Package org.springframework.vault.config
Class EnvironmentVaultConfiguration
java.lang.Object
org.springframework.vault.config.AbstractVaultConfiguration
org.springframework.vault.config.EnvironmentVaultConfiguration
- All Implemented Interfaces:
Aware,ApplicationContextAware
@Configuration
public class EnvironmentVaultConfiguration
extends AbstractVaultConfiguration
implements ApplicationContextAware
Configuration using Spring's
Environment to
configure Spring Vault endpoint, SSL options and authentication options. This
configuration class uses predefined property keys and is usually imported as part of an
existing Java-based configuration. Configuration is obtained from other, existing
property sources.
Usage: Java-based configuration part:
@Configuration
@Import(EnvironmentVaultConfiguration.class)
public class MyConfiguration {
}
Supplied properties:
vault.uri=https://localhost:8200
vault.token=00000000-0000-0000-0000-000000000000
Property keys
Authentication-specific properties must be provided depending on the authentication method.- Vault URI:
vault.uri - SSL Configuration
- Keystore resource:
vault.ssl.key-store(optional) - Keystore password:
vault.ssl.key-store-password(optional) - Keystore type:
vault.ssl.key-store-type(since 2.3, optional) - Truststore resource:
vault.ssl.trust-store(optional) - Truststore password:
vault.ssl.trust-store-password(optional) - Truststore type:
vault.ssl.trust-store-password(since 2.3, optional) - Enabled SSL/TLS protocols:
vault.ssl.enabled-protocols(since 2.3.2, optional, protocols separated with comma) - Enabled SSL/TLS cipher suites:
vault.ssl.enabled-cipher-suites(since 2.3.2, optional, cipher suites separated with comma)
- Keystore resource:
- Authentication method:
vault.authentication(defaults to TOKEN, supported authentication methods are: TOKEN, APPID, APPROLE, AWS_EC2, AWS_IAM, AZURE, CERT, CUBBYHOLE, KUBERNETES, seeEnvironmentVaultConfiguration.AuthenticationMethod) - Token authentication
- Vault Token:
vault.token
- Vault Token:
- AppId authentication
- AppId path:
vault.app-id.app-id-path(since 2.2.1, defaults toAppIdAuthenticationOptions.DEFAULT_APPID_AUTHENTICATION_PATH) - AppId:
vault.app-id.app-id - UserId:
vault.app-id.user-id. MAC_ADDRESS and IP_ADDRESS useMacAddressUserId, respectiveIpAddressUserId. Any other value is used withStaticUserId.
- AppId path:
- AppRole authentication
- AppRole path:
vault.app-role.app-role-path(since 2.2.1, defaults toAppRoleAuthenticationOptions.DEFAULT_APPROLE_AUTHENTICATION_PATH) - RoleId:
vault.app-role.role-id - SecretId:
vault.app-role.secret-id(optional)
- AppRole path:
- AWS EC2 authentication
- AWS EC2 path:
vault.aws-ec2.aws-ec2-path(since 2.2.1, defaults toAwsEc2AuthenticationOptions.DEFAULT_AWS_AUTHENTICATION_PATH) - Role:
vault.aws-ec2.role(since 2.2.1) - RoleId:
vault.aws-ec2.role-id(deprecated since 2.2.1: usevault.aws-ec2.roleinstead) - Identity Document URL:
vault.aws-ec2.identity-document(defaults toAwsEc2AuthenticationOptions.DEFAULT_PKCS7_IDENTITY_DOCUMENT_URI)
- AWS EC2 path:
- AWS IAM authentication
- Role:
vault.aws-iam.role(since 3.0.2)
- Role:
- Azure MSI authentication
- Azure MSI path:
vault.azure-msi.azure-path(since 2.2.1, defaults toAzureMsiAuthenticationOptions.DEFAULT_AZURE_AUTHENTICATION_PATH) - Role:
vault.azure-msi.role - MetadataServiceUri:
vault.azure-msi.metadata-service(defaults toAzureMsiAuthenticationOptions.DEFAULT_INSTANCE_METADATA_SERVICE_URI) - IdentityTokenServiceUri:
vault.azure-msi.identity-token-service(defaults toAzureMsiAuthenticationOptions.DEFAULT_IDENTITY_TOKEN_SERVICE_URI)
- Azure MSI path:
- Client Certificate authentication
- (no configuration options)
- Cubbyhole authentication
- Initial Vault Token:
vault.token
- Initial Vault Token:
- Kubernetes authentication
- Kubernetes path:
vault.kubernetes.kubernetes-path(since 2.2.1, defaults toKubernetesAuthenticationOptions.DEFAULT_KUBERNETES_AUTHENTICATION_PATH) - Role:
vault.kubernetes.role - Path to service account token file:
vault.kubernetes.service-account-token-file(defaults toKubernetesServiceAccountTokenFile.DEFAULT_KUBERNETES_SERVICE_ACCOUNT_TOKEN_FILE)
- Kubernetes path:
- Author:
- Mark Paluch, Michal Budzyn, Raoof Mohammed, Justin Bertrand, Ryan Gow, Nick Tan
- See Also:
-
Nested Class Summary
Nested classes/interfaces inherited from class org.springframework.vault.config.AbstractVaultConfiguration
AbstractVaultConfiguration.ClientFactoryWrapper, AbstractVaultConfiguration.TaskSchedulerWrapper -
Constructor Summary
Constructors -
Method Summary
Modifier and TypeMethodDescriptionprotected ClientAuthenticationprotected ClientAuthenticationprotected ClientAuthenticationprotected ClientAuthenticationprotected ClientAuthenticationAnnotate withBeanin case you want to expose aClientAuthenticationinstance to theApplicationContext.protected ClientAuthenticationprotected AppIdUserIdMechanismgetAppIdUserIdMechanism(String userId) protected ClientAuthenticationConstruct aRestOperationsobject configured for Vault session management and authentication usage.voidsetApplicationContext(ApplicationContext applicationContext) protected ClientAuthenticationMethods inherited from class org.springframework.vault.config.AbstractVaultConfiguration
clientHttpRequestFactoryWrapper, clientOptions, getBeanFactory, getEnvironment, getRestTemplateFactory, getVaultThreadPoolTaskScheduler, restTemplateBuilder, restTemplateFactory, secretLeaseContainer, sessionManager, threadPoolTaskScheduler, vaultEndpointProvider, vaultTemplate
-
Constructor Details
-
EnvironmentVaultConfiguration
public EnvironmentVaultConfiguration()
-
-
Method Details
-
restOperations
Description copied from class:AbstractVaultConfigurationConstruct aRestOperationsobject configured for Vault session management and authentication usage. Can be customized by providing aRestTemplateFactorybean.- Overrides:
restOperationsin classAbstractVaultConfiguration- Returns:
- the
RestOperationsto be used for Vault access. - See Also:
-
setApplicationContext
- Specified by:
setApplicationContextin interfaceApplicationContextAware- Overrides:
setApplicationContextin classAbstractVaultConfiguration- Throws:
BeansException
-
vaultEndpoint
- Specified by:
vaultEndpointin classAbstractVaultConfiguration- Returns:
- Vault endpoint coordinates for HTTP/HTTPS communication, must not be null.
-
sslConfiguration
- Overrides:
sslConfigurationin classAbstractVaultConfiguration- Returns:
- SSL configuration options. Defaults to
SslConfiguration.unconfigured(). - See Also:
-
clientAuthentication
Description copied from class:AbstractVaultConfigurationAnnotate withBeanin case you want to expose aClientAuthenticationinstance to theApplicationContext.- Specified by:
clientAuthenticationin classAbstractVaultConfiguration- Returns:
- the
ClientAuthenticationto use. Must not be null.
-
tokenAuthentication
-
appIdAuthentication
-
appRoleAuthentication
-
getAppIdUserIdMechanism
-
awsEc2Authentication
-
awsIamAuthentication
-
azureMsiAuthentication
-
cubbyholeAuthentication
-
kubeAuthentication
-