How to recreate a HANA Cloud service key aka password rotation

Problem:

SAP HANA Cloud uses BTP services and service keys.

There might be the need to update the service-keys.

Solution:

Warning: This is advanced scripting and you could harm your configurations. Please test carefully with dedicated spaces before you are applying this to production instances. This includes also development environments/spaces.

Writing a script that automates the update of the service-keys.

Install Cloud Foundry CLI on your machine or use the Buisness Application Studio terminal session

if you are in a terminal session and connected to CloudFoundry via “cf login”

In my case this look like this:

cf login

Now you can issue the command “cf services” and will see all services you have.

List of services in cf

Alternative you can see the same at your instances in the BTP cockpit:

BTP Cockpit view on services

Here we are only interested in the HDI_shared view but you might have other selections criteria.

I strongly recommend to adjust the grep parameter in this line to get a list the services you want to recreate.

cf services | tail -n +4 | grep hdi-shared | grep -v -i myHDiServie | grep -i -- -ws- | awk '{print $1}'

The sample script below demonstrates how you can manage serviceKey recreation.

I commented the two critical lines

• dsk (delete-service-key)
• csk (create-service-key)

with a “#”  – so a simple copy/paste will not change things immediate.

The “-f” is a force input so you do not have to confirm with a “Y”

I saw through copy/paste issues with the ‘{“permissions”: [“development”]}’ string. Particular the DoubleQuotes had some strange reformatting…

The term “development” has 2 aliases: “catalog-user” and “debugging”

THIS IS ONLY RECOMMENDED FOR DEVELOPMENT SPACES

For production environment no parameter “-c .. permission..” is needed.

#!/bin/sh

clear

echo "looping through the services"

for service in $(cf services | tail -n +4 | grep hdi-shared | grep -v -i myHDiServie | grep -i -- -ws- | awk '{print $1}')

do

echo "For service: $service"

for serviceKey in$(cf service-keys $service | tail -n +4 | awk '{print $1}')

do

echo " showing service key $serviceKey"

echo " deleteing service key $serviceKey"

echo " cf dsk $service $serviceKey "

#cf dsk $service $serviceKey -f

echo

echo " create $serviceKey"

echo " cf csk $service $serviceKey -c '{"permissions": ["development"]}'"

#cf csk $service $serviceKey -c '{"permissions": ["development"]}'

echo

echo

done

done

Post processing

You have to “train” the development environments that you have changed the service-keys.

We keep a copy of the service key in the environment of BAS. So if you change the keys we cache the wrong information. We added a little feature in the BAS HANATooling:

BIND ALL OPTION

The BIND ALL option will “refresh” all the keys in your project. If you still have bindings you have to UNBIND ALL as a first step.

Summary

It is possible to change the service-key(s) in BTP/CF development SPACE for “hdi-shared” or “schema” with a script. It is very important to test your script.  This scripts can create great damage and results in a lot of manual rework to fix.