From 23ba386b1955d84a43e26e873e68612f3c9902d0 Mon Sep 17 00:00:00 2001 From: Dave Syer Date: Fri, 18 Dec 2015 09:23:15 +0000 Subject: [PATCH] Add RSA encryption to vanilla config samples (via rsa profile) --- config-client-decrypt/pom.xml | 4 +++ .../src/main/resources/bootstrap.yml | 22 ++++++++++-- .../src/main/resources/keystore.jks | Bin 0 -> 2243 bytes configserver/pom.xml | 2 -- .../src/main/resources/application.yml | 32 +++++++++++++++--- configserver/src/main/resources/keystore.jks | Bin 0 -> 2243 bytes 6 files changed, 51 insertions(+), 9 deletions(-) create mode 100644 config-client-decrypt/src/main/resources/keystore.jks create mode 100644 configserver/src/main/resources/keystore.jks diff --git a/config-client-decrypt/pom.xml b/config-client-decrypt/pom.xml index 5c65249..783c0b8 100644 --- a/config-client-decrypt/pom.xml +++ b/config-client-decrypt/pom.xml @@ -44,6 +44,10 @@ org.springframework.security spring-security-crypto + + org.springframework.security + spring-security-rsa + org.projectlombok lombok diff --git a/config-client-decrypt/src/main/resources/bootstrap.yml b/config-client-decrypt/src/main/resources/bootstrap.yml index 9084a0f..468af46 100644 --- a/config-client-decrypt/src/main/resources/bootstrap.yml +++ b/config-client-decrypt/src/main/resources/bootstrap.yml @@ -1,7 +1,25 @@ debug: true -encrypt: - key: ${SECRET_KEY:foo} # normally this would be an environment variable + +--- spring: + profiles: default cloud: config: uri: '{cipher}10360db84ecacacf224df3334b02c85b4490b94ee6e6469bf86dd077aa6667f9b84ee3b60343f2c32d61dc14141fe5d0' +encrypt: + key: ${SECRET_KEY:foo} # normally this would be an environment variable + +--- +spring: + profiles: rsa + cloud: + config: + uri: '{cipher}AQB1ZzADAe6i2ltd857NEc1utA+D6cHjyVs8LusiwwrpMzpmhhss5NthMnNwPS14fOzqb6PVopuxgeMcgnF+bUkH66V3mOlGz9O2xbhWQdt1DBKmstxelqWDNVuE0pNIC6j7GNqBvKmnK1JaIDz2oclkR/YVcxPl6hSTNKXUc+pyrU7cpWEm3As6MMpmwTEU7hBdqFh73baTvHYOAnBTHQK1F85Om4/nOnVluh+Kh1yBWgzBx1wlASORB2IbzTDOuzeGcKGlWPl/s8O4asLNKylXnJOI0DUyq5nyn89LWz3axaEvKCCyZgztobudEpqNRzrttCb4qQ/mfn+rhC/o5wdJBiK76aj9tObDo5PsfCV5g+ZBrlSqiwm2d8gXN/4D4PD9PRtPYs8SuuKecKDjTzrJ' + +encrypt: + failOnError: false + keyStore: + location: classpath:keystore.jks + password: ${KEYSTORE_PASSWORD:foobar} # don't use a default in production + alias: test + diff --git a/config-client-decrypt/src/main/resources/keystore.jks b/config-client-decrypt/src/main/resources/keystore.jks new file mode 100644 index 0000000000000000000000000000000000000000..0ad98eade454db2617fd1b1dc54052c264710f81 GIT binary patch literal 2243 zcmchYX*3iHAI4|THjG^%nuLhPjIwWKh7lrUtkq37Tf6p@|APS=`!9oKu$`@ZL%)A#qo^Wph@`k&`K=lOFNxC;OP0CXte-+~0)3Jf|l zW;9SZ0sw%5QB=qQN)X1U3IjrbDj;DX5DI`$A#?Lv-Gx2z_bZ!mz1flQ8{Mm-doyg$ zobv>&~Ak)(@aAA@h1;9fq^L#gr8% zHF3q7)#a53Hxz-+_Aj@Bf~z(}OHiqt`+R$H3#y4q(UvY)M0^QW!q^tCoH;x>)F+V4yZ)cd&U*LYqVsT9Lt(`%4(kknd z&W2^JU+8$}Xl4bQr^DJc_p4S~iN0A9+=>q|)hT#pGHsLjvedBeQ5UIVM&am_r)m>M zrd%RDZ7}9Um5E8ERn$CYhi$lSF)&8?F#P8IZi*|J-7`{ulbFHJ+fojclLaj)2iq1h z_Cq`9Lz#|j&P=87@~AdTKv_Vc2Kd^f`x9Q^*7+f;(*_q)?O9!Lod{HEh;|gi<`#j3!%pdJE6d~KIZVKB| z%Dko-jEK^*NG~RRC$D>%`wlqldOM*VTEmNfdG|GYVW*D zzFX%;i@MTW3bcmj_P1a&O#BQvHLq|a=UcORa}_=DQX&pbkbPxBw7&22_zu0U$v-;M zAKMrmsy-A&1IoFhFEMh6fNy%dYf5Z!nUU&vrCk9BO$n2%1lxPnP|DQAcjQT|iT$ef z5)|FL)hO;O)YY;1D_fdkx9(szFnN%|(rbddafc?9t%O;S%72yWXmFScgE#C%>)dl#ydlnY`%FWTuDzc$g6 z)7|(|yS4M0@G4fW+dyWTE|i;sboyaN5W9jip9i#D-fA~0DHtzuW^QZSqNB>VZuXYV zCmYi4=@1sW)@}9uU=Ws`uhG+*Jy39GyiFOeZ^2F?DVOHoI^Kg)7{0|LOBKg7kTWiO z9+ULIkSb=k#6HZx(xd&g22v;B+n{>Z;GEE)P@{}laKJ@P$D15R{x{jm1vdz!oJ~{itTVz%M(`a9J%*ygi z@XG!Y$X@#03ZXMs-7>`nJE)G){gBWW+Ag1gU#n*C&FpIsquc9jB*^4Gw0ceY8_^=r z@5zO!e;VrvX&5Q_Jb669Im<`TTzCRs6sdolMtu zovfMh`Bdl1KTt+yQb?)yGQRY5j&IAaOQq1Uo=rqDLHvK19C|;(rOxPvpo? zgzqQ9{}TcKkD!iA!ZkEeS{M`>rHMvkod0b#P-yM{*#Gl2R3P%7aU8x2Fcl~SKv98w zASw_Dc;!vL_~J(Afs%d=E2B}h+{5Rok+IA3(VHL+9^c~7f%|hZgcM{ep!_lamX1># zvZf(;)mWF;n;cu7AZBBg%_B4QFG|Few>pKHZHhDw_e84a2DVj=$skA47K++Z zq&+grK0qtJQp5(N<}3Nrm&TfyZwE@u&6^|f?_{O#Q03cV!bE!fc_RtfN0TOUS*4@f zATSUB%szpVL&+XCL{<30(Z6+(+;lYKrIEJW8%+$ z{cTTLv(&o&niDE{tl#W+=h8HV_d(>}U@KtDXvzy!mX5R2M7_#ECjO3b?Lg%5y;X4s z7dzc#ATy}WDK5UNXioMdOqsnw@|fE!$+pWRT5Ni`x7org.springframework.cloud spring-cloud-sample-configserver - Brixton.BUILD-SNAPSHOT jar spring-cloud-sample-configserver @@ -20,7 +19,6 @@ UTF-8 - demo.DemoApplication 1.7 diff --git a/configserver/src/main/resources/application.yml b/configserver/src/main/resources/application.yml index bb01812..01a503f 100644 --- a/configserver/src/main/resources/application.yml +++ b/configserver/src/main/resources/application.yml @@ -1,19 +1,41 @@ server: port: 8888 - -encrypt: - key: ${SECRET_KEY:foo} # normally this would be an environment variable - spring: application: name: configserver cloud: config: server: - bootstrap: true git: uri: https://github.com/spring-cloud-samples/config-repo encrypt: enabled: false + +--- +spring: + profiles: default + cloud: + config: + server: overrides: info.bar: '\{cipher}762c11829d517b203ac94a0180f1950b133b83cde34296549d8fed611a9b2fb5' + +encrypt: + key: ${SECRET_KEY:foo} # normally this would be an environment variable + +--- +spring: + profiles: rsa + cloud: + config: + server: + overrides: + info.bar: '\{cipher}AQAj4tMJizMZS9sBvGjqRz4e6hxKpYXBA3CdtNMBeqS8UaLc8uiy4iydcD8C9z3cDMVprUYXjonCYarwU+13ggtxBUXuNAR1HAzCKWgkB+h8oAtYhBFb3+6gAFb4dFV+9h+DUID6OpAWmFfXj0QI0cuOMx7CXecLSflFAOtF1YUz2y9eQLp2bF8aDx8R/0TEYAYWjLGfibxOXRxRVKH3qLO4YQwQTmnHn5jtIVHtzsmo2ywJq4ySpuRZysy5gxWJwv4ogzVhk46gSesjhfX5Ysbwz6ZP4dQmzGWt8dNrzI99wBUzUXppNv5xtO/E8tUtD6TVJ/CpZuXvmuV5gpZ1Ni2w+ZDBpQfDjs74rqUdUWhnYc6KEj8hM2FaBUESqu7yweQ=' + +encrypt: + failOnError: false + keyStore: + location: classpath:keystore.jks + password: ${KEYSTORE_PASSWORD:foobar} # don't use a default in production + alias: test + diff --git a/configserver/src/main/resources/keystore.jks b/configserver/src/main/resources/keystore.jks new file mode 100644 index 0000000000000000000000000000000000000000..0ad98eade454db2617fd1b1dc54052c264710f81 GIT binary patch literal 2243 zcmchYX*3iHAI4|THjG^%nuLhPjIwWKh7lrUtkq37Tf6p@|APS=`!9oKu$`@ZL%)A#qo^Wph@`k&`K=lOFNxC;OP0CXte-+~0)3Jf|l zW;9SZ0sw%5QB=qQN)X1U3IjrbDj;DX5DI`$A#?Lv-Gx2z_bZ!mz1flQ8{Mm-doyg$ zobv>&~Ak)(@aAA@h1;9fq^L#gr8% zHF3q7)#a53Hxz-+_Aj@Bf~z(}OHiqt`+R$H3#y4q(UvY)M0^QW!q^tCoH;x>)F+V4yZ)cd&U*LYqVsT9Lt(`%4(kknd z&W2^JU+8$}Xl4bQr^DJc_p4S~iN0A9+=>q|)hT#pGHsLjvedBeQ5UIVM&am_r)m>M zrd%RDZ7}9Um5E8ERn$CYhi$lSF)&8?F#P8IZi*|J-7`{ulbFHJ+fojclLaj)2iq1h z_Cq`9Lz#|j&P=87@~AdTKv_Vc2Kd^f`x9Q^*7+f;(*_q)?O9!Lod{HEh;|gi<`#j3!%pdJE6d~KIZVKB| z%Dko-jEK^*NG~RRC$D>%`wlqldOM*VTEmNfdG|GYVW*D zzFX%;i@MTW3bcmj_P1a&O#BQvHLq|a=UcORa}_=DQX&pbkbPxBw7&22_zu0U$v-;M zAKMrmsy-A&1IoFhFEMh6fNy%dYf5Z!nUU&vrCk9BO$n2%1lxPnP|DQAcjQT|iT$ef z5)|FL)hO;O)YY;1D_fdkx9(szFnN%|(rbddafc?9t%O;S%72yWXmFScgE#C%>)dl#ydlnY`%FWTuDzc$g6 z)7|(|yS4M0@G4fW+dyWTE|i;sboyaN5W9jip9i#D-fA~0DHtzuW^QZSqNB>VZuXYV zCmYi4=@1sW)@}9uU=Ws`uhG+*Jy39GyiFOeZ^2F?DVOHoI^Kg)7{0|LOBKg7kTWiO z9+ULIkSb=k#6HZx(xd&g22v;B+n{>Z;GEE)P@{}laKJ@P$D15R{x{jm1vdz!oJ~{itTVz%M(`a9J%*ygi z@XG!Y$X@#03ZXMs-7>`nJE)G){gBWW+Ag1gU#n*C&FpIsquc9jB*^4Gw0ceY8_^=r z@5zO!e;VrvX&5Q_Jb669Im<`TTzCRs6sdolMtu zovfMh`Bdl1KTt+yQb?)yGQRY5j&IAaOQq1Uo=rqDLHvK19C|;(rOxPvpo? zgzqQ9{}TcKkD!iA!ZkEeS{M`>rHMvkod0b#P-yM{*#Gl2R3P%7aU8x2Fcl~SKv98w zASw_Dc;!vL_~J(Afs%d=E2B}h+{5Rok+IA3(VHL+9^c~7f%|hZgcM{ep!_lamX1># zvZf(;)mWF;n;cu7AZBBg%_B4QFG|Few>pKHZHhDw_e84a2DVj=$skA47K++Z zq&+grK0qtJQp5(N<}3Nrm&TfyZwE@u&6^|f?_{O#Q03cV!bE!fc_RtfN0TOUS*4@f zATSUB%szpVL&+XCL{<30(Z6+(+;lYKrIEJW8%+$ z{cTTLv(&o&niDE{tl#W+=h8HV_d(>}U@KtDXvzy!mX5R2M7_#ECjO3b?Lg%5y;X4s z7dzc#ATy}WDK5UNXioMdOqsnw@|fE!$+pWRT5Ni`x7