From 889a89d2d2d8445fd83be7b4064d2f3a5c3c7d03 Mon Sep 17 00:00:00 2001 From: buildmaster Date: Tue, 28 Nov 2017 04:37:03 +0000 Subject: [PATCH] Sync docs from master to gh-pages --- multi/multi__client_side_usage.html | 2 +- multi/multi_spring-cloud-vault.html | 2 +- ...ult.config.backends.database-backends.html | 41 +++++++++++---- multi/multi_vault.config.backends.html | 6 +-- single/spring-cloud-vault.html | 51 ++++++++++++++----- spring-cloud-vault.html | 2 +- 6 files changed, 75 insertions(+), 29 deletions(-) diff --git a/multi/multi__client_side_usage.html b/multi/multi__client_side_usage.html index 15b1dd82..9317ea11 100644 --- a/multi/multi__client_side_usage.html +++ b/multi/multi__client_side_usage.html @@ -13,7 +13,7 @@ the test cases). Example Maven configuration:

<dependency> <groupId>org.springframework.cloud</groupId> <artifactId>spring-cloud-starter-vault-config</artifactId> - <version>1.2.0.BUILD-SNAPSHOT</version> + <version>2.0.0.BUILD-SNAPSHOT</version> </dependency> <dependency> <groupId>org.springframework.boot</groupId> diff --git a/multi/multi_spring-cloud-vault.html b/multi/multi_spring-cloud-vault.html index 5c157ee5..3b5056a6 100644 --- a/multi/multi_spring-cloud-vault.html +++ b/multi/multi_spring-cloud-vault.html @@ -1,3 +1,3 @@ - Spring Cloud Vault
Spring Cloud Vault
   Next

Spring Cloud Vault

Table of Contents

1. Quick Start
2. Client Side Usage
2.1. Authentication
3. Authentication methods
3.1. Token authentication
3.2. AppId authentication
3.2.1. Custom UserId
3.3. AppRole authentication
3.4. AWS-EC2 authentication
3.5. AWS-IAM authentication
3.6. TLS certificate authentication
3.7. Cubbyhole authentication
3.8. Kubernetes authentication
4. Secret Backends
4.1. Generic Backend
4.2. Consul
4.3. RabbitMQ
4.4. AWS
5. Database backends
5.1. Apache Cassandra
5.2. MongoDB
5.3. MySQL
5.4. PostgreSQL
6. Configure PropertySourceLocator behavior
7. Service Registry Configuration
8. Vault Client Fail Fast
9. Vault Client SSL configuration
10. Lease lifecycle management (renewal and revocation)
   Next
   
\ No newline at end of file + Spring Cloud Vault
Spring Cloud Vault
   Next

Spring Cloud Vault

Table of Contents

1. Quick Start
2. Client Side Usage
2.1. Authentication
3. Authentication methods
3.1. Token authentication
3.2. AppId authentication
3.2.1. Custom UserId
3.3. AppRole authentication
3.4. AWS-EC2 authentication
3.5. AWS-IAM authentication
3.6. TLS certificate authentication
3.7. Cubbyhole authentication
3.8. Kubernetes authentication
4. Secret Backends
4.1. Generic Backend
4.2. Consul
4.3. RabbitMQ
4.4. AWS
5. Database backends
5.1. Database
5.2. Apache Cassandra
5.3. MongoDB
5.4. MySQL
5.5. PostgreSQL
6. Configure PropertySourceLocator behavior
7. Service Registry Configuration
8. Vault Client Fail Fast
9. Vault Client SSL configuration
10. Lease lifecycle management (renewal and revocation)
   Next
   
\ No newline at end of file diff --git a/multi/multi_vault.config.backends.database-backends.html b/multi/multi_vault.config.backends.database-backends.html index 01a52ae8..4056a981 100644 --- a/multi/multi_vault.config.backends.database-backends.html +++ b/multi/multi_vault.config.backends.database-backends.html @@ -4,20 +4,38 @@ credentials dynamically based on configured roles. This means services that need to access a database no longer need to configure credentials: they can request them from Vault, and use Vault’s leasing -mechanism to more easily roll keys.

Spring Cloud Vault integrates with these backends:

Using a database secret backend requires to enable the +mechanism to more easily roll keys.

Spring Cloud Vault integrates with these backends:

Using a database secret backend requires to enable the backend in the configuration and the spring-cloud-vault-config-databases dependency.

Vault ships since 0.7.1 with a dedicated database secret backend that allows -database integration via plugins. You can use that specific backend by adapting -one of the JDBC database properties above. Make sure to specify the appropriate -backend path, e.g. spring.cloud.vault.mysql.role.backend=database.

Example 5.1. pom.xml

<dependencies>
+database integration via plugins. You can use that specific backend by using the
+generic database backend. Make sure to specify the appropriate
+backend path, e.g. spring.cloud.vault.mysql.role.backend=database.
Example 5.1. pom.xml
<dependencies>
     <dependency>
         <groupId>org.springframework.cloud</groupId>
         <artifactId>spring-cloud-vault-config-databases</artifactId>
-        <version>1.2.0.BUILD-SNAPSHOT</version>
+        <version>2.0.0.BUILD-SNAPSHOT</version>
     </dependency>
 </dependencies>

[Note]Note
Enabling multiple JDBC-compliant databases will generate credentials
 and store them by default in the same property keys hence property names for
-JDBC secrets need to be configured separately.
5.1 Apache Cassandra
Spring Cloud Vault can obtain credentials for Apache Cassandra.
+JDBC secrets need to be configured separately.
5.1 Database
Spring Cloud Vault can obtain credentials for any database listed at
+https://www.vaultproject.io/api/secret/databases/index.html.
+The integration can be enabled by setting
+spring.cloud.vault.database.enabled=true (default false) and
+providing the role name with spring.cloud.vault.database.role=….
While the database backend is a generic one, spring.cloud.vault.database
+specifically targets JDBC databases. Username and password are
+stored in spring.datasource.username and spring.datasource.password
+so using Spring Boot will pick up the generated credentials
+for your DataSource without further configuration.
+You can configure the property names by setting
+spring.cloud.vault.database.username-property and
+spring.cloud.vault.database.password-property.
spring.cloud.vault:
+    database:
+        enabled: true
+        role: readonly
+        backend: database
+        username-property: spring.datasource.username
+        password-property: spring.datasource.username
  • enabled setting this value to true enables the Database backend config usage
  • role sets the role name of the Database role definition
  • backend sets the path of the Database mount to use
  • username-property sets the property name in which the Database username is stored
  • password-property sets the property name in which the Database password is stored
See also: Vault Documentation: Database Secrets backend
5.2 Apache Cassandra
[Note]Note
The cassandra backend has been deprecated in Vault 0.7.1 and
+it is recommended to use the database backend and mount it as cassandra.
Spring Cloud Vault can obtain credentials for Apache Cassandra.
 The integration can be enabled by setting
 spring.cloud.vault.cassandra.enabled=true (default false) and
 providing the role name with spring.cloud.vault.cassandra.role=….
Username and password are stored in spring.data.cassandra.username
@@ -31,7 +49,8 @@ You can configure the property names by setting
         role: readonly
         backend: cassandra
         username-property: spring.data.cassandra.username
-        password-property: spring.data.cassandra.username
  • enabled setting this value to true enables the Cassandra backend config usage
  • role sets the role name of the Cassandra role definition
  • backend sets the path of the Cassandra mount to use
  • username-property sets the property name in which the Cassandra username is stored
  • password-property sets the property name in which the Cassandra password is stored

See also: Vault Documentation: Setting up Apache Cassandra with Vault

5.2 MongoDB

Spring Cloud Vault can obtain credentials for MongoDB. + password-property: spring.data.cassandra.username

  • enabled setting this value to true enables the Cassandra backend config usage
  • role sets the role name of the Cassandra role definition
  • backend sets the path of the Cassandra mount to use
  • username-property sets the property name in which the Cassandra username is stored
  • password-property sets the property name in which the Cassandra password is stored

See also: Vault Documentation: Setting up Apache Cassandra with Vault

5.3 MongoDB

[Note]Note

The mongodb backend has been deprecated in Vault 0.7.1 and +it is recommended to use the database backend and mount it as mongodb.

Spring Cloud Vault can obtain credentials for MongoDB. The integration can be enabled by setting spring.cloud.vault.mongodb.enabled=true (default false) and providing the role name with spring.cloud.vault.mongodb.role=….

Username and password are stored in spring.data.mongodb.username @@ -45,7 +64,9 @@ You can configure the property names by setting role: readonly backend: mongodb username-property: spring.data.mongodb.username - password-property: spring.data.mongodb.password

See also: Vault Documentation: Setting up MongoDB with Vault

5.3 MySQL

Spring Cloud Vault can obtain credentials for MySQL. + password-property: spring.data.mongodb.password

See also: Vault Documentation: Setting up MongoDB with Vault

5.4 MySQL

[Note]Note

The mysql backend has been deprecated in Vault 0.7.1 and +it is recommended to use the database backend and mount it as mysql. +Configuration for spring.cloud.vault.mysql will be removed in a future version.

Spring Cloud Vault can obtain credentials for MySQL. The integration can be enabled by setting spring.cloud.vault.mysql.enabled=true (default false) and providing the role name with spring.cloud.vault.mysql.role=….

Username and password are stored in spring.datasource.username @@ -59,7 +80,9 @@ You can configure the property names by setting role: readonly backend: mysql username-property: spring.datasource.username - password-property: spring.datasource.username

See also: Vault Documentation: Setting up MySQL with Vault

5.4 PostgreSQL

Spring Cloud Vault can obtain credentials for PostgreSQL. + password-property: spring.datasource.username

See also: Vault Documentation: Setting up MySQL with Vault

5.5 PostgreSQL

[Note]Note

The postgresql backend has been deprecated in Vault 0.7.1 and +it is recommended to use the database backend and mount it as postgresql. +Configuration for spring.cloud.vault.postgresql will be removed in a future version.

Spring Cloud Vault can obtain credentials for PostgreSQL. The integration can be enabled by setting spring.cloud.vault.postgresql.enabled=true (default false) and providing the role name with spring.cloud.vault.postgresql.role=….

Username and password are stored in spring.datasource.username diff --git a/multi/multi_vault.config.backends.html b/multi/multi_vault.config.backends.html index 3b5e1989..3b67bf73 100644 --- a/multi/multi_vault.config.backends.html +++ b/multi/multi_vault.config.backends.html @@ -26,7 +26,7 @@ dependency.

<dependency> <groupId>org.springframework.cloud</groupId> <artifactId>spring-cloud-vault-config-consul</artifactId> - <version>1.2.0.BUILD-SNAPSHOT</version> + <version>2.0.0.BUILD-SNAPSHOT</version> </dependency> </dependencies>


The integration can be enabled by setting spring.cloud.vault.consul.enabled=true (default false) and @@ -43,7 +43,7 @@ dependency.

<dependency> <groupId>org.springframework.cloud</groupId> <artifactId>spring-cloud-vault-config-rabbitmq</artifactId> - <version>1.2.0.BUILD-SNAPSHOT</version> + <version>2.0.0.BUILD-SNAPSHOT</version> </dependency> </dependencies>


The integration can be enabled by setting spring.cloud.vault.rabbitmq.enabled=true (default false) @@ -62,7 +62,7 @@ dependency.

<dependency> <groupId>org.springframework.cloud</groupId> <artifactId>spring-cloud-vault-config-aws</artifactId> - <version>1.2.0.BUILD-SNAPSHOT</version> + <version>2.0.0.BUILD-SNAPSHOT</version> </dependency> </dependencies>


The integration can be enabled by setting spring.cloud.vault.aws=true (default false) diff --git a/single/spring-cloud-vault.html b/single/spring-cloud-vault.html index b28b0db5..3a420af3 100644 --- a/single/spring-cloud-vault.html +++ b/single/spring-cloud-vault.html @@ -1,6 +1,6 @@ - Spring Cloud Vault

Spring Cloud Vault

Table of Contents

1. Quick Start
2. Client Side Usage
2.1. Authentication
3. Authentication methods
3.1. Token authentication
3.2. AppId authentication
3.2.1. Custom UserId
3.3. AppRole authentication
3.4. AWS-EC2 authentication
3.5. AWS-IAM authentication
3.6. TLS certificate authentication
3.7. Cubbyhole authentication
3.8. Kubernetes authentication
4. Secret Backends
4.1. Generic Backend
4.2. Consul
4.3. RabbitMQ
4.4. AWS
5. Database backends
5.1. Apache Cassandra
5.2. MongoDB
5.3. MySQL
5.4. PostgreSQL
6. Configure PropertySourceLocator behavior
7. Service Registry Configuration
8. Vault Client Fail Fast
9. Vault Client SSL configuration
10. Lease lifecycle management (renewal and revocation)

© 2016-2017 The original authors.

[Note]Note

Copies of this document may be made for your own use and for distribution to others, provided that you do not charge any fee for such copies and further provided that each copy contains this Copyright Notice, whether distributed in print or electronically.

Spring Cloud Vault Config provides client-side support for externalized configuration in a distributed system. With HashiCorp’s Vault you have a central place to manage external secret properties for applications across all environments. Vault can manage static and dynamic secrets such as username/password for remote applications/resources and provide credentials for external services such as MySQL, PostgreSQL, Apache Cassandra, MongoDB, Consul, AWS and more.

1. Quick Start

Prerequisites

To get started with Vault and this guide you need a + Spring Cloud Vault

Spring Cloud Vault

Table of Contents

1. Quick Start
2. Client Side Usage
2.1. Authentication
3. Authentication methods
3.1. Token authentication
3.2. AppId authentication
3.2.1. Custom UserId
3.3. AppRole authentication
3.4. AWS-EC2 authentication
3.5. AWS-IAM authentication
3.6. TLS certificate authentication
3.7. Cubbyhole authentication
3.8. Kubernetes authentication
4. Secret Backends
4.1. Generic Backend
4.2. Consul
4.3. RabbitMQ
4.4. AWS
5. Database backends
5.1. Database
5.2. Apache Cassandra
5.3. MongoDB
5.4. MySQL
5.5. PostgreSQL
6. Configure PropertySourceLocator behavior
7. Service Registry Configuration
8. Vault Client Fail Fast
9. Vault Client SSL configuration
10. Lease lifecycle management (renewal and revocation)

© 2016-2017 The original authors.

[Note]Note

Copies of this document may be made for your own use and for distribution to others, provided that you do not charge any fee for such copies and further provided that each copy contains this Copyright Notice, whether distributed in print or electronically.

Spring Cloud Vault Config provides client-side support for externalized configuration in a distributed system. With HashiCorp’s Vault you have a central place to manage external secret properties for applications across all environments. Vault can manage static and dynamic secrets such as username/password for remote applications/resources and provide credentials for external services such as MySQL, PostgreSQL, Apache Cassandra, MongoDB, Consul, AWS and more.

1. Quick Start

Prerequisites

To get started with Vault and this guide you need a *NIX-like operating systems that provides:

  • wget, openssl and unzip
  • at least Java 7 and a properly configured JAVA_HOME environment variable

Install Vault

$ src/test/bash/install_vault.sh

Create SSL certificates for Vault

$ src/test/bash/create_certificates.sh
[Note]Note

create_certificates.sh creates certificates in work/ca and a JKS truststore work/keystore.jks. If you want to run Spring Cloud Vault using this quickstart guide you need to configure the truststore the spring.cloud.vault.ssl.trust-store property to file:work/keystore.jks.

Start Vault server

$ src/test/bash/local_run_vault.sh

Vault is started listening on 0.0.0.0:8200 using the inmem storage and https. Vault is sealed and not initialized when starting up.

[Note]Note

If you want to run tests, leave Vault uninitialized. The tests will @@ -47,7 +47,7 @@ the test cases). Example Maven configuration:

<dependency> <groupId>org.springframework.cloud</groupId> <artifactId>spring-cloud-starter-vault-config</artifactId> - <version>1.2.0.BUILD-SNAPSHOT</version> + <version>2.0.0.BUILD-SNAPSHOT</version> </dependency> <dependency> <groupId>org.springframework.boot</groupId> @@ -260,7 +260,7 @@ dependency.

<dependency> <groupId>org.springframework.cloud</groupId> <artifactId>spring-cloud-vault-config-consul</artifactId> - <version>1.2.0.BUILD-SNAPSHOT</version> + <version>2.0.0.BUILD-SNAPSHOT</version> </dependency> </dependencies>


The integration can be enabled by setting spring.cloud.vault.consul.enabled=true (default false) and @@ -277,7 +277,7 @@ dependency.

<dependency> <groupId>org.springframework.cloud</groupId> <artifactId>spring-cloud-vault-config-rabbitmq</artifactId> - <version>1.2.0.BUILD-SNAPSHOT</version> + <version>2.0.0.BUILD-SNAPSHOT</version> </dependency> </dependencies>


The integration can be enabled by setting spring.cloud.vault.rabbitmq.enabled=true (default false) @@ -296,7 +296,7 @@ dependency.

<dependency> <groupId>org.springframework.cloud</groupId> <artifactId>spring-cloud-vault-config-aws</artifactId> - <version>1.2.0.BUILD-SNAPSHOT</version> + <version>2.0.0.BUILD-SNAPSHOT</version> </dependency> </dependencies>


The integration can be enabled by setting spring.cloud.vault.aws=true (default false) @@ -314,20 +314,38 @@ by setting spring.cloud.vault.aws.access-key-property

Spring Cloud Vault integrates with these backends:

Using a database secret backend requires to enable the +mechanism to more easily roll keys.

Spring Cloud Vault integrates with these backends:

Using a database secret backend requires to enable the backend in the configuration and the spring-cloud-vault-config-databases dependency.

Vault ships since 0.7.1 with a dedicated database secret backend that allows -database integration via plugins. You can use that specific backend by adapting -one of the JDBC database properties above. Make sure to specify the appropriate -backend path, e.g. spring.cloud.vault.mysql.role.backend=database.

Example 5.1. pom.xml

<dependencies>
+database integration via plugins. You can use that specific backend by using the
+generic database backend. Make sure to specify the appropriate
+backend path, e.g. spring.cloud.vault.mysql.role.backend=database.
Example 5.1. pom.xml
<dependencies>
     <dependency>
         <groupId>org.springframework.cloud</groupId>
         <artifactId>spring-cloud-vault-config-databases</artifactId>
-        <version>1.2.0.BUILD-SNAPSHOT</version>
+        <version>2.0.0.BUILD-SNAPSHOT</version>
     </dependency>
 </dependencies>

[Note]Note
Enabling multiple JDBC-compliant databases will generate credentials
 and store them by default in the same property keys hence property names for
-JDBC secrets need to be configured separately.
5.1 Apache Cassandra
Spring Cloud Vault can obtain credentials for Apache Cassandra.
+JDBC secrets need to be configured separately.

5.1 Database

Spring Cloud Vault can obtain credentials for any database listed at +https://www.vaultproject.io/api/secret/databases/index.html. +The integration can be enabled by setting +spring.cloud.vault.database.enabled=true (default false) and +providing the role name with spring.cloud.vault.database.role=….

While the database backend is a generic one, spring.cloud.vault.database +specifically targets JDBC databases. Username and password are +stored in spring.datasource.username and spring.datasource.password +so using Spring Boot will pick up the generated credentials +for your DataSource without further configuration. +You can configure the property names by setting +spring.cloud.vault.database.username-property and +spring.cloud.vault.database.password-property.

spring.cloud.vault:
+    database:
+        enabled: true
+        role: readonly
+        backend: database
+        username-property: spring.datasource.username
+        password-property: spring.datasource.username
  • enabled setting this value to true enables the Database backend config usage
  • role sets the role name of the Database role definition
  • backend sets the path of the Database mount to use
  • username-property sets the property name in which the Database username is stored
  • password-property sets the property name in which the Database password is stored

See also: Vault Documentation: Database Secrets backend

5.2 Apache Cassandra

[Note]Note

The cassandra backend has been deprecated in Vault 0.7.1 and +it is recommended to use the database backend and mount it as cassandra.

Spring Cloud Vault can obtain credentials for Apache Cassandra. The integration can be enabled by setting spring.cloud.vault.cassandra.enabled=true (default false) and providing the role name with spring.cloud.vault.cassandra.role=….

Username and password are stored in spring.data.cassandra.username @@ -341,7 +359,8 @@ You can configure the property names by setting role: readonly backend: cassandra username-property: spring.data.cassandra.username - password-property: spring.data.cassandra.username

  • enabled setting this value to true enables the Cassandra backend config usage
  • role sets the role name of the Cassandra role definition
  • backend sets the path of the Cassandra mount to use
  • username-property sets the property name in which the Cassandra username is stored
  • password-property sets the property name in which the Cassandra password is stored

See also: Vault Documentation: Setting up Apache Cassandra with Vault

5.2 MongoDB

Spring Cloud Vault can obtain credentials for MongoDB. + password-property: spring.data.cassandra.username

  • enabled setting this value to true enables the Cassandra backend config usage
  • role sets the role name of the Cassandra role definition
  • backend sets the path of the Cassandra mount to use
  • username-property sets the property name in which the Cassandra username is stored
  • password-property sets the property name in which the Cassandra password is stored

See also: Vault Documentation: Setting up Apache Cassandra with Vault

5.3 MongoDB

[Note]Note

The mongodb backend has been deprecated in Vault 0.7.1 and +it is recommended to use the database backend and mount it as mongodb.

Spring Cloud Vault can obtain credentials for MongoDB. The integration can be enabled by setting spring.cloud.vault.mongodb.enabled=true (default false) and providing the role name with spring.cloud.vault.mongodb.role=….

Username and password are stored in spring.data.mongodb.username @@ -355,7 +374,9 @@ You can configure the property names by setting role: readonly backend: mongodb username-property: spring.data.mongodb.username - password-property: spring.data.mongodb.password

  • enabled setting this value to true enables the MongodB backend config usage
  • role sets the role name of the MongoDB role definition
  • backend sets the path of the MongoDB mount to use
  • username-property sets the property name in which the MongoDB username is stored
  • password-property sets the property name in which the MongoDB password is stored

See also: Vault Documentation: Setting up MongoDB with Vault

5.3 MySQL

Spring Cloud Vault can obtain credentials for MySQL. + password-property: spring.data.mongodb.password

  • enabled setting this value to true enables the MongodB backend config usage
  • role sets the role name of the MongoDB role definition
  • backend sets the path of the MongoDB mount to use
  • username-property sets the property name in which the MongoDB username is stored
  • password-property sets the property name in which the MongoDB password is stored

See also: Vault Documentation: Setting up MongoDB with Vault

5.4 MySQL

[Note]Note

The mysql backend has been deprecated in Vault 0.7.1 and +it is recommended to use the database backend and mount it as mysql. +Configuration for spring.cloud.vault.mysql will be removed in a future version.

Spring Cloud Vault can obtain credentials for MySQL. The integration can be enabled by setting spring.cloud.vault.mysql.enabled=true (default false) and providing the role name with spring.cloud.vault.mysql.role=….

Username and password are stored in spring.datasource.username @@ -369,7 +390,9 @@ You can configure the property names by setting role: readonly backend: mysql username-property: spring.datasource.username - password-property: spring.datasource.username

See also: Vault Documentation: Setting up MySQL with Vault

5.4 PostgreSQL

Spring Cloud Vault can obtain credentials for PostgreSQL. + password-property: spring.datasource.username

See also: Vault Documentation: Setting up MySQL with Vault

5.5 PostgreSQL

[Note]Note

The postgresql backend has been deprecated in Vault 0.7.1 and +it is recommended to use the database backend and mount it as postgresql. +Configuration for spring.cloud.vault.postgresql will be removed in a future version.

Spring Cloud Vault can obtain credentials for PostgreSQL. The integration can be enabled by setting spring.cloud.vault.postgresql.enabled=true (default false) and providing the role name with spring.cloud.vault.postgresql.role=….

Username and password are stored in spring.datasource.username diff --git a/spring-cloud-vault.html b/spring-cloud-vault.html index 5afad45c..d64154cf 100644 --- a/spring-cloud-vault.html +++ b/spring-cloud-vault.html @@ -90,7 +90,7 @@ $(addBlockSwitches);

-

1.2.0.BUILD-SNAPSHOT

+

2.0.0.BUILD-SNAPSHOT