Upgrade to Vault 0.10.0.

Closes gh-240.

.travis.yml

@@ -16,6 +16,7 @@ env:
     - VAULT_VER=0.8.3
     - VAULT_VER=0.9.0
     - VAULT_VER=0.9.5
+    - VAULT_VER=0.10.0
     - PROFILE=springNext
 
 before_install:

spring-vault-core/src/test/java/org/springframework/vault/core/VaultSysTemplateIntegrationTests.java

@@ -57,7 +57,7 @@ public class VaultSysTemplateIntegrationTests extends IntegrationTestSupport {
 	private VaultSysOperations adminOperations;
 
 	@Before
-	public void before() throws Exception {
+	public void before() {
 
 		vaultVersion = prepare().getVersion();
 
@@ -72,8 +72,6 @@ public class VaultSysTemplateIntegrationTests extends IntegrationTestSupport {
 		assertThat(mounts).containsKey("secret/");
 
 		VaultMount secret = mounts.get("secret/");
-		assertThat(Arrays.asList("generic secret storage", "key/value secret storage"))
-				.contains(secret.getDescription());
 		assertThat(Arrays.asList("kv", "generic")).contains(secret.getType());
 	}
 

spring-vault-core/src/test/java/org/springframework/vault/core/VaultTransitTemplateIntegrationTests.java

@@ -684,17 +684,6 @@ public class VaultTransitTemplateIntegrationTests extends IntegrationTestSupport
 		assertThat(signature.getSignature()).isNotEmpty();
 	}
 
-	@Test(expected = VaultException.class)
-	public void signWithInvalidAlgorithmShouldFail() {
-
-		String keyName = createEcdsaP256Key();
-
-		VaultSignRequest request = VaultSignRequest.builder()
-				.plaintext(Plaintext.of("hello-world")).algorithm("blah-512").build();
-
-		transitOperations.sign(keyName, request);
-	}
-
 	@Test
 	public void shouldVerifyValidSignature() {
 
@@ -746,42 +735,6 @@ public class VaultTransitTemplateIntegrationTests extends IntegrationTestSupport
 		assertThat(valid).isEqualTo(SignatureValidation.valid());
 	}
 
-	@Test
-	public void shouldFailToVerifyValidSignatureWithInvalidExistingCustomAlgorithm() {
-
-		assumeTrue(vaultVersion.isGreaterThanOrEqualTo(SIGN_VERIFY_INTRODUCED_IN_VERSION));
-
-		String keyName = createEcdsaP256Key();
-
-		Plaintext plaintext = Plaintext.of("hello-world");
-		Signature signature = transitOperations.sign(keyName, plaintext);
-
-		VaultSignatureVerificationRequest verificationRequest = VaultSignatureVerificationRequest
-				.builder().algorithm("sha2-512").plaintext(plaintext)
-				.signature(signature).build();
-
-		SignatureValidation valid = transitOperations
-				.verify(keyName, verificationRequest);
-		assertThat(valid).isEqualTo(SignatureValidation.invalid());
-	}
-
-	@Test(expected = VaultException.class)
-	public void shouldFailToVerifyValidSignatureWithInvalidCustomAlgorithm() {
-
-		assumeTrue(vaultVersion.isGreaterThanOrEqualTo(SIGN_VERIFY_INTRODUCED_IN_VERSION));
-
-		String keyName = createEcdsaP256Key();
-
-		Plaintext plaintext = Plaintext.of("hello-world");
-		Signature signature = transitOperations.sign(keyName, plaintext);
-
-		VaultSignatureVerificationRequest verificationRequest = VaultSignatureVerificationRequest
-				.builder().algorithm("blah-512").plaintext(plaintext)
-				.signature(signature).build();
-
-		transitOperations.verify(keyName, verificationRequest);
-	}
-
 	@Test
 	public void shouldCreateNewExportableKey() {
 

spring-vault-core/src/test/java/org/springframework/vault/util/PrepareVault.java

@@ -15,6 +15,8 @@
  */
 package org.springframework.vault.util;
 
+import java.util.Collections;
+
 import org.springframework.util.Assert;
 import org.springframework.util.StringUtils;
 import org.springframework.vault.core.VaultOperations;
@@ -46,6 +48,13 @@ public class PrepareVault {
 	private final VaultSysOperations adminOperations;
 	private WebClient webClient;
 
+	/**
+	 * Create a new {@link PrepareVault} object.
+	 *
+	 * @param webClient must not be {@literal null}.
+	 * @param restTemplate must not be {@literal null}.
+	 * @param vaultOperations must not be {@literal null}.
+	 */
 	public PrepareVault(WebClient webClient, RestTemplate restTemplate,
 			VaultOperations vaultOperations) {
 
@@ -84,9 +93,9 @@ public class PrepareVault {
 	/**
 	 * Create a token for the given {@code tokenId} and {@code policy}.
 	 *
-	 * @param tokenId
-	 * @param policy
-	 * @return
+	 * @param tokenId must not be {@literal null}.
+	 * @param policy must not be {@literal null}.
+	 * @return the created {@link VaultToken}.
 	 */
 	public VaultToken createToken(String tokenId, String policy) {
 
@@ -104,7 +113,7 @@ public class PrepareVault {
 	/**
 	 * Check whether Vault is available (vault created and unsealed).
 	 *
-	 * @return
+	 * @return {@literal true} if Vault is available (vault created and unsealed).
 	 */
 	public boolean isAvailable() {
 		return adminOperations.isInitialized() && !adminOperations.health().isSealed();
@@ -113,7 +122,7 @@ public class PrepareVault {
 	/**
 	 * Mount an auth backend.
 	 *
-	 * @param authBackend
+	 * @param authBackend must not be {@literal null} or empty.
 	 */
 	public void mountAuth(String authBackend) {
 
@@ -125,8 +134,8 @@ public class PrepareVault {
 	/**
 	 * Check whether a auth-backend is enabled.
 	 *
-	 * @param authBackend
-	 * @return
+	 * @param authBackend must not be {@literal null} or empty.
+	 * @return {@literal true} if a auth-backend is enabled.
 	 */
 	public boolean hasAuth(String authBackend) {
 
@@ -138,7 +147,7 @@ public class PrepareVault {
 	/**
 	 * Mount an secret backend.
 	 *
-	 * @param secretBackend
+	 * @param secretBackend must not be {@literal null} or empty.
 	 */
 	public void mountSecret(String secretBackend) {
 
@@ -150,8 +159,8 @@ public class PrepareVault {
 	/**
 	 * Check whether a auth-backend is enabled.
 	 *
-	 * @param secretBackend
-	 * @return
+	 * @param secretBackend must not be {@literal null} or empty.
+	 * @return {@literal true} if a auth-backend is enabled.
 	 */
 	public boolean hasSecret(String secretBackend) {
 
@@ -182,6 +191,18 @@ public class PrepareVault {
 		return Version.parse("0.0.0");
 	}
 
+	/**
+	 * Disable Vault versioning Key-Value backend (kv version 2).
+	 */
+	public void disableGenericVersioning() {
+
+		vaultOperations.opsForSys().unmount("secret");
+
+		VaultMount kv = VaultMount.builder().type("kv")
+				.config(Collections.singletonMap("versioned", false)).build();
+		vaultOperations.opsForSys().mount("secret", kv);
+	}
+
 	public VaultOperations getVaultOperations() {
 		return vaultOperations;
 	}

spring-vault-core/src/test/java/org/springframework/vault/util/VaultRule.java

@@ -15,7 +15,6 @@
  */
 package org.springframework.vault.util;
 
-import java.io.IOException;
 import java.net.InetAddress;
 import java.net.InetSocketAddress;
 import java.net.Socket;
@@ -32,12 +31,17 @@ import org.springframework.web.client.RestTemplate;
 import org.springframework.web.reactive.function.client.WebClient;
 
 /**
- * Vault rule to ensure a running and prepared Vault.
+ * Vault rule to ensure a running and prepared Vault. Prepared means unsealed, having a
+ * non-versioning key-value backend mounted at {@code secret/} and a {@link VaultToken}
+ * with {@code root} privileges.
  *
  * @author Mark Paluch
+ * @see Settings#token()
  */
 public class VaultRule extends ExternalResource {
 
+	public static final Version VERSIONING_INTRODUCED_WITH = Version.parse("0.10.0");
+
 	private final VaultEndpoint vaultEndpoint;
 
 	private final PrepareVault prepareVault;
@@ -83,15 +87,27 @@ public class VaultRule extends ExternalResource {
 	@Override
 	public void before() {
 
-		Socket socket = null;
-		try {
+		assertRunningVault();
 
-			socket = new Socket();
+		if (!this.prepareVault.isAvailable()) {
+			this.token = prepareVault.initializeVault();
+			this.prepareVault.createToken(Settings.token().getToken(), "root");
+
+			if (this.prepareVault.getVersion().isGreaterThanOrEqualTo(
+					VERSIONING_INTRODUCED_WITH)) {
+				this.prepareVault.disableGenericVersioning();
+			}
+
+			this.token = Settings.token();
+		}
+	}
+
+	private void assertRunningVault() {
+
+		try (Socket socket = new Socket()) {
 
 			socket.connect(new InetSocketAddress(InetAddress.getByName("localhost"),
 					vaultEndpoint.getPort()));
-			socket.close();
-
 		}
 		catch (Exception ex) {
 			throw new IllegalStateException(
@@ -99,23 +115,11 @@ public class VaultRule extends ExternalResource {
 							"Vault is not running on localhost:%d which is required to run a test using @Rule %s",
 							vaultEndpoint.getPort(), getClass().getSimpleName()));
 		}
-		finally {
-			if (socket != null) {
-				try {
-					socket.close();
-				}
-				catch (IOException e) {
-				}
-			}
-		}
-
-		if (!this.prepareVault.isAvailable()) {
-			this.token = prepareVault.initializeVault();
-			this.prepareVault.createToken(Settings.token().getToken(), "root");
-			this.token = Settings.token();
-		}
 	}
 
+	/**
+	 * @return the {@link PrepareVault} object.
+	 */
 	public PrepareVault prepare() {
 		return prepareVault;
 	}

src/test/bash/install_vault.sh

@@ -6,7 +6,7 @@
 ###########################################################################
 
 
-VAULT_VER="${VAULT_VER:-0.9.5}"
+VAULT_VER="${VAULT_VER:-0.10.0}"
 UNAME=$(uname -s |  tr '[:upper:]' '[:lower:]')
 VAULT_ZIP="vault_${VAULT_VER}_${UNAME}_amd64.zip"
 IGNORE_CERTS="${IGNORE_CERTS:-no}"