Spring/spring-vault
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Fix EnvironmentVaultConfiguration documentation.

Browse Source 
Closes gh-510.
This commit is contained in:
Mark Paluch
2019-11-26 09:51:40 +01:00
parent 5d3435193f
commit 841c79b01b
2 changed files with 32 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
spring-vault-core/src/main/java/org/springframework/vault/config/EnvironmentVaultConfiguration.java
View File

@@ -105,7 +105,8 @@ import org.springframework.web.client.RestOperations;
* </li>
* <li>Authentication method: {@code vault.authentication} (defaults to {@literal TOKEN},
* supported authentication methods are:
* {@literal TOKEN, APPID, APPROLE, AZURE, AWS_EC2, CERT, CUBBYHOLE})</li>
* {@literal TOKEN, APPID, APPROLE, AWS_EC2, AZURE, CERT, CUBBYHOLE, KUBERNETES}, see
* {@link AuthenticationMethod})</li>
* <li>Token authentication
* <ul>
* <li>Vault Token: {@code vault.token}</li>
@@ -121,17 +122,18 @@ import org.springframework.web.client.RestOperations;
* </ul>
* <li>AppRole authentication
* <ul>
* <li>AppRole path: {@code vault.aws-ec2.aws-ec2-path} (since 2.2.1, defaults to
* <li>AppRole path: {@code vault.app-role.app-role-path} (since 2.2.1, defaults to
* {@link AppRoleAuthenticationOptions#DEFAULT_APPROLE_AUTHENTICATION_PATH})</li>
* <li>RoleId: {@code vault.app-role.role-id}</li>
* <li>SecretId: {@code vault.app-role.secret-id} (optional)</li>
* </ul>
* <li>AWS EC2 authentication
* <ul>
* <li>AWS EC2 path: {@code vault.app-id-path} (since 2.2.1, defaults to
* <li>AWS EC2 path: {@code vault.aws-ec2.aws-ec2-path} (since 2.2.1, defaults to
* {@link AwsEc2AuthenticationOptions#DEFAULT_AWS_AUTHENTICATION_PATH})</li>
* <li>RoleId: {@code vault.aws-ec2.role-id}</li>
* <li>Identity Document URL: {@code vault.aws-ec2.identity-document} (optional)</li>
* <li>Identity Document URL: {@code vault.aws-ec2.identity-document} (defaults to
* {@link AwsEc2AuthenticationOptions#DEFAULT_PKCS7_IDENTITY_DOCUMENT_URI})</li>
* </ul>
* <li>Azure MSI authentication
* <ul>
@@ -425,6 +427,6 @@ public class EnvironmentVaultConfiguration extends AbstractVaultConfiguration
}
enum AuthenticationMethod {
TOKEN, APPID, APPROLE, AZURE, AWS_EC2, CERT, CUBBYHOLE, KUBERNETES;
TOKEN, APPID, APPROLE, AWS_EC2, AZURE, CERT, CUBBYHOLE, KUBERNETES;
}
}

38
src/main/asciidoc/reference/imperative-template.adoc
View File

@@ -170,12 +170,11 @@ vault.token=00000000-0000-0000-0000-000000000000
* Vault URI: `vault.uri`
* SSL Configuration
** Keystore resource: `vault.ssl.key-store` (optional)
** Keystore password: `vault.ssl.key-store-password` (optional)
** Truststore resource: `vault.ssl.trust-store` (optional)
** Truststore password: `vault.ssl.trust-store-password` (optional)
* Authentication method: `vault.authentication` (defaults to `TOKEN`, supported authentication methods are: `TOKEN`, `APPID`, `APPROLE`, `AWS_EC2`, `CERT`, `CUBBYHOLE`)
** Keystore resource: `vault.ssl.key-store` (optional)
** Keystore password: `vault.ssl.key-store-password` (optional)
** Truststore resource: `vault.ssl.trust-store` (optional)
** Truststore password: `vault.ssl.trust-store-password` (optional)
* Authentication method: `vault.authentication` (defaults to `TOKEN`, supported authentication methods are: `TOKEN`, `APPID`, `APPROLE`, `AWS_EC2`, `AZURE`, `CERT`, `CUBBYHOLE`, `KUBERNETES`)
**Authentication-specific property keys**
@@ -185,18 +184,27 @@ vault.token=00000000-0000-0000-0000-000000000000
**<<vault.authentication.appid>>**
* AppId path: `vault.app-id.app-id-path` (defaults to `app-id`)
* AppId: `vault.app-id.app-id`
* UserId: `vault.app-id.user-id`. `MAC_ADDRESS` and `IP_ADDRESS` use `MacAddressUserId`, respective `IpAddressUserId` user id mechanisms. Any other value is used with `StaticUserId`.
* UserId: `vault.app-id.user-id`. `MAC_ADDRESS` and `IP_ADDRESS` use `MacAddressUserId`, respective `IpAddressUserId` user id mechanisms.
Any other value is used with `StaticUserId`.
**<<vault.authentication.approle>>**
* AppRole path: `vault.app-role.app-role-path` (defaults to `approle`)
* RoleId: `vault.app-role.role-id`
* SecretId: `vault.app-role.secret-id` (optional)
**<<vault.authentication.awsec2>>**
* AWS EC2 path: `vault.aws-ec2.aws-ec2-path` (defaults to `aws-ec2`)
* RoleId: `vault.aws-ec2.role-id`
* Identity Document URL: `vault.aws-ec2.identity-document` (optional)
* Identity Document URL: `vault.aws-ec2.identity-document` (defaults to `http://169.254.169.254/latest/dynamic/instance-identity/pkcs7`)
**<<vault.authentication.azuremsi>>**
* Azure MSI path: `vault.azure-msi.azure-path` (defaults to `azure`)
* Role: `vault.azure-msi.role`
**<<vault.authentication.clientcert>>**
@@ -206,14 +214,18 @@ No configuration options.
* Initial Vault Token: `vault.token`
**<<vault.authentication.kubernetes>>**
* Kubernetes path: `vault.kubernetes.kubernetes-path` (defaults to `kubernetes`)
* Role: `vault.kubernetes.role`
* Path to service account token file: `vault.kubernetes.service-account-token-file` (defaults to `/var/run/secrets/kubernetes.io/serviceaccount/token`)
[[vault.core.executioncallback]]
== Execution callbacks
One common design feature of all Spring template classes is that all functionality
is routed into one of the templates execute callback methods. This helps ensure
that exceptions and any resource management that maybe required are performed
consistency. While this was of much greater need in the case of JDBC and JMS
than with Vault, it still offers a single spot for access and logging to occur.
One common design feature of all Spring template classes is that all functionality is routed into one of the templates execute callback methods.
This helps ensure that exceptions and any resource management that maybe required are performed consistency.
While this was of much greater need in the case of JDBC and JMS than with Vault, it still offers a single spot for access and logging to occur.
As such, using the execute callback is the preferred way to access the Vault API
to perform uncommon operations that we've not exposed as methods on `VaultTemplate`.