Upgrade to Vault 0.10.0.

Closes gh-211.
This commit is contained in:
Mark Paluch
2018-04-24 16:20:37 +02:00
parent bae45f73f0
commit f21463ec1e
4 changed files with 53 additions and 5 deletions

View File

@@ -33,7 +33,8 @@ env:
- VAULT_VER=0.8.2
- VAULT_VER=0.8.3
- VAULT_VER=0.9.0
- VAULT_VER=0.9.3
- VAULT_VER=0.9.6
- VAULT_VER=0.10.0
before_install:
- sed -i.bak -e 's|https://nexus.codehaus.org/snapshots/|https://oss.sonatype.org/content/repositories/codehaus-snapshots/|g' ~/.m2/settings.xml

View File

@@ -15,6 +15,7 @@
*/
package org.springframework.cloud.vault.util;
import java.util.Collections;
import java.util.Map;
import org.springframework.util.Assert;
@@ -27,9 +28,9 @@ import org.springframework.vault.support.VaultInitializationResponse;
import org.springframework.vault.support.VaultMount;
import org.springframework.vault.support.VaultToken;
import org.springframework.vault.support.VaultTokenRequest;
import org.springframework.vault.support.VaultTokenRequest.VaultTokenRequestBuilder;
import org.springframework.vault.support.VaultTokenResponse;
import org.springframework.vault.support.VaultUnsealStatus;
import org.springframework.vault.support.VaultTokenRequest.VaultTokenRequestBuilder;
/**
* @author Mark Paluch
@@ -129,13 +130,28 @@ public class PrepareVault {
/**
* Mount an secret backend.
*
* @param secretBackend
* @param secretBackend must not be {@literal null} or empty.
*/
public void mountSecret(String secretBackend) {
mountSecret(secretBackend, secretBackend, Collections.emptyMap());
}
/**
* Mount an secret backend {@code secretBackend} at {@code path}.
*
* @param secretBackend must not be {@literal null} or empty.
* @param path must not be {@literal null} or empty.
* @param config must not be {@literal null}.
*/
public void mountSecret(String secretBackend, String path, Map<String, Object> config) {
Assert.hasText(secretBackend, "SecretBackend must not be empty");
Assert.hasText(path, "Mount path must not be empty");
Assert.notNull(config, "Configuration must not be null");
adminOperations.mount(secretBackend, VaultMount.create(secretBackend));
VaultMount mount = VaultMount.builder().type(secretBackend).config(config)
.build();
adminOperations.mount(path, mount);
}
/**
@@ -178,4 +194,25 @@ public class PrepareVault {
return Version.parse("0.0.0");
}
/**
* Disable Vault versioning Key-Value backend (kv version 2).
*/
public void disableGenericVersioning() {
vaultOperations.opsForSys().unmount("secret");
VaultMount kv = VaultMount.builder().type("kv")
.config(Collections.singletonMap("versioned", false)).build();
vaultOperations.opsForSys().mount("secret", kv);
}
public void mountVersionedKvBackend() {
mountSecret("kv", "versioned", Collections.emptyMap());
vaultOperations.write(
"sys/mounts/versioned/tune",
Collections.singletonMap("options",
Collections.singletonMap("version", "2")));
}
}

View File

@@ -36,6 +36,8 @@ import org.springframework.vault.support.VaultToken;
*/
public class VaultRule extends ExternalResource {
public static final Version VERSIONING_INTRODUCED_WITH = Version.parse("0.10.0");
private final VaultEndpoint vaultEndpoint;
private final PrepareVault prepareVault;
@@ -92,8 +94,16 @@ public class VaultRule extends ExternalResource {
}
if (!this.prepareVault.isAvailable()) {
this.token = prepareVault.initializeVault();
this.prepareVault.createToken(Settings.token().getToken(), "root");
if (this.prepareVault.getVersion().isGreaterThanOrEqualTo(
VERSIONING_INTRODUCED_WITH)) {
this.prepareVault.disableGenericVersioning();
this.prepareVault.mountVersionedKvBackend();
}
this.token = Settings.token();
}
}

View File

@@ -6,7 +6,7 @@
###########################################################################
VAULT_VER="${VAULT_VER:-0.9.3}"
VAULT_VER="${VAULT_VER:-0.10.0}"
UNAME=$(uname -s | tr '[:upper:]' '[:lower:]')
VAULT_ZIP="vault_${VAULT_VER}_${UNAME}_amd64.zip"
IGNORE_CERTS="${IGNORE_CERTS:-no}"