Package org.springframework.vault.config
Class EnvironmentVaultConfiguration
java.lang.Object
org.springframework.vault.config.AbstractVaultConfiguration
org.springframework.vault.config.EnvironmentVaultConfiguration
- All Implemented Interfaces:
Aware
,ApplicationContextAware
@Configuration
public class EnvironmentVaultConfiguration
extends AbstractVaultConfiguration
implements ApplicationContextAware
Configuration using Spring's
Environment
to
configure Spring Vault endpoint, SSL options and authentication options. This
configuration class uses predefined property keys and is usually imported as part of an
existing Java-based configuration. Configuration is obtained from other, existing
property sources.
Usage: Java-based configuration part:
@Configuration
@Import(EnvironmentVaultConfiguration.class)
public class MyConfiguration {
}
Supplied properties:
vault.uri=https://localhost:8200
vault.token=00000000-0000-0000-0000-000000000000
Property keys
Authentication-specific properties must be provided depending on the authentication method.- Vault URI:
vault.uri
- SSL Configuration
- Keystore resource:
vault.ssl.key-store
(optional) - Keystore password:
vault.ssl.key-store-password
(optional) - Keystore type:
vault.ssl.key-store-type
(since 2.3, optional) - Truststore resource:
vault.ssl.trust-store
(optional) - Truststore password:
vault.ssl.trust-store-password
(optional) - Truststore type:
vault.ssl.trust-store-password
(since 2.3, optional) - Enabled SSL/TLS protocols:
vault.ssl.enabled-protocols
(since 2.3.2, optional, protocols separated with comma) - Enabled SSL/TLS cipher suites:
vault.ssl.enabled-cipher-suites
(since 2.3.2, optional, cipher suites separated with comma)
- Keystore resource:
- Authentication method:
vault.authentication
(defaults to TOKEN, supported authentication methods are: TOKEN, APPID, APPROLE, AWS_EC2, AWS_IAM, AZURE, CERT, CUBBYHOLE, KUBERNETES, seeEnvironmentVaultConfiguration.AuthenticationMethod
) - Token authentication
- Vault Token:
vault.token
- Vault Token:
- AppId authentication
- AppId path:
vault.app-id.app-id-path
(since 2.2.1, defaults toAppIdAuthenticationOptions.DEFAULT_APPID_AUTHENTICATION_PATH
) - AppId:
vault.app-id.app-id
- UserId:
vault.app-id.user-id
. MAC_ADDRESS and IP_ADDRESS useMacAddressUserId
, respectiveIpAddressUserId
. Any other value is used withStaticUserId
.
- AppId path:
- AppRole authentication
- AppRole path:
vault.app-role.app-role-path
(since 2.2.1, defaults toAppRoleAuthenticationOptions.DEFAULT_APPROLE_AUTHENTICATION_PATH
) - RoleId:
vault.app-role.role-id
- SecretId:
vault.app-role.secret-id
(optional)
- AppRole path:
- AWS EC2 authentication
- AWS EC2 path:
vault.aws-ec2.aws-ec2-path
(since 2.2.1, defaults toAwsEc2AuthenticationOptions.DEFAULT_AWS_AUTHENTICATION_PATH
) - Role:
vault.aws-ec2.role
(since 2.2.1) - RoleId:
vault.aws-ec2.role-id
(deprecated since 2.2.1: usevault.aws-ec2.role
instead) - Identity Document URL:
vault.aws-ec2.identity-document
(defaults toAwsEc2AuthenticationOptions.DEFAULT_PKCS7_IDENTITY_DOCUMENT_URI
)
- AWS EC2 path:
- AWS IAM authentication
- Role:
vault.aws-iam.role
(since 3.0.2)
- Role:
- Azure MSI authentication
- Azure MSI path:
vault.azure-msi.azure-path
(since 2.2.1, defaults toAzureMsiAuthenticationOptions.DEFAULT_AZURE_AUTHENTICATION_PATH
) - Role:
vault.azure-msi.role
- MetadataServiceUri:
vault.azure-msi.metadata-service
(defaults toAzureMsiAuthenticationOptions.DEFAULT_INSTANCE_METADATA_SERVICE_URI
) - IdentityTokenServiceUri:
vault.azure-msi.identity-token-service
(defaults toAzureMsiAuthenticationOptions.DEFAULT_IDENTITY_TOKEN_SERVICE_URI
)
- Azure MSI path:
- Client Certificate authentication
- (no configuration options)
- Cubbyhole authentication
- Initial Vault Token:
vault.token
- Initial Vault Token:
- Kubernetes authentication
- Kubernetes path:
vault.kubernetes.kubernetes-path
(since 2.2.1, defaults toKubernetesAuthenticationOptions.DEFAULT_KUBERNETES_AUTHENTICATION_PATH
) - Role:
vault.kubernetes.role
- Path to service account token file:
vault.kubernetes.service-account-token-file
(defaults toKubernetesServiceAccountTokenFile.DEFAULT_KUBERNETES_SERVICE_ACCOUNT_TOKEN_FILE
)
- Kubernetes path:
- Author:
- Mark Paluch, Michal Budzyn, Raoof Mohammed, Justin Bertrand, Ryan Gow, Nick Tan
- See Also:
-
Nested Class Summary
Nested classes/interfaces inherited from class org.springframework.vault.config.AbstractVaultConfiguration
AbstractVaultConfiguration.ClientFactoryWrapper, AbstractVaultConfiguration.TaskSchedulerWrapper
-
Constructor Summary
-
Method Summary
Modifier and TypeMethodDescriptionprotected ClientAuthentication
protected ClientAuthentication
protected ClientAuthentication
protected ClientAuthentication
protected ClientAuthentication
Annotate withBean
in case you want to expose aClientAuthentication
instance to theApplicationContext
.protected ClientAuthentication
protected AppIdUserIdMechanism
getAppIdUserIdMechanism
(String userId) protected ClientAuthentication
Construct aRestOperations
object configured for Vault session management and authentication usage.void
setApplicationContext
(ApplicationContext applicationContext) protected ClientAuthentication
Methods inherited from class org.springframework.vault.config.AbstractVaultConfiguration
clientHttpRequestFactoryWrapper, clientOptions, getBeanFactory, getEnvironment, getRestTemplateFactory, getVaultThreadPoolTaskScheduler, restTemplateBuilder, restTemplateFactory, secretLeaseContainer, sessionManager, threadPoolTaskScheduler, vaultEndpointProvider, vaultTemplate
-
Constructor Details
-
EnvironmentVaultConfiguration
public EnvironmentVaultConfiguration()
-
-
Method Details
-
restOperations
Description copied from class:AbstractVaultConfiguration
Construct aRestOperations
object configured for Vault session management and authentication usage. Can be customized by providing aRestTemplateFactory
bean.- Overrides:
restOperations
in classAbstractVaultConfiguration
- Returns:
- the
RestOperations
to be used for Vault access. - See Also:
-
setApplicationContext
- Specified by:
setApplicationContext
in interfaceApplicationContextAware
- Overrides:
setApplicationContext
in classAbstractVaultConfiguration
- Throws:
BeansException
-
vaultEndpoint
- Specified by:
vaultEndpoint
in classAbstractVaultConfiguration
- Returns:
- Vault endpoint coordinates for HTTP/HTTPS communication, must not be null.
-
sslConfiguration
- Overrides:
sslConfiguration
in classAbstractVaultConfiguration
- Returns:
- SSL configuration options. Defaults to
SslConfiguration.unconfigured()
. - See Also:
-
clientAuthentication
Description copied from class:AbstractVaultConfiguration
Annotate withBean
in case you want to expose aClientAuthentication
instance to theApplicationContext
.- Specified by:
clientAuthentication
in classAbstractVaultConfiguration
- Returns:
- the
ClientAuthentication
to use. Must not be null.
-
tokenAuthentication
-
appIdAuthentication
-
appRoleAuthentication
-
getAppIdUserIdMechanism
-
awsEc2Authentication
-
awsIamAuthentication
-
azureMsiAuthentication
-
cubbyholeAuthentication
-
kubeAuthentication
-