To use these features in an application, just build it as a Spring +
To use these features in an application, just build it as a Spring
Boot application that depends on spring-cloud-vault-config (e.g. see
the test cases). Example Maven configuration:
Example 2.1. pom.xml
<parent> <groupId>org.springframework.boot</groupId> diff --git a/multi/multi__quick_start.html b/multi/multi__quick_start.html index bac5384d..c26bf000 100644 --- a/multi/multi__quick_start.html +++ b/multi/multi__quick_start.html @@ -1,6 +1,6 @@ -1. Quick Start Prerequisites
To get started with Vault and this guide you need a +
1. Quick Start Prerequisites
To get started with Vault and this guide you need a *NIX-like operating systems that provides:
wget,opensslandunzip- at least Java 7 and a properly configured
JAVA_HOMEenvironment variableInstall Vault
$ src/test/bash/install_vault.shCreate SSL certificates for Vault
$ src/test/bash/create_certificates.sh
Note
create_certificates.shcreates certificates inwork/caand a JKS truststorework/keystore.jks. If you want to run Spring Cloud Vault using this quickstart guide you need to configure the truststore thespring.cloud.vault.ssl.trust-storeproperty tofile:work/keystore.jks.$ src/test/bash/local_run_vault.shVault is started listening on
0.0.0.0:8200using theinmemstorage andhttps. Vault is sealed and not initialized when starting up.
Note If you want to run tests, leave Vault uninitialized. The tests will diff --git a/multi/multi__service_registry_configuration.html b/multi/multi__service_registry_configuration.html index 0631a3f7..b0fb9734 100644 --- a/multi/multi__service_registry_configuration.html +++ b/multi/multi__service_registry_configuration.html @@ -1,6 +1,6 @@
-7. Service Registry Configuration You can use a
DiscoveryClient(such as from Spring Cloud Consul) to locate +7. Service Registry Configuration You can use a
-DiscoveryClient(such as from Spring Cloud Consul) to locate a Vault server by setting spring.cloud.vault.discovery.enabled=true (defaultfalse). The net result of that is that your apps need a bootstrap.yml (or an environment variable) with the appropriate discovery configuration. diff --git a/multi/multi_pr01.html b/multi/multi_pr01.html index a1d87121..f133b08b 100644 --- a/multi/multi_pr01.html +++ b/multi/multi_pr01.html @@ -1,3 +1,3 @@\ No newline at end of file +© 2016-2018 The original authors.
Note Copies of this document may be made for your own use and for distribution to others, provided that you do not charge any fee for such copies and further provided that each copy contains this Copyright Notice, whether distributed in print or electronically.
Spring Cloud Vault Config provides client-side support for externalized configuration in a distributed system. With HashiCorp’s Vault you have a central place to manage external secret properties for applications across all environments. Vault can manage static and dynamic secrets such as username/password for remote applications/resources and provide credentials for external services such as MySQL, PostgreSQL, Apache Cassandra, MongoDB, Consul, AWS and more.
\ No newline at end of file diff --git a/multi/multi_spring-cloud-vault.html b/multi/multi_spring-cloud-vault.html index 504088b4..40471067 100644 --- a/multi/multi_spring-cloud-vault.html +++ b/multi/multi_spring-cloud-vault.html @@ -1,3 +1,3 @@ -© 2016-2018 The original authors.
Note Copies of this document may be made for your own use and for distribution to others, provided that you do not charge any fee for such copies and further provided that each copy contains this Copyright Notice, whether distributed in print or electronically.
Spring Cloud Vault Config provides client-side support for externalized configuration in a distributed system. With HashiCorp’s Vault you have a central place to manage external secret properties for applications across all environments. Vault can manage static and dynamic secrets such as username/password for remote applications/resources and provide credentials for external services such as MySQL, PostgreSQL, Apache Cassandra, MongoDB, Consul, AWS and more.
Spring Cloud Vault \ No newline at end of file +Table of Contents
Spring Cloud Vault \ No newline at end of file diff --git a/multi/multi_vault-lease-renewal.html b/multi/multi_vault-lease-renewal.html index e5fcbbb8..7b7255f8 100644 --- a/multi/multi_vault-lease-renewal.html +++ b/multi/multi_vault-lease-renewal.html @@ -1,6 +1,6 @@ -Table of Contents
10. Lease lifecycle management (renewal and revocation) With every secret, Vault creates a lease: +
10. Lease lifecycle management (renewal and revocation) With every secret, Vault creates a lease: metadata containing information such as a time duration, renewability, and more.
Vault promises that the data will be valid for the given duration, or Time To Live (TTL). Once the lease is expired, Vault can diff --git a/multi/multi_vault.config.authentication.html b/multi/multi_vault.config.authentication.html index 84357e54..b2058a21 100644 --- a/multi/multi_vault.config.authentication.html +++ b/multi/multi_vault.config.authentication.html @@ -1,6 +1,6 @@
-3. Authentication methods Different organizations have different requirements for security +
3. Authentication methods Different organizations have different requirements for security and authentication. Vault reflects that need by shipping multiple authentication methods. Spring Cloud Vault supports token and AppId authentication.
Tokens are the core method for authentication within Vault. Token authentication requires a static token to be provided using the @@ -55,7 +55,7 @@ AppRole authentication consists of two hard to guess (secret) tokens: RoleId and Spring Vault will not look up these or create a custom SecretId.
Example 3.6. bootstrap.yml with AppRole authentication properties
spring.cloud.vault: authentication: APPROLE app-role: - role-id: bde2076b-cccb-3cf0-d57e-bca7b1e83a52The following scenarios are supported along the required configuration details:
Table 3.1. Configuration
Method
RoleId
SecretId
RoleName
Token
Provided RoleId/SecretId
Provided
Provided
Provided RoleId without SecretId
Provided
Provided RoleId, Pull SecretId
Provided
Provided
Provided
Provided
Pull RoleId, provided SecretId
Provided
Provided
Provided
Full Pull Mode
Provided
Provided
Wrapped
Provided
Wrapped RoleId, provided SecretId
Provided
Provided
Provided RoleId, wrapped SecretId
Provided
Provided
Table 3.2. Pull/Push/Wrapped Matrix
RoleId
SecretId
Supported
Provided
Provided
✅
Provided
Pull
✅
Provided
Wrapped
✅
Provided
Absent
✅
Pull
Provided
✅
Pull
Pull
✅
Pull
Wrapped
❌
Pull
Absent
❌
Wrapped
Provided
✅
Wrapped
Pull
❌
Wrapped
Wrapped
✅
Wrapped
Absent
❌
Note You can use still all combinations of push/pull/wrapped modes by providing a configured
AppRoleAuthenticationbean within the bootstrap context. Spring Cloud Vault cannot derive all possible AppRole combinations from the configuration properties.
Important AppRole authentication is limited to simple pull mode using reactive infrastructure. Full pull mode is not yet supported. Using Spring Cloud Vault with the Spring WebFlux stack enables Vault’s reactive auto-configuration which can be disabled by setting
spring.cloud.vault.reactive.enabled=false.Example 3.7. bootstrap.yml with all AppRole authentication properties
spring.cloud.vault: + role-id: bde2076b-cccb-3cf0-d57e-bca7b1e83a52The following scenarios are supported along the required configuration details:
Table 3.1. Configuration
Method
RoleId
SecretId
RoleName
Token
Provided RoleId/SecretId
Provided
Provided
Provided RoleId without SecretId
Provided
Provided RoleId, Pull SecretId
Provided
Provided
Provided
Provided
Pull RoleId, provided SecretId
Provided
Provided
Provided
Full Pull Mode
Provided
Provided
Wrapped
Provided
Wrapped RoleId, provided SecretId
Provided
Provided
Provided RoleId, wrapped SecretId
Provided
Provided
Table 3.2. Pull/Push/Wrapped Matrix
RoleId
SecretId
Supported
Provided
Provided
✅
Provided
Pull
✅
Provided
Wrapped
✅
Provided
Absent
✅
Pull
Provided
✅
Pull
Pull
✅
Pull
Wrapped
❌
Pull
Absent
❌
Wrapped
Provided
✅
Wrapped
Pull
❌
Wrapped
Wrapped
✅
Wrapped
Absent
❌
Note You can use still all combinations of push/pull/wrapped modes by providing a configured
AppRoleAuthenticationbean within the bootstrap context. Spring Cloud Vault cannot derive all possible AppRole combinations from the configuration properties.
Important AppRole authentication is limited to simple pull mode using reactive infrastructure. Full pull mode is not yet supported. Using Spring Cloud Vault with the Spring WebFlux stack enables Vault’s reactive auto-configuration which can be disabled by setting
spring.cloud.vault.reactive.enabled=false.Example 3.7. bootstrap.yml with all AppRole authentication properties
spring.cloud.vault: authentication: APPROLE app-role: role-id: bde2076b-cccb-3cf0-d57e-bca7b1e83a52 diff --git a/multi/multi_vault.config.backends.configurer.html b/multi/multi_vault.config.backends.configurer.html index feecb534..996aa2c4 100644 --- a/multi/multi_vault.config.backends.configurer.html +++ b/multi/multi_vault.config.backends.configurer.html @@ -1,6 +1,6 @@ -6. Configure PropertySourceLocator behavior Spring Cloud Vault uses property-based configuration to create
PropertySources +6. Configure PropertySourceLocator behavior Spring Cloud Vault uses property-based configuration to create
PropertySources for generic and discovered secret backends.Discovered backends provide
-VaultSecretBackendDescriptorbeans to describe the configuration state to use secret backend asPropertySource. ASecretBackendMetadataFactoryis required to create aSecretBackendMetadataobject which contains path, name and property transformation diff --git a/multi/multi_vault.config.backends.database-backends.html b/multi/multi_vault.config.backends.database-backends.html index 18b6c9b3..1c0edb00 100644 --- a/multi/multi_vault.config.backends.database-backends.html +++ b/multi/multi_vault.config.backends.database-backends.html @@ -1,6 +1,6 @@5. Database backends Vault supports several database secret backends to generate database +
5. Database backends Vault supports several database secret backends to generate database credentials dynamically based on configured roles. This means services that need to access a database no longer need to configure credentials: they can request them from Vault, and use Vault’s leasing diff --git a/multi/multi_vault.config.backends.html b/multi/multi_vault.config.backends.html index 01aca5fd..557d8829 100644 --- a/multi/multi_vault.config.backends.html +++ b/multi/multi_vault.config.backends.html @@ -1,6 +1,6 @@
-4. Secret Backends Spring Cloud Vault supports at the basic level the generic secret +
4. Secret Backends Spring Cloud Vault supports at the basic level the generic secret backend. The generic secret backend allows storage of arbitrary values as key-value store. A single context can store one or many key-value tuples. Contexts can be organized hierarchically. diff --git a/multi/multi_vault.config.fail-fast.html b/multi/multi_vault.config.fail-fast.html index 690bfc29..6272e366 100644 --- a/multi/multi_vault.config.fail-fast.html +++ b/multi/multi_vault.config.fail-fast.html @@ -1,6 +1,6 @@
-8. Vault Client Fail Fast In some cases, it may be desirable to fail startup of a service if +
8. Vault Client Fail Fast In some cases, it may be desirable to fail startup of a service if it cannot connect to the Vault Server. If this is the desired behavior, set the bootstrap configuration property
-spring.cloud.vault.fail-fast=trueand the client will halt with diff --git a/multi/multi_vault.config.ssl.html b/multi/multi_vault.config.ssl.html index cd4e69ed..b628a1b0 100644 --- a/multi/multi_vault.config.ssl.html +++ b/multi/multi_vault.config.ssl.html @@ -1,6 +1,6 @@9. Vault Client SSL configuration SSL can be configured declaratively by setting various properties. +
9. Vault Client SSL configuration SSL can be configured declaratively by setting various properties. You can set either
javax.net.ssl.trustStoreto configure JVM-wide SSL settings orspring.cloud.vault.ssl.trust-storeto set SSL settings only for Spring Cloud Vault Config.spring.cloud.vault: diff --git a/single/spring-cloud-vault.html b/single/spring-cloud-vault.html index b6a736b7..0463bfaf 100644 --- a/single/spring-cloud-vault.html +++ b/single/spring-cloud-vault.html @@ -1,6 +1,6 @@ -Spring Cloud Vault Table of Contents
© 2016-2018 The original authors.
Note Copies of this document may be made for your own use and for distribution to others, provided that you do not charge any fee for such copies and further provided that each copy contains this Copyright Notice, whether distributed in print or electronically.
Spring Cloud Vault Config provides client-side support for externalized configuration in a distributed system. With HashiCorp’s Vault you have a central place to manage external secret properties for applications across all environments. Vault can manage static and dynamic secrets such as username/password for remote applications/resources and provide credentials for external services such as MySQL, PostgreSQL, Apache Cassandra, MongoDB, Consul, AWS and more.
Prerequisites
To get started with Vault and this guide you need a +
Spring Cloud Vault Table of Contents
© 2016-2018 The original authors.
Note Copies of this document may be made for your own use and for distribution to others, provided that you do not charge any fee for such copies and further provided that each copy contains this Copyright Notice, whether distributed in print or electronically.
Spring Cloud Vault Config provides client-side support for externalized configuration in a distributed system. With HashiCorp’s Vault you have a central place to manage external secret properties for applications across all environments. Vault can manage static and dynamic secrets such as username/password for remote applications/resources and provide credentials for external services such as MySQL, PostgreSQL, Apache Cassandra, MongoDB, Consul, AWS and more.
Prerequisites
To get started with Vault and this guide you need a *NIX-like operating systems that provides:
wget,opensslandunzip- at least Java 7 and a properly configured
JAVA_HOMEenvironment variableInstall Vault
$ src/test/bash/install_vault.shCreate SSL certificates for Vault
$ src/test/bash/create_certificates.sh
Note
create_certificates.shcreates certificates inwork/caand a JKS truststorework/keystore.jks. If you want to run Spring Cloud Vault using this quickstart guide you need to configure the truststore thespring.cloud.vault.ssl.trust-storeproperty tofile:work/keystore.jks.$ src/test/bash/local_run_vault.shVault is started listening on
0.0.0.0:8200using theinmemstorage andhttps. Vault is sealed and not initialized when starting up.
![[Note]](images/note.png)
![[Important]](images/important.png)