Property Sources :: Spring Vault
Why Spring
Overview
Trending
Generative AI
Cloud
Architecture Patterns
Microservices
Reactive
Event Driven
Application Types
Web Applications
Serverless
Batch
Learn
Getting Started
Quickstart
Guides
Academy
Courses
Get Certified
Projects
Overview
Projects
Spring Boot
Spring Framework
Spring Cloud
Spring AI
Spring Data
Spring Integration
Spring Batch
Spring Security
Foundational Projects
Micrometer
Reactor
Development Tools
Spring Tools
Spring Initializr
Resources
Blog
Release Calendar
Version Mappings
Release Highlights
Security Advisories
GitHub Orgs
Spring Projects
Spring Cloud
Community
Overview
Events
Authors
Enterprise
Overview
Long-term Support
Automated Upgrades
Governance and Compliance
Modern App Development
light
Spring Vault
4.1.0
Search
Index
Introduction
Getting Started
Dependencies
Vault
Vault Client Access
Authentication Methods
Introduction to VaultTemplate
Reactive Infrastructure
Vault Secrets Engines
Property Sources
Credentials Rotation
Vault Repositories
Spring Security
HTTP Client Support
Javadoc
Search
Edit this Page
GitHub Project
Stack Overflow
Spring Vault
Vault
Property Sources
Property Sources
Vault can be used in many different ways. One specific use-case is using
Vault to store encrypted properties. Spring Vault supports Vault as property
source to obtain configuration properties using Spring’s PropertySource abstraction.
You can reference properties stored inside Vault in other property sources or use value injection with @Value(…). Special attention is required when bootstrapping beans that require data stored inside of Vault. A VaultPropertySource must be initialized at that time to retrieve properties from Vault.
Spring Boot/Spring Cloud users can benefit from Spring Cloud Vault's
configuration integration that initializes various property sources during application startup.
Vault determines the mount path through Vault’s sys/internal/ui/mounts/… endpoint. Make sure that your policy allows accessing that path, otherwise you won’t be able to use  Vault Property sources.
Registering VaultPropertySource
Spring Vault provides a VaultPropertySource to be used with Vault to obtain
properties. It uses the nested data element to expose properties stored and
encrypted in Vault.
ConfigurableApplicationContext ctx = new GenericApplicationContext();
MutablePropertySources sources = ctx.getEnvironment().getPropertySources();
sources.addFirst(new VaultPropertySource(vaultTemplate, "secret/my-application"));
In the code above, VaultPropertySource has been added with highest precedence
in the search. If it contains a ´foo` property, it will be detected and returned
ahead of any foo property in any other PropertySource.
MutablePropertySources exposes a number of methods that allow for precise
manipulation of the set of property sources.
@VaultPropertySource
The @VaultPropertySource annotation provides a convenient and declarative
mechanism for adding a PropertySource to Spring’s Environment
to be used in conjunction with @Configuration classes.
@VaultPropertySource takes a Vault path such as secret/my-application
and exposes the data stored at the node in a PropertySource.
@VaultPropertySource supports lease renewal for secrets associated with a lease (i. e. credentials from the mysql secrets engine) and credential rotation upon terminal
lease expiration. Lease renewal is disabled by default.
Example 1. Properties stored in Vault
{
// …
"data": {
"database": {
"password": ...
},
"user.name": ...,
}
// …
}
Example 2. Declaring a @VaultPropertySource
@Configuration
@VaultPropertySource("secret/my-application")
public class AppConfig {
@Autowired Environment env;
@Bean
public TestBean testBean() {
TestBean testBean = new TestBean();
testBean.setUser(env.getProperty("user.name"));
testBean.setPassword(env.getProperty("database.password"));
return testBean;
}
}
Example 3. Declaring a @VaultPropertySource with credential rotation and prefix
@Configuration
@VaultPropertySource(value = "aws/creds/s3-access",
propertyNamePrefix = "aws.",
renewal = Renewal.ROTATE)
public class AppConfig {
// provides aws.access_key and aws.secret_key properties
}
Secrets obtained from generic secrets engines are associated with a TTL (refresh_interval) but not a lease Id.
Spring Vault’s PropertySource rotates generic secrets when reaching its TTL.
You can use @VaultPropertySource to obtain the newest secret version from the versioned Key-Value secrets backend.
Make sure to not include the data/ segment in the path.
Any ${…} placeholders present in a @VaultPropertySource path are resolved against the set of property sources already registered against the environment, as the following example shows:
Example 4. Declaring a @VaultPropertySource path using placeholders
@Configuration
@VaultPropertySource(value = "aws/creds/${my.placeholder:fallback/value}",
propertyNamePrefix = "aws.",
renewal = Renewal.ROTATE)
public class AppConfig {
}
Assuming that my.placeholder is present in one of the property sources already registered (for example, system properties or environment variables), the placeholder is resolved to the corresponding value.
If not, then fallback/value is used as a default.
If no default is specified and a property cannot be resolved, an IllegalArgumentException is thrown.
In certain situations, it may not be possible or practical to tightly control
property source ordering when using @VaultPropertySource annotations.
For example, if the @Configuration classes above were registered via
component-scanning, the ordering is difficult to predict.
In such cases - and if overriding is important - it is recommended that the
user fall back to using the programmatic PropertySource API.
See ConfigurableEnvironment and
MutablePropertySources for details.
Spring Vault
Stable
4.1.0
4.0.3
3.2.1
3.1.3
Snapshot
4.2.0-SNAPSHOT
4.0.1-SNAPSHOT
3.2.2-SNAPSHOT
3.1.4-SNAPSHOT
Related Spring Documentation
Spring Framework
Spring Cloud
Spring Cloud Build
Spring Cloud Bus
Spring Cloud Circuit Breaker
Spring Cloud Commons
Spring Cloud Config
Spring Cloud Consul
Spring Cloud Contract
Spring Cloud Function
Spring Cloud Gateway
Spring Cloud Kubernetes
Spring Cloud Netflix
Spring Cloud OpenFeign
Spring Cloud Stream
Spring Cloud Task
Spring Cloud Vault
Spring Cloud Zookeeper
Spring Security
Spring Authorization Server
Spring LDAP
Spring Security Kerberos
Spring Session
Spring Vault
All Docs...
Copyright © 2005 -
Broadcom. All Rights Reserved. The term "Broadcom" refers to Broadcom Inc. and/or its subsidiaries.
Terms of Use • Privacy • Trademark Guidelines • Thank you • Your California Privacy Rights • Cookie Settings
Apache®, Apache Tomcat®, Apache Kafka®, Apache Cassandra™, and Apache Geode™ are trademarks or registered trademarks of the Apache Software Foundation in the United States and/or other countries. Java™, Java™ SE, Java™ EE, and OpenJDK™ are trademarks of Oracle and/or its affiliates. Kubernetes® is a registered trademark of the Linux Foundation in the United States and other countries. Linux® is the registered trademark of Linus Torvalds in the United States and other countries. Windows® and Microsoft® Azure are registered trademarks of Microsoft Corporation. “AWS” and “Amazon Web Services” are trademarks or registered trademarks of Amazon.com Inc. or its affiliates. All other trademarks and copyrights are property of their respective owners and are only mentioned for informative purposes. Other names may be trademarks of their respective owners.
Search in all Spring Docs