forked from cloudfoundry/bosh-deployment
-
Notifications
You must be signed in to change notification settings - Fork 1
/
credhub.yml
133 lines (121 loc) · 3.43 KB
/
credhub.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
- type: replace
path: /releases/-
value:
name: credhub
version: "2.0.2"
url: "https://s3.amazonaws.com/bosh-compiled-release-tarballs/credhub-2.0.2-ubuntu-xenial-97.16-20180912-174457-075145067-20180912174506.tgz?versionId=XXig9OLrmykqimvtJUYYlhKhykxk0M6i"
sha1: "afb03addb21543d3feafbebff8fdc242543ef0cb"
- type: replace
path: /instance_groups/name=bosh/jobs/-
value:
name: credhub
release: credhub
properties:
credhub:
authorization:
acls:
enabled: false
authentication:
uaa:
url: "https://((internal_ip)):8443"
ca_certs:
- ((uaa_ssl.ca))
verification_key: ((uaa_jwt_signing_key.public_key))
data_storage:
type: postgres
host: 127.0.0.1
port: 5432
username: postgres
password: ((postgres_password))
database: credhub
require_tls: false
tls: ((credhub_tls))
encryption:
providers:
- name: internal
type: internal
keys:
- provider_name: internal
key_properties:
encryption_password: ((credhub_encryption_password))
active: true
- type: replace
path: /instance_groups/name=bosh/properties/postgres/additional_databases?/-
value: credhub
# Configure Director
- type: replace
path: /instance_groups/name=bosh/properties/director/config_server?
value:
enabled: true
url: "https://((internal_ip)):8844/api/"
ca_cert: ((credhub_tls.ca))
uaa:
url: "https://((internal_ip)):8443"
ca_cert: ((uaa_ssl.ca))
client_id: director_to_credhub
client_secret: ((uaa_clients_director_to_credhub))
# Configure UAA
- type: replace
path: /instance_groups/name=bosh/jobs/name=uaa/properties/uaa/clients/director_to_credhub?
value:
override: true
authorized-grant-types: client_credentials
scope: ""
authorities: credhub.read,credhub.write
access-token-validity: 3600
secret: ((uaa_clients_director_to_credhub))
- type: replace
path: /instance_groups/name=bosh/jobs/name=uaa/properties/uaa/clients/credhub_cli?
value:
override: true
authorized-grant-types: password,refresh_token
scope: credhub.read,credhub.write
authorities: ""
access-token-validity: 60
refresh-token-validity: 1800
secret: ""
- type: replace
path: /instance_groups/name=bosh/jobs/name=uaa/properties/uaa/clients/credhub-admin?
value:
override: true
authorized-grant-types: client_credentials
scope: ""
authorities: credhub.read,credhub.write
access-token-validity: 3600
secret: ((credhub_admin_client_secret))
- type: replace
path: /instance_groups/name=bosh/jobs/name=uaa/properties/uaa/jwt/revocable?
value: true
# Variables
- type: replace
path: /variables/-
value:
name: credhub_ca
type: certificate
options:
is_ca: true
common_name: "CredHub CA"
- type: replace
path: /variables/-
value:
name: credhub_tls
type: certificate
options:
ca: credhub_ca
common_name: ((internal_ip))
alternative_names: [((internal_ip))]
- type: replace
path: /variables/-
value:
name: credhub_encryption_password
type: password
- type: replace
path: /variables/-
value:
name: uaa_clients_director_to_credhub
type: password
- type: replace
path: /variables/-
value:
name: credhub_admin_client_secret
type: password