When using TLS authentication, the Vault API allows the caller to specify
a role to use for authorization. Previously, we did not allow this to be
specified, which caused Vault to select one of the roles associated with
the certificate.
See gh-780
LeaseStrategy.shouldDrop(…) now controls whether to retry the session token. Dropping the token terminates renewals while retaining the token leads to another renewal. Additionally, we introduced LeaseStrategy.retainOnIoError() to retain tokens on network failures (IOException).
Closes gh-646
We now skip secretId retrieval when using AppRole authentication steps to avoid Unknown SecretId configuration errors.
Also, renamed AbsentSecretId.INSTANCE to ABSENT_SECRET_ID to cause more meaningful messages when used in toString.
Closes gh-656
We now expose access to the CA chain by providing getX509IssuerCertificates(). Additionally, a KeyStore can be created containing the full CA chain.
Closes gh-648.
Make SslConfiguration.enabledProtocols and enabledCipherSuites non-null. Update since tags. Add author tags. Update documentation.
See gh-635
Original pull request: gh-640.
- Adding the ability to explicitly configure the enabled SSL protocol
versions and cipher suites used by the Vault HTTP client via the
following Spring properties:
* vault.ssl.enabled-protocols
* vault.ssl.enabled-cipher-suites
- Properties should be a comma-separated list of String constants that
correspond to those used by the enabled SSL provider.
Closes gh-635
Original pull request: gh-640.
Several types are now enabled for reflective injection of the Logger to allow logger re-routing if needed. Especially for Spring Cloud Vault we reconfigure loggers so that components can log their failures during the bootstrap phase while the actual logging framework is not yet configured.
Closes gh-636.
We now expose a wrapped ThreadPoolTaskScheduler to not expose the bean to the context directly to avoid interference with other components requiring a properly configured ThreadPoolTaskScheduler for e.g. AtAsync usage. We remove the risk of accidentally exhausting the pool and in consequence, ensuring the pool has sufficient capacity to handle Vault background jobs.
Resolves gh-623.
We now skip secret rotation for secrets that have a zero TTL, typically kv1/kv2 secrets that don't have a TTL configured to avoid excessive Vault calls.
Closes gh-601.
See also spring-cloud/spring-cloud-vault#391
We now publish a single SecretLeaseRotatedEvent instead of publishing two events (SecretLeaseExpiredEvent and SecretLeaseCreatedEvent) to atomically update notify listeners such as LeaseAwareVaultPropertySource for atomic updates.
Closes gh-594.
