Document How to Externalize Vault's Token w/ VaultPropertySoure

[rwinch]

It would be nice to document how to externalize Vault's Token when using VaultPropertySource. At the moment, there is a bit of a chicken and the egg problem when using standard Spring Environment.

One solution might be to instruct users to leverage system properties for this. We might also discuss how Spring Cloud (and in the future Spring Boot) have bootstrap.properties.

http://docs.spring.io/spring-vault/docs/1.0.0.BUILD-SNAPSHOT/reference/html/#vault.core.propertysupport

[spencergibb]

Spring Cloud Vault auto configures vault property sources

[rwinch]

@spencergibb Thanks for the reply.

Spring Cloud Vault auto configures vault property sources

I'm curious if you are really intending to talk about Spring Cloud Vault or not. I believe Spring Cloud can do this. However, this is a separate project that can be used outside of Spring Cloud and even Spring Boot.

This isuse is the question of...in a standard Spring environment how can a user configure vault externally. If they try to use the Environment to configure vault, it will cause a circular bean reference:

• In order to create an Environment we need the VaultPropertiesSource
• In order to create the VaultPropertySource we need the VaultTemplate
• In order to create the VaultTemplate we need the ClientAuthentication
• In order to create the ClientAuthentication we need the Environment to lookup the vault token to use. However, we haven't created the Environment because we haven't resolved VaultPropertySource and its dependencies yet.

You can see this via https://github.com/rwinch/spring-vault-connecting/tree/circular-bean

I'm wondering if there might be another way that we could do this so that the Environment can still be used to configure Spring Vault. @jgrandja worked on a prototype that leveraged a GenericConverter. See EncryptedPropertySupportPostProcessor

[mp911de]

The Environment is provided by Spring itself so it's not a bean created by the context, right?

I've built an example myself, mostly to figure out how it could work and ended up with:

@PropertySources({
    @PropertySource("classpath:/org/springframework/vault/demo/secure-introduction.properties"),
    @PropertySource("classpath:/org/springframework/vault/demo/other.properties") })
@VaultPropertySource({ "secret/secure-introduction" })
@Configuration
@ComponentScan
class Config extends VaultIntegrationTestConfiguration implements ApplicationContextAware {
}

See SecurePropertyUsage.java. I'm not sure whether I'm lucky that it just works or whether there's a better way how to deal with the issue.

[spencergibb]

I'm curious if you are really intending to talk about Spring Cloud Vault or not.

Yes, you mentioned

We might also discuss how Spring Cloud (and in the future Spring Boot) have bootstrap.properties

I just wanted to point out that Spring Cloud Vault takes advantage of bootstrap to configure vault in the environment. That's where this project evolved from.

[mp911de]

Seems the issue for circular bean references/@Autowired Environment env is null is that the autowiring bean postprocessor didn't yet kick in. Using ApplicationContextAware and obtaining the Environment works to mitigate that issue.

[mp911de]

AbstractVaultConfiguration now provides Environment getEnvironment() without relying on autowiring. Environment is used from ApplicatioContext provided by ApplicationContextAware.setApplicationContext(…).