These are the release notes for VMware Tanzu Application Service for VMs (TAS for VMs) v6.0.
TAS for VMs is certified by the Cloud Foundry Foundation for 2024.
For more information about the Cloud Foundry Certified Provider Program, see How Do I Become a Certified Provider? on the Cloud Foundry website.
Because VMware uses the Percona Distribution for MySQL, expect a time lag between Oracle releasing a MySQL patch and VMware releasing TAS for VMs containing that patch.
Deprecation Notice: Cloud Foundry Command-Line Interface (cf CLI) v7 is deprecated and will lose support. For how to upgrade to cf CLI v8 see Upgrading to cf CLI v8.
- v6.0.7 - v6.0.11 versions contain a bug that causes intermittent TCP connectivity issues between TAS for VMs and tiles that use
routing
release 0.301.0 or earlier, such as Tanzu for MySQL on Cloud Foundry v3.3.0 and earlier, and Redis for Tanzu Application Service v3.5.0 and earlier. For details, see TCP Routes from Tiles are Pruned Intermittently Resulting in connectivity issues - v6.0.0 - v6.0.3 versions contain an RFC protocol issue with Gorouter, CVE-2024-22279, that can lead to denial of service. The issue has been fixed. For details, see TNZ-2024-0100.
Releases
6.0.13
Release Date: 03/11/2025
- [Feature] Operators can now “Enable comma-delimited lists of IPs for application security group (ASG) destinations” via the property in the “Networking” tab. WARNING: for foundations with the NSX-T tile installed, you MUST deploy NSX-T tile version 9.0.0 in policy mode before enabling this feature.
- [Feature Improvement] Operators can now let Puma auto-configure the number of workers based on the number of available cores.
- [Feature Improvement] Remove the need to track mapfs-release
- [Feature Improvement]: Backport GA OpenTelemetry Collector
- [Bug Fix] SMB Broker now supports all the mount parameters that the SMB Driver does (‘sec’, ‘dir_mode’, ‘file_mode’ were missing)
- Bump backup-and-restore-sdk to version
1.19.45
- Bump binary-offline-buildpack to version
1.1.32
- Bump bpm to version
1.4.16
- Bump capi to version
1.203.0
- Bump cf-autoscaling to version
250.4.1
- Bump cf-networking to version
3.66.0
- Bump cflinuxfs3 to version
0.618.0
- Bump cflinuxfs4 to version
1.288.0
- Bump credhub to version
2.12.105
- Bump dotnet-core-offline-buildpack to version
2.4.51
- Bump garden-runc to version
1.70.0
- Bump go-offline-buildpack to version
1.10.43
- Bump java-offline-buildpack to version
4.80.0
- Bump log-cache to version
3.1.9
- Bump loggregator to version
107.0.20
- Bump loggregator-agent to version
8.3.5
- Bump mysql-monitoring to version
10.22.0
- Bump nats to version
56.41.0
- Bump nfs-volume to version
7.23.0
- Bump nginx-offline-buildpack to version
1.2.37
- Bump nodejs-offline-buildpack to version
1.8.49
- Bump php-offline-buildpack to version
4.6.40
- Bump push-apps-manager-release to version
677.0.67
- Bump push-usage-service-release to version
674.0.156
- Bump pxc to version
1.0.37
- Bump python-offline-buildpack to version
1.8.44
- Bump r-offline-buildpack to version
1.2.32
- Bump routing to version
0.331.0
- Bump ruby-offline-buildpack to version
1.10.36
- Bump silk to version
3.66.0
- Bump smb-volume to version
3.22.0
- Bump staticfile-offline-buildpack to version
1.8.26
- Bump statsd-injector to version
1.11.47
- Bump syslog to version
12.3.7
- Bump system-metrics-scraper to version
4.0.17
- Bump uaa to version
77.20.3
Security Fixes
The following table lists CVEs that were fixed in each TAS for VMs component since the previous patch version of TAS for VMs:
Component | Vulnerabilities Resolved |
---|---|
credhub | |
cflinuxfs4 | |
nats | |
capi | |
push-apps-manager-release | |
cf-networking | |
smb-volume | |
system-metrics-scraper | |
nfs-volume | |
loggregator-agent | |
pxc | |
statsd-injector | |
log-cache | |
mysql-monitoring | |
syslog | |
garden-runc | |
cf-autoscaling | |
uaa | |
bpm | |
backup-and-restore-sdk | |
silk | |
loggregator | |
mapfs |
Component Release Notes
6.0.12
Release Date: 02/03/2025
- [Bug Fix] Fix intermittent connectivity issue for TCP routes from external tiles with old routing-release versions
- [Feature Improvement] Apps Manager only lists the name of a space that hosts shared services if you have access to that space; otherwise it lists the space’s GUID.
- [Feature Improvement] Add optional, experimental pprof extension to OTel Collector
- [Feature Improvement] Enable Space Auditors to view app autoscaling rules
- [Feature Improvement] Explicitly set the allowed ciphers for Diego ssh proxy. Previously these were set in the code.
- [Feature Improvement] Puma web server is no longer beta
- Bump backup-and-restore-sdk to version
1.19.39
- Bump binary-offline-buildpack to version
1.1.28
- Bump bpm to version
1.4.11
- Bump capi to version
1.200.0
- Bump cf-autoscaling to version
250.4.0
- Bump cf-networking to version
3.63.0
- Bump cflinuxfs3 to version
0.592.0
- Bump cflinuxfs4 to version
1.274.0
- Bump credhub to version
2.12.102
- Bump dotnet-core-offline-buildpack to version
2.4.47
- Bump garden-runc to version
1.67.0
- Bump go-offline-buildpack to version
1.10.37
- Bump java-offline-buildpack to version
4.77.0
- Bump log-cache to version
3.1.8
- Bump loggregator to version
107.0.19
- Bump loggregator-agent to version
8.3.3
- Bump mapfs to version
1.17.0
- Bump metric-registrar to version
4.0.6
- Bump mysql-monitoring to version
10.21.0
- Bump nats to version
56.36.0
- Bump nfs-volume to version
7.17.0
- Bump nginx-offline-buildpack to version
1.2.33
- Bump nodejs-offline-buildpack to version
1.8.44
- Bump notifications to version
77.0.0
- Bump otel-collector to version
0.11.2
- Bump php-offline-buildpack to version
4.6.36
- Bump push-apps-manager-release to version
677.0.66
- Bump push-usage-service-release to version
674.0.147
- Bump pxc to version
1.0.34
- Bump python-offline-buildpack to version
1.8.40
- Bump r-offline-buildpack to version
1.2.28
- Bump routing to version
0.329.0
- Bump ruby-offline-buildpack to version
1.10.32
- Bump silk to version
3.63.0
- Bump smb-volume to version
3.16.0
- Bump staticfile-offline-buildpack to version
1.8.21
- Bump statsd-injector to version
1.11.46
- Bump syslog to version
12.3.6
- Bump system-metrics-scraper to version
4.0.15
- Bump uaa to version
77.20.2
Security Fixes
The following table lists CVEs that were fixed in each TAS for VMs component since the previous patch version of TAS for VMs:
Component | Vulnerabilities Resolved |
---|---|
system-metrics-scraper | |
push-apps-manager-release | |
credhub | |
loggregator | |
otel-collector | |
garden-runc | |
uaa | |
bpm | |
notifications | |
syslog | |
capi | |
log-cache | |
backup-and-restore-sdk | |
metric-registrar | |
statsd-injector | |
mysql-monitoring | |
loggregator-agent |
Component Release Notes
6.0.11
Release Date: 01/09/2025
- [Bug Fix] Stop Autoscaler panic when RabbitMQ password includes reserved characters
- Bump backup-and-restore-sdk to version
1.19.36
- Bump binary-offline-buildpack to version
1.1.15
- Bump bpm to version
1.4.6
- Bump capi to version
1.197.0
- Bump cf-autoscaling to version
250.3.6
- Bump cf-cli to version
1.68.0
- Bump cf-networking to version
3.60.0
- Bump credhub to version
2.12.98
- Bump dotnet-core-offline-buildpack to version
2.4.36
- Bump garden-runc to version
1.64.0
- Bump go-offline-buildpack to version
1.10.24
- Bump log-cache to version
3.1.7
- Bump loggregator to version
107.0.18
- Bump loggregator-agent to version
8.3.2
- Bump mapfs to version
1.12.0
- Bump metric-registrar to version
4.0.5
- Bump nats to version
56.32.0
- Bump nfs-volume to version
7.13.0
- Bump nginx-offline-buildpack to version
1.2.20
- Bump nodejs-offline-buildpack to version
1.8.30
- Bump notifications to version
74.0.0
- Bump notifications-ui to version
51.0.0
- Bump php-offline-buildpack to version
4.6.25
- Bump push-apps-manager-release to version
677.0.64
- Bump push-usage-service-release to version
674.0.137
- Bump pxc to version
1.0.33
- Bump python-offline-buildpack to version
1.8.30
- Bump r-offline-buildpack to version
1.2.16
- Bump routing to version
0.325.0
- Bump ruby-offline-buildpack to version
1.10.19
- Bump silk to version
3.60.0
- Bump smb-volume to version
3.13.0
- Bump staticfile-offline-buildpack to version
1.6.18
- Bump statsd-injector to version
1.11.45
- Bump syslog to version
12.3.5
- Bump system-metrics-scraper to version
4.0.13
- Bump uaa to version
77.20.0
Security Fixes
The following table lists CVEs that were fixed in each TAS for VMs component since the previous patch version of TAS for VMs:
Component Release Notes
6.0.1 - 6.0.10
See TAS Patch Version v6.0.1-v6.0.10 Release Notes.
New features in VMware Tanzu Application Service for VMs v6.0
These are the new features for VMware Tanzu Application Service for VMs v6.0.
Updates to GenAI for Tanzu Application Service (beta)
-
Improved vSphere Support: Platform engineers can now deploy large language models on larger GPUs, such as the Nvidia A100, on VMware vSphere-backed deployments. This allows for larger models to be deployed and for improved inferencing times
-
Azure Support: GenAI for Tanzu Application Service, has been validated to work with Azure as a support IaaS destination in addition to AWS, GCP, and vSphere, providing customers with more choices across cloud providers
-
Multi-Model Support: GenAI for Tanzu Application Service now supports multiple worker models running simultaneously, which expands the types of applications that can use this service. This enables platform engineers to deploy multiple types of LLMs optimized for different use cases. For instance, a platform engineer can deploy a model optimized for chatbots and models optimized for code completion
-
Improved inferencing speeds with vLLM support: In addition to the fastchat deployment option, platform engineers can serve LLMs via vLLM, optimized for inference throughput. This improves overall model response times and preparation for running models in production
Improved Autoscaling based on Application CPU Usage
-
Managing CPU-based autoscaling rules for their apps with less tuning and fewer errors:App Autoscaler has been updated to use CPU entitlement metrics, which greatly improves the overall autoscaling of applications based on CPU usage. App Autoscaler provides a new rule that monitors an app’s average usage of its CPU entitlement and scales the app up or down accordingly.
- Unlike with the previous CPU processor utilization rule, the scaling thresholds for this rule do not need to change when developers adjust the memory allocation for the app or when the platform engineers adjust the size of the underlying Diego cell container-host VMs. When configured through the improved autoscaling UI in Apps Manager, developers get sensible default values of 30% and 80% for the low and high scaling thresholds, which should be a good starting point for most apps. Developers should have an easier and more intuitive experience configuring this new autoscaling rule for their apps.
Improved Platform Footprint and Enhanced Operations
-
Small footprint now supports an in-place upgrade to a full Tanzu Application Service Installation: Small footprint for Tanzu Application Service now supports customers that want to upgrade to a “full” Tanzu Application Service installation. Small footprint Tanzu Application Service was generally considered to be used for proof of concept or sandbox environments, but this upgrade path will allow platform engineers to migrate to full installation without having to reinstall the platform. This should allow organizations to start with an overall smaller footprint (~4-6 virtual machines) at a lower cost and gives them the option to grow their platform footprint in their own time. The small footprint for Tanzu Application Service is also fully supported for production use and can be utilized in locations with limited infrastructure footprint, such as an edge location.
-
Availability Zone Aware routing for Gorouter: The Gorouter has a new, opt-in feature to prefer local routing within an Availability Zone. When this option is enabled, the Gorouters will attempt to route all application traffic to application instances running on Diego cells within their local availability zone. This will improve the overall network traffic path and reduce overall round-trip latency to improve application performance. Gorouters will prefer not to send traffic to traffic to application instances running on other Availability Zones, but will in the event that no application instances are running in their zone.
-
Scale your dopplers and traffic controllers all the way to 0: For Tanzu Application Service installations using aggregate syslog drains to send app logs and metrics via the syslog protocol, platform engineers can now completely turn off the doppler and traffic controller VMs at the core of the loggregator subsystem. This optimization represents another step forward in the transition towards the new, more efficient “shared-nothing” observability architecture that is incrementally replacing earlier generations of observability subsystems, and helps platform engineers further reduce their infrastructure costs. Note: To completely scale down to 0, platform engineers must stop the use of firehose nozzles and other tiles that utilize nozzles, such as Healthwatch and App Metrics.
-
Human-readable foundation names in the platform log stream: Platform engineers can configure a human-readable foundation tag in their outgoing platform log stream. This will improve the overall experience when sending multiple foundation log streams to a log aggregation platform, as platform engineers will be able to identify what foundation is sending logs, ultimately avoiding mistakes and eliminating the need to re-work.
-
Certificate Rotation Dashboard for internal certificate management: Tanzu Operations Manager has been updated to include a Certificate Rotation Dashboard to continuously improve the internal platform certification rotation and management process. The dashboard allows platform engineers to track certification rotation status to easily understand the next step for the certificate rotation process within their Tanzu Application Service environments.
-
Configurable App File descriptor limits: Tanzu Application Service allows platform engineers to change the default Linux file descriptor limits for applications running on the platform. This feature enables applications to move to the platform that requires larger than normal numbers of Unix file descriptors. This allows for more application types to be migrated onto the Tanzu Application Service platform.
Enhancements to Enable Improved Platform Security Postures
-
Early access to FIPS-compliant stemcells: Tanzu Application Service now supports the use of FIPS-compliant Jammy stemcells through early access to federal customers for their TAS foundations. Please reach out to the Tanzu team if interested in testing out this feature.
-
Manage local User Account and Authentication (UAA) Password policies when external identity providers are configured: Local UAA password policies can be set and maintained in conjunction with an external identity provider. This change enables better security posture for platform engineers who are managing local platform accounts.
Tanzu Application Service Ecosystem Optimizations
Enhancements to the AWS Cloud Service Broker
-
Support for the AWS Simple Queue Service (SQS): Platform engineers can now add production-ready plans for the AWS SQS service to their Tanzu Application Service marketplace offerings. Developers can easily deploy and use the AWS SQS service to expand upon their application use cases just like any other service supported by the Cloud Service Broker.
-
Support for AWS GovCloud Regions: The Cloud Service Broker for AWS is now supported for use in AWS GovCloud Regions. Customers who wish to use these regions can now begin to migrate off the legacy AWS service broker and take advantage of all the new features and functionality of the Cloud Service Broker, allowing them with more options across cloud providers.
Reduced logging and metric infrastructure requirements
If you do not use the legacy V1 and V2 Loggregator Firehoses, you now can scale Doppler and Traffic Controller VMs down to zero. This can significantly reduce costs or free up resources for running additional workloads on the platform. You might not be able to scale down to zero if you use integrations or other features that depend on the Firehose, such as log and metric nozzles or Metric Registrar.
Reintroduction of global log rate limit
TAS for VMs v3.0 introduced granular app log rate limits for fine-grained control over application log rates.
TAS for VMs v4.0 removed the older global log rate limit feature App log rate limit (deprecated) under App Containers. This was problematic for operators who were performing a jump upgrade to TAS for VMs v4.0 (skipping v3.0), as logs would not be rate limited until application-based log rate limits were applied.
TAS for VMs v6.0 restores the global log rate limit, so that operators can perform upgrades while retaining log rate limits. Operators must configure the same setting separately for both Isolation Segment and TAS for VMs [Windows].
If you had previously set a global log rate limit, this limit is re-applied following the upgrade to VMware Tanzu Application Service for VMs v6.0.
App Autoscaler supports scaling on CPU entitlement
VMware Tanzu Application Service for VMs v6.0 introduces support for autoscaling on CPU entitlement. This improves App Autoscaler support for scaling on CPU. Previously, App Autoscaler CPU rules could be brittle due to their dependency on the underlying Diego Cell configuration. With this feature, apps can autoscale on the CPU entitlement available, calculated appropriately based on the memory allocated.
Breaking Changes
For breaking changes when upgrading VMware Tanzu Application Service for VMs to v6.0, see Breaking Changes.
Known issues
Here are the known issues for VMware Tanzu Application Service for VMs v6.0.
Loggregator Agents in other products may log failure when Dopplers are scaled to zero
Service tile products can use Loggregator Agent to egress metrics for service instances. If the Doppler instance group is scaled to zero, then Loggregator Agent jobs deployed by these products may repeatedly log a failure to connect to Doppler:
failed to connect: unable to lookup a log consumer
UAA causes database overload (for VMware Tanzu Application Service for VMs 6.0.0 and 6.0.1)
The UAA can cause and experience slowness in its database when attempting to hit its /Users
endpoint. The issue is especially noticeable when the UAA contains a large number of users; for example, in the millions. This only happens when using a MySQL database. VMware Tanzu Application Service for VMs 6.0.2 fixes the issue.
Content feedback and comments