161 lines
6.3 KiB
HTML
161 lines
6.3 KiB
HTML
---
|
|
# The name of your project
|
|
title: Spring Cloud Vault
|
|
|
|
badges:
|
|
|
|
# Customize your project's badges. Delete any entries that do not apply.
|
|
custom:
|
|
- name: Source (GitHub)
|
|
url: https://github.com/spring-cloud/spring-cloud-vault
|
|
icon: github
|
|
|
|
- name: StackOverflow
|
|
url: https://stackoverflow.com/questions/tagged/spring-cloud
|
|
icon: stackoverflow
|
|
|
|
---
|
|
<!DOCTYPE HTML>
|
|
<html lang="en-US">
|
|
|
|
<!-- Specify the parent of this project (or delete if none) to influence the rendering of the breadcrumb -->
|
|
{% capture parent_link %}
|
|
[Spring Cloud]({{ site.projects_site_url }}/spring-cloud)
|
|
{% endcapture %}
|
|
|
|
|
|
{% capture billboard_description %}
|
|
|
|
Spring Cloud Vault Config provides client-side support for externalized configuration in a distributed system. With HashiCorp's <a href="https://vaultproject.io">Vault</a> you have a central place to manage external secret properties for applications across all environments. Vault can manage static and dynamic secrets such as username/password for remote applications/resources and provide credentials for external services such as MySQL, PostgreSQL, Apache Cassandra, MongoDB, Consul, AWS and more.
|
|
|
|
{% endcapture %}
|
|
|
|
{% capture main_content %}
|
|
|
|
## Features
|
|
|
|
* Retrieve secrets from Vault and initialize Spring Environment with remote property sources.
|
|
* Obtain [secrets](https://cloud.spring.io/spring-cloud-vault/single/spring-cloud-vault.html#vault.config.backends.generic) secured with SSL.
|
|
* Generate credentials for [MySQL](https://cloud.spring.io/spring-cloud-vault/single/spring-cloud-vault.html#vault.config.backends.mysql), [PostgreSQL](https://cloud.spring.io/spring-cloud-vault/single/spring-cloud-vault.html#vault.config.backends.postgresql), [Apache Cassandra](https://cloud.spring.io/spring-cloud-vault/single/spring-cloud-vault.html#vault.config.backends.cassandra), [MongoDB](https://cloud.spring.io/spring-cloud-vault/single/spring-cloud-vault.html#vault.config.backends.mongodb), [Consul](https://cloud.spring.io/spring-cloud-vault/single/spring-cloud-vault.html#vault.config.backends.consul), [AWS](https://cloud.spring.io/spring-cloud-vault/single/spring-cloud-vault.html#vault.config.backends.aws), and [RabbitMQ](https://cloud.spring.io/spring-cloud-vault/single/spring-cloud-vault.html#vault.config.backends.rabbitmq).
|
|
* [Token](https://cloud.spring.io/spring-cloud-vault/single/spring-cloud-vault.html#vault.config.authentication.token), [AppId](https://cloud.spring.io/spring-cloud-vault/single/spring-cloud-vault.html#vault.config.authentication.appid), [AppRole](https://cloud.spring.io/spring-cloud-vault/single/spring-cloud-vault.html#vault.config.authentication.approle), [Client Certificate](https://cloud.spring.io/spring-cloud-vault/single/spring-cloud-vault.html#vault.config.authentication.clientcert), [Cubbyhole](https://cloud.spring.io/spring-cloud-vault/single/spring-cloud-vault.html#vault.config.authentication.cubbyhole), and [AWS EC2 and IAM](https://cloud.spring.io/spring-cloud-vault/single/spring-cloud-vault.html#vault.config.authentication.awsec2), [Kubernetes](https://cloud.spring.io/spring-cloud-vault/single/spring-cloud-vault.html#vault.config.authentication.kubernetes) authentication.
|
|
* Bootstrap application context: a parent context for the main application that can be trained to do anything.
|
|
* Cloud Foundry integration using [HashiCorp's Vault service broker](https://github.com/hashicorp/vault-service-broker) through [Spring Cloud Vault Connector](https://github.com/pivotal-cf/spring-cloud-vault-connector).
|
|
|
|
<span id="quick-start"></span>
|
|
|
|
## Quick Start
|
|
|
|
<script type="text/javascript">{% include custom.js %}</script>
|
|
{% include download_widget.md %}
|
|
|
|
To get started with Spring Cloud Vault, simply include a build dependency.
|
|
|
|
For example, typical POM dependencies would be:
|
|
|
|
```xml
|
|
<dependency>
|
|
<groupId>org.springframework.cloud</groupId>
|
|
<artifactId>spring-cloud-starter-vault-config</artifactId>
|
|
</dependency>
|
|
```
|
|
|
|
then configure your Vault endpoint and authentication
|
|
|
|
`bootstrap.yml` for Token-based authentication
|
|
|
|
```yaml
|
|
spring.application.name: my-application
|
|
spring.cloud.vault:
|
|
host: localhost
|
|
port: 8200
|
|
scheme: https
|
|
authentication: TOKEN
|
|
token: …
|
|
```
|
|
|
|
`bootstrap.yml` for AWS-EC2 authentication
|
|
|
|
```yaml
|
|
spring.application.name: my-application
|
|
spring.cloud.vault:
|
|
host: localhost
|
|
port: 8200
|
|
scheme: https
|
|
authentication: AWS_EC2
|
|
```
|
|
|
|
finally, use properties stored inside Vault in your application
|
|
|
|
```java
|
|
@Configuration
|
|
@RestController
|
|
public class Application {
|
|
|
|
@Value("${config.name}")
|
|
String name = "World";
|
|
|
|
@RequestMapping("/")
|
|
public String home() {
|
|
return "Hello " + name;
|
|
}
|
|
|
|
public static void main(String[] args) {
|
|
SpringApplication.run(Application.class, args);
|
|
}
|
|
}
|
|
```
|
|
|
|
Spring Cloud Vault Config reads config properties from Vaults using the application name and active profiles:
|
|
|
|
```
|
|
/secret/{application}/{profile}
|
|
/secret/{application}
|
|
/secret/{default-context}/{profile}
|
|
/secret/{default-context}
|
|
```
|
|
|
|
## Adding Spring Cloud Vault Config modules
|
|
|
|
Spring Cloud Vault Config comes with multiple modules supporting different integrations. To to get dependencies in the appropriate version you can include a BOM (Bill of Materials) in your dependency management. For example, typical POM dependency management would be:
|
|
|
|
```xml
|
|
<dependencyManagement>
|
|
<dependencies>
|
|
<dependency>
|
|
<groupId>>org.springframework.cloud</groupId>
|
|
<artifactId>spring-cloud-vault-dependencies</artifactId>
|
|
<version>x.y.z</version>
|
|
<scope>import</scope>
|
|
<type>pom</type>
|
|
</dependency>
|
|
</dependencies>
|
|
</dependencyManagement>
|
|
|
|
<dependencies>
|
|
<dependency>
|
|
<groupId>org.springframework.cloud</groupId>
|
|
<artifactId>spring-cloud-starter-vault-config</artifactId>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>org.springframework.cloud</groupId>
|
|
<artifactId>spring-cloud-vault-config-consul</artifactId>
|
|
</dependency>
|
|
</dependencies>
|
|
```
|
|
|
|
{% endcapture %}
|
|
|
|
{% capture related_resources %}
|
|
|
|
### Related resources
|
|
|
|
* [Spring Vault repository](https://github.com/spring-projects/spring-vault)
|
|
* [Spring Cloud Vault Connector](https://github.com/pivotal-cf/spring-cloud-vault-connector)
|
|
* [Examples repository](https://github.com/mp911de/spring-cloud-vault-config-samples)
|
|
|
|
{% endcapture %}
|
|
|
|
|
|
{% include project_page.html %}
|
|
</html>
|