Add an export command #38
Conversation
|
Hey archgrove! Thanks for submitting this pull request! All pull request submitters and commit authors must have a Contributor License Agreement (CLA) on-file with us. Please sign the appropriate CLA (individual or corporate). When sending signed CLA please provide your github username in case of individual CLA or the list of github usernames that can make pull requests on behalf of your organization. If you are confident that you're covered under a Corporate CLA, please make sure you've publicized your membership in the appropriate Github Org, per these instructions. Once you've publicized your membership, one of the owners of this repository can close and reopen this pull request, and dreddbot will take another look. |
|
We have created an issue in Pivotal Tracker to manage this: https://www.pivotaltracker.com/story/show/155883718 The labels on this github issue will be updated when the story is started. |
archgrove
force-pushed
the
add_export_command
branch
from
92cc047 to
ccbda79
Compare
|
Hey archgrove! Thanks for submitting this pull request! All pull request submitters and commit authors must have a Contributor License Agreement (CLA) on-file with us. Please sign the appropriate CLA (individual or corporate). When sending signed CLA please provide your github username in case of individual CLA or the list of github usernames that can make pull requests on behalf of your organization. If you are confident that you're covered under a Corporate CLA, please make sure you've publicized your membership in the appropriate Github Org, per these instructions. Once you've publicized your membership, one of the owners of this repository can close and reopen this pull request, and dreddbot will take another look. |
|
We have created an issue in Pivotal Tracker to manage this: https://www.pivotaltracker.com/story/show/156696248 The labels on this github issue will be updated when the story is started. |
|
Hey archgrove! Thanks for submitting this pull request! I'm here to inform the recipients of the pull request that you and the commit authors have already signed the CLA. |
|
We have created an issue in Pivotal Tracker to manage this: https://www.pivotaltracker.com/story/show/156720341 The labels on this github issue will be updated when the story is started. |
archgrove
force-pushed
the
add_export_command
branch
from
ccbda79 to
2213191
Compare
We would like to be able to export credentials, both for backup and mass-editing purposes. These bulk export models provide a mechanism to turn a slice of `credhub.credentials.Credential` into a YAML representation that can be serialised or reimported by the bulk import process. A test ensures that whatever is created remains importable as the code evolves.
Exporting credentials is useful both for backup and management purposes (e.g. mass-moving a number of credentials to a different path). This command enables exporting by path matching, utilising the bulk export models to create an output that is reimportable. By default, the command exports all credentials to `stdout` in import compatible YAML. The `-p` flag can be used to restrict the paths exported; the `-f` flag to write the output to a file. Note that the credentials are held unencrypted in-memory during this process; as this seems true of all the code, this should not be seen as a problem; just a caveat.
archgrove
force-pushed
the
add_export_command
branch
from
2213191 to
fd2ab34
Compare
|
Thanks @archgrove! Looks good. |
|
@benmoss I probably need to provide the documentation linked to in the flag (https://credhub-api.cfapps.io/#export-credentials). Is that in a repo somewhere I can PR to? |
|
@archgrove nice catch. i think of those as being our API documentation, but we documented import there too, which also isn't really an API feature but just a CLI abstraction. if you want to you can send a PR to https://github.com/cloudfoundry-incubator/credhub-api-site |
|
@benmoss Done; see cloudfoundry/credhub-api-site#6. Thanks! |
We're currently deploying Credhub alongside Concourse as our primary CI credential store. It's been largely fantastic - thanks so much. There's one thing we've missed so far, which is export.
The ability to mass-export credentials from Credhub would solve two helpful use-cases for us.
To facilitate these scenarios, we've created an
exportcommand, that mirrors the extantimportcommand. By default, it exports all credentials tostdoutin YAML that iscredhub importcompatible. The CLI flag-pcan restrict the paths being exported; the flag-fwill redirect the output directly to a file.It would be really useful to us if this could be upstreamed. If there are changes in style or approach that might help this, we're happy to make them. All suggestions and feedback are most welcome.