secure-service-credentials.yml

- type: replace
  path: /releases/-
  value:
    name: credhub
    sha1: 648658efdef2ff18a69914d958bcd7ebfa88027a
    url: https://bosh.io/d/github.com/pivotal-cf/credhub-release?v=1.9.3
    version: 1.9.3
- type: replace
  path: /instance_groups/-
  value:
    azs:
    - z1
    - z2
    instances: 2
    jobs:
    - consumes:
        consul_client:
          from: consul_client_link
        consul_common:
          from: consul_common_link
        consul_server: nil
      name: consul_agent
      properties:
        consul:
          agent:
            services:
              credhub: {}
      release: consul
    - name: credhub
      properties:
        credhub:
          authentication:
            mutual_tls:
              trusted_cas:
              - ((application_ca.certificate))
            uaa:
              ca_certs:
              - ((uaa_ca.certificate))
              url: https://uaa.service.cf.internal:8443
              verification_key: ((uaa_jwt_signing_key.public_key))
          authorization:
            acls:
              enabled: true
          data_storage:
            database: credhub
            host: sql-db.service.cf.internal
            password: ((credhub_database_password))
            port: 3306
            require_tls: false
            type: mysql
            username: credhub
          encryption:
            keys:
            - active: true
              encryption_password: ((credhub_encryption_password))
              provider_name: internal-provider
            providers:
            - name: internal-provider
              type: internal
          tls: ((credhub_tls))
      release: credhub
    name: credhub
    networks:
    - name: default
    stemcell: default
    vm_type: minimal
- type: replace
  path: /instance_groups/name=database/jobs/name=mysql/properties/cf_mysql/mysql/seeded_databases/-
  value:
    name: credhub
    password: ((credhub_database_password))
    username: credhub
- type: replace
  path: /instance_groups/name=diego-cell/jobs/name=rep/properties/containers?/trusted_ca_certificates/-
  value: |
    ((credhub_ca.certificate))
    ((uaa_ca.certificate))
- type: replace
  path: /instance_groups/name=diego-cell/jobs/name=cflinuxfs2-rootfs-setup/properties?/cflinuxfs2-rootfs/trusted_certs
  value: |
    ((application_ca.certificate))
    ((credhub_ca.certificate))
    ((uaa_ca.certificate))
- type: replace
  path: /instance_groups/name=api/jobs/name=cloud_controller_ng/properties/credhub_api?/ca_cert
  value: ((credhub_ca.certificate))
- type: replace
  path: /variables/-
  value:
    name: credhub_encryption_password
    type: password
- type: replace
  path: /variables/-
  value:
    name: credhub_database_password
    type: password
- type: replace
  path: /variables/-
  value:
    name: credhub_ca
    options:
      common_name: credhubServerCa
      is_ca: true
    type: certificate
- type: replace
  path: /variables/-
  value:
    name: credhub_tls
    options:
      alternative_names:
      - credhub.service.cf.internal
      - credhub.((system_domain))
      ca: credhub_ca
      common_name: credhub.((system_domain))
    type: certificate