Introduce VaultSecretBackendDescriptorFactory as abstraction for descriptor factories that can produce multiple SecretBackendDescriptors. Consider VaultSecretBackendDescriptorFactory in Boostrap and Config Data API mechanisms. Add tests.
Original pull request: gh-587
See gh-459
Add author tags. Let VaultConfigLocation accept PropertyTransformer. Extract prefix computation into its own method. Tweak documentation wording.
See gh-488
Original pull request: gh-582.
We now propagate the optional config location flag to the config data infrastructure. Also, the check whether Vault is enabled is moved from the resolver into the loader returning null if Vault support is enabled. This allows Spring Boot to skip optional config data locations.
Closes gh-571
ReactiveDiscoveryClient beans are now used to configure ReactiveVaultEndpointProvider. If no ReactiveDiscoveryClient is available, then VaultEndpointProvider gets adapted by offloading the call to a worker Scheduler to avoid blocking calls on the calling thread.
Resolves gh-486.
We've introduced two new configuration properties (spring.cloud.vault.ssl.key-store-type=…/spring.cloud.vault.ssl.trust-store-type=…) to configure the keystore type including PEM support.
Resolves gh-387.
Fix property names to spring.couchbase instead of spring.data.couchbase. Fix VaultConfigCouchbaseTests to make it work with Couchbase instead of using Cassandra.
Add CouchbaseSecretIntegrationTests to verify interaction through VaultConfigTemplate. Remove property overrides for username/password so that Vault PropertySources are used. Use unique role name to avoid clashes with other tests.
Enable VaultConfigCouchbaseDatabaseTests for ConfigData API by importing vault://. Update reference documentation.
Resolves gh-408.
We now provide configuration properties to configure session token renewal, especially renewal and expiry thresholds.
spring.cloud.vault:
session.lifecycle:
enabled: true
refresh-before-expiry: 10s
expiry-threshold: 20s
Closes gh-400.
We now provide an override spring.cloud.vault.kv.profiles=… to specify application profiles that should be used for Vault access instead of Environment.getActiveProfiles().
Closes gh-385.
Spring Cloud Vault can now obtain credentials for Elasticsearch's HTTP API by enabling vault.config.backends.elasticsearch.enabled=true and providing a role name.
Closes gh-392.
Spring Cloud Vault uses now a single mechanism for key-value backend configuration. Properties at spring.cloud.vault.generic.* are no longer supported.
All associated functionality is now solely available by configuring the corresponding spring.cloud.vault.kv.* properties. The support classes GenericSecretBackendMetadata and VaultGenericBackendProperties were removed in favor of KeyValueSecretBackendMetadata respective VaultKeyValueBackendProperties. spring.cloud.vault.kv.enabled is now enabled by default to preserve spring.cloud.vault.generic.enabled behavior.
Closes gh-395
We now allow disabling Spring Vault's ClientAuthentication and SessionManagement features to rely on authenticated requests sent by Vault Agent. The authentication infrastructure can be disabled via:
spring.cloud.vault:
authentication: NONE
Closes gh-356.
