We now allow disabling Spring Vault's ClientAuthentication and SessionManagement features to rely on authenticated requests sent by Vault Agent. The authentication infrastructure can be disabled via:
spring.cloud.vault:
authentication: NONE
Closes gh-356.
We now allow configuration which endpoints to use for renew/revocation
through configuring spring.cloud.vault.config.lifecycle.lease-endpoints=Legacy/SysLeases.
Vault 0.8 has introduced endpoints below sys/leases and deprecated the previous legacy approach.
Original pull request: gh-334.
* Update spring-cloud-vault.adoc
Updated password property in example to match the spring datasource password
* Fixing the rest of the property examples
Updating all property examples so the password property is mapped to a datasource password property
Original pull request: gh-324.
This commit updates URLs to prefer the https protocol. Redirects are not followed to avoid accidentally expanding intentionally shortened URLs (i.e. if using a URL shortener).
Closes gh-297.
We now support GCP Compute and GCP IAM authentication.
We also provide different RestTemplate's for Vault and for external service communication.
Closes gh-249.
We now provide configuration support for the versioned key-value backend introduced with Vault 0.10.0. This backend uses configuration properties prefixed with spring.cloud.vault.kv and defaults to the secret mount path. It resembles configuration properties from the generic secret backend. Using the versioned key-value backend requires disabling the generic secret backend (spring.cloud.vault.generic.enabled=false).
The versioned key-value backend can be configured programmatically through SecretBackendConfigurer.add(KeyValueSecretBackendMetadata.create(…)) which will add data path segments and unwrap nested data elements from the response.
See gh-209.
We now support a selected subset of push/pull/wrapped RoleId and SecretId combinations using AppRoleAuthentication:
* Provided RoleId/SecretId
* Provided RoleId without SecretId
* Provided RoleId, Pull SecretId
* Pull RoleId, provided SecretId
* Full pull mode
* Wrapped
* Wrapped RoleId, provided SecretId
* Provided RoleId, wrapped SecretId
The particular mode is derived from role-id, secret-id, role (name) and token properties beneath spring.cloud.vault.*.
Closes gh-174.
Slightly rewording. Remove parts that would duplicate Kubernetes/Vault reference docs.
Original pull request: gh-178.
Related ticket: gh-173.
Closes gh-178.
Convert spaces to tabs. Deprecate VaultPostgreSqlProperties and VaultMySqlProperties. Convert database integration test to use MySQL. Slightly reword reference documentation.
Upgrade lombok to 1.16.18 to use onMethod_ attributes.
Original pull request: gh-170.
Related ticket: gh-169.
We now support Vault's database backend directly. MySQL and PostgreSQL configuration properties are deprecated now in favor of spring.cloud.vault.database. Cassandra and MongoDB backends remain active and default to their deprecated backends to support multi-database configuration of multiple, various database types.
spring.cloud.vault:
database:
enabled: true
role: readonly
Original pull request: gh-170.
Related ticket: gh-169.
Rename vault-role configuration property to role for a consistent naming. Introduce path and server-name config properties. Eagerly fetch AWS credentials to fail early if credentials cannot be obtained. Fix properties in reference docs. Javadoc, reference docs wording. Add author tags. Re-generate readme.
Original pull request: gh-175.
See gh-134.
We now support configuration of AWS IAM using AWS' default credential provider chain to obtain credentials from the environment/system properties/credentials profile/ECS/EC2 metadata service.
spring.cloud.vault:
authentication: AWS_IAM
Original pull request: gh-175.
Closes gh-134.
We now support Vault server lookup using service registries via DiscoveryClient. Vault server is looked up during the bootstrap phase and configured by serviceId rather than host/port when enabling service discovery.
Closes gh-132.
We now support configuration of PropertySourceLocator behavior of generic and discovered secret backends. We introduced VaultConfigurer as strategy interface to be implemented by customizer beans in the bootstrap context. VaultConfigurer allows configuration of secret backends via SecretBackendConfigurer.
Motivation: Customization was only possible by implementing an own PropertySourceLocator by extending VaultPropertySourceLocatorSupport and implementing doCreatePropertySources. Both is non-trivial and does not allow reuse of existing functionality.
See gh-116.
We now support static configuration of the AWS-EC2 authentication nonce to support re-login on application crashes/vm-internal restarts.
Closes gh-103.
