SpringCloud/spring-cloud-vault
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Annotate API with Spring's @NonNullApi/@Nullable to indicate null/non-null rules

Browse Source 
Closes gh-494.
This commit is contained in:
Mark Paluch
2020-09-24 11:43:31 +02:00
parent 59bacc6b73
commit dcd91e200f
27 changed files with 345 additions and 352 deletions
Download Patch File Download Diff File Expand all files Collapse all files

48
spring-cloud-vault-config-aws/src/main/java/org/springframework/cloud/vault/config/aws/VaultAwsProperties.java
View File

@@ -16,11 +16,9 @@
package org.springframework.cloud.vault.config.aws;
import javax.validation.constraints.NotEmpty;
import org.springframework.boot.context.properties.ConfigurationProperties;
import org.springframework.cloud.vault.config.VaultSecretBackendDescriptor;
import org.springframework.validation.annotation.Validated;
import org.springframework.lang.Nullable;
/**
* Configuration properties for Vault using the AWS integration.
@@ -28,73 +26,73 @@ import org.springframework.validation.annotation.Validated;
* @author Mark Paluch
*/
@ConfigurationProperties("spring.cloud.vault.aws")
@Validated
public class VaultAwsProperties implements VaultSecretBackendDescriptor {
/**
* Enable aws backend usage.
*/
private boolean enabled = false;
private boolean enabled;
/**
* Role name for credentials.
*/
@Nullable
private String role;
/**
* aws backend path.
*/
@NotEmpty
private String backend = "aws";
/**
* Target property for the obtained access key.
*/
@NotEmpty
private String accessKeyProperty = "cloud.aws.credentials.accessKey";
/**
* Target property for the obtained secret key.
*/
@NotEmpty
private String secretKeyProperty = "cloud.aws.credentials.secretKey";
@Override
public boolean isEnabled() {
return this.enabled;
}
public String getRole() {
return this.role;
}
public String getBackend() {
return this.backend;
}
public String getAccessKeyProperty() {
return this.accessKeyProperty;
}
public String getSecretKeyProperty() {
return this.secretKeyProperty;
}
public void setEnabled(boolean enabled) {
this.enabled = enabled;
}
public void setRole(String role) {
@Nullable
public String getRole() {
return this.role;
}
public void setRole(@Nullable String role) {
this.role = role;
}
@Override
public String getBackend() {
return this.backend;
}
public void setBackend(String backend) {
this.backend = backend;
}
public String getAccessKeyProperty() {
return this.accessKeyProperty;
}
public void setAccessKeyProperty(String accessKeyProperty) {
this.accessKeyProperty = accessKeyProperty;
}
public String getSecretKeyProperty() {
return this.secretKeyProperty;
}
public void setSecretKeyProperty(String secretKeyProperty) {
this.secretKeyProperty = secretKeyProperty;
}

3
spring-cloud-vault-config-aws/src/main/java/org/springframework/cloud/vault/config/aws/package-info.java
View File

@@ -18,5 +18,6 @@
* AWS integration with Vault.
* @author Mark Paluch
*/
@org.springframework.lang.NonNullApi
@org.springframework.lang.NonNullFields
package org.springframework.cloud.vault.config.aws;

39
spring-cloud-vault-config-consul/src/main/java/org/springframework/cloud/vault/config/consul/VaultConsulProperties.java
View File

@@ -16,11 +16,9 @@
package org.springframework.cloud.vault.config.consul;
import javax.validation.constraints.NotEmpty;
import org.springframework.boot.context.properties.ConfigurationProperties;
import org.springframework.cloud.vault.config.VaultSecretBackendDescriptor;
import org.springframework.validation.annotation.Validated;
import org.springframework.lang.Nullable;
/**
* Configuration properties for HashiCorp Consul.
@@ -28,59 +26,60 @@ import org.springframework.validation.annotation.Validated;
* @author Mark Paluch
*/
@ConfigurationProperties("spring.cloud.vault.consul")
@Validated
public class VaultConsulProperties implements VaultSecretBackendDescriptor {
/**
* Enable consul backend usage.
*/
private boolean enabled = false;
private boolean enabled;
/**
* Role name for credentials.
*/
@Nullable
private String role;
/**
* Consul backend path.
*/
@NotEmpty
private String backend = "consul";
/**
* Target property for the obtained token.
*/
@NotEmpty
private String tokenProperty = "spring.cloud.consul.token";
@Override
public boolean isEnabled() {
return this.enabled;
}
public String getRole() {
return this.role;
}
public String getBackend() {
return this.backend;
}
public String getTokenProperty() {
return this.tokenProperty;
}
public void setEnabled(boolean enabled) {
this.enabled = enabled;
}
public void setRole(String role) {
@Nullable
public String getRole() {
return this.role;
}
public void setRole(@Nullable String role) {
this.role = role;
}
@Override
public String getBackend() {
return this.backend;
}
public void setBackend(String backend) {
this.backend = backend;
}
public String getTokenProperty() {
return this.tokenProperty;
}
public void setTokenProperty(String tokenProperty) {
this.tokenProperty = tokenProperty;
}

3
spring-cloud-vault-config-consul/src/main/java/org/springframework/cloud/vault/config/consul/package-info.java
View File

@@ -18,5 +18,6 @@
* Consul integration with Vault.
* @author Mark Paluch
*/
@org.springframework.lang.NonNullApi
@org.springframework.lang.NonNullFields
package org.springframework.cloud.vault.config.consul;

14
spring-cloud-vault-config-databases/src/main/java/org/springframework/cloud/vault/config/databases/VaultCassandraProperties.java
View File

@@ -16,9 +16,8 @@
package org.springframework.cloud.vault.config.databases;
import javax.validation.constraints.NotEmpty;
import org.springframework.boot.context.properties.ConfigurationProperties;
import org.springframework.lang.Nullable;
import org.springframework.validation.annotation.Validated;
/**
@@ -34,11 +33,12 @@ public class VaultCassandraProperties implements DatabaseSecretProperties {
/**
* Enable cassandra backend usage.
*/
private boolean enabled = false;
private boolean enabled;
/**
* Role name for credentials.
*/
@Nullable
private String role;
/**
@@ -46,24 +46,21 @@ public class VaultCassandraProperties implements DatabaseSecretProperties {
*
* @since 2.2
*/
private boolean staticRole = false;
private boolean staticRole;
/**
* Cassandra backend path.
*/
@NotEmpty
private String backend = "cassandra";
/**
* Target property for the obtained username.
*/
@NotEmpty
private String usernameProperty = "spring.data.cassandra.username";
/**
* Target property for the obtained password.
*/
@NotEmpty
private String passwordProperty = "spring.data.cassandra.password";
@Override
@@ -76,11 +73,12 @@ public class VaultCassandraProperties implements DatabaseSecretProperties {
}
@Override
@Nullable
public String getRole() {
return this.role;
}
public void setRole(String role) {
public void setRole(@Nullable String role) {
this.role = role;
}

12
spring-cloud-vault-config-databases/src/main/java/org/springframework/cloud/vault/config/databases/VaultCouchbaseProperties.java
View File

@@ -16,10 +16,8 @@
package org.springframework.cloud.vault.config.databases;
import javax.validation.constraints.NotEmpty;
import org.springframework.boot.context.properties.ConfigurationProperties;
import org.springframework.validation.annotation.Validated;
import org.springframework.lang.Nullable;
/**
* Configuration properties for Vault using the Couchbase integration.
@@ -27,7 +25,6 @@ import org.springframework.validation.annotation.Validated;
* @author Francis Hitchens
*/
@ConfigurationProperties("spring.cloud.vault.couchbase")
@Validated
public class VaultCouchbaseProperties implements DatabaseSecretProperties {
/**
@@ -38,6 +35,7 @@ public class VaultCouchbaseProperties implements DatabaseSecretProperties {
/**
* Role name for credentials.
*/
@Nullable
private String role;
/**
@@ -49,19 +47,16 @@ public class VaultCouchbaseProperties implements DatabaseSecretProperties {
/**
* Couchbase backend path.
*/
@NotEmpty
private String backend = "database";
/**
* Target property for the obtained username.
*/
@NotEmpty
private String usernameProperty = "spring.couchbase.username";
/**
* Target property for the obtained password.
*/
@NotEmpty
private String passwordProperty = "spring.couchbase.password";
@Override
@@ -74,11 +69,12 @@ public class VaultCouchbaseProperties implements DatabaseSecretProperties {
}
@Override
@Nullable
public String getRole() {
return this.role;
}
public void setRole(String role) {
public void setRole(@Nullable String role) {
this.role = role;
}

12
spring-cloud-vault-config-databases/src/main/java/org/springframework/cloud/vault/config/databases/VaultDatabaseProperties.java
View File

@@ -16,10 +16,8 @@
package org.springframework.cloud.vault.config.databases;
import javax.validation.constraints.NotEmpty;
import org.springframework.boot.context.properties.ConfigurationProperties;
import org.springframework.validation.annotation.Validated;
import org.springframework.lang.Nullable;
/**
* Configuration properties for Vault using the Database integration.
@@ -29,7 +27,6 @@ import org.springframework.validation.annotation.Validated;
* @since 2.0
*/
@ConfigurationProperties("spring.cloud.vault.database")
@Validated
public class VaultDatabaseProperties implements DatabaseSecretProperties {
/**
@@ -40,6 +37,7 @@ public class VaultDatabaseProperties implements DatabaseSecretProperties {
/**
* Role name for credentials.
*/
@Nullable
private String role;
/**
@@ -50,19 +48,16 @@ public class VaultDatabaseProperties implements DatabaseSecretProperties {
/**
* Database backend path.
*/
@NotEmpty
private String backend = "database";
/**
* Target property for the obtained username.
*/
@NotEmpty
private String usernameProperty = "spring.datasource.username";
/**
* Target property for the obtained password.
*/
@NotEmpty
private String passwordProperty = "spring.datasource.password";
@Override
@@ -75,11 +70,12 @@ public class VaultDatabaseProperties implements DatabaseSecretProperties {
}
@Override
@Nullable
public String getRole() {
return this.role;
}
public void setRole(String role) {
public void setRole(@Nullable String role) {
this.role = role;
}

16
spring-cloud-vault-config-databases/src/main/java/org/springframework/cloud/vault/config/databases/VaultElasticsearchProperties.java
View File

@@ -16,10 +16,8 @@
package org.springframework.cloud.vault.config.databases;
import javax.validation.constraints.NotEmpty;
import org.springframework.boot.context.properties.ConfigurationProperties;
import org.springframework.validation.annotation.Validated;
import org.springframework.lang.Nullable;
/**
* Configuration properties for Vault using the Elasticsearch integration.
@@ -28,40 +26,37 @@ import org.springframework.validation.annotation.Validated;
* @since 3.0
*/
@ConfigurationProperties("spring.cloud.vault.elasticsearch")
@Validated
public class VaultElasticsearchProperties implements DatabaseSecretProperties {
/**
* Enable elasticsearch backend usage.
*/
private boolean enabled = false;
private boolean enabled;
/**
* Role name for credentials.
*/
@Nullable
private String role;
/**
* Enable static role usage.
*/
private boolean staticRole = false;
private boolean staticRole;
/**
* Database backend path.
*/
@NotEmpty
private String backend = "database";
/**
* Target property for the obtained username.
*/
@NotEmpty
private String usernameProperty = "spring.elasticsearch.rest.username";
/**
* Target property for the obtained password.
*/
@NotEmpty
private String passwordProperty = "spring.elasticsearch.rest.password";
@Override
@@ -74,11 +69,12 @@ public class VaultElasticsearchProperties implements DatabaseSecretProperties {
}
@Override
@Nullable
public String getRole() {
return this.role;
}
public void setRole(String role) {
public void setRole(@Nullable String role) {
this.role = role;
}

16
spring-cloud-vault-config-databases/src/main/java/org/springframework/cloud/vault/config/databases/VaultMongoProperties.java
View File

@@ -16,10 +16,8 @@
package org.springframework.cloud.vault.config.databases;
import javax.validation.constraints.NotEmpty;
import org.springframework.boot.context.properties.ConfigurationProperties;
import org.springframework.validation.annotation.Validated;
import org.springframework.lang.Nullable;
/**
* Configuration properties for Vault using the MongoDB integration.
@@ -28,17 +26,17 @@ import org.springframework.validation.annotation.Validated;
* @author Sebastien Nahelou
*/
@ConfigurationProperties("spring.cloud.vault.mongodb")
@Validated
public class VaultMongoProperties implements DatabaseSecretProperties {
/**
* Enable mongodb backend usage.
*/
private boolean enabled = false;
private boolean enabled;
/**
* Role name for credentials.
*/
@Nullable
private String role;
/**
@@ -46,24 +44,21 @@ public class VaultMongoProperties implements DatabaseSecretProperties {
*
* @since 2.2
*/
private boolean staticRole = false;
private boolean staticRole;
/**
* MongoDB backend path.
*/
@NotEmpty
private String backend = "mongodb";
/**
* Target property for the obtained username.
*/
@NotEmpty
private String usernameProperty = "spring.data.mongodb.username";
/**
* Target property for the obtained password.
*/
@NotEmpty
private String passwordProperty = "spring.data.mongodb.password";
@Override
@@ -76,11 +71,12 @@ public class VaultMongoProperties implements DatabaseSecretProperties {
}
@Override
@Nullable
public String getRole() {
return this.role;
}
public void setRole(String role) {
public void setRole(@Nullable String role) {
this.role = role;
}

12
spring-cloud-vault-config-databases/src/main/java/org/springframework/cloud/vault/config/databases/VaultMySqlProperties.java
View File

@@ -16,11 +16,9 @@
package org.springframework.cloud.vault.config.databases;
import javax.validation.constraints.NotEmpty;
import org.springframework.boot.context.properties.ConfigurationProperties;
import org.springframework.cloud.vault.config.VaultSecretBackendDescriptor;
import org.springframework.validation.annotation.Validated;
import org.springframework.lang.Nullable;
/**
* Configuration properties for Vault using the MySQL integration.
@@ -29,7 +27,6 @@ import org.springframework.validation.annotation.Validated;
* @deprecated since 2.0. Use {@link VaultDatabaseProperties}.
*/
@ConfigurationProperties("spring.cloud.vault.mysql")
@Validated
@Deprecated
public class VaultMySqlProperties implements DatabaseSecretProperties, VaultSecretBackendDescriptor {
@@ -41,24 +38,22 @@ public class VaultMySqlProperties implements DatabaseSecretProperties, VaultSecr
/**
* Role name for credentials.
*/
@Nullable
private String role;
/**
* mysql backend path.
*/
@NotEmpty
private String backend = "mysql";
/**
* Target property for the obtained username.
*/
@NotEmpty
private String usernameProperty = "spring.datasource.username";
/**
* Target property for the obtained username.
*/
@NotEmpty
private String passwordProperty = "spring.datasource.password";
@Override
@@ -71,11 +66,12 @@ public class VaultMySqlProperties implements DatabaseSecretProperties, VaultSecr
}
@Override
@Nullable
public String getRole() {
return this.role;
}
public void setRole(String role) {
public void setRole(@Nullable String role) {
this.role = role;
}

12
spring-cloud-vault-config-databases/src/main/java/org/springframework/cloud/vault/config/databases/VaultPostgreSqlProperties.java
View File

@@ -16,10 +16,8 @@
package org.springframework.cloud.vault.config.databases;
import javax.validation.constraints.NotEmpty;
import org.springframework.boot.context.properties.ConfigurationProperties;
import org.springframework.validation.annotation.Validated;
import org.springframework.lang.Nullable;
/**
* Configuration properties for Vault using the PostgreSQL integration.
@@ -28,7 +26,6 @@ import org.springframework.validation.annotation.Validated;
* @deprecated since 2.0. Use {@link VaultDatabaseProperties}.
*/
@ConfigurationProperties("spring.cloud.vault.postgresql")
@Validated
@Deprecated
public class VaultPostgreSqlProperties implements DatabaseSecretProperties {
@@ -41,24 +38,22 @@ public class VaultPostgreSqlProperties implements DatabaseSecretProperties {
/**
* Role name for credentials.
*/
@Nullable
private String role;
/**
* postgresql backend path.
*/
@NotEmpty
private String backend = "postgresql";
/**
* Target property for the obtained username.
*/
@NotEmpty
private String usernameProperty = "spring.datasource.username";
/**
* Target property for the obtained username.
*/
@NotEmpty
private String passwordProperty = "spring.datasource.password";
@Override
@@ -71,11 +66,12 @@ public class VaultPostgreSqlProperties implements DatabaseSecretProperties {
}
@Override
@Nullable
public String getRole() {
return this.role;
}
public void setRole(String role) {
public void setRole(@Nullable String role) {
this.role = role;
}

3
spring-cloud-vault-config-databases/src/main/java/org/springframework/cloud/vault/config/databases/package-info.java
View File

@@ -18,5 +18,6 @@
* Database integration with Vault.
* @author Mark Paluch
*/
@org.springframework.lang.NonNullApi
@org.springframework.lang.NonNullFields
package org.springframework.cloud.vault.config.databases;

46
spring-cloud-vault-config-rabbitmq/src/main/java/org/springframework/cloud/vault/config/rabbitmq/VaultRabbitMqProperties.java
View File

@@ -16,11 +16,9 @@
package org.springframework.cloud.vault.config.rabbitmq;
import javax.validation.constraints.NotEmpty;
import org.springframework.boot.context.properties.ConfigurationProperties;
import org.springframework.cloud.vault.config.VaultSecretBackendDescriptor;
import org.springframework.validation.annotation.Validated;
import org.springframework.lang.Nullable;
/**
* Configuration properties for Vault using the RabbitMQ integration.
@@ -28,7 +26,6 @@ import org.springframework.validation.annotation.Validated;
* @author Mark Paluch
*/
@ConfigurationProperties("spring.cloud.vault.rabbitmq")
@Validated
public class VaultRabbitMqProperties implements VaultSecretBackendDescriptor {
/**
@@ -39,62 +36,63 @@ public class VaultRabbitMqProperties implements VaultSecretBackendDescriptor {
/**
* Role name for credentials.
*/
@Nullable
private String role;
/**
* rabbitmq backend path.
*/
@NotEmpty
private String backend = "rabbitmq";
/**
* Target property for the obtained username.
*/
@NotEmpty
private String usernameProperty = "spring.rabbitmq.username";
/**
* Target property for the obtained password.
*/
@NotEmpty
private String passwordProperty = "spring.rabbitmq.password";
@Override
public boolean isEnabled() {
return this.enabled;
}
public String getRole() {
return this.role;
}
public String getBackend() {
return this.backend;
}
public String getUsernameProperty() {
return this.usernameProperty;
}
public String getPasswordProperty() {
return this.passwordProperty;
}
public void setEnabled(boolean enabled) {
this.enabled = enabled;
}
public void setRole(String role) {
@Nullable
public String getRole() {
return this.role;
}
public void setRole(@Nullable String role) {
this.role = role;
}
@Override
public String getBackend() {
return this.backend;
}
public void setBackend(String backend) {
this.backend = backend;
}
public String getUsernameProperty() {
return this.usernameProperty;
}
public void setUsernameProperty(String usernameProperty) {
this.usernameProperty = usernameProperty;
}
public String getPasswordProperty() {
return this.passwordProperty;
}
public void setPasswordProperty(String passwordProperty) {
this.passwordProperty = passwordProperty;
}

3
spring-cloud-vault-config-rabbitmq/src/main/java/org/springframework/cloud/vault/config/rabbitmq/package-info.java
View File

@@ -18,5 +18,6 @@
* RabbitMQ integration with Vault.
* @author Mark Paluch
*/
@org.springframework.lang.NonNullApi
@org.springframework.lang.NonNullFields
package org.springframework.cloud.vault.config.rabbitmq;

13
spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/KeyValueSecretBackendMetadata.java
View File

@@ -107,10 +107,10 @@ public class KeyValueSecretBackendMetadata extends SecretBackendMetadataSupport
public static List<String> buildContexts(VaultKeyValueBackendPropertiesSupport properties, List<String> profiles) {
String appName = properties.getApplicationName();
Set<String> contexts = new LinkedHashSet<>();
String defaultContext = properties.getDefaultContext();
contexts.addAll(buildContexts(defaultContext, profiles, properties.getProfileSeparator()));
Set<String> contexts = new LinkedHashSet<>(
buildContexts(defaultContext, profiles, properties.getProfileSeparator()));
for (String applicationName : StringUtils.commaDelimitedListToSet(appName)) {
contexts.addAll(buildContexts(applicationName, profiles, properties.getProfileSeparator()));
@@ -135,15 +135,12 @@ public class KeyValueSecretBackendMetadata extends SecretBackendMetadataSupport
*/
public static List<String> buildContexts(String applicationName, List<String> profiles, String profileSeparator) {
List<String> contexts = new ArrayList<>();
if (!StringUtils.hasText(applicationName)) {
return contexts;
return Collections.emptyList();
}
if (!contexts.contains(applicationName)) {
contexts.add(applicationName);
}
List<String> contexts = new ArrayList<>(profiles.size() + 1);
contexts.add(applicationName);
for (String profile : profiles) {

4
spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/PropertyNameTransformer.java
View File

@@ -60,10 +60,6 @@ public class PropertyNameTransformer implements PropertyTransformer {
@Override
public Map<String, Object> transformProperties(Map<String, ? extends Object> input) {
if (input == null) {
return null;
}
Map<String, Object> transformed = new LinkedHashMap<>(input.size(), 1);
for (String key : input.keySet()) {

7
spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/VaultBootstrapPropertySourceConfiguration.java
View File

@@ -29,6 +29,8 @@ import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Lazy;
import org.springframework.core.Ordered;
import org.springframework.core.annotation.Order;
import org.springframework.lang.Nullable;
import org.springframework.util.Assert;
import org.springframework.vault.authentication.LifecycleAwareSessionManager;
import org.springframework.vault.authentication.SessionManager;
import org.springframework.vault.core.VaultOperations;
@@ -56,8 +58,10 @@ public class VaultBootstrapPropertySourceConfiguration implements InitializingBe
private final ConfigurableApplicationContext applicationContext;
@Nullable
private Collection<VaultSecretBackendDescriptor> vaultSecretBackendDescriptors;
@Nullable
private Collection<SecretBackendMetadataFactory<? super VaultSecretBackendDescriptor>> factories;
public VaultBootstrapPropertySourceConfiguration(VaultProperties vaultProperties,
@@ -82,6 +86,9 @@ public class VaultBootstrapPropertySourceConfiguration implements InitializingBe
VaultKeyValueBackendProperties kvBackendProperties,
ObjectFactory<SecretLeaseContainer> secretLeaseContainerObjectFactory) {
Assert.state(this.vaultSecretBackendDescriptors != null, "VaultSecretBackendDescriptors must not be null");
Assert.state(this.factories != null, "SecretBackendMetadataFactories must not be null");
VaultConfigTemplate vaultConfigTemplate = new VaultConfigTemplate(operations, vaultProperties);
Collection<VaultConfigurer> vaultConfigurers = this.applicationContext.getBeansOfType(VaultConfigurer.class)

4
spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/VaultConfigOperations.java
View File

@@ -16,6 +16,7 @@
package org.springframework.cloud.vault.config;
import org.springframework.lang.Nullable;
import org.springframework.vault.core.VaultOperations;
/**
@@ -33,9 +34,10 @@ public interface VaultConfigOperations {
* {@link SecretBackendMetadata}. Reading data using this method is suitable for
* secret backends that do not require a request body.
* @param secretBackendMetadata must not be {@literal null}.
* @return the configuration data. May be empty but never {@literal null}.
* @return the configuration data. May be {@literal null}.
* @throws IllegalStateException if {@link VaultProperties#failFast} is enabled.
*/
@Nullable
Secrets read(SecretBackendMetadata secretBackendMetadata);
/**

6
spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/VaultConfigTemplate.java
View File

@@ -84,12 +84,10 @@ public class VaultConfigTemplate implements VaultConfigOperations {
return null;
}
Map<String, Object> data = JsonMapFlattener.flatten(vaultResponse.getData());
Map<String, Object> data = JsonMapFlattener.flatten(vaultResponse.getRequiredData());
PropertyTransformer propertyTransformer = secretBackendMetadata.getPropertyTransformer();
if (propertyTransformer != null) {
data = propertyTransformer.transformProperties(data);
}
data = propertyTransformer.transformProperties(data);
return createSecrets(vaultResponse, data);
}

4
spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/VaultConfiguration.java
View File

@@ -67,10 +67,6 @@ final class VaultConfiguration {
*/
static SslConfiguration createSslConfiguration(Ssl ssl) {
if (ssl == null) {
return SslConfiguration.unconfigured();
}
KeyStoreConfiguration keyStore = KeyStoreConfiguration.unconfigured();
KeyStoreConfiguration trustStore = KeyStoreConfiguration.unconfigured();

2
spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/VaultKeyValueBackendProperties.java
View File

@@ -27,6 +27,7 @@ import org.springframework.boot.context.properties.ConfigurationProperties;
import org.springframework.boot.context.properties.DeprecatedConfigurationProperty;
import org.springframework.context.EnvironmentAware;
import org.springframework.core.env.Environment;
import org.springframework.lang.Nullable;
import org.springframework.util.StringUtils;
import org.springframework.validation.annotation.Validated;
@@ -76,6 +77,7 @@ public class VaultKeyValueBackendProperties implements EnvironmentAware, VaultKe
* List of active profiles.
* @since 3.0
*/
@Nullable
private List<String> profiles;
/**

392
spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/VaultProperties.java
View File

@@ -19,15 +19,13 @@ package org.springframework.cloud.vault.config;
import java.net.URI;
import java.time.Duration;
import javax.validation.constraints.NotEmpty;
import org.springframework.boot.context.properties.ConfigurationProperties;
import org.springframework.boot.context.properties.DeprecatedConfigurationProperty;
import org.springframework.context.EnvironmentAware;
import org.springframework.core.env.Environment;
import org.springframework.core.io.Resource;
import org.springframework.lang.Nullable;
import org.springframework.util.StringUtils;
import org.springframework.validation.annotation.Validated;
import org.springframework.vault.authentication.LoginToken;
import org.springframework.vault.core.lease.LeaseEndpoints;
@@ -42,7 +40,6 @@ import org.springframework.vault.core.lease.LeaseEndpoints;
* @author Mårten Svantesson
*/
@ConfigurationProperties(VaultProperties.PREFIX)
@Validated
public class VaultProperties implements EnvironmentAware {
/**
@@ -58,13 +55,11 @@ public class VaultProperties implements EnvironmentAware {
/**
* Vault server host.
*/
// @NotEmpty
private String host = "localhost";
/**
* Vault server port.
*/
// @Range(min = 1, max = 65535)
private int port = 8200;
/**
@@ -75,11 +70,13 @@ public class VaultProperties implements EnvironmentAware {
/**
* Vault URI. Can be set with scheme, host and port.
*/
@Nullable
private String uri;
/**
* Vault namespace (requires Vault Enterprise).
*/
@Nullable
private String namespace;
/**
@@ -105,6 +102,7 @@ public class VaultProperties implements EnvironmentAware {
/**
* Static vault token. Required if {@link #authentication} is {@code TOKEN}.
*/
@Nullable
private String token;
private AppIdProperties appId = new AppIdProperties();
@@ -152,198 +150,201 @@ public class VaultProperties implements EnvironmentAware {
return this.enabled;
}
public String getHost() {
return this.host;
}
public int getPort() {
return this.port;
}
public String getScheme() {
return this.scheme;
}
public String getUri() {
return this.uri;
}
public String getNamespace() {
return this.namespace;
}
public Discovery getDiscovery() {
return this.discovery;
}
public int getConnectionTimeout() {
return this.connectionTimeout;
}
public int getReadTimeout() {
return this.readTimeout;
}
public boolean isFailFast() {
return this.failFast;
}
public String getToken() {
return this.token;
}
public AppIdProperties getAppId() {
return this.appId;
}
public AppRoleProperties getAppRole() {
return this.appRole;
}
public AwsEc2Properties getAwsEc2() {
return this.awsEc2;
}
public AwsIamProperties getAwsIam() {
return this.awsIam;
}
public AzureMsiProperties getAzureMsi() {
return this.azureMsi;
}
public GcpGceProperties getGcpGce() {
return this.gcpGce;
}
public GcpIamProperties getGcpIam() {
return this.gcpIam;
}
public KubernetesProperties getKubernetes() {
return this.kubernetes;
}
public PcfProperties getPcf() {
return this.pcf;
}
public Ssl getSsl() {
return this.ssl;
}
public Config getConfig() {
return this.config;
}
public Session getSession() {
return this.session;
}
public String getApplicationName() {
return this.applicationName;
}
public AuthenticationMethod getAuthentication() {
return this.authentication;
}
public void setEnabled(boolean enabled) {
this.enabled = enabled;
}
public String getHost() {
return this.host;
}
public void setHost(String host) {
this.host = host;
}
public int getPort() {
return this.port;
}
public void setPort(int port) {
this.port = port;
}
public String getScheme() {
return this.scheme;
}
public void setScheme(String scheme) {
this.scheme = scheme;
}
public void setUri(String uri) {
@Nullable
public String getUri() {
return this.uri;
}
public void setUri(@Nullable String uri) {
this.uri = uri;
}
public void setNamespace(String namespace) {
@Nullable
public String getNamespace() {
return this.namespace;
}
public void setNamespace(@Nullable String namespace) {
this.namespace = namespace;
}
public Discovery getDiscovery() {
return this.discovery;
}
public void setDiscovery(Discovery discovery) {
this.discovery = discovery;
}
public int getConnectionTimeout() {
return this.connectionTimeout;
}
public void setConnectionTimeout(int connectionTimeout) {
this.connectionTimeout = connectionTimeout;
}
public int getReadTimeout() {
return this.readTimeout;
}
public void setReadTimeout(int readTimeout) {
this.readTimeout = readTimeout;
}
public boolean isFailFast() {
return this.failFast;
}
public void setFailFast(boolean failFast) {
this.failFast = failFast;
}
public void setToken(String token) {
@Nullable
public String getToken() {
return this.token;
}
public void setToken(@Nullable String token) {
this.token = token;
}
public AppIdProperties getAppId() {
return this.appId;
}
public void setAppId(AppIdProperties appId) {
this.appId = appId;
}
public AppRoleProperties getAppRole() {
return this.appRole;
}
public void setAppRole(AppRoleProperties appRole) {
this.appRole = appRole;
}
public AwsEc2Properties getAwsEc2() {
return this.awsEc2;
}
public void setAwsEc2(AwsEc2Properties awsEc2) {
this.awsEc2 = awsEc2;
}
public AwsIamProperties getAwsIam() {
return this.awsIam;
}
public void setAwsIam(AwsIamProperties awsIam) {
this.awsIam = awsIam;
}
public AzureMsiProperties getAzureMsi() {
return this.azureMsi;
}
public void setAzureMsi(AzureMsiProperties azureMsi) {
this.azureMsi = azureMsi;
}
public GcpGceProperties getGcpGce() {
return this.gcpGce;
}
public void setGcpGce(GcpGceProperties gcpGce) {
this.gcpGce = gcpGce;
}
public GcpIamProperties getGcpIam() {
return this.gcpIam;
}
public void setGcpIam(GcpIamProperties gcpIam) {
this.gcpIam = gcpIam;
}
public KubernetesProperties getKubernetes() {
return this.kubernetes;
}
public void setKubernetes(KubernetesProperties kubernetes) {
this.kubernetes = kubernetes;
}
public PcfProperties getPcf() {
return this.pcf;
}
public void setPcf(PcfProperties pcf) {
this.pcf = pcf;
}
public Ssl getSsl() {
return this.ssl;
}
public void setSsl(Ssl ssl) {
this.ssl = ssl;
}
public Config getConfig() {
return this.config;
}
public void setConfig(Config config) {
this.config = config;
}
public Session getSession() {
return this.session;
}
public void setSession(Session session) {
this.session = session;
}
public String getApplicationName() {
return this.applicationName;
}
public void setApplicationName(String applicationName) {
this.applicationName = applicationName;
}
public AuthenticationMethod getAuthentication() {
return this.authentication;
}
public void setAuthentication(AuthenticationMethod authentication) {
this.authentication = authentication;
}
@@ -382,14 +383,14 @@ public class VaultProperties implements EnvironmentAware {
return this.enabled;
}
public String getServiceId() {
return this.serviceId;
}
public void setEnabled(boolean enabled) {
this.enabled = enabled;
}
public String getServiceId() {
return this.serviceId;
}
public void setServiceId(String serviceId) {
this.serviceId = serviceId;
}
@@ -399,7 +400,6 @@ public class VaultProperties implements EnvironmentAware {
/**
* AppId properties.
*/
@Validated
public static class AppIdProperties {
/**
@@ -424,35 +424,36 @@ public class VaultProperties implements EnvironmentAware {
/**
* Network interface hint for the "MAC_ADDRESS" UserId mechanism.
*/
private String networkInterface = null;
@Nullable
private String networkInterface;
/**
* UserId mechanism. Can be either "MAC_ADDRESS", "IP_ADDRESS", a string or a
* class name.
*/
@NotEmpty
private String userId = MAC_ADDRESS;
public String getAppIdPath() {
return this.appIdPath;
}
public String getNetworkInterface() {
return this.networkInterface;
}
public String getUserId() {
return this.userId;
}
public void setAppIdPath(String appIdPath) {
this.appIdPath = appIdPath;
}
public void setNetworkInterface(String networkInterface) {
@Nullable
public String getNetworkInterface() {
return this.networkInterface;
}
public void setNetworkInterface(@Nullable String networkInterface) {
this.networkInterface = networkInterface;
}
public String getUserId() {
return this.userId;
}
public void setUserId(String userId) {
this.userId = userId;
}
@@ -462,7 +463,6 @@ public class VaultProperties implements EnvironmentAware {
/**
* AppRole properties.
*/
@Validated
public static class AppRoleProperties {
/**
@@ -478,42 +478,46 @@ public class VaultProperties implements EnvironmentAware {
/**
* The RoleId.
*/
private String roleId = null;
@Nullable
private String roleId;
/**
* The SecretId.
*/
private String secretId = null;
@Nullable
private String secretId;
public String getAppRolePath() {
return this.appRolePath;
}
public String getRole() {
return this.role;
}
public String getRoleId() {
return this.roleId;
}
public String getSecretId() {
return this.secretId;
}
public void setAppRolePath(String appRolePath) {
this.appRolePath = appRolePath;
}
public String getRole() {
return this.role;
}
public void setRole(String role) {
this.role = role;
}
public void setRoleId(String roleId) {
@Nullable
public String getRoleId() {
return this.roleId;
}
public void setRoleId(@Nullable String roleId) {
this.roleId = roleId;
}
public void setSecretId(String secretId) {
@Nullable
public String getSecretId() {
return this.secretId;
}
public void setSecretId(@Nullable String secretId) {
this.secretId = secretId;
}
@@ -522,19 +526,16 @@ public class VaultProperties implements EnvironmentAware {
/**
* AWS-EC2 properties.
*/
@Validated
public static class AwsEc2Properties {
/**
* URL of the AWS-EC2 PKCS7 identity document.
*/
@NotEmpty
private String identityDocument = "http://169.254.169.254/latest/dynamic/instance-identity/pkcs7";
/**
* Mount path of the AWS-EC2 authentication backend.
*/
@NotEmpty
private String awsEc2Path = "aws-ec2";
/**
@@ -546,37 +547,39 @@ public class VaultProperties implements EnvironmentAware {
* Nonce used for AWS-EC2 authentication. An empty nonce defaults to nonce
* generation.
*/
@Nullable
private String nonce;
public String getIdentityDocument() {
return this.identityDocument;
}
public String getAwsEc2Path() {
return this.awsEc2Path;
}
public String getRole() {
return this.role;
}
public String getNonce() {
return this.nonce;
}
public void setIdentityDocument(String identityDocument) {
this.identityDocument = identityDocument;
}
public String getAwsEc2Path() {
return this.awsEc2Path;
}
public void setAwsEc2Path(String awsEc2Path) {
this.awsEc2Path = awsEc2Path;
}
public String getRole() {
return this.role;
}
public void setRole(String role) {
this.role = role;
}
public void setNonce(String nonce) {
@Nullable
public String getNonce() {
return this.nonce;
}
public void setNonce(@Nullable String nonce) {
this.nonce = nonce;
}
@@ -590,7 +593,6 @@ public class VaultProperties implements EnvironmentAware {
/**
* Mount path of the AWS authentication backend.
*/
@NotEmpty
private String awsPath = "aws";
/**
@@ -602,6 +604,7 @@ public class VaultProperties implements EnvironmentAware {
* Name of the server used to set {@code X-Vault-AWS-IAM-Server-ID} header in the
* headers of login requests.
*/
@Nullable
private String serverName;
/**
@@ -609,6 +612,7 @@ public class VaultProperties implements EnvironmentAware {
*
* @since 2.2
*/
@Nullable
private URI endpointUri;
public String getAwsPath() {
@@ -619,6 +623,7 @@ public class VaultProperties implements EnvironmentAware {
return this.role;
}
@Nullable
public String getServerName() {
return this.serverName;
}
@@ -635,6 +640,7 @@ public class VaultProperties implements EnvironmentAware {
this.serverName = serverName;
}
@Nullable
public URI getEndpointUri() {
return this.endpointUri;
}
@@ -653,7 +659,6 @@ public class VaultProperties implements EnvironmentAware {
/**
* Mount path of the Azure MSI authentication backend.
*/
@NotEmpty
private String azurePath = "azure";
/**
@@ -687,7 +692,6 @@ public class VaultProperties implements EnvironmentAware {
/**
* Mount path of the Kubernetes authentication backend.
*/
@NotEmpty
private String gcpPath = "gcp";
/**
@@ -739,7 +743,6 @@ public class VaultProperties implements EnvironmentAware {
/**
* Mount path of the Kubernetes authentication backend.
*/
@NotEmpty
private String gcpPath = "gcp";
/**
@@ -853,7 +856,6 @@ public class VaultProperties implements EnvironmentAware {
/**
* Mount path of the Kubernetes authentication backend.
*/
@NotEmpty
private String kubernetesPath = "kubernetes";
/**
@@ -864,7 +866,6 @@ public class VaultProperties implements EnvironmentAware {
/**
* Path to the service account token file.
*/
@NotEmpty
private String serviceAccountTokenFile = "/var/run/secrets/kubernetes.io/serviceaccount/token";
public String getKubernetesPath() {
@@ -901,7 +902,6 @@ public class VaultProperties implements EnvironmentAware {
/**
* Mount path of the Kubernetes authentication backend.
*/
@NotEmpty
private String pcfPath = "pcf";
/**
@@ -913,12 +913,14 @@ public class VaultProperties implements EnvironmentAware {
* Path to the instance certificate (PEM). Defaults to {@code CF_INSTANCE_CERT}
* env variable.
*/
@Nullable
private Resource instanceCertificate;
/**
* Path to the instance key (PEM). Defaults to {@code CF_INSTANCE_KEY} env
* variable.
*/
@Nullable
private Resource instanceKey;
public String getPcfPath() {
@@ -937,19 +939,21 @@ public class VaultProperties implements EnvironmentAware {
this.role = role;
}
@Nullable
public Resource getInstanceCertificate() {
return this.instanceCertificate;
}
public void setInstanceCertificate(Resource instanceCertificate) {
public void setInstanceCertificate(@Nullable Resource instanceCertificate) {
this.instanceCertificate = instanceCertificate;
}
@Nullable
public Resource getInstanceKey() {
return this.instanceKey;
}
public void setInstanceKey(Resource instanceKey) {
public void setInstanceKey(@Nullable Resource instanceKey) {
this.instanceKey = instanceKey;
}
@@ -958,17 +962,18 @@ public class VaultProperties implements EnvironmentAware {
/**
* SSL properties.
*/
@Validated
public static class Ssl {
/**
* Trust store that holds certificates and private keys.
*/
@Nullable
private Resource keyStore;
/**
* Password used to access the key store.
*/
@Nullable
private String keyStorePassword;
/**
@@ -976,16 +981,19 @@ public class VaultProperties implements EnvironmentAware {
*
* @since 3.0
*/
@Nullable
private String keyStoreType;
/**
* Trust store that holds SSL certificates.
*/
@Nullable
private Resource trustStore;
/**
* Password used to access the trust store.
*/
@Nullable
private String trustStorePassword;
/**
@@ -993,59 +1001,65 @@ public class VaultProperties implements EnvironmentAware {
*
* @since 3.0
*/
@Nullable
private String trustStoreType;
/**
* Mount path of the TLS cert authentication backend.
*/
@NotEmpty
private String certAuthPath = "cert";
@Nullable
public Resource getKeyStore() {
return this.keyStore;
}
public void setKeyStore(Resource keyStore) {
public void setKeyStore(@Nullable Resource keyStore) {
this.keyStore = keyStore;
}
@Nullable
public String getKeyStorePassword() {
return this.keyStorePassword;
}
public void setKeyStorePassword(String keyStorePassword) {
public void setKeyStorePassword(@Nullable String keyStorePassword) {
this.keyStorePassword = keyStorePassword;
}
@Nullable
public String getKeyStoreType() {
return this.keyStoreType;
}
public void setKeyStoreType(String keyStoreType) {
public void setKeyStoreType(@Nullable String keyStoreType) {
this.keyStoreType = keyStoreType;
}
@Nullable
public Resource getTrustStore() {
return this.trustStore;
}
public void setTrustStore(Resource trustStore) {
public void setTrustStore(@Nullable Resource trustStore) {
this.trustStore = trustStore;
}
@Nullable
public String getTrustStorePassword() {
return this.trustStorePassword;
}
public void setTrustStorePassword(String trustStorePassword) {
public void setTrustStorePassword(@Nullable String trustStorePassword) {
this.trustStorePassword = trustStorePassword;
}
@Nullable
public String getTrustStoreType() {
return this.trustStoreType;
}
public void setTrustStoreType(String trustStoreType) {
public void setTrustStoreType(@Nullable String trustStoreType) {
this.trustStoreType = trustStoreType;
}
@@ -1109,6 +1123,7 @@ public class VaultProperties implements EnvironmentAware {
*
* @since 2.2
*/
@Nullable
private Duration minRenewal;
/**
@@ -1117,6 +1132,7 @@ public class VaultProperties implements EnvironmentAware {
*
* @since 2.2
*/
@Nullable
private Duration expiryThreshold;
/**
@@ -1129,37 +1145,41 @@ public class VaultProperties implements EnvironmentAware {
*
* @since 2.2
*/
@Nullable
private LeaseEndpoints leaseEndpoints;
public boolean isEnabled() {
return this.enabled;
}
public Duration getMinRenewal() {
return this.minRenewal;
}
public Duration getExpiryThreshold() {
return this.expiryThreshold;
}
public LeaseEndpoints getLeaseEndpoints() {
return this.leaseEndpoints;
}
public void setEnabled(boolean enabled) {
this.enabled = enabled;
}
public void setMinRenewal(Duration minRenewal) {
@Nullable
public Duration getMinRenewal() {
return this.minRenewal;
}
public void setMinRenewal(@Nullable Duration minRenewal) {
this.minRenewal = minRenewal;
}
public void setExpiryThreshold(Duration expiryThreshold) {
@Nullable
public Duration getExpiryThreshold() {
return this.expiryThreshold;
}
public void setExpiryThreshold(@Nullable Duration expiryThreshold) {
this.expiryThreshold = expiryThreshold;
}
public void setLeaseEndpoints(LeaseEndpoints leaseEndpoints) {
@Nullable
public LeaseEndpoints getLeaseEndpoints() {
return this.leaseEndpoints;
}
public void setLeaseEndpoints(@Nullable LeaseEndpoints leaseEndpoints) {
this.leaseEndpoints = leaseEndpoints;
}

4
spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/VaultPropertySource.java
View File

@@ -24,6 +24,7 @@ import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.springframework.core.env.EnumerablePropertySource;
import org.springframework.lang.Nullable;
import org.springframework.util.Assert;
/**
@@ -42,6 +43,7 @@ class VaultPropertySource extends EnumerablePropertySource<VaultConfigOperations
private final Map<String, Object> properties = new LinkedHashMap<>();
@Nullable
private Secrets secrets;
/**
@@ -70,7 +72,7 @@ class VaultPropertySource extends EnumerablePropertySource<VaultConfigOperations
try {
this.secrets = this.source.read(this.secretBackendMetadata);
if (this.secrets != null) {
this.properties.putAll(this.secrets.getData());
this.properties.putAll(this.secrets.getRequiredData());
}
}
catch (RuntimeException e) {

3
spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/VaultPropertySourceLocatorSupport.java
View File

@@ -113,11 +113,10 @@ public abstract class VaultPropertySourceLocatorSupport implements PropertySourc
Collection<SecretBackendMetadata> secretBackends = this.propertySourceLocatorConfiguration.getSecretBackends();
List<SecretBackendMetadata> sorted = new ArrayList<>(secretBackends);
List<PropertySource<?>> propertySources = new ArrayList<>();
AnnotationAwareOrderComparator.sort(sorted);
propertySources.addAll(doCreateKeyValuePropertySources(environment));
List<PropertySource<?>> propertySources = new ArrayList<>(doCreateKeyValuePropertySources(environment));
for (SecretBackendMetadata backendAccessor : sorted) {

8
spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/VaultReactiveAutoConfiguration.java
View File

@@ -39,6 +39,7 @@ import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.annotation.AnnotationAwareOrderComparator;
import org.springframework.http.client.reactive.ClientHttpConnector;
import org.springframework.lang.Nullable;
import org.springframework.util.Assert;
import org.springframework.vault.authentication.AuthenticationStepsFactory;
import org.springframework.vault.authentication.ClientAuthentication;
@@ -85,11 +86,13 @@ public class VaultReactiveAutoConfiguration implements InitializingBean {
private final List<WebClientCustomizer> customizers;
@Nullable
private ClientHttpConnector clientHttpConnector;
/**
* Used for Vault communication.
*/
@Nullable
private WebClientBuilder webClientBuilder;
public VaultReactiveAutoConfiguration(VaultProperties vaultProperties,
@@ -136,6 +139,9 @@ public class VaultReactiveAutoConfiguration implements InitializingBean {
@Bean
@ConditionalOnMissingBean
public WebClientFactory vaultWebClientFactory() {
Assert.state(this.clientHttpConnector != null, "ClientHttpConnector must not be null");
return new DefaultWebClientFactory(this.clientHttpConnector, this::webClientBuilder);
}
@@ -149,6 +155,8 @@ public class VaultReactiveAutoConfiguration implements InitializingBean {
@ConditionalOnMissingBean(ReactiveVaultOperations.class)
public ReactiveVaultTemplate reactiveVaultTemplate(ObjectProvider<ReactiveSessionManager> sessionManager) {
Assert.state(this.webClientBuilder != null, "WebClientBuilder must not be null");
if (this.vaultProperties.getAuthentication() == VaultProperties.AuthenticationMethod.NONE) {
return new ReactiveVaultTemplate(this.webClientBuilder);
}

2
spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/VaultReactiveHealthIndicator.java
View File

@@ -47,10 +47,12 @@ public class VaultReactiveHealthIndicator extends AbstractReactiveHealthIndicato
this.vaultOperations = vaultOperations;
}
@SuppressWarnings("BlockingMethodInNonBlockingContext")
private static Mono<? extends VaultHealthImpl> deserializeError(WebClientResponseException e) {
try {
ObjectMapper mapper = new ObjectMapper();
// Response is already materialized so not blocking here.
return Mono.just(mapper.readValue(e.getResponseBodyAsByteArray(), VaultHealthImpl.class));
}
catch (Exception jsonError) {

9
spring-cloud-vault-config/src/test/java/org/springframework/cloud/vault/config/PropertyNameTransformerUnitTests.java
View File

@@ -44,13 +44,4 @@ public class PropertyNameTransformerUnitTests {
"other-value");
}
@Test
public void shouldAllowNullInput() {
PropertyNameTransformer transformer = new PropertyNameTransformer();
transformer.addKeyTransformation("old-key", "new-key");
assertThat(transformer.transformProperties(null)).isNull();
}
}