Tanzu Hub API and automation access

Products

• VMware Tanzu Platform - Hub

Issue/Introduction

For any user with access to Tanzu Hub API, a token can be retrieved to access the API. However this token is a short lived token and is not suitable for concourse pipelines or any automation.

Environment

Tanzu Hub API access

Resolution

And Oauth App can be created with custom validity period for access token.

https://techdocs.broadcom.com/us/en/vmware-tanzu/platform/tanzu-hub/10-3/tnz-hub/users-manage-oauth-apps.html

 

Once the Oauth is created, the App ID and Secret can be used to retrieve the token

curl -k -X POST <HUB-URL>/auth/oauth/token -u "<AppID>:<AppSecret>" -d  "grant_type=client_credentials" | jq '.access_token'

Graphql

curl -kv -X POST HUB-URL/hub/graphql -H "Content-Type: application/json" -H "Authorization: Bearer $USER-TOKEN" -d "@query.json"

# query.json
mutation generateToken {
  authMutation {
    oAuthAppMutation {
      generateAccessTokenForOAuthApp(input: {
        oauthAppId: "<AppID>"
        oauthAppSecret: "<AppSecret>"
      }) {
        accessToken
      }
    }
  }
}

 

This token is then used in any automation tools to access the Hub API