diff --git a/docs/src/main/asciidoc/spring-cloud-vault.adoc b/docs/src/main/asciidoc/spring-cloud-vault.adoc index 0920c1d5..99a8c09b 100644 --- a/docs/src/main/asciidoc/spring-cloud-vault.adoc +++ b/docs/src/main/asciidoc/spring-cloud-vault.adoc @@ -634,6 +634,7 @@ mechanism to more easily roll keys. Spring Cloud Vault integrates with these backends: +* <> * <> * <> * <> @@ -644,8 +645,8 @@ backend in the configuration and the `spring-cloud-vault-config-databases` dependency. Vault ships since 0.7.1 with a dedicated `database` secret backend that allows -database integration via plugins. You can use that specific backend by adapting -one of the JDBC database properties above. Make sure to specify the appropriate +database integration via plugins. You can use that specific backend by using the +generic database backend. Make sure to specify the appropriate backend path, e.g. `spring.cloud.vault.mysql.role.backend=database`. .pom.xml @@ -666,8 +667,48 @@ NOTE: Enabling multiple JDBC-compliant databases will generate credentials and store them by default in the same property keys hence property names for JDBC secrets need to be configured separately. +[[vault.config.backends.database]] +=== Database + +Spring Cloud Vault can obtain credentials for any Database listed at +https://www.vaultproject.io/api/secret/databases/index.html. +The integration can be enabled by setting +`spring.cloud.vault.database.enabled=true` (default `false`) and +providing the role name with `spring.cloud.vault.database.role=…`. + +Username and password are stored in `spring.datasource.username` +and `spring.datasource.password` so using Spring Boot will +pick up the generated credentials without further configuration. +You can configure the property names by setting +`spring.cloud.vault.database.username-property` and +`spring.cloud.vault.database.password-property`. + +==== +[source,yaml] +---- +spring.cloud.vault: + database: + enabled: true + role: readonly + backend: database + username-property: spring.datasource.username + password-property: spring.datasource.username +---- +==== + +* `enabled` setting this value to `true` enables the Database backend config usage +* `role` sets the role name of the Database role definition +* `backend` sets the path of the Database mount to use +* `username-property` sets the property name in which the Database username is stored +* `password-property` sets the property name in which the Database password is stored + +See also: https://www.vaultproject.io/docs/secrets/databases/index.html[Vault Documentation: Database Secrets backend] + + [[vault.config.backends.cassandra]] === Apache Cassandra +This backend has been deprecated in Vault and it is recommended to use the `database` backend +and mount it as `cassandra`. Spring Cloud Vault can obtain credentials for Apache Cassandra. The integration can be enabled by setting @@ -705,6 +746,9 @@ See also: https://www.vaultproject.io/docs/secrets/cassandra/index.html[Vault Do [[vault.config.backends.mongodb]] === MongoDB +This backend has been deprecated in Vault and it is recommended to use the `database` backend +and mount it as `mongodb`. + Spring Cloud Vault can obtain credentials for MongoDB. The integration can be enabled by setting `spring.cloud.vault.mongodb.enabled=true` (default `false`) and @@ -740,6 +784,8 @@ See also: https://www.vaultproject.io/docs/secrets/mongodb/index.html[Vault Docu [[vault.config.backends.mysql]] === MySQL +This backend has been deprecated in Vault and it is recommended to use the `database` backend +and mount it as `mysql`. Spring Cloud Vault can obtain credentials for MySQL. The integration can be enabled by setting @@ -776,6 +822,8 @@ See also: https://www.vaultproject.io/docs/secrets/mysql/index.html[Vault Docume [[vault.config.backends.postgresql]] === PostgreSQL +This backend has been deprecated in Vault and it is recommended to use the `database` backend +and mount it as `postgresql`. Spring Cloud Vault can obtain credentials for PostgreSQL. The integration can be enabled by setting diff --git a/spring-cloud-vault-config-databases/src/main/java/org/springframework/cloud/vault/config/databases/VaultConfigDatabaseBootstrapConfiguration.java b/spring-cloud-vault-config-databases/src/main/java/org/springframework/cloud/vault/config/databases/VaultConfigDatabaseBootstrapConfiguration.java index d82e1f1e..9095ba8f 100644 --- a/spring-cloud-vault-config-databases/src/main/java/org/springframework/cloud/vault/config/databases/VaultConfigDatabaseBootstrapConfiguration.java +++ b/spring-cloud-vault-config-databases/src/main/java/org/springframework/cloud/vault/config/databases/VaultConfigDatabaseBootstrapConfiguration.java @@ -38,7 +38,7 @@ import org.springframework.vault.core.util.PropertyTransformer; @Configuration @EnableConfigurationProperties({ VaultMySqlProperties.class, VaultPostgreSqlProperties.class, VaultCassandraProperties.class, - VaultMongoProperties.class }) + VaultMongoProperties.class, VaultDatabaseProperties.class }) public class VaultConfigDatabaseBootstrapConfiguration { @Bean diff --git a/spring-cloud-vault-config-databases/src/main/java/org/springframework/cloud/vault/config/databases/VaultDatabaseProperties.java b/spring-cloud-vault-config-databases/src/main/java/org/springframework/cloud/vault/config/databases/VaultDatabaseProperties.java new file mode 100644 index 00000000..c9e45300 --- /dev/null +++ b/spring-cloud-vault-config-databases/src/main/java/org/springframework/cloud/vault/config/databases/VaultDatabaseProperties.java @@ -0,0 +1,61 @@ +/* + * Copyright 2016 the original author or authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package org.springframework.cloud.vault.config.databases; + +import lombok.Data; +import org.springframework.boot.context.properties.ConfigurationProperties; +import org.springframework.validation.annotation.Validated; + +import javax.validation.constraints.NotEmpty; + +/** + * Configuration properties for Vault using the Database integration. + * + * @author Per Abich + */ +@ConfigurationProperties("spring.cloud.vault.database") +@Data +@Validated +public class VaultDatabaseProperties implements DatabaseSecretProperties { + + /** + * Enable database backend usage. + */ + private boolean enabled = false; + + /** + * Role name for credentials. + */ + private String role; + + /** + * Database backend path. + */ + @NotEmpty + private String backend = "database"; + + /** + * Target property for the obtained username. + */ + @NotEmpty + private String usernameProperty = "spring.datasource.username"; + + /** + * Target property for the obtained password. + */ + @NotEmpty + private String passwordProperty = "spring.datasource.password"; +} diff --git a/spring-cloud-vault-config-databases/src/main/java/org/springframework/cloud/vault/config/databases/VaultPostgreSqlProperties.java b/spring-cloud-vault-config-databases/src/main/java/org/springframework/cloud/vault/config/databases/VaultPostgreSqlProperties.java index bb3c7c84..99695981 100644 --- a/spring-cloud-vault-config-databases/src/main/java/org/springframework/cloud/vault/config/databases/VaultPostgreSqlProperties.java +++ b/spring-cloud-vault-config-databases/src/main/java/org/springframework/cloud/vault/config/databases/VaultPostgreSqlProperties.java @@ -15,13 +15,12 @@ */ package org.springframework.cloud.vault.config.databases; -import javax.validation.constraints.NotEmpty; - import lombok.Data; - import org.springframework.boot.context.properties.ConfigurationProperties; import org.springframework.validation.annotation.Validated; +import javax.validation.constraints.NotEmpty; + /** * Configuration properties for Vault using the PostgreSQL integration. *