New & Noteworthy

Upgrade to Spring Framework 6 and Java 17 baseline

Upgrade to AWS SDK 2.

Support for Username/Password authentication for Username/Password, LDAP, Okta, and RADIUS authentication.

Support of versioned Key/Value secrets engines for Vault repositories.

Optimistic locking support through Vault repositories using versioned Key/Value secrets engines.

Support for PEM-encoded certificates for keystore and truststore usage.

ReactiveVaultEndpointProvider for non-blocking lookup of VaultEndpoint.

VaultKeyValueMetadataOperations for Key-Value metadata interaction.

Support for transform secrets engine (Enterprise Feature).

Documentation of how to use Vault secret backends.

Login credentials for Kubernetes and PCF authentication are reloaded for each login attempt.

SecretLeaseContainer publishes SecretLeaseRotatedEvent instead of SecretLeaseExpiredEvent and SecretLeaseCreatedEvent on successful secret rotation.

AbstractVaultConfiguration.threadPoolTaskScheduler() bean type changed to TaskSchedulerWrapper instead of ThreadPoolTaskScheduler.

Since 2.3.2: GcpIamCredentialsAuthentication

Support for Key-Value v2 (versioned secrets engine) secrets through @VaultPropertySource.

SpEL support in @Secret.

Add support for Jetty as reactive HttpClient.

LifecycleAwareSessionManager and ReactiveLifecycleAwareSessionManager emit now AuthenticationEvents.

PCF Authentication.

Deprecation of AppIdAuthentication. Use AppRoleAuthentication instead as recommended by HashiCorp Vault.

CubbyholeAuthentication and wrapped AppRoleAuthentication now use sys/wrapping/unwrap endpoints by default.

Kotlin Coroutines support for ReactiveVaultOperations.

GCP Compute, GCP IAM, and Azure authentication.

Template API support for versioned and unversioned Key/Value secrets engines and for Vault wrapping operations.

Support full pull mode in reactive AppRole authentication.

Improved Exception hierarchy for Vault login failures.

Authentication steps DSL to compose authentication flows.

Reactive Vault client via ReactiveVaultOperations.

Vault repository support based on Spring Data KeyValue.

Transit batch encrypt and decrypt support.

Policy management for policies stored as JSON.

Support CSR signing, certificate revocation and CRL retrieval.

Kubernetes authentication.

RoleId/SecretId unwrapping for AppRole authentication.

Spring Security integration with transit secrets engine-based BytesKeyGenerator and BytesEncryptor.

AWS IAM authentication.

Configuration of encryption/decryption versions for transit keys.

Pull mode for AppRole authentication.

Transit batch encrypt and decrypt support.

TTL-based generic secret rotation.

Initial Vault support.