org.springframework.vault.config

Class EnvironmentVaultConfiguration

java.lang.Object

org.springframework.vault.config.AbstractVaultConfiguration

org.springframework.vault.config.EnvironmentVaultConfiguration

All Implemented Interfaces:

Aware, ApplicationContextAware

@Configuration
public class EnvironmentVaultConfiguration
extends AbstractVaultConfiguration
implements ApplicationContextAware

Configuration using Spring's Environment to configure Spring Vault endpoint, SSL options and authentication options. This configuration class uses predefined property keys and is usually imported as part of an existing Java-based configuration. Configuration is obtained from other, existing property sources.

Usage: Java-based configuration part:

     
 @Configuration
 @Import(EnvironmentVaultConfiguration.class)
 public class MyConfiguration {
 }
     
 

Supplied properties:

     
 vault.uri=https://localhost:8200
 vault.token=00000000-0000-0000-0000-000000000000
     
 

Property keys

Authentication-specific properties must be provided depending on the authentication method.

• Vault URI: vault.uri
• SSL Configuration
  • Keystore resource: vault.ssl.key-store (optional)
  • Keystore password: vault.ssl.key-store-password (optional)
  • Truststore resource: vault.ssl.trust-store (optional)
  • Truststore password: vault.ssl.trust-store-password (optional)
• Authentication method: vault.authentication (defaults to TOKEN, supported authentication methods are: TOKEN, APPID, APPROLE, AZURE, AWS_EC2, CERT, CUBBYHOLE)
• Token authentication
  • Vault Token: vault.token
• AppId authentication
  • AppId: vault.app-id.app-id
  • UserId: vault.app-id.user-id. MAC_ADDRESS and IP_ADDRESS use MacAddressUserId, respective IpAddressUserId. Any other value is used with StaticUserId.
• AppRole authentication
  • RoleId: vault.app-role.role-id
  • SecretId: vault.app-role.secret-id (optional)
• AWS EC2 authentication
  • RoleId: vault.aws-ec2.role-id
  • Identity Document URL: vault.aws-ec2.identity-document (optional)
• Azure MSI authentication
  • Role: vault.azure-msi.role
• Client Certificate authentication
  • (no configuration options)
• Cubbyhole authentication
  • Initial Vault Token: vault.token

Author:

Mark Paluch, Michal Budzyn

See Also:

Environment, PropertySource, VaultEndpoint, AppIdAuthentication, AppRoleAuthentication, AwsEc2Authentication, ClientCertificateAuthentication, CubbyholeAuthentication, KubernetesAuthentication

Nested Class Summary

Nested classes/interfaces inherited from class org.springframework.vault.config.AbstractVaultConfiguration

AbstractVaultConfiguration.ClientFactoryWrapper

Constructor Summary

Constructors

Constructor and Description
EnvironmentVaultConfiguration()

Method Summary

Modifier and Type	Method and Description
protected ClientAuthentication	appIdAuthentication()
protected ClientAuthentication	appRoleAuthentication()
protected ClientAuthentication	awsEc2Authentication()
protected ClientAuthentication	azureMsiAuthentication()
ClientAuthentication	clientAuthentication() Annotate with Bean in case you want to expose a ClientAuthentication instance to the ApplicationContext.
protected ClientAuthentication	cubbyholeAuthentication()
protected AppIdUserIdMechanism	getAppIdUserIdMechanism(String userId)
protected ClientAuthentication	kubeAuthentication()
RestOperations	restOperations() Construct a RestOperations object configured for Vault session management and authentication usage.
void	setApplicationContext(ApplicationContext applicationContext)
SslConfiguration	sslConfiguration()
protected ClientAuthentication	tokenAuthentication()
VaultEndpoint	vaultEndpoint()

Methods inherited from class org.springframework.vault.config.AbstractVaultConfiguration

clientHttpRequestFactoryWrapper, clientOptions, getEnvironment, secretLeaseContainer, sessionManager, threadPoolTaskScheduler, vaultEndpointProvider, vaultTemplate

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

EnvironmentVaultConfiguration

public EnvironmentVaultConfiguration()

Method Detail

restOperations

public RestOperations restOperations()

Description copied from class: AbstractVaultConfiguration

Construct a RestOperations object configured for Vault session management and authentication usage.

Overrides:

restOperations in class AbstractVaultConfiguration

Returns:

the RestOperations to be used for Vault access.

See Also:

AbstractVaultConfiguration.vaultEndpointProvider(), AbstractVaultConfiguration.clientHttpRequestFactoryWrapper()

setApplicationContext

public void setApplicationContext(ApplicationContext applicationContext)
                           throws BeansException

Specified by:

setApplicationContext in interface ApplicationContextAware

Overrides:

setApplicationContext in class AbstractVaultConfiguration

Throws:

BeansException

vaultEndpoint

public VaultEndpoint vaultEndpoint()

Specified by:

vaultEndpoint in class AbstractVaultConfiguration

Returns:

Vault endpoint coordinates for HTTP/HTTPS communication, must not be null.

sslConfiguration

public SslConfiguration sslConfiguration()

Overrides:

sslConfiguration in class AbstractVaultConfiguration

Returns:

SSL configuration options. Defaults to SslConfiguration.unconfigured().

See Also:

SslConfiguration, SslConfiguration.unconfigured()

clientAuthentication

public ClientAuthentication clientAuthentication()

Description copied from class: AbstractVaultConfiguration

Annotate with Bean in case you want to expose a ClientAuthentication instance to the ApplicationContext.

Specified by:

clientAuthentication in class AbstractVaultConfiguration

Returns:

the ClientAuthentication to use. Must not be null.

tokenAuthentication

protected ClientAuthentication tokenAuthentication()

appIdAuthentication

protected ClientAuthentication appIdAuthentication()

appRoleAuthentication

protected ClientAuthentication appRoleAuthentication()

getAppIdUserIdMechanism

protected AppIdUserIdMechanism getAppIdUserIdMechanism(String userId)

awsEc2Authentication

protected ClientAuthentication awsEc2Authentication()

azureMsiAuthentication

protected ClientAuthentication azureMsiAuthentication()

cubbyholeAuthentication

protected ClientAuthentication cubbyholeAuthentication()

kubeAuthentication

protected ClientAuthentication kubeAuthentication()