migrate to using externally managed concourse manifest

Signed-off-by: Sapphire Mason-Brown <sapphire.mason-brown@engineerbetter.com>

bosh/assets/manifest.yml

@@ -0,0 +1,315 @@
+name: ((deployment_name))
+
+variables:
+- name: credhub-encryption-password
+  type: password
+  options: {length: 40}
+- name: uaa-jwt
+  type: rsa
+  options: {key_length: 4096}
+- name: uaa-users-admin
+  type: password
+- name: uaa-admin
+  type: password
+- name: uaa-login
+  type: password
+- name: uaa_clients_atc_to_credhub
+  type: password
+- name: credhub_cli_password
+  type: password
+- name: credhub_admin_client_secret
+  type: password
+- name: uaa-passphrase
+  type: password
+- name: atc_password
+  type: password
+- name: influxdb_password
+  type: password
+- name: grafana_password
+  type: password
+- name: token_signing_key
+  type: rsa
+- name: tsa_host_key
+  type: ssh
+- name: worker_key
+  type: ssh
+- name: ca
+  options:
+    common_name: ConcourseCA
+    is_ca: true
+  type: certificate
+- name: web_tls
+  type: certificate
+  options:
+    ca: ca
+    common_name: ((domain))
+    alternative_names:
+    - ((domain))
+    - 127.0.0.1
+
+releases:
+- name: concourse
+  version: latest
+- name: garden-runc
+  version: latest
+- name: riemann
+  version: latest
+- name: grafana
+  version: latest
+- name: influxdb
+  version: latest
+- name: credhub
+  version: latest
+- name: uaa
+  version: latest
+
+stemcells:
+- alias: trusty
+  os: ubuntu-trusty
+  version: latest
+
+tags:
+  concourse-up-project: ((project))
+  concourse-up-component: concourse
+
+instance_groups:
+- name: web
+  azs: [z1]
+  instances: 1
+  networks:
+  - name: ((web_network_name))
+    default: [dns, gateway]
+  stemcell: trusty
+  vm_type: ((web_vm_type))
+  jobs:
+  - name: atc
+    release: concourse
+    properties:
+      allow_self_signed_certificates: true
+      basic_auth_password: ((atc_password))
+      basic_auth_username: admin
+      bind_port: 80
+      credhub:
+        client_id: atc_to_credhub
+        client_secret: ((uaa_clients_atc_to_credhub))
+        tls:
+          ca_cert:
+            certificate: ((web_tls.ca))
+        url: https://((domain)):8844
+      external_url: https://((domain))
+      influxdb:
+        database: default
+        password: ((influxdb_password))
+        url: http://localhost:8086
+        username: admin
+      log_level: debug
+      postgresql:
+        ca_cert: ((postgres_ca_cert))
+        database: concourse_atc
+        host: ((postgres_host))
+        port: ((postgres_port))
+        role:
+          name: ((postgres_role))
+          password: ((postgres_password))
+        sslmode: verify-ca
+      tls_cert: ((web_tls.certificate))
+      tls_key: ((web_tls.private_key))
+      tls_bind_port: 443
+      token_signing_key: ((token_signing_key))
+  - name: tsa
+    release: concourse
+    properties:
+      authorized_keys:
+      - ((worker_key.public_key))
+      host_key: ((tsa_host_key))
+      log_level: debug
+      token_signing_key: ((token_signing_key))
+  - name: influxdb
+    release: influxdb
+    properties:
+      influxdb:
+        database: riemann
+        password: ((influxdb_password))
+        user: admin
+  - name: riemann
+    release: riemann
+    properties:
+      riemann:
+        influxdb:
+          database: riemann
+          host: 127.0.0.1
+          password: ((influxdb_password))
+          port: 8086
+          username: admin
+  - name: riemann-emitter
+    release: riemann
+    properties:
+      riemann_emitter:
+        host: 127.0.0.1
+        port: 5555
+  - name: grafana
+    release: grafana
+    properties:
+      grafana:
+        admin_password: ((grafana_password))
+        admin_username: admin
+        dashboards:
+        - name: Concourse
+          content: ((grafana_dashboard))
+        datasource:
+          database_name: riemann
+          database_type: influxdb
+          name: influxdb
+          password: ((influxdb_password))
+          url: http://localhost:8086
+          user: admin
+        listen_port: 3000
+        root_url: https://((domain)):3000/
+        ssl:
+          cert: ((web_tls.certificate))
+          key: ((web_tls.private_key))
+  - name: uaa
+    release: uaa
+    properties:
+      encryption:
+        encryption_keys:
+          - label: 'uaa-passphrase'
+            passphrase: ((uaa-passphrase))
+        active_key_label: 'uaa-passphrase'
+      uaa:
+        url: https://((domain)):8443
+        catalina_opts: -Djava.security.egd=file:/dev/./urandom -Xmx768m -XX:MaxMetaspaceSize=256m
+        scim:
+          users:
+          - name: admin
+            password: ((uaa-users-admin))
+            groups:
+            - scim.write
+            - scim.read
+            - bosh.admin
+            - credhub.read
+            - credhub.write
+          - name: credhub-cli
+            password: ((credhub_cli_password))
+            groups:
+            - credhub.read
+            - credhub.write
+        clients:
+          credhub_cli:
+            override: true
+            authorized-grant-types: password,refresh_token
+            scope: credhub.read,credhub.write
+            authorities: uaa.none
+            access-token-validity: 30
+            refresh-token-validity: 3600
+            secret: ""
+          credhub_admin:
+            override: true
+            authorized-grant-types: client_credentials
+            scope: ""
+            authorities: credhub.read,credhub.write
+            access-token-validity: 30
+            refresh-token-validity: 3600
+            secret: ((credhub_admin_client_secret))
+          atc_to_credhub:
+            override: true
+            authorized-grant-types: client_credentials
+            scope: ""
+            authorities: credhub.read,credhub.write
+            access-token-validity: 3600
+            secret: ((uaa_clients_atc_to_credhub))
+        admin: {client_secret: ((uaa-admin))}
+        login: {client_secret: ((uaa-login))}
+        zones: {internal: {hostnames: []}}
+        sslCertificate: ((web_tls.certificate))
+        sslPrivateKey: ((web_tls.private_key))
+        jwt:
+          revocable: true
+          policy:
+            active_key_id: key-1
+            keys:
+              key-1:
+                signingKey: ((uaa-jwt.private_key))
+      uaadb:
+        address: ((postgres_host))
+        port: ((postgres_port))
+        db_scheme: postgresql
+        tls_enabled: true
+        databases:
+        - tag: uaa
+          name: uaa
+        roles:
+        - tag: admin
+          name: ((postgres_role))
+          password: ((postgres_password))
+      login:
+        saml:
+          serviceProviderCertificate: ((web_tls.certificate))
+          serviceProviderKey: ((web_tls.private_key))
+          serviceProviderKeyPassword: ""
+  - name: credhub
+    release: credhub
+    properties:
+      credhub:
+        tls: ((web_tls))
+        authentication:
+          uaa:
+            url: https://((domain)):8443
+            verification_key: ((uaa-jwt.public_key))
+            ca_certs: [((web_tls.ca))]
+        data_storage:
+          type: postgres
+          username: ((postgres_role))
+          password: ((postgres_password))
+          host: ((postgres_host))
+          port: ((postgres_port))
+          database: credhub
+          require_tls: true
+          tls_ca: ((postgres_ca_cert))
+        encryption:
+          keys:
+          - provider_name: int
+            encryption_password: ((credhub-encryption-password))
+            active: true
+          providers:
+          - name: int
+            type: internal
+
+- name: worker
+  azs: [z1]
+  instances: 1
+  networks:
+  - name: ((worker_network_name))
+  stemcell: trusty
+  vm_type: ((worker_vm_type))
+  jobs:
+  - name: worker
+    release: concourse
+    consumes:
+      baggageclaim:
+        from: worker-baggageclaim
+    properties:
+      drain_timeout: 10m
+      tsa:
+        worker_key: ((worker_key))
+  - name: baggageclaim
+    release: concourse
+    properties:
+      log_level: debug
+    provides:
+      baggageclaim:
+        as: worker-baggageclaim
+  - name: garden
+    release: garden-runc
+    properties:
+      garden:
+        listen_address: 0.0.0.0:7777
+        listen_network: tcp
+
+update:
+  canaries: 1
+  canary_watch_time: 1000-300000
+  max_in_flight: 3
+  serial: false
+  update_watch_time: 1000-300000
+

bosh/assets/ops/atc_extension.yml

@@ -0,0 +1,9 @@
+- type: replace
+  path: /instance_groups/name=web/vm_extensions?/-
+  value: atc
+
+- type: replace
+  path: /instance_groups/name=web/networks/-
+  value:
+    name: vip
+    static_ips: [((atc_eip))]

bosh/assets/ops/cup_compatibility.yml

@@ -0,0 +1,16 @@
+- type: replace
+  path: /instance_groups/name=web/vm_extensions?/-
+  value: atc
+
+- type: replace
+  path: /instance_groups/name=web/networks/-
+  value:
+    name: vip
+    static_ips: [((atc_eip))]
+
+- type: remove
+  path: /variables/name=grafana_password
+
+- type: replace
+  path: /instance_groups/name=web/jobs/name=grafana/properties/grafana/admin_password
+  value: ((atc_password))