We now support cubbyhole authentication to securely use tokens. Cubbyhole authentication uses Vault primitives to provide a secured authentication workflow. Cubbyhole authentication uses tokens as primary login method.
An ephemeral token is used to obtain a second, login VaultToken from Vault's Cubbyhole secret backend. The login token is usually longer-lived and used to interact with Vault. The login token will be retrieved from a wrapped response stored at `/cubbyhole/response`.
A wrapped token can be created with:
vault token-create -wrap-ttl="10m"
boostrap.yml:
spring.cloud.vault:
authentication: CUBBYHOLE
token: (the wrapping token)
Fixes gh-15.
What we're missing ATM is different documentation versions for different application versions. What this change does is that it's:
- finding out what is the current branch (e.g. 1.0.x)
- finding out out what is the name of the main adoc file (e.g. spring-cloud-sleuth)
- pulling the changes from gh-pages after checkout
- finding out what is the list of comma separated whitelisted branches (via the `docs.whitelisted.branches` prop)
- in gh-pages creating a folder with name of the branch (e.g. /1.0.x)
copying all the docs/target/generated-docs/ to that folder
- if the branch from which we're calling the script is NOT master then we're changing the ${main.adoc}.html to index.html so that it's easier to access the docs (e.g. http://cloud.spring.io/spring-cloud-sleuth/1.0.x/)
We now support TLS client certificate authentication. The client needs to enable SSL and configure a keystore containing the client certificate/private key pair.
spring.cloud.vault:
authentication: CERT
ssl:
key-store: classpath:keystore.jks
key-store-password: changeit
Fixes gh-25
We now support AWS-EC2 authentication for applications running on EC2 instances. This authentication method uses the PKCS7 identity document to authenticate against Vault. It provides support for nonce (enabled by default) and roles.
fixes gh-17
Spring Cloud Vault Config now supports property-based SSL configuration using spring.cloud.vault.ssl.* properties to enable server certificate validation.
Introducing a Vault-specific configuration requires to configure HTTP clients individually and so this change adds configuration support for Apache HTTP Components, Netty and the OkHttp client. Clients are picked configured if they exist on the class path.
Fixes gh-7
We now support credential generation for MySQL, PostgreSQL and Apache Cassandra databases.
Credential generation can be turned on using properties and stores username/password in properties according to Spring Boot's auto configuration.
Fixes gh-2.
