This document discusses CredHub, a tool for centralized credential management. It delivers cradle-to-grave management of credentials, including creation, access control, distribution, rotation, and logging. Credentials are encrypted at rest and include passwords, certificates, SSH keys, and arbitrary values. The document outlines CredHub's architecture, credential types, REST API, language bindings, service bindings workflow, and availability. It demonstrates how CredHub improves security when used with platforms and pipelines.

1. © Copyright 2018 Pivotal Software, Inc. All rights Reserved.
CredHub
February 2019
Sharath Sahadevan @sharath_sahadev
DaShaun Carter @dashaun

2. CredHub Mitigates the Risk of Leaked Credentials
CredHub delivers centralized
management of platform and
application creds.
● Credentials are the bedrock for trust in
the cloud.
● CredHub’s goal: deliver cradle-to-grave
management of credentials (create,
access control, distribution, rotation,
logging)
● Manages passwords, certificates, ssh
keys, RSA keys, and arbitrary values
(strings and JSON blobs).
● All credentials are encrypted w/a key that
rotates (HSM support in OSS & PCF)
● CredHub Service Broker for off-platform
services

3. Architecture
CredHub
CLI
BOSH
REST API
Authentication
Provider
Encryption
Provider
(HSM)
Backing SQL
Database

4. Credential Types
value - a simple string, used for configuration and other non-generated properties
password - a simple string, used for generated secrets
user - username and password pair
json - a JSON object
certificate - an object containing a root CA, certificate and private key
rsa - an object containing an RSA public key and private key
ssh - an object containing an SSH-formatted public key and private key
http://docs.cloudfoundry.org/credhub/credential-types.html

5. REST API
Secured via Mutual TLS, and/or OAuth2
Get/Set/Generate/Delete Credential
Get/Add/Delete Permission
Interpolate VCAP_SERVICES
https://credhub-api.cfapps.io

6. Java mapping to CredHub REST API
Supports all credential types and operations
Spring Boot auto-configuration support
Apps deployed to CF with Java Buildpack automatically negotiate mutual TLS
Spring CredHub

7. Service Bindings
$ cf create-service service-name plan service-instance-
name
$ cf bind-service app-name service-instance-name
“credentials”: {
“uri”: “https://service-6yQVNrhZVP.example.com”,
“username”: “VofTuQk2BH”,
“password”: “fRqah7Wygi” }
Create
Instance
Details
Cloud
Controller
Service
Broker
Create
Binding
Credentials
Cloud
Controller
Service
Broker

8. Service Bindings
$ cf env app-name
“VCAP_SERVICES”: {
“service-name”: [{
“credentials”: {
“uri”: “https://service-6yQVNrhZVP.example.com”,
“username”: “VofTuQk2BH”,
“password”: “fRqah7Wygi”
},
}]
}

9. Where Binding Credentials Live
Cloud Controller database (encrypted)
Cloud Controller REST API responses
● /v2/apps/:guid/env
● /v2/service_bindings/:guid
Staged application droplets
cf ssh
Manual ssh
Process Environment
Application Memory

10. Service Bindings With CredHub
$ cf bind-service app-name service-instance-name
create binding
credentials with credhub-ref
PUT /data
“credentials”: {
“uri”: “https://service-6yQVNrhZVP.example.com”,
“username”: “VofTuQk2BH”,
“password”: “fRqah7Wygi” }
“credentials”: {
“credhub-ref”:
“/c/my-broker/[instance-id]/[binding-id]/credentials” }
Cloud
Controller
Service
Broker
CredHub

11. Service Bindings
$ cf env app-name
“VCAP_SERVICES”: {
“service-name”: [{
“credentials”: {
“credhub-ref”: “/c/my-broker/[instance-id]/[binding-
id]/credentials”
},
}]
}

12. Credential Interpolation
CredHub
“VCAP_SERVICES”: {
“my-service”: [{
“credentials”: {
“credhub-ref”: “/c/my-broker/1111/2222/credentials”
},
}]
}
“VCAP_SERVICES”: {
“service-name”: [{
“credentials”: {
“uri”: “https://service-6yQVNrhZVP.example.com”,
“username”: “VofTuQk2BH”,
“password”: “fRqah7Wygi”
},
}]
}
POST /interpolate
interpolated credentials

13. Diego Cell
Diego
Assisted Credential Resolution
CredHub
App
Cloud
Controller

14. Application Benefits of Using CredHub
Cloud Controller database (encrypted)
Cloud Controller REST API responses
● /v2/apps/:guid/env
● /v2/service_bindings/:guid
Staged application droplets
cf ssh
Assisted Mode

15. Non-Assisted Credential Resolution
Spring applications using Spring Cloud Connectors or Spring
Boot ${vcap.service.} properties will have framework
support to automate resolution
CredHub
Diego Cell
Diego
App
Cloud
Controller

16. Availability
CredHub bits are included in cf-
deployment since version v0.36.0
Deployment manifest customization
required to enable secure service
binding credentials workflow
Starting in Pivotal CF 2.0
● Secure service binding credentials
support can be enabled or disabled
in PAS tile configuration
● Assisted mode only
Service brokers will be updated to support secure
binding credentials on their own release schedules

17. Demo
https://github.com/ssahadevan-pivotal/springboot-credhub-sample
cf create-service credhub default mycredhub -c '{"mysecretkey":"somethingsecret"}'
cf update-service mycredhub -c '{"mysecretkey":"newsecret"}'
cf restage credhub-sample
Note: Restage application to see the new values
Click on the route for your app and you should see the secret.

18. Platforms and Pipelines

19. Build Servers

20. Secure Self Service
How many credentials do you have access to?
How are your credentials delivered?
How strong is your weakest link?
https://content.pivotal.io/white-papers/pivotal-cloud-foundry-the-auditors-guide

21. Cover w/ Image
Weakest Links
■ Sticky Notes
■ Shell History
■ Database
■ Private Git Repository
■ Encrypted Values Private Git Repo
■ Pipeline Jobs / Build
■ Email / Shared Drive

22. Pipeline Benefits
of Using
CredHub
Security, Change Approval, Architecture
● Public/Private Cloud Tenant IDs
● Subscription IDs
● Account IDs / Service Accounts
● kubectl credentials
● Secure Pipelines*

23. BOSH + UAA + CredHub + Concourse
• Automated Cradle-to-grave management of credentials (platform and
apps)
• Manages passwords, certificates, ssh keys, RSA key, and arbitrary
values (string & JSON)
• All credentials are encrypted w/a key that rotates

24. BUCC
$ source git clone https://github.com/starkandwayne/bucc.git
$ cd bucc
$ source .envrc
$ bucc up
$ bucc info
$ bosh alias-env bucc
$ bosh vms
$ bucc uaa
$ credhub api
$ bucc info
$ bucc fly

25. Before
Secure Off-Platform Services with Service Instance Sharing & the CredHub
Service Broker
Now in PCF 2.3+
cf create-service credhub default app-db -c '{"url":...,"username":...,"password":...}'
credentials: { credhub-ref: /c/prophet-db/app-db/credentials }
cf cups app-db -p '{"url":...,"username":...,"password":...}'
credentials: { url:OH,username:NO!,password:CLEARTEXT }

26. 29

27. Transforming How The World Builds Software
© Copyright 2018 Pivotal Software, Inc. All rights Reserved.