diff --git a/docs/src/main/asciidoc/spring-cloud-vault-config.adoc b/docs/src/main/asciidoc/spring-cloud-vault-config.adoc index 0d5606e8..6e882aff 100644 --- a/docs/src/main/asciidoc/spring-cloud-vault-config.adoc +++ b/docs/src/main/asciidoc/spring-cloud-vault-config.adoc @@ -11,6 +11,7 @@ include::intro.adoc[] include::quickstart.adoc[] +[[vault.config.authentication]] == Authentication methods Different organizations have different requirements for security @@ -41,7 +42,7 @@ authentication method See also: https://www.vaultproject.io/docs/concepts/tokens.html[Vault Documentation: Tokens] -[[vault.authentication.appid]] +[[vault.config.authentication.appid]] === AppId authentication Vault supports https://www.vaultproject.io/docs/auth/app-id.html[AppId] @@ -148,7 +149,7 @@ See also: https://www.vaultproject.io/docs/auth/app-id.html[Vault Documentation: == AppRole authentication https://www.vaultproject.io/docs/auth/app-id.html[AppRole] is intended for machine -authentication, like the deprecated (since Vault 0.6.1) <>. +authentication, like the deprecated (since Vault 0.6.1) <>. AppRole authentication consists of two hard to guess (secret) tokens: RoleId and SecretId. Spring Vault supports AppRole authentication by providing either RoleId only @@ -267,10 +268,10 @@ certificates that are either signed by a CA or self-signed. To enable `cert` authentication you need to: -1. Use SSL, see <> +1. Use SSL, see <> 2. Configure a Java `Keystore` that contains the client certificate and the private key -3. Set the `spring.cloud.vault.authentication` to `CERT` +3. Set the `spring.cloud.vault.config.authentication` to `CERT` [source,yaml] .bootstrap.yml @@ -283,14 +284,7 @@ spring.cloud.vault: cert-auth-path: cert ---- -* `key-store` sets the resource for the key-store. SSL-secured Vault -communication will validate the Vault SSL certificate with the specified -trust-store. -* `key-store-password` sets the key-store password -* `cert-auth-path` sets the path of the cert authentication mount to use - -See also: https://www.vaultproject.io/docs/auth/cert.html[Vault Documentation: Using the cert auth backend] - +See also: https://www.vaultproject.io/docs/auth/cert.html[Vault Documentation: Using the Cert auth backend] == Cubbyhole authentication @@ -330,12 +324,13 @@ spring.cloud.vault: See also: * https://www.vaultproject.io/docs/concepts/tokens.html[Vault Documentation: Tokens] -* https://www.vaultproject.io/docs/secrets/cubbyhole/index.html[Vault Documentation:Cubbyhole Secret Backend] +* https://www.vaultproject.io/docs/secrets/cubbyhole/index.html[Vault Documentation: Cubbyhole Secret Backend] * https://www.vaultproject.io/docs/concepts/response-wrapping.html[Vault Documentation: Response Wrapping] -== Backends +[[vault.config.backends]] +== Secret Backends -[[vault-client-generic]] +[[vault.config.backends.generic]] === Generic Backend Spring Cloud Vault supports at the basic level the generic secret @@ -376,7 +371,7 @@ profile name in property sources with profiles See also: https://www.vaultproject.io/docs/secrets/generic/index.html[Vault Documentation: Using the generic secret backend] -[[vault-client-consul]] +[[vault.config.backends.consul]] === Consul Spring Cloud Vault can obtain credentials for Hashicorp Consul. @@ -421,7 +416,7 @@ spring.cloud.vault: See also: https://www.vaultproject.io/docs/secrets/consul/index.html[Vault Documentation: Setting up Consul with Vault] -[[vault-client-rabbitmq]] +[[vault.config.backends.rabbitmq]] === RabbitMQ Spring Cloud Vault can obtain credentials for RabbitMQ. @@ -470,7 +465,7 @@ spring.cloud.vault: See also: https://www.vaultproject.io/docs/secrets/rabbit/index.html[Vault Documentation: Setting up RabbitMQ with Vault] -[[vault-client-aws]] +[[vault.config.backends.aws]] === AWS Spring Cloud Vault can obtain credentials for AWS. @@ -519,7 +514,7 @@ spring.cloud.vault: See also: https://www.vaultproject.io/docs/secrets/aws/index.html[Vault Documentation: Setting up AWS with Vault] -[[vault-client-database-backends]] +[[vault.config.backends.database-backends]] == Database backends Vault supports several database secret backends to generate database @@ -530,10 +525,10 @@ mechanism to more easily roll keys. Spring Cloud Vault integrates with these backends: -* <> -* <> -* <> -* <> +* <> +* <> +* <> +* <> Using a database secret backend requires to enable the backend in the configuration and the `spring-cloud-vault-config-databases` @@ -555,7 +550,7 @@ NOTE: Enabling multiple JDBC-compliant databases will generate credentials and store them by default in the same property keys hence property names for JDBC secrets need to be configured separately. -[[vault-client-database-cassandra]] +[[vault.config.backends.cassandra]] === Apache Cassandra Spring Cloud Vault can obtain credentials for Apache Cassandra. @@ -589,7 +584,7 @@ spring.cloud.vault: See also: https://www.vaultproject.io/docs/secrets/cassandra/index.html[Vault Documentation: Setting up Apache Cassandra with Vault] -[[vault-client-database-mongodb]] +[[vault.config.backends.mongodb]] === MongoDB Spring Cloud Vault can obtain credentials for MongoDB. @@ -623,7 +618,7 @@ spring.cloud.vault: See also: https://www.vaultproject.io/docs/secrets/mongodb/index.html[Vault Documentation: Setting up MongoDB with Vault] -[[vault-client-database-mysql]] +[[vault.config.backends.mysql]] === MySQL Spring Cloud Vault can obtain credentials for MySQL. @@ -657,7 +652,7 @@ spring.cloud.vault: See also: https://www.vaultproject.io/docs/secrets/mysql/index.html[Vault Documentation: Setting up MySQL with Vault] -[[vault-client-database-postgresql]] +[[vault.config.backends.postgresql]] === PostgreSQL Spring Cloud Vault can obtain credentials for PostgreSQL. @@ -691,7 +686,7 @@ spring.cloud.vault: See also: https://www.vaultproject.io/docs/secrets/postgresql/index.html[Vault Documentation: Setting up PostgreSQL with Vault] -[[vault-client-fail-fast]] +[[vault.config.fail-fast]] == Vault Client Fail Fast In some cases, it may be desirable to fail startup of a service if @@ -706,7 +701,7 @@ spring.cloud.vault: fail-fast: true ---- -[[vault-client-ssl]] +[[vault.config.ssl]] == Vault Client SSL configuration SSL can be configured declaratively by setting various properties. diff --git a/spring-cloud-vault-config/src/test/java/org/springframework/cloud/vault/config/VaultConfigAppIdTests.java b/spring-cloud-vault-config/src/test/java/org/springframework/cloud/vault/config/VaultConfigAppIdTests.java index 1b64f76b..8ec55b67 100644 --- a/spring-cloud-vault-config/src/test/java/org/springframework/cloud/vault/config/VaultConfigAppIdTests.java +++ b/spring-cloud-vault-config/src/test/java/org/springframework/cloud/vault/config/VaultConfigAppIdTests.java @@ -15,15 +15,10 @@ */ package org.springframework.cloud.vault.config; -import static org.assertj.core.api.Assertions.*; - import java.util.Collections; import java.util.HashMap; import java.util.Map; -import org.junit.BeforeClass; -import org.junit.Test; -import org.junit.runner.RunWith; import org.springframework.beans.factory.annotation.Value; import org.springframework.boot.SpringApplication; import org.springframework.boot.autoconfigure.SpringBootApplication; @@ -34,9 +29,16 @@ import org.springframework.test.context.junit4.SpringJUnit4ClassRunner; import org.springframework.vault.authentication.IpAddressUserId; import org.springframework.vault.core.VaultOperations; +import static org.assertj.core.api.Assertions.*; + +import org.junit.BeforeClass; +import org.junit.Test; +import org.junit.runner.RunWith; + /** - * Integration test using config infrastructure with AppId authentication. In case this - * test should fail because of SSL make sure you run the test within the + * Integration test using config infrastructure with AppId authentication. + *

+ * In case this test should fail because of SSL make sure you run the test within the * spring-cloud-vault-config/spring-cloud-vault-config directory as the keystore is * referenced with {@code ../work/keystore.jks}. * @@ -101,7 +103,6 @@ public class VaultConfigAppIdTests { @Test public void contextLoads() { - assertThat(configValue).isEqualTo("foo"); } diff --git a/spring-cloud-vault-config/src/test/java/org/springframework/cloud/vault/config/VaultConfigAppRoleTests.java b/spring-cloud-vault-config/src/test/java/org/springframework/cloud/vault/config/VaultConfigAppRoleTests.java index eed31954..54c62710 100644 --- a/spring-cloud-vault-config/src/test/java/org/springframework/cloud/vault/config/VaultConfigAppRoleTests.java +++ b/spring-cloud-vault-config/src/test/java/org/springframework/cloud/vault/config/VaultConfigAppRoleTests.java @@ -27,19 +27,19 @@ import org.springframework.cloud.vault.util.Settings; import org.springframework.cloud.vault.util.VaultRule; import org.springframework.cloud.vault.util.Version; import org.springframework.test.context.junit4.SpringJUnit4ClassRunner; -import org.springframework.vault.authentication.IpAddressUserId; import org.springframework.vault.core.VaultOperations; import static org.assertj.core.api.Assertions.*; -import static org.junit.Assume.assumeTrue; +import static org.junit.Assume.*; import org.junit.BeforeClass; import org.junit.Test; import org.junit.runner.RunWith; /** - * Integration test using config infrastructure with AppRole authentication. In case this - * test should fail because of SSL make sure you run the test within the + * Integration test using config infrastructure with AppRole authentication. + *

+ * In case this test should fail because of SSL make sure you run the test within the * spring-cloud-vault-config/spring-cloud-vault-config directory as the keystore is * referenced with {@code ../work/keystore.jks}. * @@ -106,7 +106,6 @@ public class VaultConfigAppRoleTests { @Test public void contextLoads() { - assertThat(configValue).isEqualTo("foo"); } diff --git a/spring-cloud-vault-config/src/test/java/org/springframework/cloud/vault/config/VaultConfigCubbyholeAuthenticationTests.java b/spring-cloud-vault-config/src/test/java/org/springframework/cloud/vault/config/VaultConfigCubbyholeAuthenticationTests.java index a2fba55b..653531c1 100644 --- a/spring-cloud-vault-config/src/test/java/org/springframework/cloud/vault/config/VaultConfigCubbyholeAuthenticationTests.java +++ b/spring-cloud-vault-config/src/test/java/org/springframework/cloud/vault/config/VaultConfigCubbyholeAuthenticationTests.java @@ -15,16 +15,8 @@ */ package org.springframework.cloud.vault.config; -import static org.assertj.core.api.Assertions.*; -import static org.junit.Assume.*; - import java.util.Collections; -import org.junit.AfterClass; -import org.junit.BeforeClass; -import org.junit.Test; -import org.junit.runner.RunWith; - import org.springframework.beans.factory.annotation.Value; import org.springframework.boot.SpringApplication; import org.springframework.boot.autoconfigure.SpringBootApplication; @@ -39,9 +31,18 @@ import org.springframework.vault.client.VaultResponseEntity; import org.springframework.vault.core.VaultOperations; import org.springframework.vault.support.VaultResponse; +import static org.assertj.core.api.Assertions.*; +import static org.junit.Assume.*; + +import org.junit.AfterClass; +import org.junit.BeforeClass; +import org.junit.Test; +import org.junit.runner.RunWith; + /** - * Integration test using config infrastructure with Cubbyhole authentication. In case - * this test should fail because of SSL make sure you run the test within the + * Integration test using config infrastructure with Cubbyhole authentication. + *

+ * In case this test should fail because of SSL make sure you run the test within the * spring-cloud-vault-config/spring-cloud-vault-config directory as the keystore is * referenced with {@code ../work/keystore.jks}. * @@ -64,12 +65,13 @@ public class VaultConfigCubbyholeAuthenticationTests { VaultOperations vaultOperations = vaultRule.prepare().getVaultOperations(); - vaultOperations.write( - "secret/" + VaultConfigCubbyholeAuthenticationTests.class.getSimpleName(), - Collections.singletonMap("vault.value", "foo")); + vaultOperations + .write("secret/" + + VaultConfigCubbyholeAuthenticationTests.class.getSimpleName(), + Collections.singletonMap("vault.value", "foo")); - VaultResponseEntity entity = vaultOperations.doWithVault( - new VaultOperations.SessionCallback>() { + VaultResponseEntity entity = vaultOperations + .doWithVault(new VaultOperations.SessionCallback>() { @Override public VaultResponseEntity doWithVault( VaultOperations.VaultSession session) { @@ -97,7 +99,6 @@ public class VaultConfigCubbyholeAuthenticationTests { @Test public void contextLoads() { - assertThat(configValue).isEqualTo("foo"); } diff --git a/spring-cloud-vault-config/src/test/java/org/springframework/cloud/vault/config/VaultConfigDisabledTests.java b/spring-cloud-vault-config/src/test/java/org/springframework/cloud/vault/config/VaultConfigDisabledTests.java index d7350448..ca0bce83 100644 --- a/spring-cloud-vault-config/src/test/java/org/springframework/cloud/vault/config/VaultConfigDisabledTests.java +++ b/spring-cloud-vault-config/src/test/java/org/springframework/cloud/vault/config/VaultConfigDisabledTests.java @@ -15,13 +15,8 @@ */ package org.springframework.cloud.vault.config; -import static org.assertj.core.api.Assertions.*; - import java.util.Collections; -import org.junit.BeforeClass; -import org.junit.Test; -import org.junit.runner.RunWith; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.boot.SpringApplication; import org.springframework.boot.autoconfigure.SpringBootApplication; @@ -32,9 +27,16 @@ import org.springframework.core.env.Environment; import org.springframework.test.context.junit4.SpringJUnit4ClassRunner; import org.springframework.vault.client.VaultClient; +import static org.assertj.core.api.Assertions.*; + +import org.junit.BeforeClass; +import org.junit.Test; +import org.junit.runner.RunWith; + /** - * Integration test using config infrastructure with token authentication. In case this - * test should fail because of SSL make sure you run the test within the + * Integration test using config infrastructure with token authentication. + *

+ * In case this test should fail because of SSL make sure you run the test within the * spring-cloud-vault-config/spring-cloud-vault-config directory as the keystore is * referenced with {@code ../work/keystore.jks}. * @@ -50,8 +52,11 @@ public class VaultConfigDisabledTests { VaultRule vaultRule = new VaultRule(); vaultRule.before(); - vaultRule.prepare().getVaultOperations().write("secret/testVaultApp", - Collections.singletonMap("vault.value", "foo")); + vaultRule + .prepare() + .getVaultOperations() + .write("secret/testVaultApp", + Collections.singletonMap("vault.value", "foo")); } @Autowired diff --git a/spring-cloud-vault-config/src/test/java/org/springframework/cloud/vault/config/VaultConfigGenericBackendDisabledTests.java b/spring-cloud-vault-config/src/test/java/org/springframework/cloud/vault/config/VaultConfigGenericBackendDisabledTests.java index 9823fc07..d12102ba 100644 --- a/spring-cloud-vault-config/src/test/java/org/springframework/cloud/vault/config/VaultConfigGenericBackendDisabledTests.java +++ b/spring-cloud-vault-config/src/test/java/org/springframework/cloud/vault/config/VaultConfigGenericBackendDisabledTests.java @@ -15,13 +15,8 @@ */ package org.springframework.cloud.vault.config; -import static org.assertj.core.api.Assertions.*; - import java.util.Collections; -import org.junit.BeforeClass; -import org.junit.Test; -import org.junit.runner.RunWith; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.boot.SpringApplication; import org.springframework.boot.autoconfigure.SpringBootApplication; @@ -30,9 +25,16 @@ import org.springframework.cloud.vault.util.VaultRule; import org.springframework.core.env.Environment; import org.springframework.test.context.junit4.SpringJUnit4ClassRunner; +import static org.assertj.core.api.Assertions.*; + +import org.junit.BeforeClass; +import org.junit.Test; +import org.junit.runner.RunWith; + /** - * Integration test using config infrastructure with token authentication. In case this - * test should fail because of SSL make sure you run the test within the + * Integration test using config infrastructure with token authentication. + *

+ * In case this test should fail because of SSL make sure you run the test within the * spring-cloud-vault-config/spring-cloud-vault-config directory as the keystore is * referenced with {@code ../work/keystore.jks}. * @@ -48,8 +50,11 @@ public class VaultConfigGenericBackendDisabledTests { VaultRule vaultRule = new VaultRule(); vaultRule.before(); - vaultRule.prepare().getVaultOperations().write("secret/testVaultApp", - Collections.singletonMap("vault.value", "foo")); + vaultRule + .prepare() + .getVaultOperations() + .write("secret/testVaultApp", + Collections.singletonMap("vault.value", "foo")); } @Autowired diff --git a/spring-cloud-vault-config/src/test/java/org/springframework/cloud/vault/config/VaultConfigTests.java b/spring-cloud-vault-config/src/test/java/org/springframework/cloud/vault/config/VaultConfigTests.java index 6f199b22..8edc9640 100644 --- a/spring-cloud-vault-config/src/test/java/org/springframework/cloud/vault/config/VaultConfigTests.java +++ b/spring-cloud-vault-config/src/test/java/org/springframework/cloud/vault/config/VaultConfigTests.java @@ -15,13 +15,8 @@ */ package org.springframework.cloud.vault.config; -import static org.assertj.core.api.Assertions.*; - import java.util.Collections; -import org.junit.BeforeClass; -import org.junit.Test; -import org.junit.runner.RunWith; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.beans.factory.annotation.Value; import org.springframework.boot.SpringApplication; @@ -35,9 +30,16 @@ import org.springframework.test.context.junit4.SpringJUnit4ClassRunner; import org.springframework.vault.client.VaultClient; import org.springframework.web.client.RestTemplate; +import static org.assertj.core.api.Assertions.*; + +import org.junit.BeforeClass; +import org.junit.Test; +import org.junit.runner.RunWith; + /** - * Integration test using config infrastructure with token authentication. In case this - * test should fail because of SSL make sure you run the test within the + * Integration test using config infrastructure with token authentication. + *

+ * In case this test should fail because of SSL make sure you run the test within the * spring-cloud-vault-config/spring-cloud-vault-config directory as the keystore is * referenced with {@code ../work/keystore.jks}. * @@ -53,8 +55,11 @@ public class VaultConfigTests { VaultRule vaultRule = new VaultRule(); vaultRule.before(); - vaultRule.prepare().getVaultOperations().write("secret/testVaultApp", - Collections.singletonMap("vault.value", "foo")); + vaultRule + .prepare() + .getVaultOperations() + .write("secret/testVaultApp", + Collections.singletonMap("vault.value", "foo")); } @Value("${vault.value}") diff --git a/spring-cloud-vault-config/src/test/java/org/springframework/cloud/vault/config/VaultConfigTlsCertAuthenticationTests.java b/spring-cloud-vault-config/src/test/java/org/springframework/cloud/vault/config/VaultConfigTlsCertAuthenticationTests.java index b16a5cbb..85cf87b3 100644 --- a/spring-cloud-vault-config/src/test/java/org/springframework/cloud/vault/config/VaultConfigTlsCertAuthenticationTests.java +++ b/spring-cloud-vault-config/src/test/java/org/springframework/cloud/vault/config/VaultConfigTlsCertAuthenticationTests.java @@ -97,7 +97,6 @@ public class VaultConfigTlsCertAuthenticationTests { @Test public void contextLoads() { - assertThat(configValue).isEqualTo("foo"); } diff --git a/spring-cloud-vault-config/src/test/java/org/springframework/cloud/vault/config/VaultConfigWithContextTests.java b/spring-cloud-vault-config/src/test/java/org/springframework/cloud/vault/config/VaultConfigWithContextTests.java index bc25fd20..084f86d3 100644 --- a/spring-cloud-vault-config/src/test/java/org/springframework/cloud/vault/config/VaultConfigWithContextTests.java +++ b/spring-cloud-vault-config/src/test/java/org/springframework/cloud/vault/config/VaultConfigWithContextTests.java @@ -15,13 +15,8 @@ */ package org.springframework.cloud.vault.config; -import static org.assertj.core.api.Assertions.*; - import java.util.Collections; -import org.junit.BeforeClass; -import org.junit.Test; -import org.junit.runner.RunWith; import org.springframework.beans.factory.annotation.Value; import org.springframework.boot.SpringApplication; import org.springframework.boot.autoconfigure.SpringBootApplication; @@ -31,9 +26,16 @@ import org.springframework.test.context.ActiveProfiles; import org.springframework.test.context.junit4.SpringJUnit4ClassRunner; import org.springframework.vault.core.VaultOperations; +import static org.assertj.core.api.Assertions.*; + +import org.junit.BeforeClass; +import org.junit.Test; +import org.junit.runner.RunWith; + /** - * Integration test using config infrastructure with token authentication. In case this - * test should fail because of SSL make sure you run the test within the + * Integration test using config infrastructure with token authentication. + *

+ * In case this test should fail because of SSL make sure you run the test within the * spring-cloud-vault-config/spring-cloud-vault-config directory as the keystore is * referenced with {@code ../work/keystore.jks}. * diff --git a/spring-cloud-vault-config/src/test/java/org/springframework/cloud/vault/config/VaultHealthIndicatorUnitTests.java b/spring-cloud-vault-config/src/test/java/org/springframework/cloud/vault/config/VaultHealthIndicatorUnitTests.java index 259f8edc..a2391bc0 100644 --- a/spring-cloud-vault-config/src/test/java/org/springframework/cloud/vault/config/VaultHealthIndicatorUnitTests.java +++ b/spring-cloud-vault-config/src/test/java/org/springframework/cloud/vault/config/VaultHealthIndicatorUnitTests.java @@ -15,6 +15,12 @@ */ package org.springframework.cloud.vault.config; +import org.springframework.boot.actuate.health.Health; +import org.springframework.boot.actuate.health.Status; +import org.springframework.vault.core.VaultOperations; +import org.springframework.vault.core.VaultSysOperations; +import org.springframework.vault.support.VaultHealth; + import static org.assertj.core.api.Assertions.*; import static org.mockito.Mockito.*; @@ -24,13 +30,10 @@ import org.junit.runner.RunWith; import org.mockito.InjectMocks; import org.mockito.Mock; import org.mockito.runners.MockitoJUnitRunner; -import org.springframework.boot.actuate.health.Health; -import org.springframework.boot.actuate.health.Status; -import org.springframework.vault.core.VaultOperations; -import org.springframework.vault.core.VaultSysOperations; -import org.springframework.vault.support.VaultHealth; /** + * Unit tests for {@link VaultHealthIndicator}. + * * @author Mark Paluch */ @RunWith(MockitoJUnitRunner.class) @@ -109,4 +112,4 @@ public class VaultHealthIndicatorUnitTests { assertThat(health.getStatus()).isEqualTo(Status.DOWN); assertThat(health.getDetails()).containsKey("error"); } -} \ No newline at end of file +}