springboot-vault-examples

The goal of this project is play with Vault. For it, we will implement some applications that rely on Vault to store/retrieve secrets. The credentials to access databases are generated dynamically by Vault that uses Consul as backend.

Lease Rotation

One of the problems faced by many people when using Vault is about rotating the lease obtained for some backend databases. When a Spring Boot application requests a lease from Vault using, for instance, the library Spring Cloud Vault, the library itself is able to automatically renew the lease from time to time (default_lease_ttl).

However, when the maximum expiration time of a lease is reached (max_lease_ttl), it means that the lease cannot be renewed anymore, and a new lease is required. In this situation, Spring Cloud Vault library cannot rotate it, leaving the application without connection to database.

In order to solve this problem, I have implemented some solutions for applications that use Spring Cloud Vault or Spring Vault. Please, have a look at the examples below.

Examples

Example	Diagram
spring-cloud-vault-approle-mysql (with lease rotation)
spring-cloud-vault-approle-cassandra
spring-vault-approle-mysql (with lease rotation)
spring-vault-approle-multi-datasources-mysql (with lease rotation)

Prerequisites

• Java 17+
• Docker
• Docker-Compose

Initialize Environment

Open a terminal and, inside springboot-vault-examples root folder, run the following script

./init-environment.sh

This script will:

• start Consul, Vault, MySQL, and Cassandra Docker containers;
• unseal Vault and enable AppRole in it;
• setup Database roles and policies in Vault for the application so that they can access their databases using dynamically generated credentials;
• setup KV Secrets in Vault for the application;

Shutdown Environment

To stop and remove docker-compose containers, network and volumes, go to a terminal and, inside springboot-vault-examples root folder, run the script below

./shutdown-environment.sh

Cleanup

To remove all Docker images created by this project, go to a terminal and, inside springboot-vault-examples root folder, run the following script

./remove-docker-images.sh all

References

• spring-cloud/spring-cloud-vault#85
• https://blog.ruanbekker.com/blog/2019/05/07/use-the-vault-api-to-provision-app-keys-and-create-kv-pairs/