We now use RelaxedPropertyResolver to resolve configuration property defaults because `@Value` defaulting does not support relaxed binding. Previously configuration properties were annotated with of `@Value` specifying a cascade of property names.
Fixes gh-87.
Use create daemon threads in ThreadPoolTaskScheduler to not prevent application shutdown if the ThreadPoolTaskScheduler is not shut down upon application exit. ThreadPoolTaskScheduler may stay active because the actual threads prevent a VM exit so the shutdown hook isn't called.
Fixes gh-81.
We now support AppRole authentication. This authentication method uses a provided RoleId and optionally SecretId to authenticate against Vault.
Fixes gh-39.
Rename SecureBackend to SecretBackend. Refactor SecureBackendAccessor to SecretBackendMetadata. Move Property Transformation into PropertyTransformer. Enhance JavaDoc. Remove Properties beans and use EnableProperties annotation.
Spring Cloud Vault now handles lifecycle of obtained secrets by property sources. Secrets associated with a renewable lease are renewed before they expire until terminal expiration. Application shutdown revokes leases so generated credentials can be disabled by Vault.
Fixes gh-40.
VaultClient now uses a ClientHttpRequestInterceptor to force marshaling. Outgoing data is buffered and available as byte array. This allows setting a Content-Length header using netty. Previously, requests were streamed to the TCP channel without knowing the request body size in advance. Vault expects a Content-Length header and rejected requests with a body but without a Content-Length header.
Fixes gh-19.
We now support cubbyhole authentication to securely use tokens. Cubbyhole authentication uses Vault primitives to provide a secured authentication workflow. Cubbyhole authentication uses tokens as primary login method.
An ephemeral token is used to obtain a second, login VaultToken from Vault's Cubbyhole secret backend. The login token is usually longer-lived and used to interact with Vault. The login token will be retrieved from a wrapped response stored at `/cubbyhole/response`.
A wrapped token can be created with:
vault token-create -wrap-ttl="10m"
boostrap.yml:
spring.cloud.vault:
authentication: CUBBYHOLE
token: (the wrapping token)
Fixes gh-15.
We now support setting a priority for VaultPropertySourceLocator by configuring `spring.cloud.vault.config.order`. Lower values increase priority, higher values decrease priority. Applying a priority can be used to control VaultPropertySourceLocator precedence over other property sources.
Original pull request: gh-36.
Reformat code. Use state key for health indicator details. Add health method declaration to VaultOperations. Switch actuator dependency to optional dependency. Add tests.
Original pull request: gh-29
Fixes gh-24
We now support TLS client certificate authentication. The client needs to enable SSL and configure a keystore containing the client certificate/private key pair.
spring.cloud.vault:
authentication: CERT
ssl:
key-store: classpath:keystore.jks
key-store-password: changeit
Fixes gh-25
Split functionality from VaultClient and refactor it into VaultConfigOperations/VaultConfigTemplate. The template now holds the authentication state and the property source just uses the template.
Fixes gh-23
We now support AWS-EC2 authentication for applications running on EC2 instances. This authentication method uses the PKCS7 identity document to authenticate against Vault. It provides support for nonce (enabled by default) and roles.
fixes gh-17
