RFC: Add Google Distributed Cloud air-gapped BOSH CPI and Stemcell Builder

[dilipkumar2k6]

Link for easy reading

Summary

This RFC proposes adding official support for Google Distributed Cloud air-gapped (GDC) infrastructure to the Cloud Foundry ecosystem under the Foundational Infrastructure (FI) Working Group.

As discussed in the TOC meeting and requested in #1610 (comment), this RFC covers:

• The creation of two new repositories:
  • cloudfoundry/bosh-gdc-cpi-release (BOSH CPI v2 implementation for GDC APIs)
  • cloudfoundry/bosh-gdc-ci (GDC-specific CFBOSH CI/CD orchestration and end-to-end test suites)
• Contributing GDC stemcell support (definitions, OS image stages, and packaging scripts) directly into the existing cloudfoundry/bosh-linux-stemcell-builder repository to keep Linux stemcells aligned and in sync.
• A long-term joint maintenance plan between Google (primary maintainer) and SAP (co-maintainer).
• A two-level CI/CD, testing, and release pipeline strategy running natively on GitHub Actions:
  • Presubmit Testing: Static and unit checks on standard GitHub Actions runners on every PR, plus maintainer-gated component integration tests running against isolated test namespaces on Google's internal GDC Staging cluster.
  • Release Pipeline & Full E2E Qualification: Scheduled/on-demand builds, binary and stemcell OS vulnerability scanning on GCP, and full CFBOSH E2E test qualification via a Google-managed Concourse cluster hosted on GKE targeting to GDC Staging environment—publishing verified releases via GitHub Releases to the shared public Cloud Foundry registry, with a restricted read-only release pipeline dashboard for Google and SAP maintainers.
  • Infrastructure Access & Debugging Ownership: SAP maintainers and external contributors have zero direct access to GDC Staging infrastructure or GCP resources (visibility is limited to logs surfaced in GitHub Actions and the read-only release dashboard). The Google team owns debugging and fixing any GDC Staging or GCP infrastructure errors.
  • Minimal CFF Infrastructure Overhead: Workflows use GitHub's standard Linux runners for public repositories (currently provided at no cost by GitHub), and Google fully hosts, manages, and funds the GDC Staging environment and production GCP test infrastructure. Aside from standard GitHub usage and nominal storage costs for publishing verified artifacts to the shared Cloud Foundry registry, no dedicated GDC hardware or test runtime infrastructure is required from the Cloud Foundry Foundation.

Related Issues

• Resolves Request to create new repository: cloudfoundry/bosh-gdc-stemcell-builder #1609 (GDC stemcell support will be contributed directly to cloudfoundry/bosh-linux-stemcell-builder instead of a separate repository)
• Resolves Request to create new repository: cloudfoundry/bosh-gdc-cpi-release #1610 (cloudfoundry/bosh-gdc-cpi-release)

Working Group & Approvers

• Working Group: Foundational Infrastructure (FI) WG
• Proposed Approvers:
  • @ajlfleos (Google)
  • @sanjay-nagarur (Google)
  • @dilipkumar2k6 (Google)
  • @a-hassanin (SAP)
  • @neddp (SAP)
  • @gowrisankar22 (SAP)
  • @Ivaylogi98 (SAP)

CC: @beyhan @gowrisankar22

[linux-foundation-easycla]

The committers listed above are authorized under a signed CLA.

• ✅ login: dilipkumar2k6 / name: Dilip Kumar (913334d)

[beyhan]

We decided to start the final comment period during the TOC meeting on 15th of September.

[mkocher]

Why use a separate repo for the stemcell? We currently use bosh-linux-stemcell-builder to build all the other infrastructure linux stemcells, which keeps them in sync.

[dilipkumar2k6]

Why use a separate repo for the stemcell? We currently use bosh-linux-stemcell-builder to build all the other infrastructure linux stemcells, which keeps them in sync.

Thx, updated the RFC and PR details to reflect the feedback.

[oliver-heinrich]

Hi @beyhan: As no GDCH IaaS is planned in the CF foundation, I assume there is no CF validation planned for the stemcell with CATs/Smoke tests, that we have in the ARD working group e.g. on GCP and AWS. Correct?

[beyhan]

Hi @beyhan: As no GDCH IaaS is planned in the CF foundation, I assume there is no CF validation planned for the stemcell with CATs/Smoke tests, that we have in the ARD working group e.g. on GCP and AWS. Correct?

We are still waiting on the clarification of this open question before deciding to approve this RFC.

[dilipkumar2k6]

Hi @beyhan: As no GDCH IaaS is planned in the CF foundation, I assume there is no CF validation planned for the stemcell with CATs/Smoke tests, that we have in the ARD working group e.g. on GCP and AWS. Correct?

We are still waiting on the clarification of this open question before deciding to approve this RFC.

Updated to run the CF validation and execution of integration tests on GDC Staging infra. Please review it one more time.

[gowrisankar22]

Looks good now to me.