Package org.springframework.vault.core

Class VaultTemplate

java.lang.Object

org.springframework.vault.core.VaultTemplate

All Implemented Interfaces:

DisposableBean, InitializingBean, VaultOperations

public class VaultTemplate
extends Object
implements InitializingBean, VaultOperations, DisposableBean

This class encapsulates main Vault interaction. VaultTemplate will log into Vault on initialization and use the token throughout the whole lifetime. This is the main entry point to interact with Vault in an authenticated and unauthenticated context.

VaultTemplate allows execution of callback methods. Callbacks can execute requests within a session context and the without a session.

Paths used in this interface (and interfaces accessible from here) are considered relative to the VaultEndpoint. Paths that are fully-qualified URI's can be used to access Vault cluster members in an authenticated context. To prevent unwanted full URI access, make sure to sanitize paths before passing them to this interface.

Author:

Mark Paluch

See Also:

• SessionManager

Constructor Summary

Constructors

Constructor	Description
VaultTemplate(RestClientBuilder restClientBuilder)	Create a new VaultTemplate through a RestClientBuilder.
VaultTemplate(RestClientBuilder restClientBuilder, SessionManager sessionManager)	Create a new VaultTemplate through a RestClientBuilder and SessionManager.
VaultTemplate(RestTemplateBuilder restTemplateBuilder)	Deprecated. since 4.1 in favor of a revised VaultClient-based constructor.
VaultTemplate(RestTemplateBuilder restTemplateBuilder, SessionManager sessionManager)	Deprecated. since 4.1 in favor of a revised VaultClient-based constructor.
VaultTemplate(VaultClient client)	Create a new VaultTemplate with a VaultClient.
VaultTemplate(VaultClient client, ClientAuthentication clientAuthentication)	Create a new VaultTemplate with a VaultClient and ClientAuthentication.
VaultTemplate(VaultClient client, SessionManager sessionManager)	Create a new VaultTemplate with a VaultClient and SessionManager.
VaultTemplate(VaultEndpoint vaultEndpoint)	Create a new VaultTemplate with a VaultEndpoint.
VaultTemplate(VaultEndpointProvider endpointProvider, ClientHttpRequestFactory requestFactory)	Deprecated. since 4.1 in favor of a revised VaultClient-based constructor.
VaultTemplate(VaultEndpointProvider endpointProvider, ClientHttpRequestFactory requestFactory, SessionManager sessionManager)	Deprecated. since 4.1 in favor of a revised VaultClient-based constructor.
VaultTemplate(VaultEndpoint vaultEndpoint, ClientHttpRequestFactory clientHttpRequestFactory)	Deprecated. since 4.1 in favor of a revised VaultClient-based constructor.
VaultTemplate(VaultEndpoint vaultEndpoint, ClientHttpRequestFactory clientHttpRequestFactory, SessionManager sessionManager)	Deprecated. since 4.1 in favor of a revised VaultClient-based constructor.
VaultTemplate(VaultEndpoint vaultEndpoint, ClientAuthentication clientAuthentication)	Create a new VaultTemplate with a VaultEndpoint and ClientAuthentication.

Method Summary

Modifier and Type	Method	Description
void	afterPropertiesSet()
void	delete(String path)	Delete a path.
void	destroy()
protected RestClient	doCreateRestClient(VaultEndpointProvider endpointProvider, ClientHttpRequestFactory requestFactory)	Deprecated. since 4.1, use VaultClient with the appropriate constructor instead.
protected RestTemplate	doCreateRestTemplate(VaultEndpointProvider endpointProvider, ClientHttpRequestFactory requestFactory)	Deprecated. since 4.1, use VaultClient with the appropriate constructor instead.
protected RestClient	doCreateSessionClient(VaultEndpointProvider endpointProvider, ClientHttpRequestFactory requestFactory)	Deprecated. since 4.1, use VaultClient with the appropriate constructor instead.
protected RestTemplate	doCreateSessionTemplate(VaultEndpointProvider endpointProvider, ClientHttpRequestFactory requestFactory)	Deprecated. since 4.1, use VaultClient with the appropriate constructor instead.
<T extends @Nullable Object> T	doWithSession(RestOperationsCallback<T> sessionCallback)	Executes a Vault RestOperationsCallback.
<T extends @Nullable Object> T	doWithVault(RestOperationsCallback<T> clientCallback)	Executes a Vault RestOperationsCallback.
@Nullable List<String>	list(String path)	Enumerate keys from a Vault path.
VaultKeyValueOperations	opsForKeyValue(String path)	Return VaultKeyValueOperations and determine the version by querying Vault.
VaultKeyValueOperations	opsForKeyValue(String path, VaultKeyValueOperationsSupport.KeyValueBackend apiVersion)	Return VaultKeyValueOperations.
VaultPkiOperations	opsForPki()
VaultPkiOperations	opsForPki(String path)	Return VaultPkiOperations if the PKI secrets engine is mounted on a different path than pki.
VaultSysOperations	opsForSys()
VaultTokenOperations	opsForToken()
VaultTransformOperations	opsForTransform()
VaultTransformOperations	opsForTransform(String path)	Return VaultTransformOperations if the transit secrets engine is mounted on a different path than transform.
VaultTransitOperations	opsForTransit()
VaultTransitOperations	opsForTransit(String path)	Return VaultTransitOperations if the transit secrets engine is mounted on a different path than transit.
VaultVersionedKeyValueOperations	opsForVersionedKeyValue(String path)	Return VaultVersionedKeyValueOperations.
VaultWrappingOperations	opsForWrapping()
@Nullable VaultResponse	read(String path)	Read (GET) from a Vault path.
<T> @Nullable VaultResponseSupport<T>	read(String path, Class<T> responseType)	Read (GET) from a secrets engine.
void	setSessionManager(SessionManager sessionManager)	Set the SessionManager.
@Nullable VaultResponse	write(String path, @Nullable Object body)	Write (POST) to a Vault path.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface org.springframework.vault.core.VaultOperations

invoke, readRequired, readRequired, write

Constructor Details

VaultTemplate

public VaultTemplate(VaultEndpoint vaultEndpoint)

Create a new VaultTemplate with a VaultEndpoint. This constructor does not use a ClientAuthentication mechanism. It is intended for usage with Vault Agent to inherit Vault Agent's authentication without using the authentication token header.

Parameters:

vaultEndpoint - must not be null.

Since:

2.2.1

VaultTemplate

public VaultTemplate(VaultEndpoint vaultEndpoint,
 ClientAuthentication clientAuthentication)

Create a new VaultTemplate with a VaultEndpoint and ClientAuthentication.

Parameters:

vaultEndpoint - must not be null.

clientAuthentication - must not be null.

VaultTemplate

public VaultTemplate(VaultClient client)

Create a new VaultTemplate with a VaultClient.

Parameters:

client - must not be null.

Since:

4.1

VaultTemplate

public VaultTemplate(VaultClient client,
 ClientAuthentication clientAuthentication)

Create a new VaultTemplate with a VaultClient and ClientAuthentication.

Parameters:

client - must not be null.

clientAuthentication - must not be null.

Since:

4.1

VaultTemplate

public VaultTemplate(VaultClient client,
 SessionManager sessionManager)

Create a new VaultTemplate with a VaultClient and SessionManager.

Parameters:

client - must not be null.

sessionManager - must not be null.

Since:

4.1

VaultTemplate

@Deprecated(since="4.1")
public VaultTemplate(VaultEndpoint vaultEndpoint,
 ClientHttpRequestFactory clientHttpRequestFactory)

Deprecated.

since 4.1 in favor of a revised VaultClient-based constructor.

Create a new VaultTemplate with a VaultEndpoint, and ClientHttpRequestFactory. This constructor does not use a ClientAuthentication mechanism. It is intended for usage with Vault Agent to inherit Vault Agent's authentication without using the authentication token header.

Parameters:

vaultEndpoint - must not be null.

clientHttpRequestFactory - must not be null.

Since:

2.2.1

VaultTemplate

@Deprecated(since="4.1")
public VaultTemplate(VaultEndpoint vaultEndpoint,
 ClientHttpRequestFactory clientHttpRequestFactory,
 SessionManager sessionManager)

Deprecated.

since 4.1 in favor of a revised VaultClient-based constructor.

Create a new VaultTemplate with a VaultEndpoint, ClientHttpRequestFactory and SessionManager.

Parameters:

vaultEndpoint - must not be null.

clientHttpRequestFactory - must not be null.

sessionManager - must not be null.

VaultTemplate

@Deprecated(since="4.1")
public VaultTemplate(VaultEndpointProvider endpointProvider,
 ClientHttpRequestFactory requestFactory)

Deprecated.

since 4.1 in favor of a revised VaultClient-based constructor.

Create a new VaultTemplate with a VaultEndpointProvider, ClientHttpRequestFactory and SessionManager. This constructor does not use a ClientAuthentication mechanism. It is intended for usage with Vault Agent to inherit Vault Agent's authentication without using the authentication token header.

Parameters:

endpointProvider - must not be null.

requestFactory - must not be null.

Since:

2.2.1

VaultTemplate

@Deprecated(since="4.1")
public VaultTemplate(VaultEndpointProvider endpointProvider,
 ClientHttpRequestFactory requestFactory,
 SessionManager sessionManager)

Deprecated.

since 4.1 in favor of a revised VaultClient-based constructor.

Create a new VaultTemplate with a VaultEndpointProvider, ClientHttpRequestFactory and SessionManager.

Parameters:

endpointProvider - must not be null.

requestFactory - must not be null.

sessionManager - must not be null.

Since:

1.1

VaultTemplate

@Deprecated(since="4.1")
public VaultTemplate(RestTemplateBuilder restTemplateBuilder)

Deprecated.

since 4.1 in favor of a revised VaultClient-based constructor.

Create a new VaultTemplate through a RestTemplateBuilder. This constructor does not use a ClientAuthentication mechanism. It is intended for usage with Vault Agent to inherit Vault Agent's authentication without using the authentication token header.

Parameters:

restTemplateBuilder - must not be null.

Since:

2.2.1

VaultTemplate

public VaultTemplate(RestClientBuilder restClientBuilder)

Create a new VaultTemplate through a RestClientBuilder. This constructor does not use a ClientAuthentication mechanism. It is intended for usage with Vault Agent to inherit Vault Agent's authentication without using the authentication token header.

Parameters:

restClientBuilder - must not be null.

Since:

4.0

VaultTemplate

@Deprecated(since="4.1")
public VaultTemplate(RestTemplateBuilder restTemplateBuilder,
 SessionManager sessionManager)

Deprecated.

since 4.1 in favor of a revised VaultClient-based constructor.

Create a new VaultTemplate through a RestTemplateBuilder and SessionManager.

Parameters:

restTemplateBuilder - must not be null.

sessionManager - must not be null.

Since:

2.2

VaultTemplate

public VaultTemplate(RestClientBuilder restClientBuilder,
 SessionManager sessionManager)

Create a new VaultTemplate through a RestClientBuilder and SessionManager.

Parameters:

restClientBuilder - must not be null.

sessionManager - must not be null.

Since:

4.0

Method Details

doCreateRestTemplate

@Deprecated(since="4.1")
protected RestTemplate doCreateRestTemplate(VaultEndpointProvider endpointProvider,
 ClientHttpRequestFactory requestFactory)

Deprecated.

since 4.1, use VaultClient with the appropriate constructor instead. Session-authentication will be performed through the VaultClient and no longer through a request interceptor.

Create a RestTemplate to be used by VaultTemplate for Vault communication given VaultEndpointProvider and ClientHttpRequestFactory. VaultEndpointProvider is used to contribute host and port details for relative URLs typically used by the Template API. Subclasses may override this method to customize the RestTemplate.

Parameters:

endpointProvider - must not be null.

requestFactory - must not be null.

Returns:

the RestTemplate used for Vault communication.

Since:

2.1

doCreateRestClient

@Deprecated(since="4.1")
protected RestClient doCreateRestClient(VaultEndpointProvider endpointProvider,
 ClientHttpRequestFactory requestFactory)

Deprecated.

since 4.1, use VaultClient with the appropriate constructor instead. Session-authentication will be performed through the VaultClient and no longer through a request interceptor.

Create a RestClient to be used by VaultTemplate for Vault communication given VaultEndpointProvider and ClientHttpRequestFactory. VaultEndpointProvider is used to contribute host and port details for relative URLs typically used by the client API. Subclasses may override this method to customize the RestClient.

Parameters:

endpointProvider - must not be null.

requestFactory - must not be null.

Returns:

the RestClient used for Vault communication.

Since:

4.0

doCreateSessionTemplate

@Deprecated(since="4.1")
protected RestTemplate doCreateSessionTemplate(VaultEndpointProvider endpointProvider,
 ClientHttpRequestFactory requestFactory)

Deprecated.

since 4.1, use VaultClient with the appropriate constructor instead. Session-authentication will be performed through the VaultClient and no longer through a request interceptor.

Create a session-bound RestTemplate to be used by VaultTemplate for Vault communication given VaultEndpointProvider and ClientHttpRequestFactory for calls that require an authenticated context. VaultEndpointProvider is used to contribute host and port details for relative URLs typically used by the Template API. Subclasses may override this method to customize the RestTemplate.

Parameters:

endpointProvider - must not be null.

requestFactory - must not be null.

Returns:

the RestTemplate used for Vault communication.

Since:

2.1

doCreateSessionClient

protected RestClient doCreateSessionClient(VaultEndpointProvider endpointProvider,
 ClientHttpRequestFactory requestFactory)

Deprecated.

since 4.1, use VaultClient with the appropriate constructor instead. Session-authentication will be performed through the VaultClient and no longer through a request interceptor.

Create a session-bound RestClient to be used by VaultTemplate for Vault communication given VaultEndpointProvider and ClientHttpRequestFactory for calls that require an authenticated context. VaultEndpointProvider is used to contribute host and port details for relative URLs typically used by the Template API. Subclasses may override this method to customize the RestClient.

Parameters:

endpointProvider - must not be null.

requestFactory - must not be null.

Returns:

the RestClient used for Vault communication.

Since:

4.0

setSessionManager

public void setSessionManager(SessionManager sessionManager)

Set the SessionManager.

Parameters:

sessionManager - must not be null.

afterPropertiesSet

public void afterPropertiesSet()

Specified by:

afterPropertiesSet in interface InitializingBean

destroy

public void destroy()
             throws Exception

Specified by:

destroy in interface DisposableBean

Throws:

Exception

opsForKeyValue

public VaultKeyValueOperations opsForKeyValue(String path)

Description copied from interface: VaultOperations

Return VaultKeyValueOperations and determine the version by querying Vault. Paths used with this method must be relative to the given mount path.

Specified by:

opsForKeyValue in interface VaultOperations

Parameters:

path - the mount path, must not be empty or null.

Returns:

the operations interface to interact with the Vault Key/Value secrets engine.

opsForKeyValue

public VaultKeyValueOperations opsForKeyValue(String path,
 VaultKeyValueOperationsSupport.KeyValueBackend apiVersion)

Description copied from interface: VaultOperations

Return VaultKeyValueOperations. Paths used with this method must be relative to the given mount path.

Specified by:

opsForKeyValue in interface VaultOperations

Parameters:

path - the mount path, must not be empty or null.

apiVersion - API version to use, must not be null.

Returns:

the operations interface to interact with the Vault Key/Value secrets engine.

opsForVersionedKeyValue

public VaultVersionedKeyValueOperations opsForVersionedKeyValue(String path)

Description copied from interface: VaultOperations

Return VaultVersionedKeyValueOperations.

Specified by:

opsForVersionedKeyValue in interface VaultOperations

Parameters:

path - the mount path

Returns:

the operations interface to interact with the versioned Vault Key/Value (version 2) secrets engine.

opsForPki

public VaultPkiOperations opsForPki()

Specified by:

opsForPki in interface VaultOperations

Returns:

the operations interface to interact with the Vault PKI secrets engine.

opsForPki

public VaultPkiOperations opsForPki(String path)

Description copied from interface: VaultOperations

Return VaultPkiOperations if the PKI secrets engine is mounted on a different path than pki.

Specified by:

opsForPki in interface VaultOperations

Parameters:

path - the mount path

Returns:

the operations interface to interact with the Vault PKI secrets engine.

opsForSys

public VaultSysOperations opsForSys()

Specified by:

opsForSys in interface VaultOperations

Returns:

the operations interface administrative Vault access.

opsForToken

public VaultTokenOperations opsForToken()

Specified by:

opsForToken in interface VaultOperations

Returns:

the operations interface to interact with Vault token.

opsForTransform

public VaultTransformOperations opsForTransform()

Specified by:

opsForTransform in interface VaultOperations

Returns:

the operations interface to interact with the Vault transform secrets engine.

opsForTransform

public VaultTransformOperations opsForTransform(String path)

Description copied from interface: VaultOperations

Return VaultTransformOperations if the transit secrets engine is mounted on a different path than transform.

Specified by:

opsForTransform in interface VaultOperations

Parameters:

path - the mount path

Returns:

the operations interface to interact with the Vault transform secrets engine.

opsForTransit

public VaultTransitOperations opsForTransit()

Specified by:

opsForTransit in interface VaultOperations

Returns:

the operations interface to interact with the Vault transit secrets engine.

opsForTransit

public VaultTransitOperations opsForTransit(String path)

Description copied from interface: VaultOperations

Return VaultTransitOperations if the transit secrets engine is mounted on a different path than transit.

Specified by:

opsForTransit in interface VaultOperations

Parameters:

path - the mount path

Returns:

the operations interface to interact with the Vault transit secrets engine.

opsForWrapping

public VaultWrappingOperations opsForWrapping()

Specified by:

opsForWrapping in interface VaultOperations

Returns:

the operations interface to interact with the Vault system/wrapping endpoints.

read

public @Nullable VaultResponse read(String path)

Description copied from interface: VaultOperations

Read (GET) from a Vault path. Reading data using this method is suitable for API calls/secrets engines that do not require a request body.

Specified by:

read in interface VaultOperations

Parameters:

path - must not be null.

Returns:

the data. May be null if the path does not exist.

read

public <T> @Nullable VaultResponseSupport<T> read(String path,
 Class<T> responseType)

Description copied from interface: VaultOperations

Read (GET) from a secrets engine. Reading data using this method is suitable for secrets engines that do not require a request body.

Specified by:

read in interface VaultOperations

Parameters:

path - must not be null.

responseType - must not be null.

Returns:

the data. May be null if the path does not exist.

list

public @Nullable List<String> list(String path)

Description copied from interface: VaultOperations

Enumerate keys from a Vault path.

Specified by:

list in interface VaultOperations

Parameters:

path - must not be null.

Returns:

the data. May be null if the path does not exist.

write

public @Nullable VaultResponse write(String path,
 @Nullable Object body)

Description copied from interface: VaultOperations

Write (POST) to a Vault path.

Specified by:

write in interface VaultOperations

Parameters:

path - must not be null.

body - the body, may be null if absent.

Returns:

the response, may be null.

delete

public void delete(String path)

Description copied from interface: VaultOperations

Delete a path.

Specified by:

delete in interface VaultOperations

Parameters:

path - must not be null.

doWithVault

public <T extends @Nullable Object> T doWithVault(RestOperationsCallback<T> clientCallback)

Description copied from interface: VaultOperations

Executes a Vault RestOperationsCallback. Allows to interact with Vault using RestOperations without requiring a session.

Specified by:

doWithVault in interface VaultOperations

Parameters:

clientCallback - the request.

Returns:

the RestOperationsCallback return value.

doWithSession

public <T extends @Nullable Object> T doWithSession(RestOperationsCallback<T> sessionCallback)

Description copied from interface: VaultOperations

Executes a Vault RestOperationsCallback. Allows to interact with Vault in an authenticated session. Operations without a session manager or ClientAuthentication do not attach a session token and behave like VaultOperations.doWithVault(RestOperationsCallback).

Specified by:

doWithSession in interface VaultOperations

Parameters:

sessionCallback - the request.

Returns:

the RestOperationsCallback return value.