Integrating CredHub with SUSE Cloud Application Platfo…

Deployment, Administration, and User Guides › SUSE Cloud Application Platform Administration › Integrating CredHub with SUSE Cloud Application Platform

ContentsContents

Deployment, Administration, and User Guides

Navigation←→

Applies to SUSE Cloud Application Platform 2.1.1

24 Integrating CredHub with SUSE Cloud Application Platform #

File Name: cap_admin_credhub.xml
ID: no ID found

24.1 Installing the CredHub Client
24.2 Enabling and Disabling CredHub
24.3 Connecting to the CredHub Service

SUSE Cloud Application Platform supports CredHub integration. You should already have a working CredHub instance, a CredHub service on your cluster, then apply the steps in this chapter to connect SUSE Cloud Application Platform.

24.1 Installing the CredHub Client #

File Name: cap_admin_credhub.xml
ID: sec-cap-credhub

Start by creating a new directory for the CredHub client on your local workstation, then download and unpack the CredHub client. The following example is for the 2.2.0 Linux release. For other platforms and current releases, see the cloudfoundry-incubator/credhub-cli at https://github.com/cloudfoundry-incubator/credhub-cli/releases

tux > mkdir chclient
tux > cd chclient
tux > wget https://github.com/cloudfoundry-incubator/credhub-cli/releases/download/2.2.0/credhub-linux-2.2.0.tgz
tux > tar zxf credhub-linux-2.2.0.tgz

24.2 Enabling and Disabling CredHub #

File Name: cap_admin_credhub.xml
ID: sec-cap-credhub-enable

CredHub is enabled by default. To disable it, add the following the following block to your kubecf-config-values.yaml file.

features:
  credhub:
    enabled: false

To enable CredHub again, update the above block in your kubecf-config-values.yaml so that enabled is set to true.

After making the change above, and any other configuration changes, apply the update by doing the following:

For an initial deployment, continue to the deployment steps for your platform:
- For SUSE CaaS Platform, see Section 4.13, “Deploying SUSE Cloud Application Platform”.
- For Microsoft AKS, see Section 5.13, “Deploying SUSE Cloud Application Platform”.
- For Amazon EKS, see Section 6.13, “Deploying SUSE Cloud Application Platform”.
- For Google GKE, see Section 7.14, “Deploying SUSE Cloud Application Platform”.

For an existing deployment, use helm upgrade to apply the change.

tux > helm upgrade kubecf suse/kubecf \
--namespace kubecf \
--values kubecf-config-values.yaml \
--version 2.7.13

Warning

On occasion, the credhub pod may fail to start due to database migration failures; this has been spotted intermittently on Microsoft Azure Kubernetes Service and to a lesser extent, other public clouds. In these situations, manual intervention is required to track the last completed transaction in credhub_user database and update the flyway schema history table with the record of the last completed transaction. Please contact support for further instructions.

24.3 Connecting to the CredHub Service #

File Name: cap_admin_credhub.xml
ID: sec-cap-credhub-connect

Set environment variables for the CredHub client, your CredHub service location, and Cloud Application Platform namespace. In these guides the example namespace is kubecf:

tux > CH_CLI=~/chclient/credhub
tux > CH_SERVICE=https://credhub.example.com
tux > NAMESPACE=kubecf

Set up the CredHub service location:

tux > SECRET="$(kubectl get secrets --namespace "${NAMESPACE}" | awk '/^secrets-/ { print $1 }')"
tux > CH_SECRET="$(kubectl get secrets --namespace "${NAMESPACE}" "${SECRET}" --output jsonpath="{.data['uaa-clients-credhub-user-cli-secret']}"|base64 --decode)"
tux > CH_CLIENT=credhub_user_cli
tux > echo Service ......@ $CH_SERVICE
tux > echo CH cli Secret @ $CH_SECRET

Set the CredHub target through its Kubernetes service, then log into CredHub:

tux > "${CH_CLI}" api --skip-tls-validation --server "${CH_SERVICE}"
tux > "${CH_CLI}" login --client-name="${CH_CLIENT}" --client-secret="${CH_SECRET}"

Test your new connection by inserting and retrieving some fake credentials:

tux > "${CH_CLI}" set --name FOX --type value --value 'fox over lazy dog'
tux > "${CH_CLI}" set --name DOG --type user --username dog --password fox
tux > "${CH_CLI}" get --name FOX
tux > "${CH_CLI}" get --name DOG

Print this page