cloudfoundry-community/credhub-resource

Credhub Resource

A concourse resource for Credhub.

Adding to your pipeline

To use the Credhub Resource, you must declare it in your pipeline as a resource type:

resource_types:
- name: credhub
  type: docker-image
  source:
    repository: cfcommunity/credhub-resource

Source Configuration

• server: Required. The address of the Credhub server
• username: Required. The UAA client ID for authorizing with Credhub.
• password: Required. The UAA client secret for authorizing with Credhub.
• path: Optional. The Credhub path which needs to be watched.
• skip_tls_validation: Optional. Skip TLS validation for connections to Credhub and UAA.

Example

- name: credhub
  type: credhub
  source:
    server: https://credhub.example.com
    username: admin
    password: admin
    path: /bosh/cf/
    skip_tls_validation: true

Behaviour

This resource will create a new version when a credential Credhub changes.

Example

jobs:
- name: deploy_cf
  plan:
  - aggregate:
  - get: cf-deployment
  - get: credhub
    trigger: true
...

credhub-resource's Issues

Check does not work when there are no creds

~/bucc-ops/ci$ fly -t bucc check-resource -r cf/credhub                                                                                                                                                          [826/10271]
error: check failed with exit status '1':
No credentials exist which match the provided parameters.

Workaround:

credhub set -n /foo -t password -v bar

Ability to pull credentials from `get: ` & use it in later steps of pipeline

If I perform a get: credhub, I'm only able to determine if a credhub path has changed. I'd like to be able to use the output of credhub get -n /my/path in later steps of the pipeline.

I'm imagining something that could be used alongside the terraform resource or the bosh deployment resource

This isn't

- get: credhub
- put: terraform
   params:
      var_files: credhub/output.yml
- put: some-bosh-deployment
   params:
      var_files: credhub/output.yml

Ability to use clientid and clientsecret

Currently we can only authenticate with a username and password

It would be great if we could authenticate using a client_id and client_secret

Document config for out / in

Currently only the source config is documented.
It is not clear to me if a credential can be written or read to/from credhub via this resource.