Adding --value flag to credhub get

[ljfranklin]

To make the CLI more usable in automated scripts, a flag that pulls out just the value of a credential would be super helpful. A current workaround would be setting --output-json and using jq, but a simple flag feels nicer.

For example:

Plain get:

$ credhub get --name /vbox/cf/uaa_scim_users_admin_password
type: password
name: /vbox/cf/uaa_scim_users_admin_password
value: MY_PASSWORD
updated: 2017-05-10T21:25:53Z

With flag:

$ credhub get --name /vbox/cf/uaa_scim_users_admin_password --value
MY_PASSWORD

If this seems reasonable but y'all don't have time, I'd be willing to throw a PR your way.

[cf-gitbot]

We have created an issue in Pivotal Tracker to manage this:

https://www.pivotaltracker.com/story/show/145284463

The labels on this github issue will be updated when the story is started.

[ljfranklin]

Now that I think about it, would be nice to be able to retrieve nested values as well, e.g. etcd_ca.certificate. Not sure what the right flag syntax is in that case. Maybe --value-path=/ for the whole thing and --value-path=/certificate to grab just a nested field?

[danjahner]

Hey Lyle -

Thanks for the feature request. Can you summarize your use case where you are consuming CLI value programmatically?

It feels consistent to allow property accessors like etcd_ca.certificate, similar to how they are provided by BOSH, but we have some complications to resolve before that would be possible.

[ljfranklin]

@pivotal-danjahner For example, CI scripts that need the CF admin password in order to run a test suite or programmatically push an app. Also developer workflows for targeting a given CF environment with a one-liner rather than copy-pasting creds in the terminal. For example:

# authenticating against CF
cf auth admin "$( credhub get --name /director/cf/uaa_scim_admin_users_password --value )"
# or pretending the CF CLI has a --ca-cert flag
cf api https://api.bosh-lite.com --ca-cert="$( credhub get --name /director/cf/ca/certificate --value )"

I'd be happy with the first line as a start, sound like getting nested values like in the second line is more complicated.

Does the --value flag that returns only the value of the field seem doable as a backlog item or would you rather take a PR?

[danjahner]

@ljfranklin

We've recently finished a story that restricts credential names to disallow dots as part of the name. After a migration period, we should be able to implement property accessors using the cred-name.property syntax with expected results.

[voelzmo]

ping
We find ourselves writing things like this

CREDHUB_OUTPUT="$(credhub get -n "${CRED-NAME}" 2> /dev/null)"
jq -r ".value" <<< "$(yaml2json <<< "${CREDHUB_OUTPUT}")"

That would be much easier, if the cli could provide just the value with a flag.

[voelzmo]

How do you feel about what Lyle said above?

Does the --value flag that returns only the value of the field seem doable as a backlog item or would you rather take a PR?

I'm not sure if that's a feature you entirely rejected or just didn't prioritize.

[voelzmo]

ping @crawsible

[aegershman]

Any updates on feelings about this by any chance?

[mdelillo]

@ljfranklin @voelzmo @aegershman we're going to prioritize a story for adding the --value flag to the get command. You can follow along here.

[ankeesler]

This is done! It is available in the latest version of the CLI. :)

[voelzmo]

@ankeesler I recently tried to use --value but couldn't find that flag. Could you point me to the right direction how I can try that?

EDIT: I just now realized this switch is named --quiet – seems like I didn't understand what that switch is supposed to do. Thanks!