diff --git a/spring-cloud-vault-config-databases/src/main/java/org/springframework/cloud/vault/config/databases/DatabaseSecretProperties.java b/spring-cloud-vault-config-databases/src/main/java/org/springframework/cloud/vault/config/databases/DatabaseSecretProperties.java index 15a7ec3e..1bf184cb 100644 --- a/spring-cloud-vault-config-databases/src/main/java/org/springframework/cloud/vault/config/databases/DatabaseSecretProperties.java +++ b/spring-cloud-vault-config-databases/src/main/java/org/springframework/cloud/vault/config/databases/DatabaseSecretProperties.java @@ -47,4 +47,10 @@ public interface DatabaseSecretProperties extends VaultSecretBackendDescriptor { */ String getPasswordProperty(); + /** + * see https://learn.hashicorp.com/vault/secrets-management/db-creds-rotation + * @return is vault configured to use static role or not. + */ + boolean isStaticRole(); + } diff --git a/spring-cloud-vault-config-databases/src/main/java/org/springframework/cloud/vault/config/databases/VaultCassandraProperties.java b/spring-cloud-vault-config-databases/src/main/java/org/springframework/cloud/vault/config/databases/VaultCassandraProperties.java index e6ff1a01..b940986a 100644 --- a/spring-cloud-vault-config-databases/src/main/java/org/springframework/cloud/vault/config/databases/VaultCassandraProperties.java +++ b/spring-cloud-vault-config-databases/src/main/java/org/springframework/cloud/vault/config/databases/VaultCassandraProperties.java @@ -58,6 +58,11 @@ public class VaultCassandraProperties implements DatabaseSecretProperties { @NotEmpty private String passwordProperty = "spring.data.cassandra.password"; + /** + * Enable static role usage. + */ + private boolean staticRole = false; + public boolean isEnabled() { return this.enabled; } diff --git a/spring-cloud-vault-config-databases/src/main/java/org/springframework/cloud/vault/config/databases/VaultConfigDatabaseBootstrapConfiguration.java b/spring-cloud-vault-config-databases/src/main/java/org/springframework/cloud/vault/config/databases/VaultConfigDatabaseBootstrapConfiguration.java index d2d00a64..6fa8de34 100644 --- a/spring-cloud-vault-config-databases/src/main/java/org/springframework/cloud/vault/config/databases/VaultConfigDatabaseBootstrapConfiguration.java +++ b/spring-cloud-vault-config-databases/src/main/java/org/springframework/cloud/vault/config/databases/VaultConfigDatabaseBootstrapConfiguration.java @@ -78,6 +78,9 @@ public class VaultConfigDatabaseBootstrapConfiguration { return new SecretBackendMetadata() { + private String credPath = properties.isStaticRole() ? "static-creds" + : "creds"; + @Override public String getName() { return String.format("%s with Role %s", properties.getBackend(), @@ -86,7 +89,7 @@ public class VaultConfigDatabaseBootstrapConfiguration { @Override public String getPath() { - return String.format("%s/creds/%s", properties.getBackend(), + return String.format("%s/%s/%s", properties.getBackend(), credPath, properties.getRole()); } @@ -100,7 +103,8 @@ public class VaultConfigDatabaseBootstrapConfiguration { Map variables = new HashMap<>(); variables.put("backend", properties.getBackend()); - variables.put("key", String.format("creds/%s", properties.getRole())); + variables.put("key", + String.format("%s/%s", credPath, properties.getRole())); return variables; } }; diff --git a/spring-cloud-vault-config-databases/src/main/java/org/springframework/cloud/vault/config/databases/VaultDatabaseProperties.java b/spring-cloud-vault-config-databases/src/main/java/org/springframework/cloud/vault/config/databases/VaultDatabaseProperties.java index ad4952fa..fd29bf64 100644 --- a/spring-cloud-vault-config-databases/src/main/java/org/springframework/cloud/vault/config/databases/VaultDatabaseProperties.java +++ b/spring-cloud-vault-config-databases/src/main/java/org/springframework/cloud/vault/config/databases/VaultDatabaseProperties.java @@ -59,6 +59,11 @@ public class VaultDatabaseProperties implements DatabaseSecretProperties { @NotEmpty private String passwordProperty = "spring.datasource.password"; + /** + * Enable static role usage. + */ + private boolean staticRole = false; + public boolean isEnabled() { return this.enabled; } diff --git a/spring-cloud-vault-config-databases/src/main/java/org/springframework/cloud/vault/config/databases/VaultMongoProperties.java b/spring-cloud-vault-config-databases/src/main/java/org/springframework/cloud/vault/config/databases/VaultMongoProperties.java index 6171d6c2..23fee72a 100644 --- a/spring-cloud-vault-config-databases/src/main/java/org/springframework/cloud/vault/config/databases/VaultMongoProperties.java +++ b/spring-cloud-vault-config-databases/src/main/java/org/springframework/cloud/vault/config/databases/VaultMongoProperties.java @@ -58,6 +58,11 @@ public class VaultMongoProperties implements DatabaseSecretProperties { @NotEmpty private String passwordProperty = "spring.data.mongodb.password"; + /** + * Enable static role usage. + */ + private boolean staticRole = false; + public VaultMongoProperties() { } diff --git a/spring-cloud-vault-config-databases/src/main/java/org/springframework/cloud/vault/config/databases/VaultMySqlProperties.java b/spring-cloud-vault-config-databases/src/main/java/org/springframework/cloud/vault/config/databases/VaultMySqlProperties.java index 9d89e096..d0821853 100644 --- a/spring-cloud-vault-config-databases/src/main/java/org/springframework/cloud/vault/config/databases/VaultMySqlProperties.java +++ b/spring-cloud-vault-config-databases/src/main/java/org/springframework/cloud/vault/config/databases/VaultMySqlProperties.java @@ -62,6 +62,11 @@ public class VaultMySqlProperties @NotEmpty private String passwordProperty = "spring.datasource.password"; + /** + * Enable static role usage. + */ + private boolean staticRole = false; + public VaultMySqlProperties() { } diff --git a/spring-cloud-vault-config-databases/src/main/java/org/springframework/cloud/vault/config/databases/VaultPostgreSqlProperties.java b/spring-cloud-vault-config-databases/src/main/java/org/springframework/cloud/vault/config/databases/VaultPostgreSqlProperties.java index 69d0d6a7..01bf4c3e 100644 --- a/spring-cloud-vault-config-databases/src/main/java/org/springframework/cloud/vault/config/databases/VaultPostgreSqlProperties.java +++ b/spring-cloud-vault-config-databases/src/main/java/org/springframework/cloud/vault/config/databases/VaultPostgreSqlProperties.java @@ -61,6 +61,11 @@ public class VaultPostgreSqlProperties implements DatabaseSecretProperties { @NotEmpty private String passwordProperty = "spring.datasource.password"; + /** + * Enable static role usage. + */ + private boolean staticRole = false; + public VaultPostgreSqlProperties() { }