Discover SecretBackendMetadataFactory and VaultSecretBackendDescriptor using spring.factories. Add instance suppliers for all imperative support classes.
We're now exposing vaulRestTemplateFactory and vaultWebClientFactory that allow construction of RestTemplate respective WebClient with Spring Vault's customizations applied.
Closes gh-401.
We now provide configuration properties to configure session token renewal, especially renewal and expiry thresholds.
spring.cloud.vault:
session.lifecycle:
enabled: true
refresh-before-expiry: 10s
expiry-threshold: 20s
Closes gh-400.
We now provide an override spring.cloud.vault.kv.profiles=… to specify application profiles that should be used for Vault access instead of Environment.getActiveProfiles().
Closes gh-385.
Spring Cloud Vault uses now a single mechanism for key-value backend configuration. Properties at spring.cloud.vault.generic.* are no longer supported.
All associated functionality is now solely available by configuring the corresponding spring.cloud.vault.kv.* properties. The support classes GenericSecretBackendMetadata and VaultGenericBackendProperties were removed in favor of KeyValueSecretBackendMetadata respective VaultKeyValueBackendProperties. spring.cloud.vault.kv.enabled is now enabled by default to preserve spring.cloud.vault.generic.enabled behavior.
Closes gh-395
Add this for field dereference. Tweak renewal timing for shorter test runtime. Move lifecycle configuration into SecretLeaseContainer bean method.
Closes gh-393.
Extend LeasingSecretBackendMetadata with callback methods before/after registration to add secret rotation listeners for config properties rebinding.
Refactor Consul configuration to use LeasingSecretBackendMetadata and rebind Consul ConfigurationProperties accordingly.
See gh-393
We now pass-thru the token obtained from ReactiveSessionManager instead of caching it.
Previously, we used a method reference and the method reference cached the SessionToken Mono instead of requesting a fresh token each time from the session manager.
Closes gh-382.
We now allow disabling Spring Vault's ClientAuthentication and SessionManagement features to rely on authenticated requests sent by Vault Agent. The authentication infrastructure can be disabled via:
spring.cloud.vault:
authentication: NONE
Closes gh-356.
Versioned key-value secrets are now loaded properly when lifecycle support is disabled.
We're using our own mechanism to read secrets instead of using Spring Vault's property source so we need to inspect whether the mount is a key-value v1 or v2 one to load its value properly.
Closes gh-372.
