CredHub and Secure Credential Management - Peter Blum, Scott Frederick
summary
CredHub provides a central, encrypted store for generated or supplied secrets and adds access control, rotation, and audit logging; service brokers can push binding credentials as the JSON credential type and Cloud Foundry replaces those bindings with single CredHub references so Diego calls the interpolate endpoint at launch to resolve real secrets into the app process, hiding them from CF API responses, droplets and CF SSH. Authentication uses mTLS or OAuth2 with UAA, BOSH integrates via BOSH variables, and CredHub ships with CF deployment/PCF (SCS 1.5 adds integration) and demonstrably resolves secrets for unmodified Spring apps.
AI-written summary · about
chapters (18)
- 0:00Intro
- 1:00Agenda
- 3:34Goals
- 4:15Users
- 4:56Credentials
- 5:44Credential Types
- 8:13How to Use CredHub
- 9:35Benefits of CredHub
- 10:35When is it available
- 11:17Service Binding Credentials
- 19:03User Provided Credentials
- 27:11Fortune Teller
- 28:09App Environment
- 31:15CredHub
- 31:31Open Source
- 31:57OAuth
- 32:39Bosch
- 34:35Deployments
related talks
37mUsing CredHub to Increase the Security of Your Platform - Dan Jahner, Pivotal
25mHandling Secrets in Your Cloud Native Architecture
17mVault and Credhub: Better Together
11mOpening Remarks - Chip Childers, CTO, Cloud Foundry Foundation
38mKeeping Secrets - A Practical Approach to Managing Credentials
28mConfiguring a More Secure BOSH [I]
24mRoche: Securing & Connecting Healthcare Platforms
36mManage Distributed Secrets in Applications on Cloud Foundry With Spring Cloud Vault