Secure Credential Management with CredHub by Eoghan Kelleher at SpringOne Tour 2019

1. © Copyright 2018 Pivotal Software, Inc. All rights Reserved.
CredHub and Secure
Credential Management
Eoghan Kelleher, Senior Platform Architect
ekelleher@pivotal.io
@eoghan_kelleher

2. Why CredHub?

3. Story of CredHub
Configuring Credentials is Hard
Tesla: Unsecured Kubernetes console gave hackers
access to infra creds and mined bitcoin using hacked
creds
Oklahoma Securities Commission: Millions of files
including FBI files and Social Security numbers
exposed by public server with no password
Leaking Credentials is Easy
Uber: Code found on GitHub containing usernames
and passwords
Detecting Credential Leaks is Hard
Equifax: Hackers roamed its systems undetected
from mid-May through late July 2017

4. Story of CredHub
G
enerate
Encrypt
R
otate
Audit
Access Control
Configuring Credentials is Hard
Tesla: Unsecured Kubernetes console gave hackers
access to infra creds and mined bitcoin using hacked
creds
Oklahoma Securities Commission: Millions of files
including FBI files and Social Security numbers
exposed by public server with no password
Leaking Credentials is Easy
Uber: Code found on GitHub containing usernames
and passwords
Detecting Credential Leaks is Hard
Equifax: Hackers roamed its systems undetected
from mid-May through late July 2017

5. Pivotal Application Service
Pivotal Container Service
CredHub in PCF
Concourse

6. Java mapping to CredHub REST API
Supports all credential types and operations
Spring Boot auto-configuration support
Apps deployed to CF with Java Buildpack automatically negotiate mutual TLS
Spring CredHub

7. What is CredHub?

8. Architecture
CredHub
CLI
BOSH
REST API
Authentication
Provider
Encryption
Provider
(HSM)
Backing SQL
Database

9. Credential API
Credential Types
● value - a simple string, used for configuration and other non-generated properties
● password - a simple string, used for generated secrets
● user - username and password pair
● json - a JSON object
● certificate - an object containing a root CA, certificate and private key
● rsa - an object containing an RSA public key and private key
● ssh - an object containing an SSH-formatted public key and private key
https://credhub-api-cfapps.io
Operations
● Get/Set/Generate/Delete Credential
● Get/Add/Delete Permission
● Interpolate (VCAP_SERVICES)
Authentication
● Mutual TLS
● OAuth2 with UAA

10. CredHub for Operators

11. BOSH Benefits
$ bosh -e pcf -d pcf manifest
Simplified Deployment
Manifests
vs
Relax Access to BOSH
Director
Enables Sharing of
Deployment Manifests&
$ bosh -e pcf -d pcf manifest
vs

12. CredHub and Concourse

13. CredHub & Concourse
Simplified Pipeline
Params files
Enables Sharing of
Concourse Pipelines

14. CredHub and Service Broker
Credentials
Pivotal Application Service

15. Service Broker Integration
$ cf env app-name
"VCAP_SERVICES": {
"service-name": {{
"credentials": {
"uri": "https://service-1.example.com",
"username" : "VofTuQk2BH ",
"password" : "fRqah7Wygi"
},
"label": "service-label",
"name": "my-service",
"syslog_drain_url": "",
"tags": [],
"volume_mounts": [],
}}
}
$ cf env app-name
"VCAP_SERVICES": {
"service-name": {{
"credentials": {
"credhub_ref": "/c/[broker-id]/[instance-id]/[binding-id]/credentials"
},
"label": "service-label",
"name": "my-service",
"syslog_drain_url": "",
"tags": [],
"volume_mounts": [],
}}
}

16. Where Binding Credentials Live
Cloud Controller database (encrypted)
Cloud Controller REST API responses
● /v2/apps/:guid/env
● /v2/service_bindings/:guid
Staged application droplets
cf ssh
Manual ssh
Process Environment
Application Memory

17. >Demo

18. Diego Cell
Diego
Cloud Foundry Resolution
CredHub
App
cf push
create env
POST /interpolate
VCAP_SERVICES
Cloud
Controller
V##P_#####
VCAP_SERVICESV##P_#####

19. Credential Interpolation
“VCAP_SERVICES”: {
“my-service”: [{
“credentials”: {
“credhub-ref”: “/c/my-broker/1111/2222/credentials”
},
}]
}
“VCAP_SERVICES”: {
“service-name”: [{
“credentials”: {
“uri”: “https://service-6yQVNrhZVP.example.com”,
“username”: “VofTuQk2BH”,
“password”: “fRqah7Wygi”
},
}]
}
POST /interpolate
interpolated credentials
CredHub

20. Securing User Provided
Credentials
Pivotal Application Service

21. Creating CredHub Service Broker Instances
create service
instance
create service instance
Cloud
Controller
CredHub
Service
Broker
CredHub
cf create-service credhub default dbcreds -c
'{"username": "name", "password": "CREDHUB_SECRET"}'

22. Securing User Provided Services - CredHub Service Broker
Diego Cell
Diego
CredHub
App
POST /interpolate
VCAP_SERVICES
CredHub
Broker
V##P_#####
cf create-service cred:
dbpassword

23. Sharing CredHub Service Instances
cf share-service
dbcreds
DBA
DBASpace DevSpace
Diego Cell
App
cf update-service
dbcreds
cf bind-service myapp
dbcreds
Developer

24. >Demo