We now provide extensions for VaultOperations, ReactiveVaultOperations, VaultKeyValueOperations, VaultVersionedKeyValueOperations, and VaultWrappingOperations to leverage reified type parameters with read(…) methods.
Closes gh-442.
Adapt to changes in Reactor Netty and Spring Framework 5.1 RC1.
Disable ClientCertificateAuthenticationOperatorIntegrationTests as HttpClient (Reactor Netty) has issues with multiple SSL configurations.
Closes gh-281.
We now provide GCP IAM and GCP GCE authentication support for service accounts based on JSON Web Token.
GCP IAM requires Google Cloud Java SDK for credential and IAM interaction.
GcpIamAuthenticationOptions options = GcpIamAuthenticationOptions.builder()
.role(…).credential(GoogleCredentials.getApplicationDefault()).build();
GcpIamAuthentication authentication = new GcpIamAuthentication(options, restOperations());
Closes gh-126.
We now support policy management via Vault's policy endpoint to enumerate policy names, read, write and delete policies. Policy parsing support is limited to JSON as there is no Java HCL parser.
Closes gh-10.
We now support Spring Data Repositories via Spring Data's KeyValue module. Domain objects can be mapped to JSON using a custom converter and created, update, deleted and queried using the repository abstraction. Vault repositories support query derivation limited to predicates on the Id property with paging and sorting.
@Configuration
@EnableVaultRepositories
public class ApplicationConfig {
@Bean
public VaultTemplate vaultTemplate() {
return new VaultTemplate(…);
}
}
@Test
public void loadAndSave() {
Credentials heisenberg = new Credentials();
heisenberg.setId("heisenberg");
heisenberg.setPassword("327215");
vaultRepository.save(heisenberg);
Iterable<Credentials> all = vaultRepository.findAll();
//
}
interface CredentialsRepository extends PagingAndSortingRepository<Credentials, String> {
}
@Data
public class Credentials {
@Id String id;
String password;
}
GET https://localhost:8200/v1/secret/credentials/heisenberg
HTTP/1.1 200 OK
Content-Type: application/json
{
// …
"renewable": false,
"lease_duration": …,
"data": {
"_class": "com.example.Credentials",
"password": "327215"
},
// …
}
See gh-128.
Spring Vault now supports AWS IAM authentication via signed HTTP requests that are executed by Vault to determine the caller (signer) identity.
AwsIamAuthentication requires AWS Java Core SDK to create the actual signature:
AwsIamAuthenticationOptions options = AwsIamAuthenticationOptions.builder()
.credentials(new BasicAWSCredentials(…)).build();
AwsIamAuthentication auth = new AwsIamAuthentication(options, restOperations());
Closes gh-91.
