NATS Protocol “TLS only” Compatibility for TPCF 6.0 + 7.0 + 8.0

Products

• VMware Tanzu Application Service for VMs

Issue/Introduction

Historically there have been both non-TLS and TLS endpoints for NATS. In an effort to make the entire TPCF ecosystem more secure by default we are removing the non-TLS NATS endpoint. Below is the timeline for migrating all clients to using the TLS endpoint and removing the non-TLS NATS endpoint.

Resolution

Timeline

• Prior to TPCF 6.0: TLS and non-TLS NATS endpoints are both available for clients to use.
• In TPCF 6.0: There is a new API-only property “NATS Protocol” with options “TLS and non-TLS” or “TLS only”. The default is “TLS and non-TLS”. This property was intended to be used by clients to do compatibility testing with.
• All tiles with NATS clients have been updated to use the TLS NATS endpoint (see table for updated versions below).
• In TPCF 7.0: In the “Networking” tab the property “NATS Protocol” with options for “TLS and non-TLS” or “TLS only” is now exposed in the UI. The default for upgrades and new installs is now “TLS only”. All clients should have migrated to using the TLS NATS endpoint at this point. The option to re-enable non-TLS is available in case users have custom clients that they need to migrate.
• In TPCF 8.0: The “NATS Protocol” property will be removed. NATS will only be available via TLS.

 

Tile	Version Compatible with NATS via TLS
App Metrics for VMware Tanzu	2.2.2
VMware Tanzu RabbitMQ for Tanzu Application Service	2.3.0
Spring Cloud Gateway for VMware Tanzu	2.1.6
Spring Cloud Services for VMware Tanzu	3.2.2
VMware Postgres for Tanzu Application Service	1.1.1