SpringOne Platform 2018 CredHub and Secure Credential Management Scott Frederick & Peter Blum, Pivotal

1. CredHub and Secure Credential
Management
Scott Frederick
@scottyfred
Peter Blum
@_PBlum

2. Unless otherwise indicated, these slides are © 2013-2018 Pivotal Software, Inc. and licensed under a Creative Commons
Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Configuring Credentials is Hard
Equifax: Website secured by `admin`, `admin`
Leaking Credentials is Easy
Uber: Code found on github which included usernames and
passwords
Detecting Credential Leaks is Hard
Equifax: Hackers accessed files on nearly half the U.S.
population.
G
enerate
Encrypt
Log
Access
Rotate
Story of CredHub

3. Unless otherwise indicated, these slides are © 2013-2018 Pivotal Software, Inc. and licensed under a Creative Commons
Attribution-NonCommercial license: http://creativecommons.org/licenses/by-nc/3.0/
Configuring Credentials is Hard
Equifax: Website secured by `admin`, `admin`
Leaking Credentials is Easy
Uber: Code found on github which included usernames and
passwords
Detecting Credential Leaks is Hard
Equifax: Hackers accessed files on nearly half the U.S.
population.
G
enerate
Encrypt
Audit
Rotate
Story of CredHub

4. Unless otherwise indicated, these slides are © 2013-2018 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license:
http://creativecommons.org/licenses/by-nc/3.0/

5. Unless otherwise indicated, these slides are © 2013-2018 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license:
http://creativecommons.org/licenses/by-nc/3.0/
CredHub
CredHub
CLI
BOSH
Config Server
REST
Client
Authentication
Provider
Backing SQL
Database
Encryption
Provider
(HSM)
CredHub Architecture

6. Unless otherwise indicated, these slides are © 2013-2018 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license:
http://creativecommons.org/licenses/by-nc/3.0/
Operations
• Get/Set/Generate/Delete Credential
• Get/Add/Delete Permission
• Interpolate (VCAP_SERVICES)
Authentication
• Mutual TLS
• OAuth2 with UAA
https://credhub-api.cfapps.io
Credential types
• value - a simple string, used for configuration and other non-generated properties
• password - a simple string, used for generated secrets
• user - username and password pair
• json - a JSON object
• certificate - an object containing a root CA, certificate and private key
• rsa - an object containing an RSA public key and private key
• ssh - an object containing an SSH-formatted public key and private key
CredHub API

7. Unless otherwise indicated, these slides are © 2013-2018 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license:
http://creativecommons.org/licenses/by-nc/3.0/
Infrastructure
Credential Management
BOSH

8. Unless otherwise indicated, these slides are © 2013-2018 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license:
http://creativecommons.org/licenses/by-nc/3.0/
Simplified Deployment
Manifests
vs
Relax Access to BOSH
Director
Enables Sharing of
Deployment Manifests
&
BOSH Integration

9. Unless otherwise indicated, these slides are © 2013-2018 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license:
http://creativecommons.org/licenses/by-nc/3.0/
CI Credential Management
Concourse

10. Unless otherwise indicated, these slides are © 2013-2018 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license:
http://creativecommons.org/licenses/by-nc/3.0/
vs
Access to secrets without
knowledge of secrets
Enables Sharing of Pipelines
&
Streamlined Pipelines
Concourse Integration

11. Unless otherwise indicated, these slides are © 2013-2018 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license:
http://creativecommons.org/licenses/by-nc/3.0/
Service Broker
Credential Management
Pivotal
Application Service

12. Unless otherwise indicated, these slides are © 2013-2018 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license:
http://creativecommons.org/licenses/by-nc/3.0/
$ cf env app-name
“VCAP_SERVICES”: {
“service-name”: [{
“credentials”: {
“uri”: “https://service-1.example.com”,
“username”: “VofTuQk2BH”,
“password”: “fRqah7Wygi”
},
"label": "service-label",
"name": "my-service",
"syslog_drain_url": "",
"tags": [],
"volume_mounts": []
}]
}
$ cf env app-name
“VCAP_SERVICES”: {
“service-name”: [{
“credentials”: {
“credhub-ref”: “/c/[broker-id]/[instance-id]/[binding-id]/credentials”
},
"label": "service-label",
"name": "my-service",
"syslog_drain_url": "",
"tags": [],
"volume_mounts": []
}]
}
Service Broker Integration

13. Where Binding Credentials Live
13
Cloud Controller database (encrypted)
Cloud Controller REST API responses
/v2/apps/:guid/env
/v2/service_bindings/:guid
Staged application droplets
cf ssh
Manual ssh
Process Environment
Application Memory

14. > Demo

15. Unless otherwise indicated, these slides are © 2013-2018 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license:
http://creativecommons.org/licenses/by-nc/3.0/
“VCAP_SERVICES”: {
“my-service”: [{
“credentials”: {
“credhub-ref”: “/c/my-broker/1111/2222/credentials”
},
}]
}
“VCAP_SERVICES”: {
“service-name”: [{
“credentials”: {
“uri”: “https://service-6yQVNrhZVP.example.com”,
“username”: “VofTuQk2BH”,
“password”: “fRqah7Wygi”
},
}]
}
POST
/interpolate
interpolated credentials
CredHub
Credential Interpolation

16. Unless otherwise indicated, these slides are © 2013-2018 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license:
http://creativecommons.org/licenses/by-nc/3.0/
Diego Cell
Diego
CredHub
App
cf push
create env
POST /interpolate
VCAP_SERVICES
Cloud
Controller
V##P_#####
VCAP_SERVICESV##P_#####
Cloud Foundry Resolution
Diego Cell
Diego
App
cf ssh
create-env
Cloud
Controller V##P_#####V##P_#####

17. Unless otherwise indicated, these slides are © 2013-2018 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license:
http://creativecommons.org/licenses/by-nc/3.0/
Secure User Provided
Credential Management
Pivotal
Application Service

18. Unless otherwise indicated, these slides are © 2013-2018 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license:
http://creativecommons.org/licenses/by-nc/3.0/
Platform
Diego
CredHub
App
cf create-service
POST /interpolate
VCAP_SERVICES
Credhub
Broker
V##P_#####
cred: dbPass
Secured User Provided Service

19. Unless otherwise indicated, these slides are © 2013-2018 Pivotal Software, Inc. and licensed under a Creative Commons Attribution-NonCommercial license:
http://creativecommons.org/licenses/by-nc/3.0/
$ cf env app-name
“VCAP_SERVICES”: {
"user-provided": [
{
"binding_name": null,
"credentials": {
"url": "https://example.com",
"username": "admin",
"password": "pa55woRD"
},
"instance_name": "my-service",
"label": "user-provided",
"name": "my-service",
"syslog_drain_url": "",
"tags": [],
"volume_mounts": []
}
]
$ cf env app-name
“VCAP_SERVICES”: {
"secure_credentials": [
{
"binding_name": null,
"credentials": {
"credhub_ref": "/c/credhub-service-broker/credhub/<Binding-ID>/credentials"
},
"instance_name": "my-service",
"label": "credhub",
"name": "my-service",
"syslog_drain_url": "",
"tags": ["credhub"],
"volume_mounts": []
}
]
User Provided Services

20. > Demo

21. > Stay Connected.
MongoDB + CredHub = Secure By
Default Data Services on PCF
Diana Esteves
#springone@s1p
Using CredHub for Kubernetes
Deployments
Peter Blum
Eugene Kiselev