add shared path support to credhub

[VikranthBala]

Changes proposed by this PR

As of now, it is not possible to configure shared paths for Credhub cred manager as opposed to other cred managers such as Vault,AWS. So I propose to add a new parameter --credhub-shared-path similar to the Vault cred manager. This parameter can be optional (as with Vault). This PR provides all the changes needed for this functionality.

Notes to reviewer

Release Note

Added `--credhub-shared-path` to configure shared secret paths for Credhub cred manager similarly to the one for Vault, SSM.

PR is for the issue: #9062

[linux-foundation-easycla]

The committers listed above are authorized under a signed CLA.

• ✅ login: VikranthBala / name: Vikranth Kumar (acff4e2, ee4c848)

[taylorsilva]

This looks good! Change the lookup path logic for it and then this looks good to merge.

[taylorsilva]

I think this should also include the c.prefix. I think the credhub semantics are similar to Vault's. Both var sources have a PathPrefix that is, as per their descriptions:

Path under which to namespace credential lookup.

Which in Vault means all secret lookups happen under the PathPrefix. See

concourse/atc/creds/vault/vault.go

Lines 43 to 45 in 6d8aee7

	if v.SharedPath != "" {
	lookupPaths = append(lookupPaths, creds.NewSecretLookupWithPrefix(path.Join(v.Prefix, v.SharedPath)+"/"))
	}

Contrasting that, we don't do that in the SSM cred manager:

concourse/atc/creds/ssm/ssm.go

Lines 49 to 51 in 6d8aee7

	if s.sharedPath != "" {
	lookupPaths = append(lookupPaths, creds.NewSecretLookupWithPrefix(s.sharedPath+"/"))
	}

but that's because it has no PathPrefix:

concourse/atc/creds/ssm/manager.go

Lines 22 to 31 in 6d8aee7

	type SsmManager struct {
	AwsAccessKeyID string `mapstructure:"access_key" long:"access-key" description:"AWS Access key ID"`
	AwsSecretAccessKey string `mapstructure:"secret_key" long:"secret-key" description:"AWS Secret Access Key"`
	AwsSessionToken string `mapstructure:"session_token" long:"session-token" description:"AWS Session Token"`
	AwsRegion string `mapstructure:"region" long:"region" description:"AWS region to send requests to"`
	PipelineSecretTemplate string `mapstructure:"pipeline_secret_template" long:"pipeline-secret-template" description:"AWS SSM parameter name template used for pipeline specific parameter" default:"/concourse/{{.Team}}/{{.Pipeline}}/{{.Secret}}"`
	TeamSecretTemplate string `mapstructure:"team_secret_template" long:"team-secret-template" description:"AWS SSM parameter name template used for team specific parameter" default:"/concourse/{{.Team}}/{{.Secret}}"`
	SharedPath string `mapstructure:"shared_path" long:"shared-path" description:"AWS SSM parameter path used for shared parameters"`
	Ssm *Ssm
	}

[taylorsilva]

nit: change description to match Vault's

Suggested change

	SharedPath string `long:"shared-path" description:"CredHub parameter path used for shared parameters"`
	SharedPath string `long:"shared-path" description:"Path under which to namespace credential lookup."`

[VikranthBala]

Thanks for the review, I will have a look at the comments & update the PR