From f06153d36c28b375767b81384154a4f26b2028cc Mon Sep 17 00:00:00 2001 From: Mark Paluch Date: Fri, 24 Nov 2023 14:26:27 +0100 Subject: [PATCH] Add configuration to retry lease renewal on error. Closes gh-708 --- .../vault/config/VaultConfiguration.java | 10 +++++++ .../cloud/vault/config/VaultProperties.java | 30 ++++++++++++++++++- ...strapPropertySourceConfigurationTests.java | 5 +++- 3 files changed, 43 insertions(+), 2 deletions(-) diff --git a/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/VaultConfiguration.java b/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/VaultConfiguration.java index 4d79a8c0..7f40390b 100644 --- a/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/VaultConfiguration.java +++ b/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/VaultConfiguration.java @@ -45,6 +45,7 @@ import org.springframework.vault.client.VaultHttpHeaders; import org.springframework.vault.core.VaultOperations; import org.springframework.vault.core.lease.SecretLeaseContainer; import org.springframework.vault.support.ClientOptions; +import org.springframework.vault.support.LeaseStrategy; import org.springframework.vault.support.SslConfiguration; import org.springframework.vault.support.SslConfiguration.KeyStoreConfiguration; import org.springframework.web.client.RestTemplate; @@ -222,6 +223,15 @@ final class VaultConfiguration { if (lifecycle.getLeaseEndpoints() != null) { container.setLeaseEndpoints(lifecycle.getLeaseEndpoints()); } + + if (lifecycle.getLeaseStrategy() != null) { + + switch (lifecycle.getLeaseStrategy()) { + case DropOnError -> container.setLeaseStrategy(LeaseStrategy.dropOnError()); + case RetainOnError -> container.setLeaseStrategy(LeaseStrategy.retainOnError()); + case RetainOnIoError -> container.setLeaseStrategy(LeaseStrategy.retainOnIoError()); + } + } } } diff --git a/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/VaultProperties.java b/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/VaultProperties.java index 5e123a89..e5e6de1d 100644 --- a/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/VaultProperties.java +++ b/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/VaultProperties.java @@ -31,6 +31,7 @@ import org.springframework.util.StringUtils; import org.springframework.vault.authentication.AzureMsiAuthenticationOptions; import org.springframework.vault.authentication.LoginToken; import org.springframework.vault.core.lease.LeaseEndpoints; +import org.springframework.vault.support.LeaseStrategy; /** * Properties to configure Vault support. @@ -1252,12 +1253,20 @@ public class VaultProperties implements EnvironmentAware { * * Can be {@link LeaseEndpoints#SysLeases} for version 0.8 or above of Vault or * {@link LeaseEndpoints#Legacy} for older versions (the default). - * * @since 2.2 */ @Nullable private LeaseEndpoints leaseEndpoints; + /** + * Sets the {@link LeaseStrategy} to be used with + * {@link org.springframework.vault.core.lease.SecretLeaseContainer#setLeaseStrategy(LeaseStrategy)} + * to retain or drop tokens on renewal errors. + * @since 4.1 + */ + @Nullable + private PredefinedLeaseStrategy leaseStrategy; + public boolean isEnabled() { return this.enabled; } @@ -1293,6 +1302,25 @@ public class VaultProperties implements EnvironmentAware { this.leaseEndpoints = leaseEndpoints; } + @Nullable + public PredefinedLeaseStrategy getLeaseStrategy() { + return this.leaseStrategy; + } + + public void setLeaseStrategy(@Nullable PredefinedLeaseStrategy leaseStrategy) { + this.leaseStrategy = leaseStrategy; + } + + } + + /** + * @since 4.1 + * @see LeaseStrategy + */ + enum PredefinedLeaseStrategy { + + RetainOnError, RetainOnIoError, DropOnError, + } /** diff --git a/spring-cloud-vault-config/src/test/java/org/springframework/cloud/vault/config/VaultBootstrapPropertySourceConfigurationTests.java b/spring-cloud-vault-config/src/test/java/org/springframework/cloud/vault/config/VaultBootstrapPropertySourceConfigurationTests.java index 1b7946f2..091cd1bd 100644 --- a/spring-cloud-vault-config/src/test/java/org/springframework/cloud/vault/config/VaultBootstrapPropertySourceConfigurationTests.java +++ b/spring-cloud-vault-config/src/test/java/org/springframework/cloud/vault/config/VaultBootstrapPropertySourceConfigurationTests.java @@ -29,6 +29,7 @@ import org.springframework.scheduling.concurrent.ThreadPoolTaskScheduler; import org.springframework.vault.core.VaultOperations; import org.springframework.vault.core.lease.LeaseEndpoints; import org.springframework.vault.core.lease.SecretLeaseContainer; +import org.springframework.vault.support.LeaseStrategy; import static org.mockito.Mockito.mock; import static org.mockito.Mockito.verify; @@ -45,13 +46,14 @@ public class VaultBootstrapPropertySourceConfigurationTests { .withConfiguration(AutoConfigurations.of(VaultBootstrapPropertySourceConfiguration.class)); @Test - public void shouldConfigureExpiryTimeouts() { + public void shouldConfigureExpiryTimeoutsAndStrategy() { this.contextRunner.withUserConfiguration(MockConfiguration.class).withAllowBeanDefinitionOverriding(true) .withPropertyValues("spring.cloud.vault.kv.enabled=false", "spring.cloud.vault.config.lifecycle.expiry-threshold=5m", "spring.cloud.vault.config.lifecycle.min-renewal=6m", "spring.cloud.vault.config.lifecycle.lease-endpoints=Leases", + "spring.cloud.vault.config.lifecycle.lease-strategy=retain-on-error", "spring.cloud.bootstrap.enabled=true") .run(context -> { @@ -59,6 +61,7 @@ public class VaultBootstrapPropertySourceConfigurationTests { verify(container).setExpiryThreshold(Duration.ofMinutes(5)); verify(container).setMinRenewal(Duration.ofMinutes(6)); verify(container).setLeaseEndpoints(LeaseEndpoints.Leases); + verify(container).setLeaseStrategy(LeaseStrategy.retainOnError()); }); }