From a3c5dd8f1a7d3733f2a4794e4596c46298f124b4 Mon Sep 17 00:00:00 2001 From: Mark Paluch Date: Mon, 2 Dec 2019 10:10:17 +0100 Subject: [PATCH] Polishing Add logging for deprecated property usage. Tweak log message wording. Refactor configured property check to if-style. Closes gh-508. Original pull request: gh-509. --- .../config/EnvironmentVaultConfiguration.java | 31 ++++++++++++++----- ...gurationAwsEc2AuthenticationUnitTests.java | 2 +- .../reference/imperative-template.adoc | 2 +- 3 files changed, 25 insertions(+), 10 deletions(-) diff --git a/spring-vault-core/src/main/java/org/springframework/vault/config/EnvironmentVaultConfiguration.java b/spring-vault-core/src/main/java/org/springframework/vault/config/EnvironmentVaultConfiguration.java index ca70c8b2..c38002fa 100644 --- a/spring-vault-core/src/main/java/org/springframework/vault/config/EnvironmentVaultConfiguration.java +++ b/spring-vault-core/src/main/java/org/springframework/vault/config/EnvironmentVaultConfiguration.java @@ -17,6 +17,9 @@ package org.springframework.vault.config; import java.net.URI; +import org.apache.commons.logging.Log; +import org.apache.commons.logging.LogFactory; + import org.springframework.beans.BeansException; import org.springframework.context.ApplicationContext; import org.springframework.context.ApplicationContextAware; @@ -132,7 +135,8 @@ import org.springframework.web.client.RestOperations; *
  • AWS EC2 path: {@code vault.aws-ec2.aws-ec2-path} (since 2.2.1, defaults to * {@link AwsEc2AuthenticationOptions#DEFAULT_AWS_AUTHENTICATION_PATH})
    • *
  • Role: {@code vault.aws-ec2.role} (since 2.2.1)
    • - *
  • RoleId: {@code vault.aws-ec2.role-id} (@Deprecated - use {@code vault.aws-ec2.role} instead)
    • + *
  • RoleId: {@code vault.aws-ec2.role-id} (deprecated since 2.2.1: use + * {@code vault.aws-ec2.role} instead)
    • *
  • Identity Document URL: {@code vault.aws-ec2.identity-document} (defaults to * {@link AwsEc2AuthenticationOptions#DEFAULT_PKCS7_IDENTITY_DOCUMENT_URI})
    • * @@ -178,6 +182,9 @@ import org.springframework.web.client.RestOperations; public class EnvironmentVaultConfiguration extends AbstractVaultConfiguration implements ApplicationContextAware { + private static final Log logger = LogFactory + .getLog(EnvironmentVaultConfiguration.class); + private @Nullable RestOperations cachedRestOperations; private @Nullable ApplicationContext applicationContext; @@ -350,9 +357,16 @@ public class EnvironmentVaultConfiguration extends AbstractVaultConfiguration Assert.isTrue(StringUtils.hasText(roleId) || StringUtils.hasText(role), "Vault AWS-EC2 authentication: Role (vault.aws-ec2.role) must not be empty"); - Assert.isTrue(!(StringUtils.hasText(roleId) && StringUtils.hasText(role)), - "Vault AWS-EC2 authentication: Only one of Role (vault.aws-ec2.role) or" - + " RoleId(@Deprecated) (vault.aws-ec2.roleId) must be provided"); + if (StringUtils.hasText(roleId) && StringUtils.hasText(role)) { + throw new IllegalStateException( + "AWS-EC2 Authentication: Only one of Role (vault.aws-ec2.role) or" + + " RoleId (deprecated, vault.aws-ec2.roleId) must be provided"); + } + + if (StringUtils.hasText(roleId)) { + logger.warn( + "AWS-EC2 Authentication: vault.aws-ec2.roleId is deprecated. Please use vault.aws-ec2.role instead."); + } AwsEc2AuthenticationOptionsBuilder builder = AwsEc2AuthenticationOptions.builder() .role(StringUtils.hasText(role) ? role : roleId).path(path); @@ -361,20 +375,21 @@ public class EnvironmentVaultConfiguration extends AbstractVaultConfiguration builder.identityDocumentUri(URI.create(identityDocument)); } - return new AwsEc2Authentication(builder.build(), restOperations(), restOperations()); + return new AwsEc2Authentication(builder.build(), restOperations(), + restOperations()); } protected ClientAuthentication azureMsiAuthentication() { - String roleId = getProperty("vault.azure-msi.role"); + String role = getProperty("vault.azure-msi.role"); String path = getProperty("vault.azure-msi.azure-path", AzureMsiAuthenticationOptions.DEFAULT_AZURE_AUTHENTICATION_PATH); - Assert.hasText(roleId, + Assert.hasText(role, "Vault Azure MSI authentication: Role (vault.azure-msi.role) must not be empty"); AzureMsiAuthenticationOptionsBuilder builder = AzureMsiAuthenticationOptions - .builder().role(roleId).path(path); + .builder().role(role).path(path); return new AzureMsiAuthentication(builder.build(), restOperations()); } diff --git a/spring-vault-core/src/test/java/org/springframework/vault/config/EnvironmentVaultConfigurationAwsEc2AuthenticationUnitTests.java b/spring-vault-core/src/test/java/org/springframework/vault/config/EnvironmentVaultConfigurationAwsEc2AuthenticationUnitTests.java index 083be9db..efd3edff 100644 --- a/spring-vault-core/src/test/java/org/springframework/vault/config/EnvironmentVaultConfigurationAwsEc2AuthenticationUnitTests.java +++ b/spring-vault-core/src/test/java/org/springframework/vault/config/EnvironmentVaultConfigurationAwsEc2AuthenticationUnitTests.java @@ -35,7 +35,7 @@ import static org.assertj.core.api.Assertions.assertThat; */ @ExtendWith(SpringExtension.class) @TestPropertySource(properties = { "vault.uri=https://localhost:8123", - "vault.authentication=aws-ec2", "vault.aws-ec2.role-id=role" }) + "vault.authentication=aws-ec2", "vault.aws-ec2.role=role" }) class EnvironmentVaultConfigurationAwsEc2AuthenticationUnitTests { @Configuration diff --git a/src/main/asciidoc/reference/imperative-template.adoc b/src/main/asciidoc/reference/imperative-template.adoc index 2f4e201e..eff1a8e3 100644 --- a/src/main/asciidoc/reference/imperative-template.adoc +++ b/src/main/asciidoc/reference/imperative-template.adoc @@ -199,7 +199,7 @@ Any other value is used with `StaticUserId`. * AWS EC2 path: `vault.aws-ec2.aws-ec2-path` (defaults to `aws-ec2`) * Role: `vault.aws-ec2.role` -* RoleId: `vault.aws-ec2.role-id` (deprecated - use `vault.aws-ec2.role` instead) +* RoleId: `vault.aws-ec2.role-id` (*deprecated:* use `vault.aws-ec2.role` instead) * Identity Document URL: `vault.aws-ec2.identity-document` (defaults to `http://169.254.169.254/latest/dynamic/instance-identity/pkcs7`) **<>**