Align naming with Vault's serverId that sets Vault-AWS-IAM-Server-ID headers on AWS requests for consistency. serverName builder/getter is deprecated now.
Closes gh-191.
Remove PropertyTransformerSupport in favor of default method in PropertyTransformer and refactor PropertyTransformer to functional interface.
See gh-169.
We now retain the JSON data type in the property source. This change requires property transformers to accept/produce a Map of String to Object whereas it was String to String before.
See gh-169.
We now provide a reactive, lifecycle-aware SessionManager using WebClient. ReactiveSessionManager is mirroring imperative SessionManager functionality. Using AbstractReactiveVaultConfiguration will register an adapter between ReactiveSessionManager and SessionManager to reuse the same token for reactive and imperative API use.
Closes gh-159.
We now consider the token TTL after renewal to calculate the next renewal time to prevent stale token use. Previously, we assumed the TTL to be the same as the initial TTL. This caused the token to render invalid for a period of time.
We now also check the TTL after renewal whether a subsequent renewal run makes sense for the token. If the remaining TTL exceeds the minimum valid TTL we drop the token and re-login upon the next session token request. We do not revoke the token explicitly to not interrupt processes that obtained the token during the renewal period. Since the remaining TTL is rather short the token will silently expire.
Closes gh-176.
httpcore 4.4.7 -> 4.4.8
netty 4.1.16.Final -> 4.1.17.Final
Jackson 2.9.1 -> 2.9.2
Spring Data Kay GA -> Kay SR1
Reactor Bismuth GA -> Bismuth SR3
Closes gh-174
We now enhance VaultTokens obtained from a ClientAuthentication with a self-lookup to determine renewability and the remaining TTL. Self-lookup creates a LoginToken: We need to make sure to only revoke tokens that were initially a LoginToken supplied by the authentication and not LoginToken created by augmentation.
Closes gh-161.
Rename Kube* authentication classes to Kubernetes*. Refactor KubernetesJwtSupplier to extend Supplier<String>. Load token file content eagerly. Extend Javadoc. Reformat code. Remove superfluous exception declarations in tests. Remove commented code from local_run_k8s.sh. Copy CA file from pod.
Reinstantiate AuthenticationStepsFactory for KubernetesAuthentication.
Add Kubernetes authentication to the reference documentation.
Original pull request: gh-166.
Related ticket: gh-143.
Closes gh-166.
We now support authentication via Kubernetes using Service Account Tokens.
KubernetesAuthenticationOptions options = KubernetesAuthenticationOptions.builder().role("dev-role").build();
KubernetesAuthentication authentication = new KubernetesAuthentication(options, restTemplate);
Original pull request: gh-166.
Closes gh-143.
Encapsulate RoleId and SecretId modes (pull, provided, wrapped, absent) with value objects. Adapt AppRoleAuthentication for imperative and AuthenticationSteps authentication. Split imperative and AuthenticationSteps tests.
Use the deprecated cubbyhole response unwrapping endpoint to unwrap responses.
Original pull request: gh-165.
Closes: gh-165.
Remove VaultTransitContext from Hmac and Signature types and requests. Introduce SignatureValidation to encapsulate validation outcome. Refactor request objects to pure value objects. Build request body inside of VaultTransitTemplate from request objects. Refactor request types to use Plaintext/Signature/Hmac types instead of String primitives.
Remove Hmac/Signature factory methods from bytes to keep Vault responses encapsulated.
Reorder field order/parameters in signatures/methods according their parameter significance. Extend Javadoc, add tests, add author tags. Guard tests to run against the appropriate Vault version.
Original pull request: gh-162.
Closes: gh-162.
