Spring / Spring CredHub Interview questions
Explain the lifecycle of a generated credential in CredHub?
A generated credential moves through a fairly linear lifecycle, and Spring CredHub exposes a method for each stage:
flowchart TD
A[generate with CredentialGenerateRequest] --> B[CredHub creates value and stores generation parameters]
B --> C[Credential readable via getByName / getByNameWithHistory]
C --> D{Rotation needed?}
D -- Yes --> E[regenerate using stored parameters]
E --> F[New version becomes current; old version kept in history]
F --> C
D -- No --> G[deleteByName removes the credential entirely]
The key detail that shapes this whole lifecycle is that CredHub remembers how a value was generated, not just the value itself. That's why regenerate() can produce a new password of the same length and character rules, or a new certificate with the same subject and key usage, without the caller repeating any parameters.
Each regeneration doesn't erase the previous value; it becomes an older version accessible through getByNameWithHistory(), which is what lets a consumer briefly accept both the old and new value during a rolling deployment before the old one is finally deleted.
What does regenerate() rely on that write() never stores?
After several regenerations, what can getByNameWithHistory() return?
More Related questions...
