SpringCloud/spring-cloud-static
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
Files
3b9afd66a4d5731e464d2cd0a9373da5c3753116
spring-cloud-static/spring-cloud-vault/2.2.0.M2/reference/html/spring-cloud-vault.html
buildmaster 3b9afd66a4 Sync docs from v2.2.0.M2 to gh-pages
2019-08-15 15:12:40 +00:00

2654 lines
97 KiB
HTML
Raw Blame History

This file contains ambiguous Unicode characters
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<!--[if IE]><meta http-equiv="X-UA-Compatible" content="IE=edge"><![endif]-->
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<meta name="generator" content="Asciidoctor 1.5.7.1">
<title>Spring Cloud Vault</title>
<link rel="stylesheet" href="css/spring.css">
<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css">
<style>
.hidden {
display: none;
}
.switch {
border-width: 1px 1px 0 1px;
border-style: solid;
border-color: #7a2518;
display: inline-block;
}
.switch--item {
padding: 10px;
background-color: #ffffff;
color: #7a2518;
display: inline-block;
cursor: pointer;
}
.switch--item:not(:first-child) {
border-width: 0 0 0 1px;
border-style: solid;
border-color: #7a2518;
}
.switch--item.selected {
background-color: #7a2519;
color: #ffffff;
}
</style>
<script src="https://cdnjs.cloudflare.com/ajax/libs/zepto/1.2.0/zepto.min.js"></script>
<script type="text/javascript">
function addBlockSwitches() {
$('.primary').each(function() {
primary = $(this);
createSwitchItem(primary, createBlockSwitch(primary)).item.addClass("selected");
primary.children('.title').remove();
});
$('.secondary').each(function(idx, node) {
secondary = $(node);
primary = findPrimary(secondary);
switchItem = createSwitchItem(secondary, primary.children('.switch'));
switchItem.content.addClass('hidden');
findPrimary(secondary).append(switchItem.content);
secondary.remove();
});
}
function createBlockSwitch(primary) {
blockSwitch = $('<div class="switch"></div>');
primary.prepend(blockSwitch);
return blockSwitch;
}
function findPrimary(secondary) {
candidate = secondary.prev();
while (!candidate.is('.primary')) {
candidate = candidate.prev();
}
return candidate;
}
function createSwitchItem(block, blockSwitch) {
blockName = block.children('.title').text();
content = block.children('.content').first().append(block.next('.colist'));
item = $('<div class="switch--item">' + blockName + '</div>');
item.on('click', '', content, function(e) {
$(this).addClass('selected');
$(this).siblings().removeClass('selected');
e.data.siblings('.content').addClass('hidden');
e.data.removeClass('hidden');
});
blockSwitch.append(item);
return {'item': item, 'content': content};
}
$(addBlockSwitches);
</script>
</head>
<body class="book toc2 toc-left">
<div id="header">
<h1>Spring Cloud Vault</h1>
<div class="details">
<span id="revnumber">version 2.2.0.M2</span>
</div>
<div id="toc" class="toc2">
<div id="toctitle">Table of Contents</div>
<ul class="sectlevel1">
<li><a href="#_quick_start">Quick Start</a></li>
<li><a href="#_client_side_usage">Client Side Usage</a>
<ul class="sectlevel2">
<li><a href="#_authentication">Authentication</a></li>
</ul>
</li>
<li><a href="#vault.config.authentication">Authentication methods</a>
<ul class="sectlevel2">
<li><a href="#vault.config.authentication.token">Token authentication</a></li>
<li><a href="#vault.config.authentication.appid">AppId authentication</a></li>
<li><a href="#_approle_authentication">AppRole authentication</a></li>
<li><a href="#vault.config.authentication.awsec2">AWS-EC2 authentication</a></li>
<li><a href="#vault.config.authentication.awsiam">AWS-IAM authentication</a></li>
<li><a href="#vault.config.authentication.azuremsi">Azure MSI authentication</a></li>
<li><a href="#vault.config.authentication.clientcert">TLS certificate authentication</a></li>
<li><a href="#vault.config.authentication.cubbyhole">Cubbyhole authentication</a></li>
<li><a href="#vault.config.authentication.gcpgce">GCP-GCE authentication</a></li>
<li><a href="#vault.config.authentication.gcpiam">GCP-IAM authentication</a></li>
<li><a href="#vault.config.authentication.kubernetes">Kubernetes authentication</a></li>
</ul>
</li>
<li><a href="#vault.config.backends">Secret Backends</a>
<ul class="sectlevel2">
<li><a href="#vault.config.backends.generic">Generic Backend</a></li>
<li><a href="#vault.config.backends.kv.versioned">Versioned Key-Value Backend</a></li>
<li><a href="#vault.config.backends.consul">Consul</a></li>
<li><a href="#vault.config.backends.rabbitmq">RabbitMQ</a></li>
<li><a href="#vault.config.backends.aws">AWS</a></li>
</ul>
</li>
<li><a href="#vault.config.backends.database-backends">Database backends</a>
<ul class="sectlevel2">
<li><a href="#vault.config.backends.database">Database</a></li>
<li><a href="#vault.config.backends.cassandra">Apache Cassandra</a></li>
<li><a href="#vault.config.backends.mongodb">MongoDB</a></li>
<li><a href="#vault.config.backends.mysql">MySQL</a></li>
<li><a href="#vault.config.backends.postgresql">PostgreSQL</a></li>
</ul>
</li>
<li><a href="#vault.config.backends.configurer">Configure <code>PropertySourceLocator</code> behavior</a></li>
<li><a href="#_service_registry_configuration">Service Registry Configuration</a></li>
<li><a href="#vault.config.fail-fast">Vault Client Fail Fast</a></li>
<li><a href="#vault.config.ssl">Vault Client SSL configuration</a></li>
<li><a href="#vault-lease-renewal">Lease lifecycle management (renewal and revocation)</a></li>
</ul>
</div>
</div>
<div id="content">
<div id="preamble">
<div class="sectionbody">
<div class="paragraph">
<p>&#169; 2016-2019 The original authors.</p>
</div>
<div class="admonitionblock note">
<table>
<tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
<em>Copies of this document may be made for your own use and for distribution to others, provided that you do not charge any fee for such copies and further provided that each copy contains this Copyright Notice, whether distributed in print or electronically.</em>
</td>
</tr>
</table>
</div>
<div class="paragraph">
<p>Spring Cloud Vault Config provides client-side support for externalized configuration in a distributed system. With <a href="https://www.vaultproject.io">HashiCorp&#8217;s Vault</a> you have a central place to manage external secret properties for applications across all environments. Vault can manage static and dynamic secrets such as username/password for remote applications/resources and provide credentials for external services such as MySQL, PostgreSQL, Apache Cassandra, MongoDB, Consul, AWS and more.</p>
</div>
</div>
</div>
<div class="sect1">
<h2 id="_quick_start"><a class="link" href="#_quick_start">Quick Start</a></h2>
<div class="sectionbody">
<div class="paragraph">
<p><strong>Prerequisites</strong></p>
</div>
<div class="paragraph">
<p>To get started with Vault and this guide you need a
*NIX-like operating systems that provides:</p>
</div>
<div class="ulist">
<ul>
<li>
<p><code>wget</code>, <code>openssl</code> and <code>unzip</code></p>
</li>
<li>
<p>at least Java 7 and a properly configured <code>JAVA_HOME</code> environment variable</p>
</li>
</ul>
</div>
<div class="paragraph">
<p><strong>Install Vault</strong></p>
</div>
<div class="listingblock">
<div class="content">
<pre class="highlightjs highlight"><code class="language-bash hljs" data-lang="bash">$ src/test/bash/install_vault.sh</code></pre>
</div>
</div>
<div class="paragraph">
<p><strong>Create SSL certificates for Vault</strong></p>
</div>
<div class="listingblock">
<div class="content">
<pre class="highlightjs highlight"><code class="language-bash hljs" data-lang="bash">$ src/test/bash/create_certificates.sh</code></pre>
</div>
</div>
<div class="admonitionblock note">
<table>
<tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
<code>create_certificates.sh</code> creates certificates in <code>work/ca</code> and a JKS truststore <code>work/keystore.jks</code>. If you want to run Spring Cloud Vault using this quickstart guide you need to configure the truststore the <code>spring.cloud.vault.ssl.trust-store</code> property to <code>file:work/keystore.jks</code>.
</td>
</tr>
</table>
</div>
<div id="quickstart.vault.start" class="paragraph">
<p><strong>Start Vault server</strong></p>
</div>
<div class="listingblock">
<div class="content">
<pre class="highlightjs highlight"><code class="language-bash hljs" data-lang="bash">$ src/test/bash/local_run_vault.sh</code></pre>
</div>
</div>
<div class="paragraph">
<p>Vault is started listening on <code>0.0.0.0:8200</code> using the <code>inmem</code> storage and
<code>https</code>.
Vault is sealed and not initialized when starting up.</p>
</div>
<div class="admonitionblock note">
<table>
<tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
If you want to run tests, leave Vault uninitialized. The tests will
initialize Vault and create a root token <code>00000000-0000-0000-0000-000000000000</code>.
</td>
</tr>
</table>
</div>
<div class="paragraph">
<p>If you want to use Vault for your application or give it a try then you need to initialize it first.</p>
</div>
<div class="listingblock">
<div class="content">
<pre class="highlightjs highlight"><code class="language-bash hljs" data-lang="bash">$ export VAULT_ADDR="https://localhost:8200"
$ export VAULT_SKIP_VERIFY=true # Don't do this for production
$ vault init</code></pre>
</div>
</div>
<div class="paragraph">
<p>You should see something like:</p>
</div>
<div class="listingblock">
<div class="content">
<pre class="highlightjs highlight"><code class="language-bash hljs" data-lang="bash">Key 1: 7149c6a2e16b8833f6eb1e76df03e47f6113a3288b3093faf5033d44f0e70fe701
Key 2: 901c534c7988c18c20435a85213c683bdcf0efcd82e38e2893779f152978c18c02
Key 3: 03ff3948575b1165a20c20ee7c3e6edf04f4cdbe0e82dbff5be49c63f98bc03a03
Key 4: 216ae5cc3ddaf93ceb8e1d15bb9fc3176653f5b738f5f3d1ee00cd7dccbe926e04
Key 5: b2898fc8130929d569c1677ee69dc5f3be57d7c4b494a6062693ce0b1c4d93d805
Initial Root Token: 19aefa97-cccc-bbbb-aaaa-225940e63d76
Vault initialized with 5 keys and a key threshold of 3. Please
securely distribute the above keys. When the Vault is re-sealed,
restarted, or stopped, you must provide at least 3 of these keys
to unseal it again.
Vault does not store the master key. Without at least 3 keys,
your Vault will remain permanently sealed.</code></pre>
</div>
</div>
<div class="paragraph">
<p>Vault will initialize and return a set of unsealing keys and the root token.
Pick 3 keys and unseal Vault. Store the Vault token in the <code>VAULT_TOKEN</code>
environment variable.</p>
</div>
<div class="listingblock">
<div class="content">
<pre class="highlightjs highlight"><code class="language-bash hljs" data-lang="bash">$ vault unseal (Key 1)
$ vault unseal (Key 2)
$ vault unseal (Key 3)
$ export VAULT_TOKEN=(Root token)
# Required to run Spring Cloud Vault tests after manual initialization
$ vault token-create -id="00000000-0000-0000-0000-000000000000" -policy="root"</code></pre>
</div>
</div>
<div class="paragraph">
<p>Spring Cloud Vault accesses different resources. By default, the secret
backend is enabled which accesses secret config settings via JSON endpoints.</p>
</div>
<div class="paragraph">
<p>The HTTP service has resources in the form:</p>
</div>
<div class="listingblock">
<div class="content">
<pre>/secret/{application}/{profile}
/secret/{application}
/secret/{defaultContext}/{profile}
/secret/{defaultContext}</pre>
</div>
</div>
<div class="paragraph">
<p>where the "application" is injected as the <code>spring.application.name</code> in the
<code>SpringApplication</code> (i.e. what is normally "application" in a regular
Spring Boot app), "profile" is an active profile (or comma-separated
list of properties). Properties retrieved from Vault will be used "as-is"
without further prefixing of the property names.</p>
</div>
</div>
</div>
<div class="sect1">
<h2 id="_client_side_usage"><a class="link" href="#_client_side_usage">Client Side Usage</a></h2>
<div class="sectionbody">
<div class="paragraph">
<p>To use these features in an application, just build it as a Spring
Boot application that depends on <code>spring-cloud-vault-config</code> (e.g. see
the test cases). Example Maven configuration:</p>
</div>
<div class="exampleblock">
<div class="title">Example 1. pom.xml</div>
<div class="content">
<div class="listingblock">
<div class="content">
<pre class="highlightjs highlight"><code class="language-xml hljs" data-lang="xml">&lt;parent&gt;
&lt;groupId&gt;org.springframework.boot&lt;/groupId&gt;
&lt;artifactId&gt;spring-boot-starter-parent&lt;/artifactId&gt;
&lt;version&gt;2.0.0.RELEASE&lt;/version&gt;
&lt;relativePath /&gt; &lt;!-- lookup parent from repository --&gt;
&lt;/parent&gt;
&lt;dependencies&gt;
&lt;dependency&gt;
&lt;groupId&gt;org.springframework.cloud&lt;/groupId&gt;
&lt;artifactId&gt;spring-cloud-starter-vault-config&lt;/artifactId&gt;
&lt;version&gt;2.2.0.M2&lt;/version&gt;
&lt;/dependency&gt;
&lt;dependency&gt;
&lt;groupId&gt;org.springframework.boot&lt;/groupId&gt;
&lt;artifactId&gt;spring-boot-starter-test&lt;/artifactId&gt;
&lt;scope&gt;test&lt;/scope&gt;
&lt;/dependency&gt;
&lt;/dependencies&gt;
&lt;build&gt;
&lt;plugins&gt;
&lt;plugin&gt;
&lt;groupId&gt;org.springframework.boot&lt;/groupId&gt;
&lt;artifactId&gt;spring-boot-maven-plugin&lt;/artifactId&gt;
&lt;/plugin&gt;
&lt;/plugins&gt;
&lt;/build&gt;
&lt;!-- repositories also needed for snapshots and milestones --&gt;</code></pre>
</div>
</div>
</div>
</div>
<div class="paragraph">
<p>Then you can create a standard Spring Boot application, like this simple HTTP server:</p>
</div>
<div class="exampleblock">
<div class="content">
<div class="listingblock">
<div class="content">
<pre class="highlightjs highlight"><code class="language-java hljs" data-lang="java">@SpringBootApplication
@RestController
public class Application {
@RequestMapping("/")
public String home() {
return "Hello World!";
}
public static void main(String[] args) {
SpringApplication.run(Application.class, args);
}
}</code></pre>
</div>
</div>
</div>
</div>
<div class="paragraph">
<p>When it runs it will pick up the external configuration from the
default local Vault server on port <code>8200</code> if it is running. To modify
the startup behavior you can change the location of the Vault server
using <code>bootstrap.properties</code> (like <code>application.properties</code> but for
the bootstrap phase of an application context), e.g.</p>
</div>
<div class="exampleblock">
<div class="title">Example 2. bootstrap.yml</div>
<div class="content">
<div class="listingblock">
<div class="content">
<pre class="highlightjs highlight"><code class="language-yaml hljs" data-lang="yaml">spring.cloud.vault:
host: localhost
port: 8200
scheme: https
uri: https://localhost:8200
connection-timeout: 5000
read-timeout: 15000
config:
order: -10</code></pre>
</div>
</div>
</div>
</div>
<div class="ulist">
<ul>
<li>
<p><code>host</code> sets the hostname of the Vault host. The host name will be used
for SSL certificate validation</p>
</li>
<li>
<p><code>port</code> sets the Vault port</p>
</li>
<li>
<p><code>scheme</code> setting the scheme to <code>http</code> will use plain HTTP.
Supported schemes are <code>http</code> and <code>https</code>.</p>
</li>
<li>
<p><code>uri</code> configure the Vault endpoint with an URI. Takes precedence over host/port/scheme configuration</p>
</li>
<li>
<p><code>connection-timeout</code> sets the connection timeout in milliseconds</p>
</li>
<li>
<p><code>read-timeout</code> sets the read timeout in milliseconds</p>
</li>
<li>
<p><code>config.order</code> sets the order for the property source</p>
</li>
</ul>
</div>
<div class="paragraph">
<p>Enabling further integrations requires additional dependencies and
configuration. Depending on how you have set up Vault you might need
additional configuration like
<a href="https://cloud.spring.io/spring-cloud-vault/spring-cloud-vault.html#vault.config.ssl">SSL</a> and
<a href="https://cloud.spring.io/spring-cloud-vault/spring-cloud-vault.html#vault.config.authentication">authentication</a>.</p>
</div>
<div class="paragraph">
<p>If the application imports the <code>spring-boot-starter-actuator</code> project, the
status of the vault server will be available via the <code>/health</code> endpoint.</p>
</div>
<div class="paragraph">
<p>The vault health indicator can be enabled or disabled through the property <code>management.health.vault.enabled</code> (default to <code>true</code>).</p>
</div>
<div class="sect2">
<h3 id="_authentication"><a class="link" href="#_authentication">Authentication</a></h3>
<div class="paragraph">
<p>Vault requires an <a href="https://www.vaultproject.io/docs/concepts/auth.html">authentication mechanism</a> to <a href="https://www.vaultproject.io/docs/concepts/tokens.html">authorize client requests</a>.</p>
</div>
<div class="paragraph">
<p>Spring Cloud Vault supports multiple <a href="https://cloud.spring.io/spring-cloud-vault/spring-cloud-vault.html#vault.config.authentication">authentication mechanisms</a> to authenticate applications with Vault.</p>
</div>
<div class="paragraph">
<p>For a quickstart, use the root token printed by the <a href="#quickstart.vault.start">Vault initialization</a>.</p>
</div>
<div class="exampleblock">
<div class="title">Example 3. bootstrap.yml</div>
<div class="content">
<div class="listingblock">
<div class="content">
<pre class="highlightjs highlight"><code class="language-yaml hljs" data-lang="yaml">spring.cloud.vault:
token: 19aefa97-cccc-bbbb-aaaa-225940e63d76</code></pre>
</div>
</div>
</div>
</div>
<div class="admonitionblock warning">
<table>
<tr>
<td class="icon">
<i class="fa icon-warning" title="Warning"></i>
</td>
<td class="content">
Consider carefully your security requirements. Static token authentication is fine if you want quickly get started with Vault, but a static token is not protected any further. Any disclosure to unintended parties allows Vault use with the associated token roles.
</td>
</tr>
</table>
</div>
</div>
</div>
</div>
<div class="sect1">
<h2 id="vault.config.authentication"><a class="link" href="#vault.config.authentication">Authentication methods</a></h2>
<div class="sectionbody">
<div class="paragraph">
<p>Different organizations have different requirements for security
and authentication. Vault reflects that need by shipping multiple authentication
methods. Spring Cloud Vault supports token and AppId authentication.</p>
</div>
<div class="sect2">
<h3 id="vault.config.authentication.token"><a class="link" href="#vault.config.authentication.token">Token authentication</a></h3>
<div class="paragraph">
<p>Tokens are the core method for authentication within Vault.
Token authentication requires a static token to be provided using the
<a href="https://github.com/spring-cloud/spring-cloud-commons/blob/master/docs/src/main/asciidoc/spring-cloud-commons.adoc#the-bootstrap-application-context">Bootstrap Application Context</a>.</p>
</div>
<div class="admonitionblock note">
<table>
<tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
Token authentication is the default authentication method.
If a token is disclosed an unintended party gains access to Vault and
can access secrets for the intended client.
</td>
</tr>
</table>
</div>
<div class="exampleblock">
<div class="title">Example 4. bootstrap.yml</div>
<div class="content">
<div class="listingblock">
<div class="content">
<pre class="highlightjs highlight"><code class="language-yaml hljs" data-lang="yaml">spring.cloud.vault:
authentication: TOKEN
token: 00000000-0000-0000-0000-000000000000</code></pre>
</div>
</div>
</div>
</div>
<div class="ulist">
<ul>
<li>
<p><code>authentication</code> setting this value to <code>TOKEN</code> selects the Token
authentication method</p>
</li>
<li>
<p><code>token</code> sets the static token to use</p>
</li>
</ul>
</div>
<div class="paragraph">
<p>See also: <a href="https://www.vaultproject.io/docs/concepts/tokens.html">Vault Documentation: Tokens</a></p>
</div>
</div>
<div class="sect2">
<h3 id="vault.config.authentication.appid"><a class="link" href="#vault.config.authentication.appid">AppId authentication</a></h3>
<div class="paragraph">
<p>Vault supports <a href="https://www.vaultproject.io/docs/auth/app-id.html">AppId</a>
authentication that consists of two hard to guess tokens. The AppId
defaults to <code>spring.application.name</code> that is statically configured.
The second token is the UserId which is a part determined by the application,
usually related to the runtime environment. IP address, Mac address or a
Docker container name are good examples. Spring Cloud Vault Config supports
IP address, Mac address and static UserId&#8217;s (e.g. supplied via System properties).
The IP and Mac address are represented as Hex-encoded SHA256 hash.</p>
</div>
<div class="paragraph">
<p>IP address-based UserId&#8217;s use the local host&#8217;s IP address.</p>
</div>
<div class="exampleblock">
<div class="title">Example 5. bootstrap.yml using SHA256 IP-Address UserId&#8217;s</div>
<div class="content">
<div class="listingblock">
<div class="content">
<pre class="highlightjs highlight"><code class="language-yaml hljs" data-lang="yaml">spring.cloud.vault:
authentication: APPID
app-id:
user-id: IP_ADDRESS</code></pre>
</div>
</div>
</div>
</div>
<div class="ulist">
<ul>
<li>
<p><code>authentication</code> setting this value to <code>APPID</code> selects the AppId
authentication method</p>
</li>
<li>
<p><code>app-id-path</code> sets the path of the AppId mount to use</p>
</li>
<li>
<p><code>user-id</code> sets the UserId method. Possible values are <code>IP_ADDRESS</code>,
<code>MAC_ADDRESS</code> or a class name implementing a custom <code>AppIdUserIdMechanism</code></p>
</li>
</ul>
</div>
<div class="paragraph">
<p>The corresponding command to generate the IP address UserId from a command line is:</p>
</div>
<div class="listingblock">
<div class="content">
<pre>$ echo -n 192.168.99.1 | sha256sum</pre>
</div>
</div>
<div class="admonitionblock note">
<table>
<tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
Including the line break of <code>echo</code> leads to a different hash value
so make sure to include the <code>-n</code> flag.
</td>
</tr>
</table>
</div>
<div class="paragraph">
<p>Mac address-based UserId&#8217;s obtain their network device from the
localhost-bound device. The configuration also allows specifying
a <code>network-interface</code> hint to pick the right device. The value of
<code>network-interface</code> is optional and can be either an interface
name or interface index (0-based).</p>
</div>
<div class="exampleblock">
<div class="title">Example 6. bootstrap.yml using SHA256 Mac-Address UserId&#8217;s</div>
<div class="content">
<div class="listingblock">
<div class="content">
<pre class="highlightjs highlight"><code class="language-yaml hljs" data-lang="yaml">spring.cloud.vault:
authentication: APPID
app-id:
user-id: MAC_ADDRESS
network-interface: eth0</code></pre>
</div>
</div>
</div>
</div>
<div class="ulist">
<ul>
<li>
<p><code>network-interface</code> sets network interface to obtain the physical address</p>
</li>
</ul>
</div>
<div class="paragraph">
<p>The corresponding command to generate the IP address UserId from a command line is:</p>
</div>
<div class="listingblock">
<div class="content">
<pre>$ echo -n 0AFEDE1234AC | sha256sum</pre>
</div>
</div>
<div class="admonitionblock note">
<table>
<tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
The Mac address is specified uppercase and without colons.
Including the line break of <code>echo</code> leads to a different hash value
so make sure to include the <code>-n</code> flag.
</td>
</tr>
</table>
</div>
<div class="sect3">
<h4 id="_custom_userid"><a class="link" href="#_custom_userid">Custom UserId</a></h4>
<div class="paragraph">
<p>The UserId generation is an open mechanism. You can set
<code>spring.cloud.vault.app-id.user-id</code> to any string and the configured
value will be used as static UserId.</p>
</div>
<div class="paragraph">
<p>A more advanced approach lets you set <code>spring.cloud.vault.app-id.user-id</code> to a
classname. This class must be on your classpath and must implement
the <code>org.springframework.cloud.vault.AppIdUserIdMechanism</code> interface
and the <code>createUserId</code> method. Spring Cloud Vault will obtain the UserId
by calling <code>createUserId</code> each time it authenticates using AppId to
obtain a token.</p>
</div>
<div class="exampleblock">
<div class="title">Example 7. bootstrap.yml</div>
<div class="content">
<div class="listingblock">
<div class="content">
<pre class="highlightjs highlight"><code class="language-yaml hljs" data-lang="yaml">spring.cloud.vault:
authentication: APPID
app-id:
user-id: com.examlple.MyUserIdMechanism</code></pre>
</div>
</div>
</div>
</div>
<div class="exampleblock">
<div class="title">Example 8. MyUserIdMechanism.java</div>
<div class="content">
<div class="listingblock">
<div class="content">
<pre class="highlightjs highlight"><code class="language-yaml hljs" data-lang="yaml">public class MyUserIdMechanism implements AppIdUserIdMechanism {
@Override
public String createUserId() {
String userId = ...
return userId;
}
}</code></pre>
</div>
</div>
</div>
</div>
<div class="paragraph">
<p>See also: <a href="https://www.vaultproject.io/docs/auth/app-id.html">Vault Documentation: Using the App ID auth backend</a></p>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_approle_authentication"><a class="link" href="#_approle_authentication">AppRole authentication</a></h3>
<div class="paragraph">
<p><a href="https://www.vaultproject.io/docs/auth/app-id.html">AppRole</a> is intended for machine
authentication, like the deprecated (since Vault 0.6.1) <a href="#vault.config.authentication.appid">AppId authentication</a>.
AppRole authentication consists of two hard to guess (secret) tokens: RoleId and SecretId.</p>
</div>
<div class="paragraph">
<p>Spring Vault supports various AppRole scenarios (push/pull mode and wrapped).</p>
</div>
<div class="paragraph">
<p>RoleId and optionally SecretId must be provided by configuration,
Spring Vault will not look up these or create a custom SecretId.</p>
</div>
<div class="exampleblock">
<div class="title">Example 9. bootstrap.yml with AppRole authentication properties</div>
<div class="content">
<div class="listingblock">
<div class="content">
<pre class="highlightjs highlight"><code class="language-yaml hljs" data-lang="yaml">spring.cloud.vault:
authentication: APPROLE
app-role:
role-id: bde2076b-cccb-3cf0-d57e-bca7b1e83a52</code></pre>
</div>
</div>
</div>
</div>
<div class="paragraph">
<p>The following scenarios are supported along the required configuration details:</p>
</div>
<table class="tableblock frame-all grid-all stretch">
<caption class="title">Table 1. Configuration</caption>
<colgroup>
<col style="width: 20%;">
<col style="width: 20%;">
<col style="width: 20%;">
<col style="width: 20%;">
<col style="width: 20%;">
</colgroup>
<tbody>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock"><strong>Method</strong></p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock"><strong>RoleId</strong></p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock"><strong>SecretId</strong></p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock"><strong>RoleName</strong></p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock"><strong>Token</strong></p></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">Provided RoleId/SecretId</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">Provided</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">Provided</p></td>
<td class="tableblock halign-left valign-top"></td>
<td class="tableblock halign-left valign-top"></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">Provided RoleId without SecretId</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">Provided</p></td>
<td class="tableblock halign-left valign-top"></td>
<td class="tableblock halign-left valign-top"></td>
<td class="tableblock halign-left valign-top"></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">Provided RoleId, Pull SecretId</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">Provided</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">Provided</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">Provided</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">Provided</p></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">Pull RoleId, provided SecretId</p></td>
<td class="tableblock halign-left valign-top"></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">Provided</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">Provided</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">Provided</p></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">Full Pull Mode</p></td>
<td class="tableblock halign-left valign-top"></td>
<td class="tableblock halign-left valign-top"></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">Provided</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">Provided</p></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">Wrapped</p></td>
<td class="tableblock halign-left valign-top"></td>
<td class="tableblock halign-left valign-top"></td>
<td class="tableblock halign-left valign-top"></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">Provided</p></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">Wrapped RoleId, provided SecretId</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">Provided</p></td>
<td class="tableblock halign-left valign-top"></td>
<td class="tableblock halign-left valign-top"></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">Provided</p></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">Provided RoleId, wrapped SecretId</p></td>
<td class="tableblock halign-left valign-top"></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">Provided</p></td>
<td class="tableblock halign-left valign-top"></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">Provided</p></td>
</tr>
</tbody>
</table>
<table class="tableblock frame-all grid-all stretch">
<caption class="title">Table 2. Pull/Push/Wrapped Matrix</caption>
<colgroup>
<col style="width: 33.3333%;">
<col style="width: 33.3333%;">
<col style="width: 33.3334%;">
</colgroup>
<tbody>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock"><strong>RoleId</strong></p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock"><strong>SecretId</strong></p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock"><strong>Supported</strong></p></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">Provided</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">Provided</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">✅</p></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">Provided</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">Pull</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">✅</p></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">Provided</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">Wrapped</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">✅</p></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">Provided</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">Absent</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">✅</p></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">Pull</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">Provided</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">✅</p></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">Pull</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">Pull</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">✅</p></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">Pull</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">Wrapped</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">❌</p></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">Pull</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">Absent</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">❌</p></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">Wrapped</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">Provided</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">✅</p></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">Wrapped</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">Pull</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">❌</p></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">Wrapped</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">Wrapped</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">✅</p></td>
</tr>
<tr>
<td class="tableblock halign-left valign-top"><p class="tableblock">Wrapped</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">Absent</p></td>
<td class="tableblock halign-left valign-top"><p class="tableblock">❌</p></td>
</tr>
</tbody>
</table>
<div class="admonitionblock note">
<table>
<tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
You can use still all combinations of push/pull/wrapped modes by providing a configured <code>AppRoleAuthentication</code> bean within the bootstrap context. Spring Cloud Vault cannot derive all possible AppRole combinations from the configuration properties.
</td>
</tr>
</table>
</div>
<div class="admonitionblock important">
<table>
<tr>
<td class="icon">
<i class="fa icon-important" title="Important"></i>
</td>
<td class="content">
AppRole authentication is limited to simple pull mode using reactive infrastructure. Full pull mode is not yet supported. Using Spring Cloud Vault with the Spring WebFlux stack enables Vault&#8217;s reactive auto-configuration which can be disabled by setting <code>spring.cloud.vault.reactive.enabled=false</code>.
</td>
</tr>
</table>
</div>
<div class="exampleblock">
<div class="title">Example 10. bootstrap.yml with all AppRole authentication properties</div>
<div class="content">
<div class="listingblock">
<div class="content">
<pre class="highlightjs highlight"><code class="language-yaml hljs" data-lang="yaml">spring.cloud.vault:
authentication: APPROLE
app-role:
role-id: bde2076b-cccb-3cf0-d57e-bca7b1e83a52
secret-id: 1696536f-1976-73b1-b241-0b4213908d39
role: my-role
app-role-path: approle</code></pre>
</div>
</div>
</div>
</div>
<div class="ulist">
<ul>
<li>
<p><code>role-id</code> sets the RoleId.</p>
</li>
<li>
<p><code>secret-id</code> sets the SecretId. SecretId can be omitted if AppRole is configured without requiring SecretId (See <code>bind_secret_id</code>).</p>
</li>
<li>
<p><code>role</code>: sets the AppRole name for pull mode.</p>
</li>
<li>
<p><code>app-role-path</code> sets the path of the approle authentication mount to use.</p>
</li>
</ul>
</div>
<div class="paragraph">
<p>See also: <a href="https://www.vaultproject.io/docs/auth/approle.html">Vault Documentation: Using the AppRole auth backend</a></p>
</div>
</div>
<div class="sect2">
<h3 id="vault.config.authentication.awsec2"><a class="link" href="#vault.config.authentication.awsec2">AWS-EC2 authentication</a></h3>
<div class="paragraph">
<p>The <a href="https://www.vaultproject.io/docs/auth/aws-ec2.html">aws-ec2</a>
auth backend provides a secure introduction mechanism
for AWS EC2 instances, allowing automated retrieval of a Vault
token. Unlike most Vault authentication backends, this backend
does not require first-deploying, or provisioning security-sensitive
credentials (tokens, username/password, client certificates, etc.).
Instead, it treats AWS as a Trusted Third Party and uses the
cryptographically signed dynamic metadata information that uniquely
represents each EC2 instance.</p>
</div>
<div class="exampleblock">
<div class="title">Example 11. bootstrap.yml using AWS-EC2 Authentication</div>
<div class="content">
<div class="listingblock">
<div class="content">
<pre class="highlightjs highlight"><code class="language-yaml hljs" data-lang="yaml">spring.cloud.vault:
authentication: AWS_EC2</code></pre>
</div>
</div>
</div>
</div>
<div class="paragraph">
<p>AWS-EC2 authentication enables nonce by default to follow
the Trust On First Use (TOFU) principle. Any unintended party that
gains access to the PKCS#7 identity metadata can authenticate
against Vault.</p>
</div>
<div class="paragraph">
<p>During the first login, Spring Cloud Vault generates a nonce
that is stored in the auth backend aside the instance Id.
Re-authentication requires the same nonce to be sent. Any other
party does not have the nonce and can raise an alert in Vault for
further investigation.</p>
</div>
<div class="paragraph">
<p>The nonce is kept in memory and is lost during application restart.
You can configure a static nonce with <code>spring.cloud.vault.aws-ec2.nonce</code>.</p>
</div>
<div class="paragraph">
<p>AWS-EC2 authentication roles are optional and default to the AMI.
You can configure the authentication role by setting the
<code>spring.cloud.vault.aws-ec2.role</code> property.</p>
</div>
<div class="exampleblock">
<div class="title">Example 12. bootstrap.yml with configured role</div>
<div class="content">
<div class="listingblock">
<div class="content">
<pre class="highlightjs highlight"><code class="language-yaml hljs" data-lang="yaml">spring.cloud.vault:
authentication: AWS_EC2
aws-ec2:
role: application-server</code></pre>
</div>
</div>
</div>
</div>
<div class="exampleblock">
<div class="title">Example 13. bootstrap.yml with all AWS EC2 authentication properties</div>
<div class="content">
<div class="listingblock">
<div class="content">
<pre class="highlightjs highlight"><code class="language-yaml hljs" data-lang="yaml">spring.cloud.vault:
authentication: AWS_EC2
aws-ec2:
role: application-server
aws-ec2-path: aws-ec2
identity-document: http://...
nonce: my-static-nonce</code></pre>
</div>
</div>
</div>
</div>
<div class="ulist">
<ul>
<li>
<p><code>authentication</code> setting this value to <code>AWS_EC2</code> selects the AWS EC2
authentication method</p>
</li>
<li>
<p><code>role</code> sets the name of the role against which the login is being attempted.</p>
</li>
<li>
<p><code>aws-ec2-path</code> sets the path of the AWS EC2 mount to use</p>
</li>
<li>
<p><code>identity-document</code> sets URL of the PKCS#7 AWS EC2 identity document</p>
</li>
<li>
<p><code>nonce</code> used for AWS-EC2 authentication. An empty nonce defaults to nonce generation</p>
</li>
</ul>
</div>
<div class="paragraph">
<p>See also: <a href="https://www.vaultproject.io/docs/auth/aws.html">Vault Documentation: Using the aws auth backend</a></p>
</div>
</div>
<div class="sect2">
<h3 id="vault.config.authentication.awsiam"><a class="link" href="#vault.config.authentication.awsiam">AWS-IAM authentication</a></h3>
<div class="paragraph">
<p>The <a href="https://www.vaultproject.io/docs/auth/aws-ec2.html">aws</a> backend provides a secure
authentication mechanism for AWS IAM roles, allowing the automatic authentication with
vault based on the current IAM role of the running application.
Unlike most Vault authentication backends, this backend
does not require first-deploying, or provisioning security-sensitive
credentials (tokens, username/password, client certificates, etc.).
Instead, it treats AWS as a Trusted Third Party and uses the
4 pieces of information signed by the caller with their IAM credentials
to verify that the caller is indeed using that IAM role.</p>
</div>
<div class="paragraph">
<p>The current IAM role the application is running in is automatically calculated.
If you are running your application on AWS ECS then the application
will use the IAM role assigned to the ECS task of the running container.
If you are running your application naked on top of an EC2 instance then
the IAM role used will be the one assigned to the EC2 instance.</p>
</div>
<div class="paragraph">
<p>When using the AWS-IAM authentication you must create a role in Vault
and assign it to your IAM role. An empty <code>role</code> defaults to
the friendly name the current IAM role.</p>
</div>
<div class="exampleblock">
<div class="title">Example 14. bootstrap.yml with required AWS-IAM Authentication properties</div>
<div class="content">
<div class="listingblock">
<div class="content">
<pre class="highlightjs highlight"><code class="language-yaml hljs" data-lang="yaml">spring.cloud.vault:
authentication: AWS_IAM</code></pre>
</div>
</div>
</div>
</div>
<div class="exampleblock">
<div class="title">Example 15. bootstrap.yml with all AWS-IAM Authentication properties</div>
<div class="content">
<div class="listingblock">
<div class="content">
<pre class="highlightjs highlight"><code class="language-yaml hljs" data-lang="yaml">spring.cloud.vault:
authentication: AWS_IAM
aws-iam:
role: my-dev-role
aws-path: aws
server-id: some.server.name
endpoint-uri: https://sts.eu-central-1.amazonaws.com</code></pre>
</div>
</div>
</div>
</div>
<div class="ulist">
<ul>
<li>
<p><code>role</code> sets the name of the role against which the login is being attempted. This should be bound to your IAM role. If one is not supplied then the friendly name of the current IAM user will be used as the vault role.</p>
</li>
<li>
<p><code>aws-path</code> sets the path of the AWS mount to use</p>
</li>
<li>
<p><code>server-id</code> sets the value to use for the <code>X-Vault-AWS-IAM-Server-ID</code> header preventing certain types of replay attacks.</p>
</li>
<li>
<p><code>endpoint-uri</code> sets the value to use for the AWS STS API used for the <code>iam_request_url</code> parameter.</p>
</li>
</ul>
</div>
<div class="paragraph">
<p>AWS-IAM requires the AWS Java SDK dependency (<code>com.amazonaws:aws-java-sdk-core</code>)
as the authentication implementation uses AWS SDK types for credentials and request signing.</p>
</div>
<div class="paragraph">
<p>See also: <a href="https://www.vaultproject.io/docs/auth/aws.html">Vault Documentation: Using the aws auth backend</a></p>
</div>
</div>
<div class="sect2">
<h3 id="vault.config.authentication.azuremsi"><a class="link" href="#vault.config.authentication.azuremsi">Azure MSI authentication</a></h3>
<div class="paragraph">
<p>The <a href="https://www.vaultproject.io/docs/auth/azure.html">azure</a>
auth backend provides a secure introduction mechanism
for Azure VM instances, allowing automated retrieval of a Vault
token. Unlike most Vault authentication backends, this backend
does not require first-deploying, or provisioning security-sensitive
credentials (tokens, username/password, client certificates, etc.).
Instead, it treats Azure as a Trusted Third Party and uses the
managed service identity and instance metadata information that can be
bound to a VM instance.</p>
</div>
<div class="exampleblock">
<div class="title">Example 16. bootstrap.yml with required Azure Authentication properties</div>
<div class="content">
<div class="listingblock">
<div class="content">
<pre class="highlightjs highlight"><code class="language-yaml hljs" data-lang="yaml">spring.cloud.vault:
authentication: AZURE_MSI
azure-msi:
role: my-dev-role</code></pre>
</div>
</div>
</div>
</div>
<div class="exampleblock">
<div class="title">Example 17. bootstrap.yml with all Azure Authentication properties</div>
<div class="content">
<div class="listingblock">
<div class="content">
<pre class="highlightjs highlight"><code class="language-yaml hljs" data-lang="yaml">spring.cloud.vault:
authentication: AZURE_MSI
azure-msi:
role: my-dev-role
azure-path: aws</code></pre>
</div>
</div>
</div>
</div>
<div class="ulist">
<ul>
<li>
<p><code>role</code> sets the name of the role against which the login is being attempted.</p>
</li>
<li>
<p><code>azure-path</code> sets the path of the Azure mount to use</p>
</li>
</ul>
</div>
<div class="paragraph">
<p>Azure MSI authentication fetches environmental details about the virtual machine
(subscription Id, resource group, VM name) from the instance metadata service.</p>
</div>
<div class="paragraph">
<p>See also: <a href="https://www.vaultproject.io/docs/auth/azure.html">Vault Documentation: Using the azure auth backend</a></p>
</div>
</div>
<div class="sect2">
<h3 id="vault.config.authentication.clientcert"><a class="link" href="#vault.config.authentication.clientcert">TLS certificate authentication</a></h3>
<div class="paragraph">
<p>The <code>cert</code> auth backend allows authentication using SSL/TLS client
certificates that are either signed by a CA or self-signed.</p>
</div>
<div class="paragraph">
<p>To enable <code>cert</code> authentication you need to:</p>
</div>
<div class="olist arabic">
<ol class="arabic">
<li>
<p>Use SSL, see <a href="#vault.config.ssl">Vault Client SSL configuration</a></p>
</li>
<li>
<p>Configure a Java <code>Keystore</code> that contains the client
certificate and the private key</p>
</li>
<li>
<p>Set the <code>spring.cloud.vault.authentication</code> to <code>CERT</code></p>
</li>
</ol>
</div>
<div class="exampleblock">
<div class="title">Example 18. bootstrap.yml</div>
<div class="content">
<div class="listingblock">
<div class="content">
<pre class="highlightjs highlight"><code class="language-yaml hljs" data-lang="yaml">spring.cloud.vault:
authentication: CERT
ssl:
key-store: classpath:keystore.jks
key-store-password: changeit
cert-auth-path: cert</code></pre>
</div>
</div>
</div>
</div>
<div class="paragraph">
<p>See also: <a href="https://www.vaultproject.io/docs/auth/cert.html">Vault Documentation: Using the Cert auth backend</a></p>
</div>
</div>
<div class="sect2">
<h3 id="vault.config.authentication.cubbyhole"><a class="link" href="#vault.config.authentication.cubbyhole">Cubbyhole authentication</a></h3>
<div class="paragraph">
<p>Cubbyhole authentication uses Vault primitives to provide a secured authentication
workflow. Cubbyhole authentication uses tokens as primary login method.
An ephemeral token is used to obtain a second, login VaultToken from Vault&#8217;s
Cubbyhole secret backend. The login token is usually longer-lived and used to
interact with Vault. The login token will be retrieved from a wrapped
response stored at <code>/cubbyhole/response</code>.</p>
</div>
<div class="paragraph">
<p><strong>Creating a wrapped token</strong></p>
</div>
<div class="admonitionblock note">
<table>
<tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
Response Wrapping for token creation requires Vault 0.6.0 or higher.
</td>
</tr>
</table>
</div>
<div class="exampleblock">
<div class="title">Example 19. Creating and storing tokens</div>
<div class="content">
<div class="listingblock">
<div class="content">
<pre class="highlightjs highlight"><code class="language-shell hljs" data-lang="shell">$ vault token-create -wrap-ttl="10m"
Key Value
--- -----
wrapping_token: 397ccb93-ff6c-b17b-9389-380b01ca2645
wrapping_token_ttl: 0h10m0s
wrapping_token_creation_time: 2016-09-18 20:29:48.652957077 +0200 CEST
wrapped_accessor: 46b6aebb-187f-932a-26d7-4f3d86a68319</code></pre>
</div>
</div>
</div>
</div>
<div class="exampleblock">
<div class="title">Example 20. bootstrap.yml</div>
<div class="content">
<div class="listingblock">
<div class="content">
<pre class="highlightjs highlight"><code class="language-yaml hljs" data-lang="yaml">spring.cloud.vault:
authentication: CUBBYHOLE
token: 397ccb93-ff6c-b17b-9389-380b01ca2645</code></pre>
</div>
</div>
</div>
</div>
<div class="paragraph">
<p>See also:</p>
</div>
<div class="ulist">
<ul>
<li>
<p><a href="https://www.vaultproject.io/docs/concepts/tokens.html">Vault Documentation: Tokens</a></p>
</li>
<li>
<p><a href="https://www.vaultproject.io/docs/secrets/cubbyhole/index.html">Vault Documentation: Cubbyhole Secret Backend</a></p>
</li>
<li>
<p><a href="https://www.vaultproject.io/docs/concepts/response-wrapping.html">Vault Documentation: Response Wrapping</a></p>
</li>
</ul>
</div>
</div>
<div class="sect2">
<h3 id="vault.config.authentication.gcpgce"><a class="link" href="#vault.config.authentication.gcpgce">GCP-GCE authentication</a></h3>
<div class="paragraph">
<p>The <a href="https://www.vaultproject.io/docs/auth/gcp.html">gcp</a>
auth backend allows Vault login by using existing GCP (Google Cloud Platform) IAM and GCE credentials.</p>
</div>
<div class="paragraph">
<p>GCP GCE (Google Compute Engine) authentication creates a signature in the form of a
JSON Web Token (JWT) for a service account. A JWT for a Compute Engine instance
is obtained from the GCE metadata service using <a href="https://cloud.google.com/compute/docs/instances/verifying-instance-identity">Instance identification</a>.
This API creates a JSON Web Token that can be used to confirm the instance identity.</p>
</div>
<div class="paragraph">
<p>Unlike most Vault authentication backends, this backend
does not require first-deploying, or provisioning security-sensitive
credentials (tokens, username/password, client certificates, etc.).
Instead, it treats GCP as a Trusted Third Party and uses the
cryptographically signed dynamic metadata information that uniquely
represents each GCP service account.</p>
</div>
<div class="exampleblock">
<div class="title">Example 21. bootstrap.yml with required GCP-GCE Authentication properties</div>
<div class="content">
<div class="listingblock">
<div class="content">
<pre class="highlightjs highlight"><code class="language-yaml hljs" data-lang="yaml">spring.cloud.vault:
authentication: GCP_GCE
gcp-gce:
role: my-dev-role</code></pre>
</div>
</div>
</div>
</div>
<div class="exampleblock">
<div class="title">Example 22. bootstrap.yml with all GCP-GCE Authentication properties</div>
<div class="content">
<div class="listingblock">
<div class="content">
<pre class="highlightjs highlight"><code class="language-yaml hljs" data-lang="yaml">spring.cloud.vault:
authentication: GCP_GCE
gcp-gce:
gcp-path: gcp
role: my-dev-role
service-account: my-service@projectid.iam.gserviceaccount.com</code></pre>
</div>
</div>
</div>
</div>
<div class="ulist">
<ul>
<li>
<p><code>role</code> sets the name of the role against which the login is being attempted.</p>
</li>
<li>
<p><code>gcp-path</code> sets the path of the GCP mount to use</p>
</li>
<li>
<p><code>service-account</code> allows overriding the service account Id to a specific value. Defaults to the <code>default</code> service account.</p>
</li>
</ul>
</div>
<div class="paragraph">
<p>See also:</p>
</div>
<div class="ulist">
<ul>
<li>
<p><a href="https://www.vaultproject.io/docs/auth/gcp.html">Vault Documentation: Using the GCP auth backend</a></p>
</li>
<li>
<p><a href="https://cloud.google.com/compute/docs/instances/verifying-instance-identity">GCP Documentation: Verifying the Identity of Instances</a></p>
</li>
</ul>
</div>
</div>
<div class="sect2">
<h3 id="vault.config.authentication.gcpiam"><a class="link" href="#vault.config.authentication.gcpiam">GCP-IAM authentication</a></h3>
<div class="paragraph">
<p>The <a href="https://www.vaultproject.io/docs/auth/gcp.html">gcp</a>
auth backend allows Vault login by using existing GCP (Google Cloud Platform) IAM and GCE credentials.</p>
</div>
<div class="paragraph">
<p>GCP IAM authentication creates a signature in the form of a JSON Web Token (JWT)
for a service account. A JWT for a service account is obtained by
calling GCP IAM&#8217;s <a href="https://cloud.google.com/iam/reference/rest/v1/projects.serviceAccounts/signJwt"><code>projects.serviceAccounts.signJwt</code></a> API. The caller authenticates against GCP IAM
and proves thereby its identity. This Vault backend treats GCP as a Trusted Third Party.</p>
</div>
<div class="paragraph">
<p>IAM credentials can be obtained from either the runtime environment
, specifically the <a href="https://cloud.google.com/docs/authentication/production"><code>GOOGLE_APPLICATION_CREDENTIALS</code></a>
environment variable, the Google Compute metadata service,
or supplied externally as e.g. JSON or base64 encoded.
JSON is the preferred form as it carries the project id and
service account identifier required for calling <code>projects.serviceAccounts.signJwt</code>.</p>
</div>
<div class="exampleblock">
<div class="title">Example 23. bootstrap.yml with required GCP-IAM Authentication properties</div>
<div class="content">
<div class="listingblock">
<div class="content">
<pre class="highlightjs highlight"><code class="language-yaml hljs" data-lang="yaml">spring.cloud.vault:
authentication: GCP_IAM
gcp-iam:
role: my-dev-role</code></pre>
</div>
</div>
</div>
</div>
<div class="exampleblock">
<div class="title">Example 24. bootstrap.yml with all GCP-IAM Authentication properties</div>
<div class="content">
<div class="listingblock">
<div class="content">
<pre class="highlightjs highlight"><code class="language-yaml hljs" data-lang="yaml">spring.cloud.vault:
authentication: GCP_IAM
gcp-iam:
credentials:
location: classpath:credentials.json
encoded-key: e+KApn0=
gcp-path: gcp
jwt-validity: 15m
project-id: my-project-id
role: my-dev-role
service-account: my-service@projectid.iam.gserviceaccount.com</code></pre>
</div>
</div>
</div>
</div>
<div class="ulist">
<ul>
<li>
<p><code>role</code> sets the name of the role against which the login is being attempted.</p>
</li>
<li>
<p><code>credentials.location</code> path to the credentials resource that contains Google credentials in JSON format.</p>
</li>
<li>
<p><code>credentials.encoded-key</code> the base64 encoded contents of an OAuth2 account private key in the JSON format.</p>
</li>
<li>
<p><code>gcp-path</code> sets the path of the GCP mount to use</p>
</li>
<li>
<p><code>jwt-validity</code> configures the JWT token validity. Defaults to 15 minutes.</p>
</li>
<li>
<p><code>project-id</code> allows overriding the project Id to a specific value. Defaults to the project Id from the obtained credential.</p>
</li>
<li>
<p><code>service-account</code> allows overriding the service account Id to a specific value. Defaults to the service account from the obtained credential.</p>
</li>
</ul>
</div>
<div class="paragraph">
<p>GCP IAM authentication requires the Google Cloud Java SDK dependency
(<code>com.google.apis:google-api-services-iam</code> and <code>com.google.auth:google-auth-library-oauth2-http</code>)
as the authentication implementation uses Google APIs for credentials and JWT signing.</p>
</div>
<div class="admonitionblock note">
<table>
<tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
Google credentials require an OAuth 2 token maintaining the token lifecycle. All API
is synchronous therefore, <code>GcpIamAuthentication</code> does not support <code>AuthenticationSteps</code> which is
required for reactive usage.
</td>
</tr>
</table>
</div>
<div class="paragraph">
<p>See also:</p>
</div>
<div class="ulist">
<ul>
<li>
<p><a href="https://www.vaultproject.io/docs/auth/gcp.html">Vault Documentation: Using the GCP auth backend</a></p>
</li>
<li>
<p><a href="https://cloud.google.com/iam/reference/rest/v1/projects.serviceAccounts/signJwt">GCP Documentation: projects.serviceAccounts.signJwt</a><a id="vault.authentication.gcpiam"></a></p>
</li>
</ul>
</div>
</div>
<div class="sect2">
<h3 id="vault.config.authentication.kubernetes"><a class="link" href="#vault.config.authentication.kubernetes">Kubernetes authentication</a></h3>
<div class="paragraph">
<p>Kubernetes authentication mechanism (since Vault 0.8.3) allows to authenticate with Vault using a Kubernetes Service Account Token.
The authentication is role based and the role is bound to a service account name and a namespace.</p>
</div>
<div class="paragraph">
<p>A file containing a JWT token for a pod’s service account is automatically mounted at <code>/var/run/secrets/kubernetes.io/serviceaccount/token</code>.</p>
</div>
<div class="exampleblock">
<div class="title">Example 25. bootstrap.yml with all Kubernetes authentication properties</div>
<div class="content">
<div class="listingblock">
<div class="content">
<pre class="highlightjs highlight"><code class="language-yaml hljs" data-lang="yaml">spring.cloud.vault:
authentication: KUBERNETES
kubernetes:
role: my-dev-role
kubernetes-path: kubernetes
service-account-token-file: /var/run/secrets/kubernetes.io/serviceaccount/token</code></pre>
</div>
</div>
</div>
</div>
<div class="ulist">
<ul>
<li>
<p><code>role</code> sets the Role.</p>
</li>
<li>
<p><code>kubernetes-path</code> sets the path of the Kubernetes mount to use.</p>
</li>
<li>
<p><code>service-account-token-file</code> sets the location of the file containing the Kubernetes Service Account Token. Defaults to <code>/var/run/secrets/kubernetes.io/serviceaccount/token</code>.</p>
</li>
</ul>
</div>
<div class="paragraph">
<p>See also:</p>
</div>
<div class="ulist">
<ul>
<li>
<p><a href="https://www.vaultproject.io/docs/auth/kubernetes.html">Vault Documentation: Kubernetes</a></p>
</li>
<li>
<p><a href="https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/">Kubernetes Documentation: Configure Service Accounts for Pods</a></p>
</li>
</ul>
</div>
</div>
</div>
</div>
<div class="sect1">
<h2 id="vault.config.backends"><a class="link" href="#vault.config.backends">Secret Backends</a></h2>
<div class="sectionbody">
<div class="sect2">
<h3 id="vault.config.backends.generic"><a class="link" href="#vault.config.backends.generic">Generic Backend</a></h3>
<div class="paragraph">
<p>Spring Cloud Vault supports at the basic level the generic secret
backend. The generic secret backend allows storage of arbitrary
values as key-value store. A single context can store one or many
key-value tuples. Contexts can be organized hierarchically.
Spring Cloud Vault allows using the Application name
and a default context name (<code>application</code>) in combination with active
profiles.</p>
</div>
<div class="listingblock">
<div class="content">
<pre>/secret/{application}/{profile}
/secret/{application}
/secret/{default-context}/{profile}
/secret/{default-context}</pre>
</div>
</div>
<div class="paragraph">
<p>The application name is determined by the properties:</p>
</div>
<div class="ulist">
<ul>
<li>
<p><code>spring.cloud.vault.generic.application-name</code></p>
</li>
<li>
<p><code>spring.cloud.vault.application-name</code></p>
</li>
<li>
<p><code>spring.application.name</code></p>
</li>
</ul>
</div>
<div class="paragraph">
<p>Secrets can be obtained from other contexts within the generic backend by adding their
paths to the application name, separated by commas. For example, given the application
name <code>usefulapp,mysql1,projectx/aws</code>, each of these folders will be used:</p>
</div>
<div class="ulist">
<ul>
<li>
<p><code>/secret/usefulapp</code></p>
</li>
<li>
<p><code>/secret/mysql1</code></p>
</li>
<li>
<p><code>/secret/projectx/aws</code></p>
</li>
</ul>
</div>
<div class="paragraph">
<p>Spring Cloud Vault adds all active profiles to the list of possible context paths.
No active profiles will skip accessing contexts with a profile name.</p>
</div>
<div class="paragraph">
<p>Properties are exposed like they are stored (i.e. without additional prefixes).</p>
</div>
<div class="exampleblock">
<div class="content">
<div class="listingblock">
<div class="content">
<pre class="highlightjs highlight"><code class="language-yaml hljs" data-lang="yaml">spring.cloud.vault:
generic:
enabled: true
backend: secret
profile-separator: '/'
default-context: application
application-name: my-app</code></pre>
</div>
</div>
</div>
</div>
<div class="ulist">
<ul>
<li>
<p><code>enabled</code> setting this value to <code>false</code> disables the secret backend
config usage</p>
</li>
<li>
<p><code>backend</code> sets the path of the secret mount to use</p>
</li>
<li>
<p><code>default-context</code> sets the context name used by all applications</p>
</li>
<li>
<p><code>application-name</code> overrides the application name for use in the generic backend</p>
</li>
<li>
<p><code>profile-separator</code> separates the profile name from the context in
property sources with profiles</p>
</li>
</ul>
</div>
<div class="admonitionblock note">
<table>
<tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
The key-value secret backend can be operated in versioned (v2) and non-versioned (v1) modes. Depending on the mode of operation, a different API is required to access secrets. Make sure to enable <code>generic</code> secret backend usage for non-versioned key-value backends and <code>kv</code> secret backend usage for versioned key-value backends.
</td>
</tr>
</table>
</div>
<div class="paragraph">
<p>See also: <a href="https://www.vaultproject.io/docs/secrets/kv/kv-v1.html">Vault Documentation: Using the KV Secrets Engine - Version 1 (generic secret backend)</a></p>
</div>
</div>
<div class="sect2">
<h3 id="vault.config.backends.kv.versioned"><a class="link" href="#vault.config.backends.kv.versioned">Versioned Key-Value Backend</a></h3>
<div class="paragraph">
<p>Spring Cloud Vault supports the versioned Key-Value secret
backend. The key-value backend allows storage of arbitrary
values as key-value store. A single context can store one or many
key-value tuples. Contexts can be organized hierarchically.
Spring Cloud Vault allows using the Application name
and a default context name (<code>application</code>) in combination with active
profiles.</p>
</div>
<div class="listingblock">
<div class="content">
<pre>/secret/{application}/{profile}
/secret/{application}
/secret/{default-context}/{profile}
/secret/{default-context}</pre>
</div>
</div>
<div class="paragraph">
<p>The application name is determined by the properties:</p>
</div>
<div class="ulist">
<ul>
<li>
<p><code>spring.cloud.vault.kv.application-name</code></p>
</li>
<li>
<p><code>spring.cloud.vault.application-name</code></p>
</li>
<li>
<p><code>spring.application.name</code></p>
</li>
</ul>
</div>
<div class="paragraph">
<p>Secrets can be obtained from other contexts within the key-value backend by adding their
paths to the application name, separated by commas. For example, given the application
name <code>usefulapp,mysql1,projectx/aws</code>, each of these folders will be used:</p>
</div>
<div class="ulist">
<ul>
<li>
<p><code>/secret/usefulapp</code></p>
</li>
<li>
<p><code>/secret/mysql1</code></p>
</li>
<li>
<p><code>/secret/projectx/aws</code></p>
</li>
</ul>
</div>
<div class="paragraph">
<p>Spring Cloud Vault adds all active profiles to the list of possible context paths.
No active profiles will skip accessing contexts with a profile name.</p>
</div>
<div class="paragraph">
<p>Properties are exposed like they are stored (i.e. without additional prefixes).</p>
</div>
<div class="admonitionblock note">
<table>
<tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
Spring Cloud Vault adds the <code>data/</code> context between the mount path and the actual context path.
</td>
</tr>
</table>
</div>
<div class="exampleblock">
<div class="content">
<div class="listingblock">
<div class="content">
<pre class="highlightjs highlight"><code class="language-yaml hljs" data-lang="yaml">spring.cloud.vault:
kv:
enabled: true
backend: secret
profile-separator: '/'
default-context: application
application-name: my-app</code></pre>
</div>
</div>
</div>
</div>
<div class="ulist">
<ul>
<li>
<p><code>enabled</code> setting this value to <code>false</code> disables the secret backend
config usage</p>
</li>
<li>
<p><code>backend</code> sets the path of the secret mount to use</p>
</li>
<li>
<p><code>default-context</code> sets the context name used by all applications</p>
</li>
<li>
<p><code>application-name</code> overrides the application name for use in the generic backend</p>
</li>
<li>
<p><code>profile-separator</code> separates the profile name from the context in
property sources with profiles</p>
</li>
</ul>
</div>
<div class="admonitionblock note">
<table>
<tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
The key-value secret backend can be operated in versioned (v2) and non-versioned (v1) modes. Depending on the mode of operation, a different API is required to access secrets. Make sure to enable <code>generic</code> secret backend usage for non-versioned key-value backends and <code>kv</code> secret backend usage for versioned key-value backends.
</td>
</tr>
</table>
</div>
<div class="paragraph">
<p>See also: <a href="https://www.vaultproject.io/docs/secrets/kv/kv-v2.html">Vault Documentation: Using the KV Secrets Engine - Version 2 (versioned key-value backend)</a></p>
</div>
</div>
<div class="sect2">
<h3 id="vault.config.backends.consul"><a class="link" href="#vault.config.backends.consul">Consul</a></h3>
<div class="paragraph">
<p>Spring Cloud Vault can obtain credentials for HashiCorp Consul.
The Consul integration requires the <code>spring-cloud-vault-config-consul</code>
dependency.</p>
</div>
<div class="exampleblock">
<div class="title">Example 26. pom.xml</div>
<div class="content">
<div class="listingblock">
<div class="content">
<pre class="highlightjs highlight"><code class="language-xml hljs" data-lang="xml">&lt;dependencies&gt;
&lt;dependency&gt;
&lt;groupId&gt;org.springframework.cloud&lt;/groupId&gt;
&lt;artifactId&gt;spring-cloud-vault-config-consul&lt;/artifactId&gt;
&lt;version&gt;2.2.0.M2&lt;/version&gt;
&lt;/dependency&gt;
&lt;/dependencies&gt;</code></pre>
</div>
</div>
</div>
</div>
<div class="paragraph">
<p>The integration can be enabled by setting
<code>spring.cloud.vault.consul.enabled=true</code> (default <code>false</code>) and
providing the role name with <code>spring.cloud.vault.consul.role=…</code>.</p>
</div>
<div class="paragraph">
<p>The obtained token is stored in <code>spring.cloud.consul.token</code>
so using Spring Cloud Consul can pick up the generated
credentials without further configuration. You can configure
the property name by setting <code>spring.cloud.vault.consul.token-property</code>.</p>
</div>
<div class="exampleblock">
<div class="content">
<div class="listingblock">
<div class="content">
<pre class="highlightjs highlight"><code class="language-yaml hljs" data-lang="yaml">spring.cloud.vault:
consul:
enabled: true
role: readonly
backend: consul
token-property: spring.cloud.consul.token</code></pre>
</div>
</div>
</div>
</div>
<div class="ulist">
<ul>
<li>
<p><code>enabled</code> setting this value to <code>true</code> enables the Consul backend config usage</p>
</li>
<li>
<p><code>role</code> sets the role name of the Consul role definition</p>
</li>
<li>
<p><code>backend</code> sets the path of the Consul mount to use</p>
</li>
<li>
<p><code>token-property</code> sets the property name in which the Consul ACL token is stored</p>
</li>
</ul>
</div>
<div class="paragraph">
<p>See also: <a href="https://www.vaultproject.io/docs/secrets/consul/index.html">Vault Documentation: Setting up Consul with Vault</a></p>
</div>
</div>
<div class="sect2">
<h3 id="vault.config.backends.rabbitmq"><a class="link" href="#vault.config.backends.rabbitmq">RabbitMQ</a></h3>
<div class="paragraph">
<p>Spring Cloud Vault can obtain credentials for RabbitMQ.</p>
</div>
<div class="paragraph">
<p>The RabbitMQ integration requires the <code>spring-cloud-vault-config-rabbitmq</code>
dependency.</p>
</div>
<div class="exampleblock">
<div class="title">Example 27. pom.xml</div>
<div class="content">
<div class="listingblock">
<div class="content">
<pre class="highlightjs highlight"><code class="language-xml hljs" data-lang="xml">&lt;dependencies&gt;
&lt;dependency&gt;
&lt;groupId&gt;org.springframework.cloud&lt;/groupId&gt;
&lt;artifactId&gt;spring-cloud-vault-config-rabbitmq&lt;/artifactId&gt;
&lt;version&gt;2.2.0.M2&lt;/version&gt;
&lt;/dependency&gt;
&lt;/dependencies&gt;</code></pre>
</div>
</div>
</div>
</div>
<div class="paragraph">
<p>The integration can be enabled by setting
<code>spring.cloud.vault.rabbitmq.enabled=true</code> (default <code>false</code>)
and providing the role name with <code>spring.cloud.vault.rabbitmq.role=…</code>.</p>
</div>
<div class="paragraph">
<p>Username and password are stored in <code>spring.rabbitmq.username</code>
and <code>spring.rabbitmq.password</code> so using Spring Boot will pick up the generated
credentials without further configuration. You can configure the property names
by setting <code>spring.cloud.vault.rabbitmq.username-property</code> and
<code>spring.cloud.vault.rabbitmq.password-property</code>.</p>
</div>
<div class="exampleblock">
<div class="content">
<div class="listingblock">
<div class="content">
<pre class="highlightjs highlight"><code class="language-yaml hljs" data-lang="yaml">spring.cloud.vault:
rabbitmq:
enabled: true
role: readonly
backend: rabbitmq
username-property: spring.rabbitmq.username
password-property: spring.rabbitmq.password</code></pre>
</div>
</div>
</div>
</div>
<div class="ulist">
<ul>
<li>
<p><code>enabled</code> setting this value to <code>true</code> enables the RabbitMQ backend config usage</p>
</li>
<li>
<p><code>role</code> sets the role name of the RabbitMQ role definition</p>
</li>
<li>
<p><code>backend</code> sets the path of the RabbitMQ mount to use</p>
</li>
<li>
<p><code>username-property</code> sets the property name in which the RabbitMQ username is stored</p>
</li>
<li>
<p><code>password-property</code> sets the property name in which the RabbitMQ password is stored</p>
</li>
</ul>
</div>
<div class="paragraph">
<p>See also: <a href="https://www.vaultproject.io/docs/secrets/rabbitmq/index.html">Vault Documentation: Setting up RabbitMQ with Vault</a></p>
</div>
</div>
<div class="sect2">
<h3 id="vault.config.backends.aws"><a class="link" href="#vault.config.backends.aws">AWS</a></h3>
<div class="paragraph">
<p>Spring Cloud Vault can obtain credentials for AWS.</p>
</div>
<div class="paragraph">
<p>The AWS integration requires the <code>spring-cloud-vault-config-aws</code>
dependency.</p>
</div>
<div class="exampleblock">
<div class="title">Example 28. pom.xml</div>
<div class="content">
<div class="listingblock">
<div class="content">
<pre class="highlightjs highlight"><code class="language-xml hljs" data-lang="xml">&lt;dependencies&gt;
&lt;dependency&gt;
&lt;groupId&gt;org.springframework.cloud&lt;/groupId&gt;
&lt;artifactId&gt;spring-cloud-vault-config-aws&lt;/artifactId&gt;
&lt;version&gt;2.2.0.M2&lt;/version&gt;
&lt;/dependency&gt;
&lt;/dependencies&gt;</code></pre>
</div>
</div>
</div>
</div>
<div class="paragraph">
<p>The integration can be enabled by setting
<code>spring.cloud.vault.aws=true</code> (default <code>false</code>)
and providing the role name with <code>spring.cloud.vault.aws.role=…</code>.</p>
</div>
<div class="paragraph">
<p>The access key and secret key are stored in <code>cloud.aws.credentials.accessKey</code>
and <code>cloud.aws.credentials.secretKey</code> so using Spring Cloud AWS will pick up the generated
credentials without further configuration. You can configure the property names
by setting <code>spring.cloud.vault.aws.access-key-property</code> and
<code>spring.cloud.vault.aws.secret-key-property</code>.</p>
</div>
<div class="exampleblock">
<div class="content">
<div class="listingblock">
<div class="content">
<pre class="highlightjs highlight"><code class="language-yaml hljs" data-lang="yaml">spring.cloud.vault:
aws:
enabled: true
role: readonly
backend: aws
access-key-property: cloud.aws.credentials.accessKey
secret-key-property: cloud.aws.credentials.secretKey</code></pre>
</div>
</div>
</div>
</div>
<div class="ulist">
<ul>
<li>
<p><code>enabled</code> setting this value to <code>true</code> enables the AWS backend config usage</p>
</li>
<li>
<p><code>role</code> sets the role name of the AWS role definition</p>
</li>
<li>
<p><code>backend</code> sets the path of the AWS mount to use</p>
</li>
<li>
<p><code>access-key-property</code> sets the property name in which the AWS access key is stored</p>
</li>
<li>
<p><code>secret-key-property</code> sets the property name in which the AWS secret key is stored</p>
</li>
</ul>
</div>
<div class="paragraph">
<p>See also: <a href="https://www.vaultproject.io/docs/secrets/aws/index.html">Vault Documentation: Setting up AWS with Vault</a></p>
</div>
</div>
</div>
</div>
<div class="sect1">
<h2 id="vault.config.backends.database-backends"><a class="link" href="#vault.config.backends.database-backends">Database backends</a></h2>
<div class="sectionbody">
<div class="paragraph">
<p>Vault supports several database secret backends to generate database
credentials dynamically based on configured roles. This means
services that need to access a database no longer need to configure
credentials: they can request them from Vault, and use Vault&#8217;s leasing
mechanism to more easily roll keys.</p>
</div>
<div class="paragraph">
<p>Spring Cloud Vault integrates with these backends:</p>
</div>
<div class="ulist">
<ul>
<li>
<p><a href="#vault.config.backends.database">Database</a></p>
</li>
<li>
<p><a href="#vault.config.backends.cassandra">Apache Cassandra</a></p>
</li>
<li>
<p><a href="#vault.config.backends.mongodb">MongoDB</a></p>
</li>
<li>
<p><a href="#vault.config.backends.mysql">MySQL</a></p>
</li>
<li>
<p><a href="#vault.config.backends.postgresql">PostgreSQL</a></p>
</li>
</ul>
</div>
<div class="paragraph">
<p>Using a database secret backend requires to enable the
backend in the configuration and the <code>spring-cloud-vault-config-databases</code>
dependency.</p>
</div>
<div class="paragraph">
<p>Vault ships since 0.7.1 with a dedicated <code>database</code> secret backend that allows
database integration via plugins. You can use that specific backend by using the
generic database backend. Make sure to specify the appropriate
backend path, e.g. <code>spring.cloud.vault.mysql.role.backend=database</code>.</p>
</div>
<div class="exampleblock">
<div class="title">Example 29. pom.xml</div>
<div class="content">
<div class="listingblock">
<div class="content">
<pre class="highlightjs highlight"><code class="language-xml hljs" data-lang="xml">&lt;dependencies&gt;
&lt;dependency&gt;
&lt;groupId&gt;org.springframework.cloud&lt;/groupId&gt;
&lt;artifactId&gt;spring-cloud-vault-config-databases&lt;/artifactId&gt;
&lt;version&gt;2.2.0.M2&lt;/version&gt;
&lt;/dependency&gt;
&lt;/dependencies&gt;</code></pre>
</div>
</div>
</div>
</div>
<div class="admonitionblock note">
<table>
<tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
Enabling multiple JDBC-compliant databases will generate credentials
and store them by default in the same property keys hence property names for
JDBC secrets need to be configured separately.
</td>
</tr>
</table>
</div>
<div class="sect2">
<h3 id="vault.config.backends.database"><a class="link" href="#vault.config.backends.database">Database</a></h3>
<div class="paragraph">
<p>Spring Cloud Vault can obtain credentials for any database listed at
<a href="https://www.vaultproject.io/api/secret/databases/index.html" class="bare">https://www.vaultproject.io/api/secret/databases/index.html</a>.
The integration can be enabled by setting
<code>spring.cloud.vault.database.enabled=true</code> (default <code>false</code>) and
providing the role name with <code>spring.cloud.vault.database.role=…</code>.</p>
</div>
<div class="paragraph">
<p>While the database backend is a generic one, <code>spring.cloud.vault.database</code>
specifically targets JDBC databases. Username and password are
stored in <code>spring.datasource.username</code> and <code>spring.datasource.password</code>
so using Spring Boot will pick up the generated credentials
for your <code>DataSource</code> without further configuration.
You can configure the property names by setting
<code>spring.cloud.vault.database.username-property</code> and
<code>spring.cloud.vault.database.password-property</code>.</p>
</div>
<div class="exampleblock">
<div class="content">
<div class="listingblock">
<div class="content">
<pre class="highlightjs highlight"><code class="language-yaml hljs" data-lang="yaml">spring.cloud.vault:
database:
enabled: true
role: readonly
backend: database
username-property: spring.datasource.username
password-property: spring.datasource.password</code></pre>
</div>
</div>
</div>
</div>
<div class="ulist">
<ul>
<li>
<p><code>enabled</code> setting this value to <code>true</code> enables the Database backend config usage</p>
</li>
<li>
<p><code>role</code> sets the role name of the Database role definition</p>
</li>
<li>
<p><code>backend</code> sets the path of the Database mount to use</p>
</li>
<li>
<p><code>username-property</code> sets the property name in which the Database username is stored</p>
</li>
<li>
<p><code>password-property</code> sets the property name in which the Database password is stored</p>
</li>
</ul>
</div>
<div class="paragraph">
<p>See also: <a href="https://www.vaultproject.io/docs/secrets/databases/index.html">Vault Documentation: Database Secrets backend</a></p>
</div>
<div class="admonitionblock warning">
<table>
<tr>
<td class="icon">
<i class="fa icon-warning" title="Warning"></i>
</td>
<td class="content">
Spring Cloud Vault does not support getting new credentials and
configuring your <code>DataSource</code> with them when the maximum lease time
has been reached. That is, if <code>max_ttl</code> of the Database role in Vault
is set to <code>24h</code> that means that 24 hours after your application has
started it can no longer authenticate with the database.
</td>
</tr>
</table>
</div>
</div>
<div class="sect2">
<h3 id="vault.config.backends.cassandra"><a class="link" href="#vault.config.backends.cassandra">Apache Cassandra</a></h3>
<div class="admonitionblock note">
<table>
<tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
The <code>cassandra</code> backend has been deprecated in Vault 0.7.1 and
it is recommended to use the <code>database</code> backend and mount it as <code>cassandra</code>.
</td>
</tr>
</table>
</div>
<div class="paragraph">
<p>Spring Cloud Vault can obtain credentials for Apache Cassandra.
The integration can be enabled by setting
<code>spring.cloud.vault.cassandra.enabled=true</code> (default <code>false</code>) and
providing the role name with <code>spring.cloud.vault.cassandra.role=…</code>.</p>
</div>
<div class="paragraph">
<p>Username and password are stored in <code>spring.data.cassandra.username</code>
and <code>spring.data.cassandra.password</code> so using Spring Boot will pick
up the generated credentials without further configuration.
You can configure the property names by setting
<code>spring.cloud.vault.cassandra.username-property</code> and
<code>spring.cloud.vault.cassandra.password-property</code>.</p>
</div>
<div class="exampleblock">
<div class="content">
<div class="listingblock">
<div class="content">
<pre class="highlightjs highlight"><code class="language-yaml hljs" data-lang="yaml">spring.cloud.vault:
cassandra:
enabled: true
role: readonly
backend: cassandra
username-property: spring.data.cassandra.username
password-property: spring.data.cassandra.password</code></pre>
</div>
</div>
</div>
</div>
<div class="ulist">
<ul>
<li>
<p><code>enabled</code> setting this value to <code>true</code> enables the Cassandra backend config usage</p>
</li>
<li>
<p><code>role</code> sets the role name of the Cassandra role definition</p>
</li>
<li>
<p><code>backend</code> sets the path of the Cassandra mount to use</p>
</li>
<li>
<p><code>username-property</code> sets the property name in which the Cassandra username is stored</p>
</li>
<li>
<p><code>password-property</code> sets the property name in which the Cassandra password is stored</p>
</li>
</ul>
</div>
<div class="paragraph">
<p>See also: <a href="https://www.vaultproject.io/docs/secrets/cassandra/index.html">Vault Documentation: Setting up Apache Cassandra with Vault</a></p>
</div>
</div>
<div class="sect2">
<h3 id="vault.config.backends.mongodb"><a class="link" href="#vault.config.backends.mongodb">MongoDB</a></h3>
<div class="admonitionblock note">
<table>
<tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
The <code>mongodb</code> backend has been deprecated in Vault 0.7.1 and
it is recommended to use the <code>database</code> backend and mount it as <code>mongodb</code>.
</td>
</tr>
</table>
</div>
<div class="paragraph">
<p>Spring Cloud Vault can obtain credentials for MongoDB.
The integration can be enabled by setting
<code>spring.cloud.vault.mongodb.enabled=true</code> (default <code>false</code>) and
providing the role name with <code>spring.cloud.vault.mongodb.role=…</code>.</p>
</div>
<div class="paragraph">
<p>Username and password are stored in <code>spring.data.mongodb.username</code>
and <code>spring.data.mongodb.password</code> so using Spring Boot will
pick up the generated credentials without further configuration.
You can configure the property names by setting
<code>spring.cloud.vault.mongodb.username-property</code> and
<code>spring.cloud.vault.mongodb.password-property</code>.</p>
</div>
<div class="exampleblock">
<div class="content">
<div class="listingblock">
<div class="content">
<pre class="highlightjs highlight"><code class="language-yaml hljs" data-lang="yaml">spring.cloud.vault:
mongodb:
enabled: true
role: readonly
backend: mongodb
username-property: spring.data.mongodb.username
password-property: spring.data.mongodb.password</code></pre>
</div>
</div>
</div>
</div>
<div class="ulist">
<ul>
<li>
<p><code>enabled</code> setting this value to <code>true</code> enables the MongodB backend config usage</p>
</li>
<li>
<p><code>role</code> sets the role name of the MongoDB role definition</p>
</li>
<li>
<p><code>backend</code> sets the path of the MongoDB mount to use</p>
</li>
<li>
<p><code>username-property</code> sets the property name in which the MongoDB username is stored</p>
</li>
<li>
<p><code>password-property</code> sets the property name in which the MongoDB password is stored</p>
</li>
</ul>
</div>
<div class="paragraph">
<p>See also: <a href="https://www.vaultproject.io/docs/secrets/mongodb/index.html">Vault Documentation: Setting up MongoDB with Vault</a></p>
</div>
</div>
<div class="sect2">
<h3 id="vault.config.backends.mysql"><a class="link" href="#vault.config.backends.mysql">MySQL</a></h3>
<div class="admonitionblock note">
<table>
<tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
The <code>mysql</code> backend has been deprecated in Vault 0.7.1 and
it is recommended to use the <code>database</code> backend and mount it as <code>mysql</code>.
Configuration for <code>spring.cloud.vault.mysql</code> will be removed in a future version.
</td>
</tr>
</table>
</div>
<div class="paragraph">
<p>Spring Cloud Vault can obtain credentials for MySQL.
The integration can be enabled by setting
<code>spring.cloud.vault.mysql.enabled=true</code> (default <code>false</code>) and
providing the role name with <code>spring.cloud.vault.mysql.role=…</code>.</p>
</div>
<div class="paragraph">
<p>Username and password are stored in <code>spring.datasource.username</code>
and <code>spring.datasource.password</code> so using Spring Boot will
pick up the generated credentials without further configuration.
You can configure the property names by setting
<code>spring.cloud.vault.mysql.username-property</code> and
<code>spring.cloud.vault.mysql.password-property</code>.</p>
</div>
<div class="exampleblock">
<div class="content">
<div class="listingblock">
<div class="content">
<pre class="highlightjs highlight"><code class="language-yaml hljs" data-lang="yaml">spring.cloud.vault:
mysql:
enabled: true
role: readonly
backend: mysql
username-property: spring.datasource.username
password-property: spring.datasource.password</code></pre>
</div>
</div>
</div>
</div>
<div class="ulist">
<ul>
<li>
<p><code>enabled</code> setting this value to <code>true</code> enables the MySQL backend config usage</p>
</li>
<li>
<p><code>role</code> sets the role name of the MySQL role definition</p>
</li>
<li>
<p><code>backend</code> sets the path of the MySQL mount to use</p>
</li>
<li>
<p><code>username-property</code> sets the property name in which the MySQL username is stored</p>
</li>
<li>
<p><code>password-property</code> sets the property name in which the MySQL password is stored</p>
</li>
</ul>
</div>
<div class="paragraph">
<p>See also: <a href="https://www.vaultproject.io/docs/secrets/mysql/index.html">Vault Documentation: Setting up MySQL with Vault</a></p>
</div>
</div>
<div class="sect2">
<h3 id="vault.config.backends.postgresql"><a class="link" href="#vault.config.backends.postgresql">PostgreSQL</a></h3>
<div class="admonitionblock note">
<table>
<tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
The <code>postgresql</code> backend has been deprecated in Vault 0.7.1 and
it is recommended to use the <code>database</code> backend and mount it as <code>postgresql</code>.
Configuration for <code>spring.cloud.vault.postgresql</code> will be removed in a future version.
</td>
</tr>
</table>
</div>
<div class="paragraph">
<p>Spring Cloud Vault can obtain credentials for PostgreSQL.
The integration can be enabled by setting
<code>spring.cloud.vault.postgresql.enabled=true</code> (default <code>false</code>) and
providing the role name with <code>spring.cloud.vault.postgresql.role=…</code>.</p>
</div>
<div class="paragraph">
<p>Username and password are stored in <code>spring.datasource.username</code>
and <code>spring.datasource.password</code> so using Spring Boot will
pick up the generated credentials without further configuration.
You can configure the property names by setting
<code>spring.cloud.vault.postgresql.username-property</code> and
<code>spring.cloud.vault.postgresql.password-property</code>.</p>
</div>
<div class="exampleblock">
<div class="content">
<div class="listingblock">
<div class="content">
<pre class="highlightjs highlight"><code class="language-yaml hljs" data-lang="yaml">spring.cloud.vault:
postgresql:
enabled: true
role: readonly
backend: postgresql
username-property: spring.datasource.username
password-property: spring.datasource.password</code></pre>
</div>
</div>
</div>
</div>
<div class="ulist">
<ul>
<li>
<p><code>enabled</code> setting this value to <code>true</code> enables the PostgreSQL backend config usage</p>
</li>
<li>
<p><code>role</code> sets the role name of the PostgreSQL role definition</p>
</li>
<li>
<p><code>backend</code> sets the path of the PostgreSQL mount to use</p>
</li>
<li>
<p><code>username-property</code> sets the property name in which the PostgreSQL username is stored</p>
</li>
<li>
<p><code>password-property</code> sets the property name in which the PostgreSQL password is stored</p>
</li>
</ul>
</div>
<div class="paragraph">
<p>See also: <a href="https://www.vaultproject.io/docs/secrets/postgresql/index.html">Vault Documentation: Setting up PostgreSQL with Vault</a></p>
</div>
</div>
</div>
</div>
<div class="sect1">
<h2 id="vault.config.backends.configurer"><a class="link" href="#vault.config.backends.configurer">Configure <code>PropertySourceLocator</code> behavior</a></h2>
<div class="sectionbody">
<div class="paragraph">
<p>Spring Cloud Vault uses property-based configuration to create <code>PropertySource</code>s
for generic and discovered secret backends.</p>
</div>
<div class="paragraph">
<p>Discovered backends provide <code>VaultSecretBackendDescriptor</code> beans to describe the configuration
state to use secret backend as <code>PropertySource</code>. A <code>SecretBackendMetadataFactory</code> is required
to create a <code>SecretBackendMetadata</code> object which contains path, name and property transformation
configuration.</p>
</div>
<div class="paragraph">
<p><code>SecretBackendMetadata</code> is used to back a particular <code>PropertySource</code>.</p>
</div>
<div class="paragraph">
<p>You can register an arbitrary number of beans implementing <code>VaultConfigurer</code> for customization.
Default generic and discovered backend registration is disabled if Spring Cloud Vault discovers
at least one <code>VaultConfigurer</code> bean. You can however enable default registration with
<code>SecretBackendConfigurer.registerDefaultGenericSecretBackends()</code> and <code>SecretBackendConfigurer.registerDefaultDiscoveredSecretBackends()</code>.</p>
</div>
<div class="exampleblock">
<div class="content">
<div class="listingblock">
<div class="content">
<pre class="highlightjs highlight"><code class="language-java hljs" data-lang="java">public class CustomizationBean implements VaultConfigurer {
@Override
public void addSecretBackends(SecretBackendConfigurer configurer) {
configurer.add("secret/my-application");
configurer.registerDefaultGenericSecretBackends(false);
configurer.registerDefaultDiscoveredSecretBackends(true);
}
}</code></pre>
</div>
</div>
</div>
</div>
<div class="admonitionblock note">
<table>
<tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
All customization is required to happen in the bootstrap context. Add your configuration
classes to <code>META-INF/spring.factories</code> at <code>org.springframework.cloud.bootstrap.BootstrapConfiguration</code>
in your application.
</td>
</tr>
</table>
</div>
</div>
</div>
<div class="sect1">
<h2 id="_service_registry_configuration"><a class="link" href="#_service_registry_configuration">Service Registry Configuration</a></h2>
<div class="sectionbody">
<div class="paragraph">
<p>You can use a <code>DiscoveryClient</code> (such as from Spring Cloud Consul) to locate
a Vault server by setting spring.cloud.vault.discovery.enabled=true (default <code>false</code>).
The net result of that is that your apps need a bootstrap.yml (or an environment variable)
with the appropriate discovery configuration.
The benefit is that the Vault can change its co-ordinates, as long as the discovery service
is a fixed point. The default service id is <code>vault</code> but you can change that on the client with
<code>spring.cloud.vault.discovery.serviceId</code>.</p>
</div>
<div class="paragraph">
<p>The discovery client implementations all support some kind of metadata map
(e.g. for Eureka we have eureka.instance.metadataMap). Some additional properties of the service
may need to be configured in its service registration metadata so that clients can connect
correctly. Service registries that do not provide details about transport layer security
need to provide a <code>scheme</code> metadata entry to be set either to <code>https</code> or <code>http</code>.
If no scheme is configured and the service is not exposed as secure service, then
configuration defaults to <code>spring.cloud.vault.scheme</code> which is <code>https</code> when it&#8217;s not set.</p>
</div>
<div class="exampleblock">
<div class="content">
<div class="listingblock">
<div class="content">
<pre class="highlightjs highlight"><code class="language-yaml hljs" data-lang="yaml">spring.cloud.vault.discovery:
enabled: true
service-id: my-vault-service</code></pre>
</div>
</div>
</div>
</div>
</div>
</div>
<div class="sect1">
<h2 id="vault.config.fail-fast"><a class="link" href="#vault.config.fail-fast">Vault Client Fail Fast</a></h2>
<div class="sectionbody">
<div class="paragraph">
<p>In some cases, it may be desirable to fail startup of a service if
it cannot connect to the Vault Server. If this is the desired
behavior, set the bootstrap configuration property
<code>spring.cloud.vault.fail-fast=true</code> and the client will halt with
an Exception.</p>
</div>
<div class="exampleblock">
<div class="content">
<div class="listingblock">
<div class="content">
<pre class="highlightjs highlight"><code class="language-yaml hljs" data-lang="yaml">spring.cloud.vault:
fail-fast: true</code></pre>
</div>
</div>
</div>
</div>
</div>
</div>
<div class="sect1">
<h2 id="vault.config.ssl"><a class="link" href="#vault.config.ssl">Vault Client SSL configuration</a></h2>
<div class="sectionbody">
<div class="paragraph">
<p>SSL can be configured declaratively by setting various properties.
You can set either <code>javax.net.ssl.trustStore</code> to configure
JVM-wide SSL settings or <code>spring.cloud.vault.ssl.trust-store</code>
to set SSL settings only for Spring Cloud Vault Config.</p>
</div>
<div class="exampleblock">
<div class="content">
<div class="listingblock">
<div class="content">
<pre class="highlightjs highlight"><code class="language-yaml hljs" data-lang="yaml">spring.cloud.vault:
ssl:
trust-store: classpath:keystore.jks
trust-store-password: changeit</code></pre>
</div>
</div>
</div>
</div>
<div class="ulist">
<ul>
<li>
<p><code>trust-store</code> sets the resource for the trust-store. SSL-secured Vault
communication will validate the Vault SSL certificate with the specified
trust-store.</p>
</li>
<li>
<p><code>trust-store-password</code> sets the trust-store password</p>
</li>
</ul>
</div>
<div class="paragraph">
<p>Please note that configuring <code>spring.cloud.vault.ssl.*</code> can be only
applied when either Apache Http Components or the OkHttp client
is on your class-path.</p>
</div>
</div>
</div>
<div class="sect1">
<h2 id="vault-lease-renewal"><a class="link" href="#vault-lease-renewal">Lease lifecycle management (renewal and revocation)</a></h2>
<div class="sectionbody">
<div class="paragraph">
<p>With every secret, Vault creates a lease:
metadata containing information such as a time duration,
renewability, and more.</p>
</div>
<div class="paragraph">
<p>Vault promises that the data will be valid for the given duration,
or Time To Live (TTL). Once the lease is expired, Vault can
revoke the data, and the consumer of the secret can no longer
be certain that it is valid.</p>
</div>
<div class="paragraph">
<p>Spring Cloud Vault maintains a lease lifecycle beyond
the creation of login tokens and secrets. That said,
login tokens and secrets associated with a lease
are scheduled for renewal just before the lease expires
until terminal expiry.
Application shutdown revokes obtained login tokens and renewable
leases.</p>
</div>
<div class="paragraph">
<p>Secret service and database backends (such as MongoDB or MySQL)
usually generate a renewable lease so generated credentials will
be disabled on application shutdown.</p>
</div>
<div class="admonitionblock note">
<table>
<tr>
<td class="icon">
<i class="fa icon-note" title="Note"></i>
</td>
<td class="content">
Static tokens are not renewed or revoked.
</td>
</tr>
</table>
</div>
<div class="paragraph">
<p>Lease renewal and revocation is enabled by default and can
be disabled by setting <code>spring.cloud.vault.config.lifecycle.enabled</code>
to <code>false</code>. This is not recommended as leases can expire and
Spring Cloud Vault cannot longer access Vault or services
using generated credentials and valid credentials remain active
after application shutdown.</p>
</div>
<div class="exampleblock">
<div class="content">
<div class="listingblock">
<div class="content">
<pre class="highlightjs highlight"><code class="language-yaml hljs" data-lang="yaml">spring.cloud.vault:
config.lifecycle:
enabled: true
min-renewal: 10s
expiry-threshold: 1m
lease-endpoints: Legacy</code></pre>
</div>
</div>
</div>
</div>
<div class="ulist">
<ul>
<li>
<p><code>enabled</code> controls whether leases associated with secrets are considered to be renewed and expired secrets are rotated. Enabled by default.</p>
</li>
<li>
<p><code>min-renewal</code> sets the duration that is at least required before renewing a lease. This setting prevents renewals from happening too often.</p>
</li>
<li>
<p><code>expiry-threshold</code> sets the expiry threshold. A lease is renewed the configured period of time before it expires.</p>
</li>
<li>
<p><code>lease-endpoints</code> sets the endpoints for renew and revoke. Legacy for vault versions before 0.8 and SysLeases for later.</p>
</li>
</ul>
</div>
<div class="paragraph">
<p>See also: <a href="https://www.vaultproject.io/docs/concepts/lease.html">Vault Documentation: Lease, Renew, and Revoke</a></p>
</div>
</div>
</div>
</div>
<script type="text/javascript" src="js/tocbot/tocbot.min.js"></script>
<script type="text/javascript" src="js/toc.js"></script>
<link rel="stylesheet" href="js/highlight/styles/atom-one-dark-reasonable.min.css">
<script src="js/highlight/highlight.min.js"></script>
<script>hljs.initHighlighting()</script>
</body>
</html>
Reference in New Issue View Git Blame Copy Permalink