We now enhance VaultTokens obtained from a ClientAuthentication with a self-lookup to determine renewability and the remaining TTL. Self-lookup creates a LoginToken: We need to make sure to only revoke tokens that were initially a LoginToken supplied by the authentication and not LoginToken created by augmentation.
Closes gh-161.
Rename Kube* authentication classes to Kubernetes*. Refactor KubernetesJwtSupplier to extend Supplier<String>. Load token file content eagerly. Extend Javadoc. Reformat code. Remove superfluous exception declarations in tests. Remove commented code from local_run_k8s.sh. Copy CA file from pod.
Reinstantiate AuthenticationStepsFactory for KubernetesAuthentication.
Add Kubernetes authentication to the reference documentation.
Original pull request: gh-166.
Related ticket: gh-143.
Closes gh-166.
We now support authentication via Kubernetes using Service Account Tokens.
KubernetesAuthenticationOptions options = KubernetesAuthenticationOptions.builder().role("dev-role").build();
KubernetesAuthentication authentication = new KubernetesAuthentication(options, restTemplate);
Original pull request: gh-166.
Closes gh-143.
Encapsulate RoleId and SecretId modes (pull, provided, wrapped, absent) with value objects. Adapt AppRoleAuthentication for imperative and AuthenticationSteps authentication. Split imperative and AuthenticationSteps tests.
Use the deprecated cubbyhole response unwrapping endpoint to unwrap responses.
Original pull request: gh-165.
Closes: gh-165.
We now support policy management via Vault's policy endpoint to enumerate policy names, read, write and delete policies. Policy parsing support is limited to JSON as there is no Java HCL parser.
Closes gh-10.
Rename VaultDecryptionPayload to Ciphertext and VaultEncryptionPayload to Plaintext. Move methods of VaultEncryptionDecryptionResultHelper to VaultTrainsitTemplate. Extract common base class from VaultDecryptionResult and VaultEncryptionResult. Refactor value objects to immutable objects. Create encrypt(…) and decrypt(…) methods interchanging Plaintext and Ciphertext objects. Generate equals/hashcode methods for Plaintext, Ciphertext and VaultTransitContext. Simplify tests. Javadoc, license headers, formatting, typo fixes.
Original pull request: gh-138.
Related ticket: gh-137.
Fetch SecretId if no secretId is configured but an initial token is provided instead of relying on a configured role name. Use configured AppRole mount path instead of static literal. Reorder methods, add since and author tags. Reduce tests to AppRoleAuthenticationOptions code. Add further test cases. Add integration tests. Formatting, fix typos.
Original pull request: gh-133.
Related ticket: gh-132.
We now support AppRole authentication pull mode by fetching roleId/secretId from Vault's AppRole auth backend using an initial (ephemeral token) if roleId/secretId are not configured.
Original pull request: gh-133.
Related ticket: gh-132.
We now support Spring Data Repositories via Spring Data's KeyValue module. Domain objects can be mapped to JSON using a custom converter and created, update, deleted and queried using the repository abstraction. Vault repositories support query derivation limited to predicates on the Id property with paging and sorting.
@Configuration
@EnableVaultRepositories
public class ApplicationConfig {
@Bean
public VaultTemplate vaultTemplate() {
return new VaultTemplate(…);
}
}
@Test
public void loadAndSave() {
Credentials heisenberg = new Credentials();
heisenberg.setId("heisenberg");
heisenberg.setPassword("327215");
vaultRepository.save(heisenberg);
Iterable<Credentials> all = vaultRepository.findAll();
//
}
interface CredentialsRepository extends PagingAndSortingRepository<Credentials, String> {
}
@Data
public class Credentials {
@Id String id;
String password;
}
GET https://localhost:8200/v1/secret/credentials/heisenberg
HTTP/1.1 200 OK
Content-Type: application/json
{
// …
"renewable": false,
"lease_duration": …,
"data": {
"_class": "com.example.Credentials",
"password": "327215"
},
// …
}
See gh-128.
