Skip to main content

SSH Credentials API

This topic lists sample queries for CRUD operations that create, read, update, and delete Harness secrets that manage SSH keys.

note

The ! following the type means that this field is required.

Before You Begin

Get a Secret

This sample retrieves an existing SSH Credentials secret by its ID.

query{  
secret(secretId:"iyBV3R8ZQWe48GMiaTht7A",secretType:SSH_CREDENTIAL){
... on SSHCredential{
name
id
authenticationType{
... on SSHAuthentication{
port
userName
}
... on KerberosAuthentication{
principal
port
realm
}
}
}
}
}

The authenticationType element supports credentials using both SSHAuthentication and KerberosAuthentication.

Get a Secret by Name

This sample uses a secretByName query to retrieve an existing secret by its name.

query{  
secretByName(name:"testing_SSH",secretType:SSH_CREDENTIAL){
... on SSHCredential{
name
authenticationType{
... on SSHAuthentication{
port
userName
}
... on KerberosAuthentication{
principal
port
realm
}
}
}
}
}

Create an SSH Credentials Secret

This sample creates a secret. The required CreateSecretInput input must include a SecretType.

 mutation($secret: CreateSecretInput!){  
createSecret(input: $secret){
secret{
... on SSHCredential{
name
id
authenticationType{
... on SSHAuthentication{
port
userName
}
... on KerberosAuthentication{
principal
port
realm
}
}
}
}
}
}

Query Variables: Inline Key

For the above query, these sample variables supply the SecretType and an inline SSH key.

You must provide the inline SSH key as a Base64-encoded string.

{  
"secret": {
"secretType": "SSH_CREDENTIAL",
"sshCredential": {
"name": "ssh_credential_with_inline_key",
"authenticationScheme": "SSH",
"sshAuthentication": {
"port": 22,
"userName": "ubuntu",
"sshAuthenticationMethod": {
"sshCredentialType": "SSH_KEY",
"inlineSSHKey": {
"sshKeySecretFileId": "ePuBMQvPQ0Sl3FGYkd9NQg"
}
}
},
"usageScope": {
"appEnvScopes": [
{
"application": {
"filterType": "ALL"
},
"environment": {
"filterType": "PRODUCTION_ENVIRONMENTS"
}
}
]
}
}
}
}

Query Variables: File Path

These sample variables specify the SecretType, and reference the SSH Key by its file path.

{  
"secret": {
"secretType": "SSH_CREDENTIAL",
"sshCredential": {
"name": "Test",
"authenticationScheme": "SSH",
"sshAuthentication": {
"port": 22,
"userName": "ubuntu",
"sshAuthenticationMethod": {
"sshCredentialType": "SSH_KEY_FILE_PATH",
"sshKeyFile": {
"path": "ePuBMQvPQ0Sl3FGYkd9NQg"
}
}
},
"usageScope": {
"appEnvScopes": [
{
"application": {
"filterType": "ALL"
},
"environment": {
"filterType": "PRODUCTION_ENVIRONMENTS"
}
}
]
}
}
}
}

Query Variables: Password

These sample variables supply an inline password for the new secret.

{  
"secret": {
"secretType": "SSH_CREDENTIAL",
"sshCredential": {
"name": "Test",
"authenticationScheme": "SSH",
"sshAuthentication": {
"port": 22,
"userName": "ubuntu",
"sshAuthenticationMethod": {
"sshCredentialType": "PASSWORD",
"serverPassword": {
"passwordSecretId": "mq-PSjt0Sjmq43dEE5V1og"
}
}
},
"usageScope": {
"appEnvScopes": [
{
"application": {
"filterType": "ALL"
},
"environment": {
"filterType": "PRODUCTION_ENVIRONMENTS"
}
}
]
}
}
}
}

Query Variables: Kerberos Keytab

These sample variables supply a Kerberos keytab for the new secret.

{  
"secret": {
"secretType": "SSH_CREDENTIAL",
"sshCredential": {
"name": "TestSample1",
"authenticationScheme": "KERBEROS",
"kerberosAuthentication": {
"principal": "asdasd",
"realm": "asdasd",
"port": 22,
"tgtGenerationMethod": {
"tgtGenerationUsing": "KEY_TAB_FILE",
"keyTabFile": {
"filePath": "/asd/asdasd"
}
}
},
"usageScope": {
"appEnvScopes": [
{
"application": {
"filterType": "ALL"
},
"environment": {
"filterType": "PRODUCTION_ENVIRONMENTS"
}
}
]
}
}
}
}

Query Variables: Kerberos Password

These sample variables supply a Kerberos password for the new secret.

{  
"secret": {
"secretType": "SSH_CREDENTIAL",
"sshCredential": {
"name": "TestSample1",
"authenticationScheme": "KERBEROS",
"kerberosAuthentication": {
"principal": "asdasd",
"realm": "asdasd",
"port": 22,
"tgtGenerationMethod": {
"tgtGenerationUsing": "PASSWORD",
"kerberosPassword": {
"passwordSecretId": "mq-PSjt0Sjmq43dEE5V1og"
}
}
},
"usageScope": {
"appEnvScopes": [
{
"application": {
"filterType": "ALL"
},
"environment": {
"filterType": "PRODUCTION_ENVIRONMENTS"
}
}
]
}
}
}
}

Update a Secret

This sample updates an existing secret. The required UpdateSecretInput input must supply a secretType and an id.

You can update the name or the sshAuthentication/kerberosAuthentication. To update the credentials, you must supply the complete sshAuthentication/kerberosAuthentication as input.

mutation($secret: UpdateSecretInput!){  
updateSecret(input: $secret){
secret{
... on SSHCredential{
name
id
authenticationType{
... on SSHAuthentication{
port
userName
}
... on KerberosAuthentication{
principal
port
realm
}
}
}
}
}
}

Query Variables

These sample variables supply the required secretType and id.

{  
"secret": {
"secretId": "",
"secretType": "SSH_CREDENTIAL",
"sshCredential": {
"name": "Test",
"authenticationScheme": "SSH",
"sshAuthentication": {
"port": 22,
"userName": "ubuntu",
"sshAuthenticationMethod": {
"sshCredentialType": "PASSWORD",
"serverPassword": {
"passwordSecretId": "mq-PSjt0Sjmq43dEE5V1og"
}
}
},
"usageScope": {
"appEnvScopes": [
{
"application": {
"filterType": "ALL"
},
"environment": {
"filterType": "PRODUCTION_ENVIRONMENTS"
}
}
]
}
}
}
}

Delete a Secret

This sample deletes a specified secret. The required DeleteSecretInput input must supply a secretId and a secretType.

mutation($secret: DeleteSecretInput!){  
deleteSecret(input: $secret){
clientMutationId
}
}

Query Variables

Here are query variables for the above deleteSecret operation.

{  
"secret": {
"secretId": "okvQ69PMQIqjyI3r5YB1JQ",
"secretType": "SSH_CREDENTIAL"
}
}