1

In my application we are making two calls from my app for getting secrets from Vault, as shown below:

  1. Login to Vault : POST call to https::/v1/auth/approle/login -- It will take role_id and secret_id as payload and response will be client_token.

  2. Fetch secrets : GET call to https::/v1/secret/data/abc/dev/xyz.json -- It will take headers as X-Vault-Token and X-Vault-Namespace and it will give you the response as below:

    { "request_id": "......", "lease_id": "", "renewable": false, "lease_duration": 0, "data": { "data": { "name": "ABC" }, "metadata": { "created_time": "...", "deletion_time": "", "destroyed": false, "version": 1 } }

Now I want to use Spring Cloud Vault Dependency to make things work through it. Please provide me the proper illustrations to make this work?

ash das
  • 887
  • 7
  • 11

1 Answers1

5

Assuming you are running spring boot and have a working Vault server configured for your app.

Add spring cloud vault maven dependency

    <dependency>
        <groupId>org.springframework.cloud</groupId>
        <artifactId>spring-cloud-starter-vault-config</artifactId>
    </dependency>

Add vault configuration to bootstrap.yaml

spring:
  application:
    name: abc
  cloud:
    vault:
      host: <vault-server-hostname>
      port: <vault-server-port>
      scheme: HTTPS
      namespace: <name-of-vault-namespace>
      authentication: APPROLE
      app-role:
        role-id: <your-application-role-id>
        secret-id: <your-application-secret-id>
        role: <your-application-role>

If you run your app with spring profiles, like dev, it will be picked up and added to the vault path.

Now you should be able to inject secrets stored on the path secret/data/abc/dev with @Value("${<name-of-property>}

jokarls
  • 330
  • 2
  • 11
  • 2
    Is it me or storing role-id AND secret-id in version control isn't considered a proper practice? Wouldn't it be a better idea to inject these through environment variables? – Charles Morin Apr 21 '21 at 11:35
  • 3
    No, it's not you. It is a bad practice to store it in version control. – jokarls Sep 07 '21 at 11:49
  • So the solution would be, create a configuration bean, read the role id and secret id from the environment variables and pass them to the configuration bean. – s33h Dec 12 '22 at 08:04