Spring / Spring CredHub Interview questions
1. What is Spring CredHub?
Spring CredHub is a client library that gives Spring applications Java bindings for the CredHub API. CredHub itself is a Cloud Foundry component that centralizes credential generation, storage, and retrieval, so an app doesn't need to hardcode passwords, certificates, or keys. The library covers ...
2. What is CredHub?
CredHub is a Cloud Foundry component for centrally managing credentials — passwords, certificates, SSH keys, RSA keys, and arbitrary values — across the lifecycle of an application or platform. Instead of secrets living in config files, environment variables, or app manifests, CredHub...
3. What are the core modules of Spring CredHub?
Spring CredHub is split across a small set of Maven artifacts, each with a distinct job: spring-credhub-core — the Java bindings for the CredHub API: templates, operations interfaces, and request/response types. spring-credhub-starter — the Spring Boot starter that pulls in the core m...
4. What is the purpose of the spring-credhub-starter dependency?
The spring-credhub-starter dependency is what turns Spring CredHub from a plain Java library into something that auto-configures itself inside a Spring Boot application. Once it's on the classpath, Spring Boot reads properties under the spring.credhub prefix — mainly the server URL, and opt...
5. How do you add Spring CredHub to a Maven project?
Add the starter artifact to the
6. What is CredHubOperations?
CredHubOperations is the main interface Spring CredHub exposes for interacting with a CredHub server. It lives in org.springframework.credhub.core and acts as an entry point to a family of focused sub-interfaces. Rather than exposing every method directly, it groups them by concern: credentials()...
7. What is CredHubTemplate?
CredHubTemplate is the default implementation of CredHubOperations . It wraps a RestTemplate configured to talk to the CredHub server and handles serializing requests and responses to and from CredHub's JSON API. When Spring CredHub auto-configures a connection using mutual TLS — the defaul...
8. What are the credential types supported by Spring CredHub?
Spring CredHub models every credential type CredHub itself supports, each with its own request/response classes under org.springframework.credhub.support.* : Type Typical use Value A single opaque string, like an API key Password A generated or provided password string User A username/password pa...
9. Define CredentialName in Spring CredHub?
CredentialName represents the path-like name CredHub uses to identify a credential, such as /myapp/prod/db-password . It's the type every read, write, and delete operation takes instead of a plain string. Spring CredHub provides SimpleCredentialName as the standard implementation, which lets you ...
10. What is a CredentialDetails object?
CredentialDetails
11. Describe CredHubCredentialOperations?
CredHubCredentialOperations , obtained by calling credHubOperations.credentials() , is the sub-interface focused specifically on credential CRUD — write, generate, regenerate, find, and delete — as opposed to permissions or interpolation. It's the interface most application code actua...
12. What is CredHubPermissionOperations used for?
CredHubPermissionOperations , returned by credHubOperations.permissions() , manages the original (v1) permission model in CredHub: it lets you add, retrieve, and delete the access-control entries attached to a specific credential name. Each entry pairs an Actor — identified as an app, a UAA...
13. List the authentication mechanisms supported by Spring CredHub?
Spring CredHub supports two ways to authenticate to a CredHub server, and auto-configuration picks between them based on which properties are set: Mutual TLS — the default on Cloud Foundry. The app and CredHub each present a certificate issued by the platform, and no extra credentials are c...
14. What is mutual TLS authentication in Spring CredHub?
Mutual TLS (mTLS) is the default way an app on Cloud Foundry authenticates to CredHub: both sides present a certificate during the TLS handshake, so the connection itself proves who the app is, with no separate token or credential needed. On Cloud Foundry, this works because the platform's contai...
15. How do you configure the CredHub server URL?
Set the spring.credhub.url property, either in application.yml or as an environment variable, pointing at the CredHub server's address: spring: credhub: url: https://credhub.service.cf.internal:8844 On Cloud Foundry, apps typically use the platform-internal address shown above rather than a publi...
16. What is a password credential in Spring CredHub?
A password credential is a CredHub credential type that stores a single string value intended to be used as a password, modeled in Spring CredHub by the PasswordCredential class. It can be written directly with a caller-supplied string via PasswordCredentialRequest , or generated by CredHub itsel...
17. What is a JsonCredential?
JsonCredential is the Spring CredHub type for CredHub's JSON credential kind — a credential whose value is an arbitrary JSON object rather than a single string, username/password pair, or key material. It's useful for grouping several related settings under one credential name, such as a se...
18. How do you write a credential using CredHubOperations?
Get the credentials sub-interface from the injected CredHubOperations bean, build a typed request, and call write() : PasswordCredential value = new PasswordCredential("s3cr3t-value"); PasswordCredentialRequest request = PasswordCredentialRequest.builder() .name(new SimpleCredentialName("myapp", ...
19. What is CredHubInfoOperations?
CredHubInfoOperations , returned by credHubOperations.info() , exposes read-only information about the CredHub server itself rather than about any particular credential. Its main use is retrieving the server's version and configuration details, which is handy for a health check or a startup log l...
20. Describe CredHubInterpolationOperations?
CredHubInterpolationOperations , returned by credHubOperations.interpolation() , has a single job: taking the VCAP_SERVICES -style data structure Cloud Foundry gives a bound app and replacing any CredHub credential references inside it with the actual values. When a service broker binds an app to...
21. What is the difference between write and generate operations in Spring CredHub?
write() and generate() both store a credential, but they differ in who decides the value and, as a result, what you can do with it afterward: write() generate() Caller supplies the value CredHub generates the value Takes a CredentialRequest Takes a CredentialGenerateRequest with generation parame...
22. What is the difference between getByName and getByNameWithHistory?
getByName() returns only the current value of a credential — a single CredentialDetails
23. How does Spring CredHub regenerate a credential?
Regeneration only works on credentials that CredHub itself created with generate() ; CredHub remembers the generation parameters that were used, so regenerate() can reproduce a fresh value with the same shape — same length, same character rules for a password, same key size for an RSA key &...
24. Why does Spring CredHub prefer mutual TLS over OAuth2 on Cloud Foundry?
On Cloud Foundry, mutual TLS is the path of least friction: the platform already issues every app a short-lived identity certificate through its container security provider, and CredHub already trusts certificates from the platform's CA. An app gets strong, per-instance authentication with zero c...
25. How do you configure OAuth2 authentication for Spring CredHub?
Add the OAuth2 client-credentials properties alongside the CredHub URL, along with the spring-security-config and spring-security-oauth2-client dependencies: spring: credhub: url: https://credhub.example.com:8844 oauth2: registration-id: credhub-client security: oauth2: client: registration: cred...
26. What is the difference between CredHubPermissionOperations and CredHubPermissionV2Operations?
Both manage access control, but they model it differently: CredHubPermissionOperations (v1) CredHubPermissionV2Operations Permissions attached directly to a credential name Permissions attached to a path, which can include wildcards No individual permission identity Each permission entry has its ...
27. How does Spring CredHub represent an actor in a permission entry?
An actor is modeled by the Actor class in org.springframework.credhub.support.permissions , built with a static factory method matching the kind of identity being granted access: Actor.app(appGuid) for a Cloud Foundry application, Actor.user(userGuid) for a UAA user, or Actor.client(clientName) f...
28. When should you use CredHubInterpolationOperations?
Reach for CredHubInterpolationOperations when an app is consuming a service binding whose credentials were stored in CredHub rather than embedded directly — a common pattern for CredHub-backed service brokers on Cloud Foundry. Rather than parsing VCAP_SERVICES yourself and calling the crede...
29. What happens when you call getByName for a credential that does not exist?
CredHub returns an HTTP 404, and Spring CredHub surfaces that as a CredHubException rather than returning null or an empty result — so calling code needs to catch it (or check existence some other way) rather than null-check the return value. This trips up developers migrating from APIs tha...
30. How is CredHubException structured?
CredHubException lives in org.springframework.credhub.core and extends Spring's RestClientResponseException (itself a HttpStatusCodeException ), which means every failed CredHub call surfaces the same rich HTTP context a REST client would give you: status code, status text, response headers, and ...
31. What is the difference between a UserCredential and a PasswordCredential?
PasswordCredential stores a single value — just the password string, with no identity attached. UserCredential stores a username alongside the password as one credential, which matches how CredHub itself models a user account: username, password, and a password hash together. Practically, t...
32. How do you enable reactive support in Spring CredHub?
Add spring-boot-starter-webflux to the project alongside the existing spring-credhub-starter dependency:
33. What is the difference between CredHubOperations and ReactiveCredHubOperations?
Both expose the same shape of API — credentials() , permissions() , permissionsV2() , certificates() , interpolation() , info() — but their return types and underlying HTTP client differ completely. CredHubOperations methods return values directly and block the calling thread, backed ...
34. Why would you choose CertificateCredential over a generic JsonCredential for TLS material?
CertificateCredential is a purpose-built type with dedicated fields for the certificate authority, the certificate itself, and the private key, plus support for CredHub's certificate-specific operations — generation with SAN/key-usage parameters, and regeneration with a transitional version...
35. How does Spring Cloud Config Server use CredHub as a backend?
Spring Cloud Config Server can use CredHub as an environment repository backend instead of, or alongside, Git: configuration values are stored as CredHub credentials and served back to client apps through the normal Config Server API. Configuring it means activating the credhub profile and pointi...
36. When should you use the generate operation instead of write for a password?
Use generate() whenever nothing outside CredHub needs to dictate the password's actual value — a brand-new database user's password, a service-to-service secret, anything where "a strong, random value" is the requirement rather than a specific one. The payoff comes later: because CredHub re...
37. How do you troubleshoot a certificate_unknown error with mutual TLS?
A certificate_unknown error during the mTLS handshake almost always means the app's container isn't presenting a certificate CredHub trusts, so the fix is to check the pieces that make that certificate available rather than anything in Spring CredHub's own configuration. Start with the buildpack:...
38. What is the difference between spring-credhub-core and spring-credhub-starter?
spring-credhub-core is the plain Java library: the CredHubOperations / CredHubTemplate classes, request/response types, and credential-type classes, with no dependency on Spring Boot's auto-configuration machinery. spring-credhub-starter depends on spring-credhub-core and adds the Spring Boot aut...
39. Explain the lifecycle of a generated credential in CredHub?
A generated credential moves through a fairly linear lifecycle, and Spring CredHub exposes a method for each stage: flowchart TD A[generate with CredentialGenerateRequest] --> B[CredHub creates value and stores generation parameters] B --> C[Credential readable via getByName / getByNameWithHistor...
40. Explain the execution flow of a Spring Boot app calling CredHubOperations.write()?
A single write() call passes through a short, predictable chain from application code to the CredHub server and back: sequenceDiagram participant App as Application code participant Ops as Credentials operations participant Tpl as CredHubTemplate participant RT as RestTemplate participant CH as C...
41. Explain the internal working of Spring CredHub's OAuth2 client-credentials authentication?
When OAuth2 properties are present, a dedicated auto-configuration path takes over instead of the plain mutual-TLS configuration. It builds a client-credentials resource definition from the configured OAuth2 client registration, and wires it into the same CredHubTemplate used elsewhere — th...
42. How can you optimize credential retrieval in a high-throughput Spring service?
The biggest lever is simply not calling CredHub on every request: fetch a credential once at startup or on first use, cache it in memory, and only go back to CredHub when it's known to have changed — for example, driven by a rotation event or a scheduled refresh, rather than a lookup per in...
43. Which is better for testing Spring CredHub integrations, Mockito or a real CredHub server, and why?
Neither replaces the other; they answer different questions. Mockito, mocking the credentials operations interface directly, is the right tool for unit-testing a service class's own logic — what it does with the value it gets back, how it reacts to a CredHubException — and it runs in ...
44. Explain how CredentialRequest and CredentialDetails work together in the write API?
CredentialRequest
45. Explain the internal working of Spring CredHub's mutual TLS auto-configuration on Cloud Foundry?
flowchart TD A[App staged with Java buildpack] --> B[Container Security Provider injects app identity cert and key] B --> C[Spring CredHub auto-configuration reads spring.credhub.url] C --> D[No OAuth2 properties present, so CredHubTemplate is built for mTLS] D --> E[RestTemplate uses container's...
46. How do you unit test a service that depends on CredHubCredentialOperations?
Mock the interface with Mockito rather than standing up a real CredHub server, and inject it the same way production code would — typically through a constructor: @ExtendWith (MockitoExtension . class) class OrderCredentialServiceTest { @Mock CredHubCredentialOperations credentialOperations...
47. Explain how permission actors and operations combine to enforce access control in CredHub?
Every CredHub credential (or, with V2 permissions, every matching path) carries an access-control list made up of entries, and each entry is nothing more than an Actor paired with a set of Operation values — READ , WRITE , DELETE , READ_ACL , WRITE_ACL . When a request comes in, CredHub fir...
48. How does Spring CredHub's ReactiveCredHubTemplate differ internally from CredHubTemplate?
Both implement the same set of sub-operation accessors, but everything underneath is swapped for a non-blocking equivalent. CredHubTemplate is built on a RestTemplate and its methods return the value directly, blocking the calling thread until the HTTP response arrives. ReactiveCredHubTemplate is...
49. Explain the execution flow of credential interpolation for VCAP_SERVICES?
flowchart TD A[App receives VCAP_SERVICES from platform] --> B[Bound service entry contains a credential reference, not the raw secret] B --> C[App builds a ServicesData object from VCAP_SERVICES] C --> D[interpolateServiceData sent to CredHub's interpolation endpoint] D --> E[CredHub scans the s...
50. How can you design a credential rotation strategy using Spring CredHub's regenerate operation?
A workable rotation strategy leans on three things CredHub already gives you: generated (not written) credentials, version history, and permission scoping — combined with a schedule your app controls. Generate, don't write. Only credentials created with generate() remember their parameters ...
