the value for deployment, your scripts may break when upgrading to PAS v2.5.

Additionally, if you have PCF Healthwatch installed and you changed the value of Use “cf” as deployment name in emitted metrics instead of unique name in PAS, you must run the Push Monitoring Components errand for Healthwatch to detect the change.

AWS Deployments Using CloudFront-Enabled Blobstores May Result in cf push Failing Due to Untrusted Root Certificates

Symptom

cf push to Windows cells on Amazon Web Services (AWS) fails with the following error:

ERR: Downloading failed

Explanation

Windows Server 2019 stemcells (version v2019.2) on AWS are missing the root CA certificate that is used to sign Amazon’s CloudFront CDN certificate. The missing root CA certificate is the VeriSign Class 3 Public Primary Certification Authority.

If you deploy PAS with a blobstore that is fronted by CloudFront, there is an x509 certificate error when downloading the app droplet from the blobstore. As a result, cf push fails.

Workaround

Add the missing VeriSign root CA certificate to Trusted Certificates in Ops Manager to ensure that the certificate presented by CloudFront is trusted on Windows cells, allowing the droplet to be successfully downloaded from the blobstore.