springboot-vault-examples
The goal of this project is play with Vault
. For it, we will implement some applications that rely on Vault
to store/retrieve secrets. The credentials to access databases are generated dynamically by Vault
that uses Consul
as backend.
Lease Rotation
One of the problems faced by many people when using Vault
is about rotating the lease obtained for some backend databases. When a Spring Boot
application requests a lease from Vault
using, for instance, the library Spring Cloud Vault
, the library itself is able to automatically renew the lease from time to time (default_lease_ttl
).
However, when the maximum expiration time of a lease is reached (max_lease_ttl
), it means that the lease cannot be renewed anymore, and a new lease is required. In this situation, Spring Cloud Vault
library cannot rotate it, leaving the application without connection to database.
In order to solve this problem, I have implemented some solutions for applications that use Spring Cloud Vault
or Spring Vault
. Please, have a look at the examples below.
Examples
-
spring-cloud-vault-approle-mysql (with lease rotation)
-
spring-cloud-vault-approle-cassandra
-
spring-vault-approle-mysql (with lease rotation)
-
spring-vault-approle-multi-datasources-mysql (with lease rotation)
Prerequisites
Start Environment
-
Open one terminal and inside
springboot-vault-examples
root folder rundocker-compose up -d
-
Wait for Docker containers to be up and running. To check it, run
docker-compose ps
-
Once all containers are up and running, run the script below to unseal
Vault
and enableAppRole
./unseal-vault-enable-approle-databases.sh
-
At the end of the script execution, the
VAULT_ROOT_TOKEN
value will be shown. Export it into every terminal it's neededexport VAULT_ROOT_TOKEN=...
Shutdown
To stop and remove docker-compose containers, network and volumes, go to a terminal and, inside springboot-vault-examples
root folder, run the command below
docker-compose down -v
Cleanup
To remove the Docker images created by this project, go to a terminal and, inside springboot-vault-examples
root folder, run the following script
./remove-docker-images.sh