org.springframework.vault.core.lease

Class SecretLeaseContainer

java.lang.Object

org.springframework.vault.core.lease.SecretLeaseEventPublisher

org.springframework.vault.core.lease.SecretLeaseContainer

All Implemented Interfaces:

DisposableBean, InitializingBean

public class SecretLeaseContainer
extends SecretLeaseEventPublisher
implements InitializingBean, DisposableBean

Event-based container to request secrets from Vault and renew the associated Lease. Secrets can be rotated, depending on the requested RequestedSecret.getMode(). Usage example:

 
 SecretLeaseContainer container = new SecretLeaseContainer(vaultOperations,
                taskScheduler);

 RequestedSecret requestedSecret = container
                .requestRotatingSecret("mysql/creds/my-role");
 container.addLeaseListener(new LeaseListenerAdapter() {
        @Override
        public void onLeaseEvent(SecretLeaseEvent secretLeaseEvent) {

                if (requestedSecret == secretLeaseEvent.getSource()) {

                        if (secretLeaseEvent instanceof SecretLeaseCreatedEvent) {

                        }

                        if (secretLeaseEvent instanceof SecretLeaseExpiredEvent) {

                        }
                }
        }
 });

 container.afterPropertiesSet();
 container.start(); // events are triggered after starting the container
 
 

This container keeps track over RequestedSecrets and requests secrets upon start(). Leases qualified for renewal are renewed by this container applying minRenewalSeconds/expiryThresholdSeconds on a background thread.

Requests for secrets can define either renewal or rotation. The container renews leases until expiry. Rotating secrets renew their associated lease until expiry and request new secrets after expiry. Vault requires active interaction from a caller side to determine a secret is expired. Vault does not send any events. Expired secrets events can dispatch later than the actual expiry.

The container dispatches lease events to LeaseListener and LeaseErrorListener. Event notifications are dispatched either on the starting Thread or worker threads used for background renewal.

Instances are thread-safe once initialized.

Author:

Mark Paluch, Steven Swor, Erik Lindblom

See Also:

RequestedSecret, SecretLeaseEventPublisher, Lease, LeaseEndpoints

Nested Class Summary

Nested classes/interfaces inherited from class org.springframework.vault.core.lease.SecretLeaseEventPublisher

SecretLeaseEventPublisher.LoggingErrorListener

Constructor Summary

Constructors

Constructor and Description
SecretLeaseContainer(VaultOperations operations) Create a new SecretLeaseContainer given VaultOperations.
SecretLeaseContainer(VaultOperations operations, TaskScheduler taskScheduler) Create a new SecretLeaseContainer given VaultOperations and TaskScheduler.

Method Summary

Modifier and Type	Method and Description
RequestedSecret	addRequestedSecret(RequestedSecret requestedSecret) Add a RequestedSecret.
void	afterPropertiesSet()
void	destroy() Shutdown this SecretLeaseContainer, disable lease renewal and revoke leases.
protected VaultResponseSupport<Map<String,Object>>	doGetSecrets(RequestedSecret requestedSecret) Retrieve secrets from VaultOperations.
protected Lease	doRenewLease(RequestedSecret requestedSecret, Lease lease) Renew a Lease for a RequestedSecret.
protected void	doRevokeLease(RequestedSecret requestedSecret, Lease lease) Revoke the Lease.
Duration	getExpiryThreshold()
int	getExpiryThresholdSeconds()
Duration	getMinRenewal()
int	getMinRenewalSeconds()
protected void	onLeaseExpired(RequestedSecret requestedSecret, Lease lease) Hook method called when a Lease expires.
RequestedSecret	requestRenewableSecret(String path) Request a renewable secret at path.
RequestedSecret	requestRotatingSecret(String path) Request a rotating secret at path.
void	setExpiryThreshold(Duration expiryThreshold) Set the expiry threshold.
void	setExpiryThresholdSeconds(int expiryThresholdSeconds) Deprecated. since 2.0, use setExpiryThreshold(Duration) for time unit safety.
void	setLeaseEndpoints(LeaseEndpoints leaseEndpoints) Set the LeaseEndpoints to delegate renewal/revocation calls to.
void	setMinRenewal(Duration minRenewal) Sets the amount of seconds that is at least required before renewing a lease.
void	setMinRenewalSeconds(int minRenewalSeconds) Deprecated. since 2.0, use setMinRenewal(Duration) for time unit safety.
void	setTaskScheduler(TaskScheduler taskScheduler) Sets the TaskScheduler to use for scheduling and execution of lease renewals.
void	start() Start the SecretLeaseContainer.
void	stop() Stop the SecretLeaseContainer.

Methods inherited from class org.springframework.vault.core.lease.SecretLeaseEventPublisher

addErrorListener, addLeaseListener, onAfterLeaseRenewed, onAfterLeaseRevocation, onBeforeLeaseRevocation, onError, onSecretsObtained, removeLeaseErrorListener, removeLeaseListener

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

SecretLeaseContainer

public SecretLeaseContainer(VaultOperations operations)

Create a new SecretLeaseContainer given VaultOperations.

Parameters:

operations - must not be null.

SecretLeaseContainer

public SecretLeaseContainer(VaultOperations operations,
                            TaskScheduler taskScheduler)

Create a new SecretLeaseContainer given VaultOperations and TaskScheduler.

Parameters:

operations - must not be null.

taskScheduler - must not be null.

Method Detail

setLeaseEndpoints

public void setLeaseEndpoints(LeaseEndpoints leaseEndpoints)

Set the LeaseEndpoints to delegate renewal/revocation calls to. LeaseEndpoints encapsulates differences between Vault versions that affect the location of renewal/revocation endpoints.

Parameters:

leaseEndpoints - must not be null.

Since:

2.1

See Also:

LeaseEndpoints

setMinRenewalSeconds

@Deprecated
public void setMinRenewalSeconds(int minRenewalSeconds)

Deprecated. since 2.0, use setMinRenewal(Duration) for time unit safety.

Sets the amount of seconds that is at least required before renewing a lease. minRenewalSeconds prevents renewals to happen too often.

Parameters:

minRenewalSeconds - number of seconds that is at least required before renewing a Lease, must not be negative.

setMinRenewal

public void setMinRenewal(Duration minRenewal)

Sets the amount of seconds that is at least required before renewing a lease. minRenewal prevents renewals to happen too often.

Parameters:

minRenewal - duration that is at least required before renewing a Lease, must not be null or negative.

Since:

2.0

setExpiryThresholdSeconds

@Deprecated
public void setExpiryThresholdSeconds(int expiryThresholdSeconds)

Deprecated. since 2.0, use setExpiryThreshold(Duration) for time unit safety.

Set the expiry threshold. Lease is renewed the given seconds before it expires.

Parameters:

expiryThresholdSeconds - number of seconds before Lease expiry, must not be negative.

setExpiryThreshold

public void setExpiryThreshold(Duration expiryThreshold)

Set the expiry threshold. Lease is renewed the given time before it expires.

Parameters:

expiryThreshold - duration before Lease expiry, must not be null or negative.

Since:

2.0

getMinRenewalSeconds

public int getMinRenewalSeconds()

getMinRenewal

public Duration getMinRenewal()

Returns:

minimum renewal timeout.

Since:

2.0

getExpiryThresholdSeconds

public int getExpiryThresholdSeconds()

getExpiryThreshold

public Duration getExpiryThreshold()

Returns:

expiry threshold.

Since:

2.0

setTaskScheduler

public void setTaskScheduler(TaskScheduler taskScheduler)

Sets the TaskScheduler to use for scheduling and execution of lease renewals.

Parameters:

taskScheduler - must not be null.

requestRenewableSecret

public RequestedSecret requestRenewableSecret(String path)

Request a renewable secret at path.

Parameters:

path - must not be null or empty.

Returns:

the RequestedSecret.

requestRotatingSecret

public RequestedSecret requestRotatingSecret(String path)

Request a rotating secret at path.

Parameters:

path - must not be null or empty.

Returns:

the RequestedSecret.

addRequestedSecret

public RequestedSecret addRequestedSecret(RequestedSecret requestedSecret)

Add a RequestedSecret.

Parameters:

requestedSecret - must not be null.

start

public void start()

Start the SecretLeaseContainer. Starting the container will initially obtain secrets and leases for the requested secrets. A started container publishes events through LeaseListener. Additional secrets can be requested at any time.

Multiple calls are synchronized to start the container only once. Container start requires initialization and cannot be started once the container was destroyed.

See Also:

afterPropertiesSet(), stop()

stop

public void stop()

Stop the SecretLeaseContainer. Stopping the container will stop lease renewal, secrets rotation and event publishing. Active leases are not expired.

Multiple calls are synchronized to stop the container only once.

See Also:

start()

afterPropertiesSet

public void afterPropertiesSet()
                        throws Exception

Specified by:

afterPropertiesSet in interface InitializingBean

Overrides:

afterPropertiesSet in class SecretLeaseEventPublisher

Throws:

Exception

destroy

public void destroy()
             throws Exception

Shutdown this SecretLeaseContainer, disable lease renewal and revoke leases.

Specified by:

destroy in interface DisposableBean

Throws:

Exception

See Also:

afterPropertiesSet(), start(), stop()

doGetSecrets

@Nullable
protected VaultResponseSupport<Map<String,Object>> doGetSecrets(RequestedSecret requestedSecret)

Retrieve secrets from VaultOperations.

Parameters:

requestedSecret - the RequestedSecret providing the secret path.

Returns:

the response.

doRenewLease

protected Lease doRenewLease(RequestedSecret requestedSecret,
                             Lease lease)

Renew a Lease for a RequestedSecret.

Parameters:

requestedSecret - the requested secret.

lease - the lease.

Returns:

the new lease or null if expired/secret cannot be rotated.

onLeaseExpired

protected void onLeaseExpired(RequestedSecret requestedSecret,
                              Lease lease)

Hook method called when a Lease expires. The default implementation is to notify LeaseListener. Implementations can override this method in subclasses.

Overrides:

onLeaseExpired in class SecretLeaseEventPublisher

Parameters:

requestedSecret - must not be null.

lease - must not be null.

doRevokeLease

protected void doRevokeLease(RequestedSecret requestedSecret,
                             Lease lease)

Revoke the Lease.

Parameters:

requestedSecret - must not be null.

lease - must not be null.