From 3349c814a23eee1bef14e577ce5c517884333556 Mon Sep 17 00:00:00 2001 From: Mark Paluch Date: Thu, 24 Sep 2020 14:20:51 +0200 Subject: [PATCH] Polishing Switch AwsEc2Properties.identityDocument to URI. Reorder property accessors. Tweak documentation formatting. Original pull request: gh-495. Resolves gh-451. --- docs/src/main/asciidoc/authentication.adoc | 11 ++++-- .../config/ClientAuthenticationFactory.java | 3 +- .../cloud/vault/config/VaultProperties.java | 38 ++++++++++--------- 3 files changed, 29 insertions(+), 23 deletions(-) diff --git a/docs/src/main/asciidoc/authentication.adoc b/docs/src/main/asciidoc/authentication.adoc index 540dd9b1..e33bd481 100644 --- a/docs/src/main/asciidoc/authentication.adoc +++ b/docs/src/main/asciidoc/authentication.adoc @@ -381,8 +381,8 @@ spring.cloud.vault: azure-msi: role: my-dev-role azure-path: azure - metadata-service: http://169.254.169.254/metadata/instance... - identity-token-service: http://169.254.169.254/metadata/identity... + metadata-service: http://169.254.169.254/metadata/instance… + identity-token-service: http://169.254.169.254/metadata/identity… ---- ==== @@ -391,9 +391,12 @@ spring.cloud.vault: * `metadata-service` sets the URI at which to access the instance metadata service * `identity-token-service` sets the URI at which to access the identity token service -Azure MSI authentication fetches environmental details about the virtual machine (subscription Id, resource group, VM name) from the instance metadata service. By default, Azure assumes your Vault server has Resource ID `https://vault.hashicorp.com`. To change this, set `spring.cloud.vault.azure-msi.identity-token-service`. +Azure MSI authentication obtains environmental details about the virtual machine (subscription Id, resource group, VM name) from the instance metadata service. +The Vault server has Resource Id defaults to `https://vault.hashicorp.com`. +To change this, set `spring.cloud.vault.azure-msi.identity-token-service` accordingly. + +See also: -See also: * https://www.vaultproject.io/docs/auth/azure.html[Vault Documentation: Using the azure auth backend] * https://docs.microsoft.com/en-us/azure/virtual-machines/windows/instance-metadata-service[Azure Documentation: Azure Instance Metadata Service] diff --git a/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/ClientAuthenticationFactory.java b/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/ClientAuthenticationFactory.java index a13782be..aa002eda 100644 --- a/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/ClientAuthenticationFactory.java +++ b/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/ClientAuthenticationFactory.java @@ -18,7 +18,6 @@ package org.springframework.cloud.vault.config; import java.io.ByteArrayInputStream; import java.io.IOException; -import java.net.URI; import java.util.Base64; import java.util.concurrent.atomic.AtomicReference; @@ -263,7 +262,7 @@ class ClientAuthenticationFactory { AwsEc2AuthenticationOptions authenticationOptions = AwsEc2AuthenticationOptions.builder().role(awsEc2.getRole()) // .path(awsEc2.getAwsEc2Path()) // .nonce(nonce) // - .identityDocumentUri(URI.create(awsEc2.getIdentityDocument())) // + .identityDocumentUri(awsEc2.getIdentityDocument()) // .build(); return new AwsEc2Authentication(authenticationOptions, this.restOperations, this.externalRestOperations); diff --git a/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/VaultProperties.java b/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/VaultProperties.java index 7bf6c309..f3a38f50 100644 --- a/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/VaultProperties.java +++ b/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/VaultProperties.java @@ -532,7 +532,7 @@ public class VaultProperties implements EnvironmentAware { /** * URL of the AWS-EC2 PKCS7 identity document. */ - private String identityDocument = "http://169.254.169.254/latest/dynamic/instance-identity/pkcs7"; + private URI identityDocument = URI.create("http://169.254.169.254/latest/dynamic/instance-identity/pkcs7"); /** * Mount path of the AWS-EC2 authentication backend. @@ -551,11 +551,11 @@ public class VaultProperties implements EnvironmentAware { @Nullable private String nonce; - public String getIdentityDocument() { + public URI getIdentityDocument() { return this.identityDocument; } - public void setIdentityDocument(String identityDocument) { + public void setIdentityDocument(URI identityDocument) { this.identityDocument = identityDocument; } @@ -668,12 +668,16 @@ public class VaultProperties implements EnvironmentAware { private String role = ""; /** - * Instance metadata service URI + * Instance metadata service URI. + * + * @since 3.0 */ private URI metadataService = AzureMsiAuthenticationOptions.DEFAULT_INSTANCE_METADATA_SERVICE_URI; /** - * Identity token service URI + * Identity token service URI. + * + * @since 3.0 */ private URI identityTokenService = AzureMsiAuthenticationOptions.DEFAULT_IDENTITY_TOKEN_SERVICE_URI; @@ -681,30 +685,30 @@ public class VaultProperties implements EnvironmentAware { return this.azurePath; } - public String getRole() { - return this.role; - } - - public URI getMetadataService() { - return metadataService; - } - - public URI getIdentityTokenService() { - return identityTokenService; - } - public void setAzurePath(String azurePath) { this.azurePath = azurePath; } + public String getRole() { + return this.role; + } + public void setRole(String role) { this.role = role; } + public URI getMetadataService() { + return this.metadataService; + } + public void setMetadataService(URI metadataService) { this.metadataService = metadataService; } + public URI getIdentityTokenService() { + return this.identityTokenService; + } + public void setIdentityTokenService(URI identityTokenService) { this.identityTokenService = identityTokenService; }