anchor.diff:      allow_app_ssh_access: true
     uaa:
       clients:
  -      <<: (( merge ))
         ssh-proxy:
           authorized-grant-types: authorization_code
           autoapprove: true
  
positive.code: 
  <strong><%= modified_date %></strong>
  
  This topic describes how to configure your Cloud Foundry deployment to allow SSH access to application instances, and details about load balancing SSH sessions.
  
  ## <a id='architecture-configuration'></a> Cloud Foundry Configuration
  
  
negative.code: 
  If the HAproxy job from cf-release is used as the gorouter load balancer and `cc.allow_app_ssh_access` is set to true, HAproxy will also serve as the load balancer for Diego's SSH proxies. This configuration relies on the presence of the same consul server cluster that Diego components use for service discovery. This configuration also works well for deployments where all traffic on the system domain and its subdomains is directed towards the HAproxy job, as is the case for a BOSH-Lite CF deployment on the default `10.244.0.34.xip.io` domain.
  
  ### <a id="aws"></a>AWS Deployments
  
  For AWS deployments, where the infrastructure offers load-balancing as a service through ELBs, the deployment operator can provision an ELB to balance load across the Diego SSH proxy instances. This ELB should be configured to listen to TCP traffic on the port given by the `app_ssh.port` property in the Cloud Foundry manifest and to send it to port 2222. 
  
  In the Diego manifest, register the SSH proxies with this ELB by editing the `cloud_properties` values.
  
  * If you used the spiff-based manifest-generation templates to produce the Diego manifest, the `cloud_properties` hashes should be specified in the `iaas_settings.resource_pool_cloud_properties` section of the `iaas-settings.yml` stub.
  * Otherwise, add the ELB identifier to the `elbs` property in the `cloud_properties` hash of the Diego manifest `access_zN` resource pools. For example:
  
  <pre><code>resource_pools:
  - cloud_properties:
      availability_zone: us-east-1a
      elbs:
      - test-SSHProxyEL-16O57T64U5UAL
      instance_type: t2.nano
    name: access_z1
    network: diego1
    stemcell:
      name: bosh-aws-xen-hvm-ubuntu-trusty-go_agent
      version: '3202'
  - cloud_properties:
      availability_zone: us-east-1b
      elbs:
      - test-SSHProxyEL-16O57T64U5UAL
      instance_type: t2.nano
    name: access_z2
    network: diego2
    stemcell:
      name: bosh-aws-xen-hvm-ubuntu-trusty-go_agent
      version: '3202'
  - cloud_properties:
      availability_zone: us-east-1c
      elbs:
      - test-SSHProxyEL-16O57T64U5UAL
      instance_type: t2.nano
    name: access_z3
    network: diego3
    stemcell:
      name: bosh-aws-xen-hvm-ubuntu-trusty-go_agent
      version: '3202'
  </code></pre>
  
  ## <a id="troubleshooting"></a>Troubleshooting
  
  If you receive an error message attempting to SSH into an app container, refer to the following list below to help troubleshoot the issue:
  
  <table border="1" class="nice">
    <tr>
      <th><strong>Error</strong></th>
      <th><strong>Reason</strong></th>
    </tr>
    <tr>
      <td><code>Error getting one time auth code</code></td>
      <td>Check that you have the <code>ssh-proxy</code> client registered with your UAA server.</td>
    </tr>
    <tr>
      <td><code>Error getting one time auth code</code></td>
      <td>Review the <code>uaa_secret</code> field in your Diego manifest and ensure that it matches the <code>Client secret</code> for the <code>ssh-proxy</code> client registered with your UAA server.</td>
    </tr>
    <tr>
      <td><code>Error opening SSH connection</code></td>
      <td>Verify that <code>enable_cf_auth</code> in your Diego manifest is set to <code>true</code>.</td>
    </tr>
    <tr>
      <td><code>Error opening SSH connection</code></td>
      <td>Confirm that you provided the correct UAA token URL for the <code>uaa_token_url</code> property in the Diego manifest.</td>
    </tr>
    <tr>
      <td><code>Error opening SSH connection</code></td>
      <td>Check that you provided the correct private key in your Diego manifest.</td>
    </tr>
    <tr>
      <td><code>Server error, status code: 404</code></td>
      <td>Ensure that the <code>oath_client_id</code> in your Cloud Foundry manifest matches the client ID of the SSH proxy client you registered with your UAA server. The default client ID is <code>ssh-proxy</code>.</td>
    </tr>
  </table>
  
  
  
  
  
  
  