@@ -1490,7 +1524,7 @@ The authentication is role based and the role is bound to a service account name
A file containing a JWT token for a pod’s service account is automatically mounted at /var/run/secrets/kubernetes.io/serviceaccount/token.
-
Example 25. bootstrap.yml with all Kubernetes authentication properties
+
Example 26. bootstrap.yml with all Kubernetes authentication properties
@@ -1540,7 +1574,7 @@ Unlike most Vault authentication backends, this backend does not require first-d
Instead, it treats PCF as a Trusted Third Party and uses the managed instance identity.
-
Example 26. bootstrap.yml with required PCF Authentication properties
+
Example 27. bootstrap.yml with required PCF Authentication properties
@@ -1553,7 +1587,7 @@ Instead, it treats PCF as a Trusted Third Party and uses the managed instance id
-
Example 27. bootstrap.yml with all PCF Authentication properties
+
Example 28. bootstrap.yml with all PCF Authentication properties
@@ -1851,7 +1885,7 @@ The Consul integration requires the spring-cloud-vault-config-consul
-
Example 28. pom.xml
+
Example 29. pom.xml
@@ -1921,7 +1955,7 @@ the property name by setting spring.cloud.vault.consul.token-property
-
Example 29. pom.xml
+
Example 30. pom.xml
@@ -1996,7 +2030,7 @@ by setting spring.cloud.vault.rabbitmq.username-property and
dependency.
-
Example 30. pom.xml
+
Example 31. pom.xml
@@ -2107,7 +2141,7 @@ generic database backend. Make sure to specify the appropriate
backend path, e.g. spring.cloud.vault.mysql.role.backend=database.
-
Example 31. pom.xml
+
Example 32. pom.xml
diff --git a/reference/html/spring-cloud-vault.html b/reference/html/spring-cloud-vault.html
index 07aabef2..e167e7d8 100644
--- a/reference/html/spring-cloud-vault.html
+++ b/reference/html/spring-cloud-vault.html
@@ -108,6 +108,7 @@ $(addBlockSwitches);
Authentication methods
- Token authentication
+- Vault Agent authentication
- AppId authentication
- AppRole authentication
- AWS-EC2 authentication
@@ -152,7 +153,7 @@ $(addBlockSwitches);
-
© 2016-2019 The original authors.
+
© 2016-2020 The original authors.
@@ -546,6 +547,39 @@ authentication method
+
+
+
Vault ships a sidecar utility with Vault Agent since version 0.11.0.
+Vault Agent implements the functionality of Spring Vault’s SessionManager
+with its Auto-Auth feature. Applications can reuse cached session credentials by relying
+on Vault Agent running on localhost. Spring Vault can send requests without the
+X-Vault-Token header. Disable Spring Vault’s authentication infrastructure to
+disable client authentication and session management.
+
+
+
Example 5. bootstrap.yml
+
+
+
+
spring.cloud.vault:
+ authentication: NONE
+
+
+
+
+
+
+
+
Vault supports AppId
@@ -561,7 +595,7 @@ The IP and Mac address are represented as Hex-encoded SHA256 hash.
IP address-based UserId’s use the local host’s IP address.
-
Example 5. bootstrap.yml using SHA256 IP-Address UserId’s
+
Example 6. bootstrap.yml using SHA256 IP-Address UserId’s
@@ -617,7 +651,7 @@ a network-interface hint to pick the right device. The value of
name or interface index (0-based).
-
Example 6. bootstrap.yml using SHA256 Mac-Address UserId’s
+
Example 7. bootstrap.yml using SHA256 Mac-Address UserId’s
@@ -675,7 +709,7 @@ by calling createUserId each time it authenticates using AppId to
obtain a token.
-
Example 7. bootstrap.yml
+
Example 8. bootstrap.yml
@@ -688,7 +722,7 @@ obtain a token.
-
Example 8. MyUserIdMechanism.java
+
Example 9. MyUserIdMechanism.java
@@ -724,7 +758,7 @@ AppRole authentication consists of two hard to guess (secret) tokens: RoleId and
Spring Vault will not look up these or create a custom SecretId.
-
Example 9. bootstrap.yml with AppRole authentication properties
+
Example 10. bootstrap.yml with AppRole authentication properties
@@ -914,7 +948,7 @@ AppRole authentication is limited to simple pull mode using reactive infrastruct
-
Example 10. bootstrap.yml with all AppRole authentication properties
+
Example 11. bootstrap.yml with all AppRole authentication properties
@@ -963,7 +997,7 @@ cryptographically signed dynamic metadata information that uniquely
represents each EC2 instance.
-
Example 11. bootstrap.yml using AWS-EC2 Authentication
+
Example 12. bootstrap.yml using AWS-EC2 Authentication
@@ -996,7 +1030,7 @@ You can configure the authentication role by setting the
spring.cloud.vault.aws-ec2.role property.
-
Example 12. bootstrap.yml with configured role
+
Example 13. bootstrap.yml with configured role
@@ -1009,7 +1043,7 @@ You can configure the authentication role by setting the
-
Example 13. bootstrap.yml with all AWS EC2 authentication properties
+
Example 14. bootstrap.yml with all AWS EC2 authentication properties
@@ -1074,7 +1108,7 @@ and assign it to your IAM role. An empty role defaults to
the friendly name the current IAM role.
-
Example 14. bootstrap.yml with required AWS-IAM Authentication properties
+
Example 15. bootstrap.yml with required AWS-IAM Authentication properties
@@ -1085,7 +1119,7 @@ the friendly name the current IAM role.
-
Example 15. bootstrap.yml with all AWS-IAM Authentication properties
+
Example 16. bootstrap.yml with all AWS-IAM Authentication properties
@@ -1138,7 +1172,7 @@ managed service identity and instance metadata information that can be
bound to a VM instance.
-
Example 16. bootstrap.yml with required Azure Authentication properties
+
Example 17. bootstrap.yml with required Azure Authentication properties
@@ -1151,7 +1185,7 @@ bound to a VM instance.
-
Example 17. bootstrap.yml with all Azure Authentication properties
+
Example 18. bootstrap.yml with all Azure Authentication properties
@@ -1206,7 +1240,7 @@ certificate and the private key
-
Example 18. bootstrap.yml
+
Example 19. bootstrap.yml
@@ -1250,7 +1284,7 @@ Response Wrapping for token creation requires Vault 0.6.0 or higher.
-
Example 19. Creating and storing tokens
+
Example 20. Creating and storing tokens
@@ -1266,7 +1300,7 @@ wrapped_accessor: 46b6aebb-187f-932a-26d7-4f3d86a68319
-
Example 20. bootstrap.yml
+
Example 21. bootstrap.yml
@@ -1315,7 +1349,7 @@ cryptographically signed dynamic metadata information that uniquely
represents each GCP service account.
-
Example 21. bootstrap.yml with required GCP-GCE Authentication properties
+
Example 22. bootstrap.yml with required GCP-GCE Authentication properties
@@ -1328,7 +1362,7 @@ represents each GCP service account.
-
Example 22. bootstrap.yml with all GCP-GCE Authentication properties
+
Example 23. bootstrap.yml with all GCP-GCE Authentication properties
@@ -1390,7 +1424,7 @@ JSON is the preferred form as it carries the project id and
service account identifier required for calling projects.serviceAccounts.signJwt.
-
Example 23. bootstrap.yml with required GCP-IAM Authentication properties
+
Example 24. bootstrap.yml with required GCP-IAM Authentication properties
@@ -1403,7 +1437,7 @@ service account identifier required for calling projects.serviceAccounts.s
-
Example 24. bootstrap.yml with all GCP-IAM Authentication properties
+
Example 25. bootstrap.yml with all GCP-IAM Authentication properties
@@ -1490,7 +1524,7 @@ The authentication is role based and the role is bound to a service account name
A file containing a JWT token for a pod’s service account is automatically mounted at /var/run/secrets/kubernetes.io/serviceaccount/token.
-
Example 25. bootstrap.yml with all Kubernetes authentication properties
+
Example 26. bootstrap.yml with all Kubernetes authentication properties
@@ -1540,7 +1574,7 @@ Unlike most Vault authentication backends, this backend does not require first-d
Instead, it treats PCF as a Trusted Third Party and uses the managed instance identity.
-
Example 26. bootstrap.yml with required PCF Authentication properties
+
Example 27. bootstrap.yml with required PCF Authentication properties
@@ -1553,7 +1587,7 @@ Instead, it treats PCF as a Trusted Third Party and uses the managed instance id
-
Example 27. bootstrap.yml with all PCF Authentication properties
+
Example 28. bootstrap.yml with all PCF Authentication properties
@@ -1851,7 +1885,7 @@ The Consul integration requires the spring-cloud-vault-config-consul
-
Example 28. pom.xml
+
Example 29. pom.xml
@@ -1921,7 +1955,7 @@ the property name by setting spring.cloud.vault.consul.token-property
-
Example 29. pom.xml
+
Example 30. pom.xml
@@ -1996,7 +2030,7 @@ by setting spring.cloud.vault.rabbitmq.username-property and
dependency.
-
Example 30. pom.xml
+
Example 31. pom.xml
@@ -2107,7 +2141,7 @@ generic database backend. Make sure to specify the appropriate
backend path, e.g. spring.cloud.vault.mysql.role.backend=database.
-
Example 31. pom.xml
+
Example 32. pom.xml