---
- type: replace
  path: /instance_groups/name=diego-cell/jobs/name=rep/properties/containers?/proxy/enabled
  value: true

- type: replace
  path: /instance_groups/name=diego-cell/jobs/name=rep/properties/containers?/proxy/require_and_verify_client_certificates
  value: true

- type: replace
  path: /instance_groups/name=diego-cell/jobs/name=rep/properties/containers?/proxy/trusted_ca_certificates
  value:
  - ((service_cf_internal_ca.certificate))

- type: replace
  path: /instance_groups/name=diego-cell/jobs/name=rep/properties/containers?/proxy/verify_subject_alt_name
  value:
  - gorouter.service.cf.internal

---
- type: replace
  path: /instance_groups/name=diego-cell/jobs/name=rep/properties/containers?/proxy/enabled
  value: true

- type: replace
  path: /instance_groups/name=diego-cell/jobs/name=rep/properties/containers?/proxy/require_and_verify_client_certificates
  value: true

- type: replace
  path: /instance_groups/name=diego-cell/jobs/name=rep/properties/containers?/proxy/trusted_ca_certificates
  value:
  - ((service_cf_internal_ca.certificate))

- type: replace
  path: /instance_groups/name=scheduler/jobs/name=ssh_proxy/properties/backends?/tls/enabled
  value: true

- type: replace
  path: /instance_groups/name=scheduler/jobs/name=ssh_proxy/properties/backends?/tls/ca_certificates
  value:
  - ((application_ca.certificate))

- type: replace
  path: /variables/-
  value:
    name: ssh_proxy_backends_tls
    type: certificate
    options:
      ca: service_cf_internal_ca
      extended_key_usage:
      - client_auth
      common_name: ssh_proxy_backends_tls
      alternative_names:
      - ssh-proxy.service.cf.internal

- type: replace
  path: /instance_groups/name=scheduler/jobs/name=ssh_proxy/properties/backends?/tls/client_certificate
  value: ((ssh_proxy_backends_tls.certificate))

- type: replace
  path: /instance_groups/name=scheduler/jobs/name=ssh_proxy/properties/backends?/tls/client_private_key
  value: ((ssh_proxy_backends_tls.private_key))

- type: replace
  path: /instance_groups/name=diego-cell/jobs/name=rep/properties/containers?/proxy/verify_subject_alt_name
  value:
  - gorouter.service.cf.internal
  - ssh-proxy.service.cf.internal

Enable ssh over tls when routing integrity is enabled
Enable ssh over tls when routing integrity is enabled

- the ssh_proxy trusts the application ca cert
- ssh_proxy is configured with certs generated from service cf internal
CA
- envoy trusts ssh-proxy SAN as well as gorouter
- ssh_proxy will fall back to non-tls if handshake fails
- can now use route integrity + removal of non proxied container ports
and still have cf ssh

[#161421181](https://www.pivotaltracker.com/story/show/161421181)

Signed-off-by: Nick Wei <397a225b6adb51a440bd3821475520403c3e9564@pivotal.io>
