Control Tower deploys the credhub service alongside Concourse and configures Concourse to use it. More detail on how credhub integrates with Concourse can be found in the Concourse docs.
You can log into credhub by running:
eval "$(control-tower info --iaas [AWS|GCP] --env --region $region $deployment)"