spring-cloud / spring-cloud-open-service-broker

Spring Cloud project for creating service brokers that conform to the Open Server Broker API specification

Overview

Spring Cloud Open Service Broker is a framework for building Spring Boot applications that implement the Open Service Broker API.

Version Compatibility

The following table describes the version compatibility matrix for the various releases of Spring Cloud Open Service Broker. Please note that certain Spring Boot versions have reached end of support. We recommend upgrading to a version of Spring Cloud Open Service Broker that supports a newer version of Spring Boot.

Spring Cloud Open Service Broker	Open Service Broker API	Spring Boot	Spring Framework	JDK
4.2.x	2.16	3.2.x	6.1.x	17
4.1.x	2.16	3.1.x	6.0.x	17
4.0.x	2.16	3.0.x	6.0.x	17
3.6.x	2.16	2.7.x	5.3.x	8
3.5.x	2.16 (partial support)	2.6.x	5.3.x	8

Previous versions which were built against versions of Spring Boot that are no longer supported

Spring Cloud Open Service Broker	Open Service Broker API	Spring Boot	Spring Framework
3.4.x	2.16 (partial support)	2.5.x	5.3.x
3.3.x	2.15	2.4.x	5.3.x
3.2.x	2.15	2.3.x	5.2.x
3.1.x	2.15	2.2.x	5.2.x
3.0.x	2.14	2.1.x	5.1.x
2.1.x	2.14	2.0.x	5.0.x

Note	Spring WebFlux and Spring MVC are both supported in version 3.0 and later

Getting Started

See the project site and reference documentation to get started building a service broker using this framework.

Gradle Dependencies

implementation("org.springframework.cloud:spring-cloud-starter-open-service-broker:4.1.0")

Maven Dependencies:

<dependency>
  <groupId>org.springframework.cloud</groupId>
  <artifactId>spring-cloud-starter-open-service-broker</artifactId>
  <version>4.1.0</version>
</dependency>

Build

This project requires Java 17.

The project is built with Gradle. The Gradle wrapper allows you to build the project on multiple platforms and even if you do not have Gradle installed; run it in place of the gradle command (as ./gradlew) from the root of the main project directory.

Compile the project and run tests

./gradlew build

Deploy the artifacts to your local maven repository:

./gradlew publishToMavenLocal

Perform all checks, including checkstyle, unit tests, and contract tests:

./gradlew check

Format source according to the spring-javaformat project standards

./gradlew format

Run only unit tests:

./gradlew test

Run only contract tests:

./gradlew contractTest

Working with the code

If you don’t have an IDE preference we would recommend that you use Spring Tool Suite or Eclipse when working with the code. We use the m2eclipse eclipse plugin for maven support. Other IDEs and tools should also work without issue as long as they use Maven 3.3.3 or better.

Contributing

Spring Cloud is released under the non-restrictive Apache 2.0 license, and follows a very standard Github development process, using Github tracker for issues and merging pull requests into master. If you want to contribute even something trivial please do not hesitate, but follow the guidelines below.

Sign the Contributor License Agreement

Before we accept a non-trivial patch or pull request we will need you to sign the Contributor License Agreement. Signing the contributor’s agreement does not grant anyone commit rights to the main repository, but it does mean that we can accept your contributions, and you will get an author credit if we do. Active contributors might be asked to join the core team, and given the ability to merge pull requests.

Code of Conduct

This project adheres to the Contributor Covenant code of conduct. By participating, you are expected to uphold this code. Please report unacceptable behavior to [email protected].

Code Conventions and Housekeeping

None of these is essential for a pull request, but they will all help. They can also be added after the original pull request but before a merge.

• Use the Spring Framework code format conventions. If you use Eclipse you can import formatter settings using the eclipse-code-formatter.xml file from the Spring Cloud Build project. If using IntelliJ, you can use the Eclipse Code Formatter Plugin to import the same file.

• Make sure all new .java files to have a simple Javadoc class comment with at least an @author tag identifying you, and preferably at least a paragraph on what the class is for.

• Add the ASF license header comment to all new .java files (copy from existing files in the project)

• Add yourself as an @author to the .java files that you modify substantially (more than cosmetic changes).

• Add some Javadocs and, if you change the namespace, some XSD doc elements.

• A few unit tests would help a lot as well — someone has to do it.

• If no-one else is using your branch, please rebase it against the current master (or other target branch in the main project).

• When writing a commit message please follow these conventions, if you are fixing an existing issue please add Fixes #XXXX at the end of the commit message (where XXXX is the GitHub issue number).

spring-cloud-open-service-broker's Issues

Add unit tests for Controller classes

The Controller classes that implement the core service broker API are currently only tested with MVC integration tests. These classes should have unit tests that verify the Controller class behavior independent of the MVC test infrastructure.

Use externalized configuration to define service broker catalog

For catalog management, spring-boot-cf-service-broker provides a default implementation that requires the broker to just provide an implementation of a Catalog bean.
An improvement would be to enable the use of externalized configuration (properties files, YAML files, environment variables or command-line arguments) to set Catalog bean attributes.

Then, a very basic catalog definition using env variables would be :

$ export SERVICES_DEFINITIONS[MONGO_DB]_ID=mongodb-service-broker 
$ export SERVICES_DEFINITIONS[MONGO_DB]_NAME=Mongo DB
$ export SERVICES_DEFINITIONS[MONGO_DB]_DESCRIPTION=A simple MongoDB service broker implementation
$ export SERVICES_DEFINITIONS[MONGO_DB]_PLANS[DEFAULT]_ID=mongo-plan
$ export SERVICES_DEFINITIONS[MONGO_DB]_PLANS[DEFAULT]_NAME=Default Mongo Plan
$ export SERVICES_DEFINITIONS[MONGO_DB]_PLANS[DEFAULT]_DESCRIPTION=This is a default mongo plan. All services are created equally

This feature can be extended by enabling a remote externalized configuration

Register broker

Can you tell me where I can set the auth_username and auth_password to use for registering the broker with CF environment

cf create-service-broker mybroker auth_username auth_password http://mybroker.example.com

Thank you for helping.

Beth Tran

Make service broker version validate to `ANY` by default

By default, the current version of the broker API is required for all service broker requests. This limits brokers to only working with one version of the API. This should be changed to ANY.

Make app_guid field optional when creating service bindings

In a broker I am working I am not able to run cf create-service-key <service> <key> without receiving a response like: {"description":"Missing required fields: appGuid"}%.
I assume that @JsonProperty("app_guid") is requiring the presence of this field even though it should be optional and is not sent when creating a service-key.

Spring fails to instantiate EmptyListSerializer/EmptyMapSerializer in mvc integration tests

Hi,

I 've developped my own PostgreSQL Service Broker using the cloud foundry framework (a basic Spring boot web application - The broker works fine in my Cloud Foundry instance). I'm using the Spring test framework (MockMvc - org.springframework.spring-test-4.3.2.RELEASE) to run integration tests.

Problem
When I run tests (that use the CatalogController for instance), Spring is unable to perform the serialization because it fails to create those two beans: EmptyListSerializer and EmptyMapSerialier.

org.springframework.beans.BeanInstantiationException: Failed to instantiate [org.springframework.cloud.servicebroker.model.EmptyListSerializer]: Is the constructor accessible?; nested exception is java.lang.IllegalAccessException: Class org.springframework.beans.BeanUtils can not access a member of class org.springframework.cloud.servicebroker.model.EmptyListSerializer with modifiers "public"
at org.springframework.beans.BeanUtils.instantiate(BeanUtils.java:83)

This instantiation problem is caused by the fact that those classes are not "public" (I don't know if there is a particular reason for that) as shown below :

package org.springframework.cloud.servicebroker.model;
...
...
class EmptyMapSerializer extends JsonSerializer<List<?>> {
...

Therefore Spring is unable to access their constructors.

Temporary solution
Yet I was able to run the tests by patching those classes in the app source code (I just created/overwrote the spring package, and added public to the classes).
Do you think that this patch can be integrated in future releases ?

Thank you in advance.

A.

Support service broker API version 2.11

http://docs.cloudfoundry.org/services/api.html#api-changes-since-v2-10

Add a bindable field to Plan objects.

Support service broker API version 2.9

http://docs.cloudfoundry.org/services/api.html#api-changes-since-v2-8

Support service keys

Add support for service keys which enable access to services by external access:

...the new Service Key feature is added as a new resource which essentially externalizes the old service binding operation, except it does not require an application to be called or manipulated. Like other CF Cloud Controller (CC) resources, this one has the typical CRUD operations (except update, but includes listing)...

The details of the service keys API doesn't seem to existing within the service broker documentation, yet, but is detailed here:

https://developer.ibm.com/opentech/2015/07/09/cloudfoundry-services-keys-and-sample-go-service-broker/

Respond with error when a request to update a service plan is received but the service doesn't accept plan updates

A broker can specify whether a service supports updating of plans in the service catalog.

The ServiceInstanceController should check the value of this field in the service catalog and reject any request to update the service plan with the appropriate error code (422 Unprocessable entity).

Support service broker API version 2.10

http://docs.cloudfoundry.org/services/api-v2.10.html#api-changes-since-v2-9

Add support for volume mounts in response to a request to create a service instance.

Remove lombok

Spring library projects typically do not depend on lombok. Consider removing its usage in the next major version.

Return status code 200 on provisioning/binding of already existing service instance/binding

The service broker API specification suggests that a status code 200 (OK) might be returned in the response of a provisioning/binding if a service instance/binding already exists.

Add `previous_values` to update service instance requests

http://docs.cloudfoundry.org/services/api.html#updating-a-service-instance

Only previous_values.plan_id should be supported; other fields have been deprecated.

Capture the X-Api-Info-Location header on all broker requests

See https://docs.cloudfoundry.org/services/supporting-multiple-cf-instances.html

The value of the X-Api-Info-Location header should be captured on each request the broker and propagated to the broker-implemented SPI.

Support service broker API 2.13

https://github.com/openservicebrokerapi/servicebroker/blob/v2.13/release-notes.md#v213

Changes applicable to this project are:

• Added a schemas field to services in the catalog that brokers can use to declare the configuration parameters their service accepts for creating a service instance, updating a service instance and creating a service binding.
• Added a context field to the request body for creating a service binding.
• Add originating identity HTTP header.

Cleanup creating Response class instances

The Response class constructors for both provision and bind requests are confusing. It's not clear when a certain constructor should be used over another.

Service Plan should be free by default

Following service broker api documentation, service plan should be free by default.

Actual implementation makes service plan not free by default

	/**
	 * Indicates whether the plan can be limited by the non_basic_services_allowed field in a Cloud Foundry Quota.
	 */
	@JsonSerialize
	@JsonProperty("free")
	private boolean free;

ServiceInstanceBindingService is required even if service is not bindable

Even if a service is not bindable, a bean of type ServiceInstanceBindingService is required regardless.

Rename project?

The cloud foundry service broker API has been standardized into the Open Service Broker API.
Should the project name/documentation be updated to reflect that it can be used with more than just CF?

Author user reference documentation

Add GET endpoints for fetching a service instance/binding

Support the OSB API spec for the GET service broker endpoint.

• Add instances_retrievable and bindings_retrievable boolean properties to the `ServiceDefinition' model.
• Implement the Fetch service instance endpoint in the service instances controller and service.
• Implement the Fetch service binding endpoint in the service bindings controller and service.

Security issue caused by usage of BeanUtils (CVE-2014-0114)

While populating beans with BeanUtils a malicious request can modify the class loader causing a remote code execution. This issue is addressed as CVE-2014-0114: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-0114
We were able to reproduce it in cloudfoundry service broker with a manipulated parameters attribute in a create request to service_bindings.

How to reproduce:
Create a simple bean for the request parameter, for example MyParameterBean.
In the ServiceInstanceBindingService trigger the parsing of the parameters:

@Service
public class MyService implements ServiceInstanceBindingService {

    @Override
    public CreateServiceInstanceBindingResponse createServiceInstanceBinding(CreateServiceInstanceBindingRequest createServiceInstanceBindingRequest) {
        MyParameterBean params = createServiceInstanceBindingRequest.getParameters(MyParameterBean.class);
        return new CreateServiceInstanceAppBindingResponse();
    }

Now, if an attacker sends a PUT request to /v2/service_instances/:instance_id/service_bindings/:binding_id with a parameter like class.classLoader.defaultAssertionStatus, he can manipulate the class loader.

{
  "service_id": "MyServiceId",
  "plan_id": "MyPlan",
  "organization_guid": "org-guid-here",
  "space_guid": "space-guid-here",
  "parameters": {
  	"class.classLoader.defaultAssertionStatus" : true
  }
}

The solution of BeanUtils to prevent such an attack is to set a special BeanIntrospector:

BeanUtilsBean.getInstance().getPropertyUtils().addBeanIntrospector(SuppressPropertiesBeanIntrospector.SUPPRESS_CLASS);

But this Introspector is not set as default by BeanUtils. It has to be set within the spring-cloud-cloudfoundry-service-broker.
See here: https://issues.apache.org/jira/browse/BEANUTILS-463

Publish user reference documentation by version

return newly created instance details with CreateServiceInstanceResponse

How am I suppose to reply with the newly created instance details in response -
CreateServiceInstanceResponse does not contain any holder for sending the instance details

Author migration guide

Provide guidance on migrating from spring-cloud-cloudfoundry-service-broker:1.0.x to spring-cloud-open-service-broker:2.0.x. This could be done in wiki pages in this repo, as is being done with Spring Boot.

Review JavaDoc and update as necessary

Add a Catalog builder class.

Creating a Catalog is kind of painful and results in some ugly code, i.e. https://github.com/spring-cloud-samples/cloudfoundry-service-broker/blob/master/src%2Fmain%2Fjava%2Forg%2Fspringframework%2Fcloud%2Fservicebroker%2Fmongodb%2Fconfig%2FCatalogConfig.java

We should provide a builder that makes this easier.

Use the builder pattern for constructing request and response classes

The number of fields in request and response classes have grown over time, making constructors difficult to manage. These classes should use the builder pattern instead of constructors to make construction easier to maintain.

Upgrade Spring Boot version to latest GA

Release of 1.0.2

Hi,

When is the release of 1.0.2 planned for?

Thanks,
Andrea.

Missing user friendly message when request contains empty cfInstanceId

As a user, if I make the mistake of adding a trailing slash when registering my broker

cf create-service-broker mybroker user secret https://mybroker.site.org/

then surprisingly the spring-cloud-cloudfoundry-service-broker will reject requests sent by the CF cloudcontroller of the form https://mybroker.site.org//v2/service_instances/ef1fcb74-55ea-407a-bf79-7c09d8bdd949/last_operation?plan_id=aplan&service_id=aserviceid with the following exception:

2017-11-22T11:37:47.09+0100 [APP/PROC/WEB/0] OUT org.springframework.web.bind.MissingServletRequestParameterException: Required String parameter 'service_id' is not present
2017-11-22T11:37:47.09+0100 [APP/PROC/WEB/0] OUT        at org.springframework.web.method.support.HandlerMethodArgumentResolverComposite.resolveArgument(HandlerMethodArgumentResolverComposite.java:121) ~[spring-web-4.3.10.RELEASE.jar!/:4.3.10.RELEASE]
2017-11-22T11:37:47.09+0100 [APP/PROC/WEB/0] OUT        at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.invokeHandlerMethod(RequestMappingHandlerAdapter.java:827) ~[spring-webmvc-4.3.10.RELEASE.jar!/:4.3.10.RELEASE]
2017-11-22T11:37:47.09+0100 [APP/PROC/WEB/0] OUT        at javax.servlet.http.HttpServlet.service(HttpServlet.java:635) [tomcat-embed-core-8.5.16.jar!/:8.5.16]
2017-11-22T11:37:47.09+0100 [APP/PROC/WEB/0] OUT        at javax.servlet.http.HttpServlet.service(HttpServlet.java:742) [tomcat-embed-core-8.5.16.jar!/:8.5.16]
2017-11-22T11:37:47.09+0100 [APP/PROC/WEB/0] OUT        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-8.5.16.jar!/:8.5.16]
2017-11-22T11:37:47.09+0100 [APP/PROC/WEB/0] OUT        at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52) [tomcat-embed-websocket-8.5.16.jar!/:8.5.16]
2017-11-22T11:37:47.09+0100 [APP/PROC/WEB/0] OUT        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat-embed-

I suspect this because the request mapping enters the branch with an expected cf instance id
https://github.com/spring-cloud/spring-cloud-cloudfoundry-service-broker/blob/7905d070c8f77c2638c5eb1d262f4bfafd66d83d/src/main/java/org/springframework/cloud/servicebroker/controller/ServiceInstanceController.java#L125-L131

It would be nice to be able to display a friendly error message such as "unexpected empty cfInstanceId"

I hope nevertheless this issue might help others running into this problem to fix their base broker url.

Support Dashboard SSO

This project should make it easy to configure dashboard SSO for service instances as documented here: http://docs.cloudfoundry.org/services/dashboard-sso.html#broker-responsibilities

Is 1.0.1.RELEASE published?

Hi,

Is 1.0.1.RELEASE published anywhere?

Here's where I'm looking:
https://repo.spring.io/milestone/org/springframework/cloud/spring-cloud-cloudfoundry-service-broker/

Thanks

Enable Gradle Checkstyle plugin

Expect a consisting styling with Spring Boot
https://docs.gradle.org/current/userguide/checkstyle_plugin.html

Enable usage of openshift_form_definition in schema definition

OpenShift enable to specify in which order the parameters appear into their GUI by using the convention described here: openshift/origin#16383. By default the GUI is showing parameters sorted by their name (actually the GUI is inline with the ClusterServicePlan and it is this last one that is sorting...).
Currently, the MethodSchema class only support the 'parameters' attribute, hence preventing from using this feature.
A possible solution to enable the usage of this OpenShift feature would be to enable to MethodSchema to accept more attributes or to find a way to enable model customization.

last_operation service_id, operation and plan_id should be optional

while trying to troubleshoot #53, I ran into this small non compliance to OSB:

https://github.com/openservicebrokerapi/servicebroker/blob/v2.13/spec.md#polling-last-operation states the following, implying the parameters are optional

service_id	string	[...] If present, MUST be a non-empty string.
plan_id	string	[...] If present, MUST be a non-empty string.
operation	string	[...] If present, MUST be a non-empty string.
--	--	--

Currently, these params are made mandatory.
https://github.com/spring-cloud/spring-cloud-cloudfoundry-service-broker/blob/d8c7afabb04a3d88a7f8c4cf89e0fd358942d051/src/main/java/org/springframework/cloud/servicebroker/controller/ServiceInstanceController.java#L103-L105

As a consequence, brokers implemented leveraging spring-cloud-cloudfoundry-service-broker
might fail when invoked by other more relax by conforming clients (e.g. K8S)

Support for multiple Cloud Foundry Instances

I have a geo-distributed service, and have a need to support multiple Cloud Foundry instances. The service will need to be aware of the Cloud Foundry instance to which its bound, so we will need to include a CF instance identifier as shown in the service broker API docs.

Support mutiple type of service binding in a single CreateServiceInstanceBindingResponse

@scottfrederick It seems that actual CreateServiceInstanceBindingResponse subclasses implementation makes it impossible to return for instance Credentials and Volume Mount in a single CreateServiceInstanceBindingResponse. Is there a reason for that ?
Service broker api does not seem to be so restrictive.

Move configuration to a Boot starter subproject

The project currently contains @Controller and support classes that implement the service broker API along with Spring Boot configuration in the same library. This ties apps that use the project to Spring Web MVC and limits flexibility (as pointed out in #33).

All configuration code should be re-implemented using Spring Boot auto-configuration and moved to a separate sub-project, leaving the main library to depend only on core Spring Framework.

Break model package into subpackages

The package org.springframework.cloud.servicebroker.model has grown to be large, and contains model classes for several purposes (catalog metadata, requests, responses, etc). The package should be broken down into subpackages, dividing classes by their responsibility.

This refactoring must be done in a minor release, as it is an API change without backward compatibility.

Catalog.serviceDefinitions should not be null

If org.springframework.cloud.servicebroker.model.Catalog.serviceDefinitions == null, we can't simply add a service definition to the catalog by calling:
catalog..getServiceDefinitions().add(myServiceDefinition);
Could we change the default constructor to:
this.serviceDefinitions = new ArrayList();

Support Service Broker API 2.12

http://docs.cloudfoundry.org/services/api.html#changes-since-v211

• Add context field to request body for provisioning and updating a service instance

Link to MongoDB service broker sample is broken

I get a 404 when I click on the link in your readme under 'Getting Started' in the sentence: "A sample MongoDB service broker project is available."

• it would be very useful if we could see a sample please. Thanks!

Use Spring Cloud Contract to spec the broker API

Add a WebFlux starter

After Spring Web MVC configuration has been moved to a separate "starter" subproject in #47, add a second starter that auto-configures Spring WebFlux.

Provide simple Web MVC and WebFlux samples

Provide simple sample applications to demonstrate creating a service broker using both Spring Web MVC and Spring WebFlux. These samples should not rely on any external software and should be easily deployable to supported platforms.

Fail to assert that CreateServiceInstanceVolumeBindingResponse are equal

Asserting that two instances of CreateServiceInstanceVolumeBindingResponse are equals using basic CreateServiceInstanceVolumeBindingResponse#equals always fails.

Support arbitrary fields in the `bind_resource` field of bind requests

The Open Service Broker Spec specifies a bind_resource object in bind requests, with two common fields - app_guid and route. This project will currently parse those two fields in bind_resource. The spec allows platforms to provide other key/value pairs in a bind_resource object in a bind request, and this project should make these additional fields available if present.

Support unique usernames and passwords for multiple foundations

#15 adds support for identifying the calling CF instance in broker API methods. Broker authors should have a way to optionally configure unique basic auth usernames and password for each CF instance it is registered to.