Search code examples
cloud-foundrycloudfoundry-uaa

Why does Cloud Foundry allow creation of multiple service keys when they for provide the same secrets?

Try for example on Pivotal the Elefant SQL or Redis services: You can create multiple service keys with different names, but they contain the same secrets.

I would have thought that in creating different keys I would be able to revoke them independently. Is that only possible for some services?

Solution

  • The behavior depends on the service broker implementation. The recommended approach is to generate unique values for every binding and service key. Not all service brokers do that though.

    For reference, see the open service broker API here -> https://github.com/openservicebrokerapi/servicebroker/blob/v2.13/spec.md#credentials

    I know, for example, that the Pivotal MySQL Service Broker follows this advice and generates unique credentials for each binding and service key.

    https://github.com/cloudfoundry/cf-mysql-broker

    Hope that helps!