diff --git a/spring-cloud-vault-config-databases/src/main/java/org/springframework/cloud/vault/config/databases/DatabaseSecretProperties.java b/spring-cloud-vault-config-databases/src/main/java/org/springframework/cloud/vault/config/databases/DatabaseSecretProperties.java index 1bf184cb..54c5a83a 100644 --- a/spring-cloud-vault-config-databases/src/main/java/org/springframework/cloud/vault/config/databases/DatabaseSecretProperties.java +++ b/spring-cloud-vault-config-databases/src/main/java/org/springframework/cloud/vault/config/databases/DatabaseSecretProperties.java @@ -1,5 +1,5 @@ /* - * Copyright 2016-2018 the original author or authors. + * Copyright 2016-2019 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -22,6 +22,7 @@ import org.springframework.cloud.vault.config.VaultSecretBackendDescriptor; * Configuration properties interface for database secrets. * * @author Mark Paluch + * @author Sebastien Nahelou */ public interface DatabaseSecretProperties extends VaultSecretBackendDescriptor { @@ -31,6 +32,13 @@ public interface DatabaseSecretProperties extends VaultSecretBackendDescriptor { */ String getRole(); + /** + * Whether the configuration uses static roles. + * @return {@literal true} if the configuration uses static roles. + * @since 2.2 + */ + boolean isStaticRole(); + /** * Backend path. * @return the backend path. @@ -47,10 +55,4 @@ public interface DatabaseSecretProperties extends VaultSecretBackendDescriptor { */ String getPasswordProperty(); - /** - * see https://learn.hashicorp.com/vault/secrets-management/db-creds-rotation - * @return is vault configured to use static role or not. - */ - boolean isStaticRole(); - } diff --git a/spring-cloud-vault-config-databases/src/main/java/org/springframework/cloud/vault/config/databases/VaultCassandraProperties.java b/spring-cloud-vault-config-databases/src/main/java/org/springframework/cloud/vault/config/databases/VaultCassandraProperties.java index b940986a..7268fde2 100644 --- a/spring-cloud-vault-config-databases/src/main/java/org/springframework/cloud/vault/config/databases/VaultCassandraProperties.java +++ b/spring-cloud-vault-config-databases/src/main/java/org/springframework/cloud/vault/config/databases/VaultCassandraProperties.java @@ -1,5 +1,5 @@ /* - * Copyright 2016-2018 the original author or authors. + * Copyright 2016-2019 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -25,6 +25,7 @@ import org.springframework.validation.annotation.Validated; * Configuration properties for Vault using the Apache Cassandra integration. * * @author Mark Paluch + * @author Sebastien Nahelou */ @ConfigurationProperties("spring.cloud.vault.cassandra") @Validated @@ -40,6 +41,13 @@ public class VaultCassandraProperties implements DatabaseSecretProperties { */ private String role; + /** + * Enable static role usage. + * + * @since 2.2 + */ + private boolean staticRole = false; + /** * Cassandra backend path. */ @@ -58,47 +66,56 @@ public class VaultCassandraProperties implements DatabaseSecretProperties { @NotEmpty private String passwordProperty = "spring.data.cassandra.password"; - /** - * Enable static role usage. - */ - private boolean staticRole = false; - + @Override public boolean isEnabled() { return this.enabled; } - public String getRole() { - return this.role; - } - - public String getBackend() { - return this.backend; - } - - public String getUsernameProperty() { - return this.usernameProperty; - } - - public String getPasswordProperty() { - return this.passwordProperty; - } - public void setEnabled(boolean enabled) { this.enabled = enabled; } + @Override + public String getRole() { + return this.role; + } + public void setRole(String role) { this.role = role; } + @Override + public boolean isStaticRole() { + return this.staticRole; + } + + public void setStaticRole(boolean staticRole) { + this.staticRole = staticRole; + } + + @Override + public String getBackend() { + return this.backend; + } + public void setBackend(String backend) { this.backend = backend; } + @Override + public String getUsernameProperty() { + return this.usernameProperty; + } + public void setUsernameProperty(String usernameProperty) { this.usernameProperty = usernameProperty; } + @Override + public String getPasswordProperty() { + return this.passwordProperty; + } + public void setPasswordProperty(String passwordProperty) { this.passwordProperty = passwordProperty; } diff --git a/spring-cloud-vault-config-databases/src/main/java/org/springframework/cloud/vault/config/databases/VaultConfigDatabaseBootstrapConfiguration.java b/spring-cloud-vault-config-databases/src/main/java/org/springframework/cloud/vault/config/databases/VaultConfigDatabaseBootstrapConfiguration.java index 6fa8de34..bc3c5f40 100644 --- a/spring-cloud-vault-config-databases/src/main/java/org/springframework/cloud/vault/config/databases/VaultConfigDatabaseBootstrapConfiguration.java +++ b/spring-cloud-vault-config-databases/src/main/java/org/springframework/cloud/vault/config/databases/VaultConfigDatabaseBootstrapConfiguration.java @@ -1,5 +1,5 @@ /* - * Copyright 2016-2018 the original author or authors. + * Copyright 2016-2019 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -36,6 +36,7 @@ import org.springframework.vault.core.util.PropertyTransformer; * * @author Mark Paluch * @author Per Abich + * @author Sebastien Nahelou */ @Configuration @EnableConfigurationProperties({ VaultMySqlProperties.class, @@ -78,7 +79,7 @@ public class VaultConfigDatabaseBootstrapConfiguration { return new SecretBackendMetadata() { - private String credPath = properties.isStaticRole() ? "static-creds" + private final String credPath = properties.isStaticRole() ? "static-creds" : "creds"; @Override @@ -89,8 +90,8 @@ public class VaultConfigDatabaseBootstrapConfiguration { @Override public String getPath() { - return String.format("%s/%s/%s", properties.getBackend(), credPath, - properties.getRole()); + return String.format("%s/%s/%s", properties.getBackend(), + this.credPath, properties.getRole()); } @Override @@ -104,7 +105,7 @@ public class VaultConfigDatabaseBootstrapConfiguration { Map variables = new HashMap<>(); variables.put("backend", properties.getBackend()); variables.put("key", - String.format("%s/%s", credPath, properties.getRole())); + String.format("%s/%s", this.credPath, properties.getRole())); return variables; } }; diff --git a/spring-cloud-vault-config-databases/src/main/java/org/springframework/cloud/vault/config/databases/VaultDatabaseProperties.java b/spring-cloud-vault-config-databases/src/main/java/org/springframework/cloud/vault/config/databases/VaultDatabaseProperties.java index fd29bf64..7cf0b0a6 100644 --- a/spring-cloud-vault-config-databases/src/main/java/org/springframework/cloud/vault/config/databases/VaultDatabaseProperties.java +++ b/spring-cloud-vault-config-databases/src/main/java/org/springframework/cloud/vault/config/databases/VaultDatabaseProperties.java @@ -1,5 +1,5 @@ /* - * Copyright 2017-2018 the original author or authors. + * Copyright 2017-2019 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -25,6 +25,7 @@ import org.springframework.validation.annotation.Validated; * Configuration properties for Vault using the Database integration. * * @author Per Abich + * @author Sebastien Nahelou * @since 2.0 */ @ConfigurationProperties("spring.cloud.vault.database") @@ -41,6 +42,11 @@ public class VaultDatabaseProperties implements DatabaseSecretProperties { */ private String role; + /** + * Enable static role usage. + */ + private boolean staticRole = false; + /** * Database backend path. */ @@ -59,47 +65,56 @@ public class VaultDatabaseProperties implements DatabaseSecretProperties { @NotEmpty private String passwordProperty = "spring.datasource.password"; - /** - * Enable static role usage. - */ - private boolean staticRole = false; - + @Override public boolean isEnabled() { return this.enabled; } - public String getRole() { - return this.role; - } - - public String getBackend() { - return this.backend; - } - - public String getUsernameProperty() { - return this.usernameProperty; - } - - public String getPasswordProperty() { - return this.passwordProperty; - } - public void setEnabled(boolean enabled) { this.enabled = enabled; } + @Override + public String getRole() { + return this.role; + } + public void setRole(String role) { this.role = role; } + @Override + public boolean isStaticRole() { + return this.staticRole; + } + + public void setStaticRole(boolean staticRole) { + this.staticRole = staticRole; + } + + @Override + public String getBackend() { + return this.backend; + } + public void setBackend(String backend) { this.backend = backend; } + @Override + public String getUsernameProperty() { + return this.usernameProperty; + } + public void setUsernameProperty(String usernameProperty) { this.usernameProperty = usernameProperty; } + @Override + public String getPasswordProperty() { + return this.passwordProperty; + } + public void setPasswordProperty(String passwordProperty) { this.passwordProperty = passwordProperty; } diff --git a/spring-cloud-vault-config-databases/src/main/java/org/springframework/cloud/vault/config/databases/VaultMongoProperties.java b/spring-cloud-vault-config-databases/src/main/java/org/springframework/cloud/vault/config/databases/VaultMongoProperties.java index 23fee72a..9c758875 100644 --- a/spring-cloud-vault-config-databases/src/main/java/org/springframework/cloud/vault/config/databases/VaultMongoProperties.java +++ b/spring-cloud-vault-config-databases/src/main/java/org/springframework/cloud/vault/config/databases/VaultMongoProperties.java @@ -1,5 +1,5 @@ /* - * Copyright 2016-2018 the original author or authors. + * Copyright 2016-2019 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -25,6 +25,7 @@ import org.springframework.validation.annotation.Validated; * Configuration properties for Vault using the MongoDB integration. * * @author Mark Paluch + * @author Sebastien Nahelou */ @ConfigurationProperties("spring.cloud.vault.mongodb") @Validated @@ -40,6 +41,13 @@ public class VaultMongoProperties implements DatabaseSecretProperties { */ private String role; + /** + * Enable static role usage. + * + * @since 2.2 + */ + private boolean staticRole = false; + /** * Cassandra backend path. */ @@ -58,50 +66,56 @@ public class VaultMongoProperties implements DatabaseSecretProperties { @NotEmpty private String passwordProperty = "spring.data.mongodb.password"; - /** - * Enable static role usage. - */ - private boolean staticRole = false; - - public VaultMongoProperties() { - } - + @Override public boolean isEnabled() { return this.enabled; } - public String getRole() { - return this.role; - } - - public String getBackend() { - return this.backend; - } - - public String getUsernameProperty() { - return this.usernameProperty; - } - - public String getPasswordProperty() { - return this.passwordProperty; - } - public void setEnabled(boolean enabled) { this.enabled = enabled; } + @Override + public String getRole() { + return this.role; + } + public void setRole(String role) { this.role = role; } + @Override + public boolean isStaticRole() { + return this.staticRole; + } + + public void setStaticRole(boolean staticRole) { + this.staticRole = staticRole; + } + + @Override + public String getBackend() { + return this.backend; + } + public void setBackend(String backend) { this.backend = backend; } + @Override + public String getUsernameProperty() { + return this.usernameProperty; + } + public void setUsernameProperty(String usernameProperty) { this.usernameProperty = usernameProperty; } + @Override + public String getPasswordProperty() { + return this.passwordProperty; + } + public void setPasswordProperty(String passwordProperty) { this.passwordProperty = passwordProperty; } diff --git a/spring-cloud-vault-config-databases/src/main/java/org/springframework/cloud/vault/config/databases/VaultMySqlProperties.java b/spring-cloud-vault-config-databases/src/main/java/org/springframework/cloud/vault/config/databases/VaultMySqlProperties.java index d0821853..558508dd 100644 --- a/spring-cloud-vault-config-databases/src/main/java/org/springframework/cloud/vault/config/databases/VaultMySqlProperties.java +++ b/spring-cloud-vault-config-databases/src/main/java/org/springframework/cloud/vault/config/databases/VaultMySqlProperties.java @@ -1,5 +1,5 @@ /* - * Copyright 2016-2018 the original author or authors. + * Copyright 2016-2019 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -62,52 +62,54 @@ public class VaultMySqlProperties @NotEmpty private String passwordProperty = "spring.datasource.password"; - /** - * Enable static role usage. - */ - private boolean staticRole = false; - - public VaultMySqlProperties() { - } - - public String getBackend() { - return this.backend; - } - - public String getUsernameProperty() { - return this.usernameProperty; - } - - public String getPasswordProperty() { - return this.passwordProperty; + @Override + public boolean isEnabled() { + return this.enabled; } public void setEnabled(boolean enabled) { this.enabled = enabled; } + @Override + public String getRole() { + return this.role; + } + public void setRole(String role) { this.role = role; } + @Override + public boolean isStaticRole() { + return false; + } + + @Override + public String getBackend() { + return this.backend; + } + public void setBackend(String backend) { this.backend = backend; } + @Override + public String getUsernameProperty() { + return this.usernameProperty; + } + public void setUsernameProperty(String usernameProperty) { this.usernameProperty = usernameProperty; } + @Override + public String getPasswordProperty() { + return this.passwordProperty; + } + public void setPasswordProperty(String passwordProperty) { this.passwordProperty = passwordProperty; } - public boolean isEnabled() { - return this.enabled; - } - - public String getRole() { - return this.role; - } - } diff --git a/spring-cloud-vault-config-databases/src/main/java/org/springframework/cloud/vault/config/databases/VaultPostgreSqlProperties.java b/spring-cloud-vault-config-databases/src/main/java/org/springframework/cloud/vault/config/databases/VaultPostgreSqlProperties.java index 01bf4c3e..71539034 100644 --- a/spring-cloud-vault-config-databases/src/main/java/org/springframework/cloud/vault/config/databases/VaultPostgreSqlProperties.java +++ b/spring-cloud-vault-config-databases/src/main/java/org/springframework/cloud/vault/config/databases/VaultPostgreSqlProperties.java @@ -1,5 +1,5 @@ /* - * Copyright 2016-2018 the original author or authors. + * Copyright 2016-2019 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -61,54 +61,54 @@ public class VaultPostgreSqlProperties implements DatabaseSecretProperties { @NotEmpty private String passwordProperty = "spring.datasource.password"; - /** - * Enable static role usage. - */ - private boolean staticRole = false; - - public VaultPostgreSqlProperties() { + @Override + public boolean isEnabled() { + return this.enabled; } - public String getBackend() { - return this.backend; - } - - public String getUsernameProperty() { - return this.usernameProperty; - } - - public String getPasswordProperty() { - return this.passwordProperty; - } - - @Deprecated public void setEnabled(boolean enabled) { this.enabled = enabled; } + @Override + public String getRole() { + return this.role; + } + public void setRole(String role) { this.role = role; } + @Override + public boolean isStaticRole() { + return false; + } + + @Override + public String getBackend() { + return this.backend; + } + public void setBackend(String backend) { this.backend = backend; } + @Override + public String getUsernameProperty() { + return this.usernameProperty; + } + public void setUsernameProperty(String usernameProperty) { this.usernameProperty = usernameProperty; } + @Override + public String getPasswordProperty() { + return this.passwordProperty; + } + public void setPasswordProperty(String passwordProperty) { this.passwordProperty = passwordProperty; } - @Deprecated - public boolean isEnabled() { - return this.enabled; - } - - public String getRole() { - return this.role; - } - } diff --git a/spring-cloud-vault-config-databases/src/test/java/org/springframework/cloud/vault/config/databases/VaultConfigDatabaseBootstrapConfigurationUnitTests.java b/spring-cloud-vault-config-databases/src/test/java/org/springframework/cloud/vault/config/databases/VaultConfigDatabaseBootstrapConfigurationUnitTests.java new file mode 100644 index 00000000..a55a2626 --- /dev/null +++ b/spring-cloud-vault-config-databases/src/test/java/org/springframework/cloud/vault/config/databases/VaultConfigDatabaseBootstrapConfigurationUnitTests.java @@ -0,0 +1,47 @@ +/* + * Copyright 2018-2019 the original author or authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * https://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package org.springframework.cloud.vault.config.databases; + +import org.junit.Test; + +import org.springframework.cloud.vault.config.SecretBackendMetadata; + +import static org.assertj.core.api.Assertions.assertThat; + +/** + * Unit tests for {@link VaultConfigDatabaseBootstrapConfiguration}. + * + * @author Mark Paluch + */ +public class VaultConfigDatabaseBootstrapConfigurationUnitTests { + + @Test + public void shouldConsiderCredentialPath() { + + VaultConfigDatabaseBootstrapConfiguration.DatabaseSecretBackendMetadataFactory factory = new VaultConfigDatabaseBootstrapConfiguration() + .databaseSecretBackendMetadataFactory(); + + VaultDatabaseProperties properties = new VaultDatabaseProperties(); + properties.setStaticRole(true); + properties.setRole("my-role"); + + SecretBackendMetadata metadata = factory.createMetadata(properties); + + assertThat(metadata.getPath()).isEqualTo("database/static-creds/my-role"); + } + +}