Spring / Spring CredHub Interview questions
When should you use the generate operation instead of write for a password?
Use generate() whenever nothing outside CredHub needs to dictate the password's actual value — a brand-new database user's password, a service-to-service secret, anything where "a strong, random value" is the requirement rather than a specific one.
The payoff comes later: because CredHub remembers the generation parameters, that password can be rotated with a single regenerate() call with no extra bookkeeping. A password stored with write() has no such memory, so rotating it means generating a new value yourself and writing it again.
write() is still the right call when the password isn't CredHub's to choose — migrating an existing credential into CredHub, or storing a value a user typed in, for example.
generate() is the better choice for a password when:
What extra capability does a generated password gain over a written one?
More Related questions...
