Terraform credhub support

[poblin-orange]

The cloudfoundry community is moving to global shared secrets and certificate, with the credhub project.

Credhub API is a simple REST API. A terraform integration would be very useful.

Example use case:

• provision a cf service broker. Requires the broker http basic auth password. We should be able to get it from credhub in the key (/my_bosh_directot/my_service_deployment/broker_password).

cc @gberche-orange @ArthurHlt

[gberche-orange]

CredHub support in terraform should probably take the form of:

• a terraform data source provider, exposing a data source (inspiration from vault provider ). This enables reading credhub credentials and use/reference that in other resources (such as CF resources). Example of data that could be read from credhub data source include
  • the CC API endpoint and credentials for configuring the CF resource
  • name of CF resources provisioned outside of the CF terraform resources, and that can be referenced as data_source, such as system_domain that would be referenced into cloudfoundry_domain
• a terraform remote backend, to store terraform state and plans in credhub. Currently, terraform does not support backend plugins, see https://github.com/hashicorp/terraform/issues/5877 so this would have to be contributed within terraform repo. Inspiration in the S3 remote backend implementation

@poblin-orange I'm not sure this feature request lies into the cloudfoundry terraform repo. It might deserve a distinct repo. I'm renaming this issue from "Terraform credhub support" to "Terraform credhub support" as to improve discoverability

[gberche-orange]

Contributed by @ArthurHlt in https://github.com/orange-cloudfoundry/terraform-provider-credhub https://github.com/orange-cloudfoundry/terraform-secure-backend