Giters

cyberark / conjur-service-broker

Implementation of the Open Service Broker API for Conjur

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Enable the Service tile to support multiple conjur environments/plans

TheSecMaven opened this issue · comments

commented

Is your feature request related to a problem? Please describe.

as of now the service broker only supports a 1 to 1 mapping of PCF platform to conjur environmentt.

This doesn't work well with those who have a nonproduction conjur environment that they want some apps to use in the same platform, for testing/POC purposes.

Describe the solution you would like

offer the ability to connect to 2 conjur environments, either using a separate marketplace "plan" or a separate service offering in the marketplace.

Describe alternatives you have considered

Not many options as I can see it. the only option now is get another pcf platform, which is a lot of overhead.

commented

Hey @mkkeffeler - thanks for sharing this. It's a known issue that we only support one service broker per foundation (we actually run into this in our integration tests too :) )

I've shared this with PM and they're filing an official ER for you, but I expect this will be a slightly complex effort. For what it's worth, the root cause appears to be that the plan / service IDs are hard-coded and defined here: https://github.com/cyberark/conjur-service-broker/blob/master/config/catalog.yml. This was a hard requirement before, but I did just see in the CF docs that:

Prior to Cloud Foundry API (CAPI) v1.71, the service ID and plan IDs of each service advertised by the broker must be unique across Cloud Foundry.
With CAPI v1.71 or later, the service ID and plan IDs of each service advertised by the broker must be unique only within the broker and can overlap ids defined in other brokers

This is promising, as we may be able to set it up to be more flexible going forward. But it will require dedicated R&D effort, so I'll be working with PM to prioritize this and get it scheduled.

commented

Hi @mkkeffeler thanks again. I've added this as an ER. Counter to what I thought earlier, our Aha! ideas are not publicly visible at this point, however this can be used as a future reference (https://cyberark.aha.io/ideas/ideas/SCR-I-92)