SpringCloud/spring-cloud-config
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Uses label when searching secrets in [Spring]VaultEnvironmentRepository (#2460)

Browse Source 
* Uses label when searching secrets in [Spring]VaultEnvironmentRepository

Signed-off-by: kvmw <mshamsi@broadcom.com>

* Adds a feature flag to enable label in vault secret paths

Signed-off-by: kvmw <mshamsi@broadcom.com>

* Makes default-label in [Spring]VaultEnvironmentRepository configurable

Signed-off-by: kvmw <mshamsi@broadcom.com>

* When label flag is enabled, profile should always by included in vault key

Signed-off-by: kvmw <mshamsi@broadcom.com>

* Updates Vault docs

Signed-off-by: kvmw <mshamsi@broadcom.com>

* Switches to main as default label for vault

Signed-off-by: kvmw <mshamsi@broadcom.com>

---------

Signed-off-by: kvmw <mshamsi@broadcom.com>
This commit is contained in:
Kaveh Shamsi
2024-10-09 16:55:29 +02:00
committed by GitHub
parent e464808fa3
commit 6914dc89b1
6 changed files with 501 additions and 87 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
docs/modules/ROOT/pages/server/environment-repository/vault-backend.adoc
View File

@@ -59,6 +59,12 @@ The following table describes configurable Vault properties:
|defaultKey
|application
|defaultLabel
|main (Only used when `enableLabel` is set to `true`)
|enableLabel
|false
|profileSeparator
|,
@@ -158,6 +164,24 @@ Properties written to `secret/application` are available to <<_vault_server,all
An application with the name, `myApp`, would have any properties written to `secret/myApp` and `secret/application` available to it.
When `myApp` has the `dev` profile enabled, properties written to all of the above paths would be available to it, with properties in the first path in the list taking priority over the others.
[[enabling-serach-by-label]]
== Enabling Search by Label
By default, Vault backend does not use the label when searching for secrets. You can change this by
setting the `enableLabel` feature flag to `true` and, optionally, setting the `defaultLabel`.
When `defaultLabel` is not provided `main` will be used.
When `enableLabel` feature flag is on, the secrets in Vault should always have all three segments(application name, profile and label) in their paths.
So the example in previous section, with enabled feature flag, would be like :
[source,sh]
----
secret/myApp,dev,myLabel
secret/myApp,default,myLabel # default profile
secret/application,dev,myLabel # default application name
secret/application,default,myLabel # default application name and default profile.
----
[[decrypting-vault-secrets]]
== Decrypting Vault Secrets in Property Sources