SpringCloud/spring-cloud-vault
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Remove spring.cloud.vault.generic configuration properties.

Browse Source 
Spring Cloud Vault uses now a single mechanism for key-value backend configuration. Properties at spring.cloud.vault.generic.* are no longer supported.

All associated functionality is now solely available by configuring the corresponding spring.cloud.vault.kv.* properties. The support classes GenericSecretBackendMetadata and VaultGenericBackendProperties were removed in favor of KeyValueSecretBackendMetadata respective VaultKeyValueBackendProperties. spring.cloud.vault.kv.enabled is now enabled by default to preserve spring.cloud.vault.generic.enabled behavior.

Closes gh-395
This commit is contained in:
Mark Paluch
2020-05-20 10:57:33 +02:00
parent ef2c83758d
commit 0f7b9ec7fc
27 changed files with 68 additions and 426 deletions
Download Patch File Download Diff File Expand all files Collapse all files

64
docs/src/main/asciidoc/spring-cloud-vault.adoc
View File

@@ -587,7 +587,9 @@ All API is synchronous therefore, `GcpIamAuthentication` does not support `Authe
See also:
* https://www.vaultproject.io/docs/auth/gcp.html[Vault Documentation: Using the GCP auth backend]
* https://cloud.google.com/iam/reference/rest/v1/projects.serviceAccounts/signJwt[GCP Documentation: projects.serviceAccounts.signJwt][[vault.authentication.gcpiam]]
* https://cloud.google.com/iam/reference/rest/v1/projects.serviceAccounts/signJwt[GCP Documentation: projects.serviceAccounts.signJwt]
[[vault.authentication.gcpiam]]
[[vault.config.authentication.kubernetes]]
=== Kubernetes authentication
@@ -669,70 +671,14 @@ See also: https://www.vaultproject.io/docs/auth/pcf.html[Vault Documentation: Us
[[vault.config.backends.kv]]
[[vault.config.backends.generic]]
=== Generic Backend
NOTE: This backend is deprecated in favor of the Key-Value backend and will be removed with the next major version.
Spring Cloud Vault supports at the basic level the key-value secret backend.
The key-value secret backend allows storage of arbitrary values as key-value store.
A single context can store one or many key-value tuples.
Contexts can be organized hierarchically.
Spring Cloud Vault allows using the Application name and a default context name (`application`) in combination with active profiles.
----
/secret/{application}/{profile}
/secret/{application}
/secret/{default-context}/{profile}
/secret/{default-context}
----
The application name is determined by the properties:
* `spring.cloud.vault.generic.application-name`
* `spring.cloud.vault.application-name`
* `spring.application.name`
Secrets can be obtained from other contexts within the key-value backend by adding their paths to the application name, separated by commas.
For example, given the application name `usefulapp,mysql1,projectx/aws`, each of these folders will be used:
* `/secret/usefulapp`
* `/secret/mysql1`
* `/secret/projectx/aws`
Spring Cloud Vault adds all active profiles to the list of possible context paths.
No active profiles will skip accessing contexts with a profile name.
Properties are exposed like they are stored (i.e. without additional prefixes).
====
[source,yaml]
----
spring.cloud.vault:
generic:
enabled: true
backend: secret
profile-separator: '/'
default-context: application
application-name: my-app
----
====
* `enabled` setting this value to `false` disables the secret backend config usage
* `backend` sets the path of the secret mount to use
* `default-context` sets the context name used by all applications
* `application-name` overrides the application name for use in the key-value backend
* `profile-separator` separates the profile name from the context in property sources with profiles
See also: https://www.vaultproject.io/docs/secrets/kv/kv-v1.html[Vault Documentation: Using the KV Secrets Engine - Version 1 (generic secret backend)]
[[vault.config.backends.kv.versioned]]
=== Key-Value Backend
Spring Cloud Vault supports the Key-Value secret backend.
Spring Cloud Vault supports both Key-Value secret backends, the versioned (v2) and unversioned (v1).
The key-value backend allows storage of arbitrary values as key-value store.
A single context can store one or many key-value tuples.
Contexts can be organized hierarchically.
Spring Cloud Vault determines itself whether a secret is using versioning.
Spring Cloud Vault determines itself whether a secret is using versioning and maps the path to its appropriate URL.
Spring Cloud Vault allows using the Application name and a default context name (`application`) in combination with active profiles.
----