We now support Vault server lookup using service registries via DiscoveryClient. Vault server is looked up during the bootstrap phase and configured by serviceId rather than host/port when enabling service discovery.
Closes gh-132.
We now support configuration of PropertySourceLocator behavior of generic and discovered secret backends. We introduced VaultConfigurer as strategy interface to be implemented by customizer beans in the bootstrap context. VaultConfigurer allows configuration of secret backends via SecretBackendConfigurer.
Motivation: Customization was only possible by implementing an own PropertySourceLocator by extending VaultPropertySourceLocatorSupport and implementing doCreatePropertySources. Both is non-trivial and does not allow reuse of existing functionality.
See gh-116.
We now support static configuration of the AWS-EC2 authentication nonce to support re-login on application crashes/vm-internal restarts.
Closes gh-103.
We now support AppRole authentication. This authentication method uses a provided RoleId and optionally SecretId to authenticate against Vault.
Fixes gh-39.
Spring Cloud Vault now handles lifecycle of obtained secrets by property sources. Secrets associated with a renewable lease are renewed before they expire until terminal expiration. Application shutdown revokes leases so generated credentials can be disabled by Vault.
Fixes gh-40.
We now support cubbyhole authentication to securely use tokens. Cubbyhole authentication uses Vault primitives to provide a secured authentication workflow. Cubbyhole authentication uses tokens as primary login method.
An ephemeral token is used to obtain a second, login VaultToken from Vault's Cubbyhole secret backend. The login token is usually longer-lived and used to interact with Vault. The login token will be retrieved from a wrapped response stored at `/cubbyhole/response`.
A wrapped token can be created with:
vault token-create -wrap-ttl="10m"
boostrap.yml:
spring.cloud.vault:
authentication: CUBBYHOLE
token: (the wrapping token)
Fixes gh-15.
