org.springframework.vault.client.VaultEndpointProvider Java Examples

@Test
public void shouldRegisterDefaultBeans() {

	this.contextRunner.withUserConfiguration(DiscoveryConfiguration.class)
			.withPropertyValues("spring.cloud.vault.token=foo",
					"spring.cloud.vault.discovery.enabled=true")
			.run(context -> {

				assertThat(context.getBean(VaultServiceInstanceProvider.class))
						.isInstanceOf(
								DiscoveryClientVaultServiceInstanceProvider.class);

				VaultEndpointProvider endpointProvider = context
						.getBean(VaultEndpointProvider.class);
				VaultEndpoint vaultEndpoint = endpointProvider.getVaultEndpoint();
				assertThat(vaultEndpoint.getPort()).isEqualTo(1234);
			});
}
 

public VaultBootstrapConfiguration(ConfigurableApplicationContext applicationContext,
		VaultProperties vaultProperties,
		ObjectProvider<VaultEndpointProvider> endpointProvider,
		ObjectProvider<List<RestTemplateCustomizer>> customizers,
		ObjectProvider<List<RestTemplateRequestCustomizer<?>>> requestCustomizers) {

	this.applicationContext = applicationContext;
	this.vaultProperties = vaultProperties;

	VaultEndpointProvider provider = endpointProvider.getIfAvailable();

	if (provider == null) {
		provider = SimpleVaultEndpointProvider
				.of(VaultConfigurationUtil.createVaultEndpoint(vaultProperties));
	}

	this.endpointProvider = provider;
	this.customizers = new ArrayList<>(
			customizers.getIfAvailable(Collections::emptyList));
	AnnotationAwareOrderComparator.sort(this.customizers);

	this.requestCustomizers = new ArrayList<>(
			requestCustomizers.getIfAvailable(Collections::emptyList));
	AnnotationAwareOrderComparator.sort(this.requestCustomizers);
}
 

/**
 * Create a new {@link ReactiveVaultTemplate} with a {@link VaultEndpointProvider},
 * {@link ClientHttpConnector} and {@link VaultTokenSupplier}.
 * @param endpointProvider must not be {@literal null}.
 * @param connector must not be {@literal null}.
 * @param vaultTokenSupplier must not be {@literal null}.
 */
public ReactiveVaultTemplate(VaultEndpointProvider endpointProvider, ClientHttpConnector connector,
		VaultTokenSupplier vaultTokenSupplier) {

	Assert.notNull(endpointProvider, "VaultEndpointProvider must not be null");
	Assert.notNull(connector, "ClientHttpConnector must not be null");
	Assert.notNull(vaultTokenSupplier, "VaultTokenSupplier must not be null");

	this.vaultTokenSupplier = vaultTokenSupplier;
	this.statelessClient = doCreateWebClient(endpointProvider, connector);
	this.sessionClient = doCreateSessionWebClient(endpointProvider, connector);
}
 

private RestOperations getRestOperations(Map<String, String> properties) throws Exception {
  String vaultAddress = properties.get(HashicorpVaultAliasService.VAULT_ADDRESS_KEY);
  VaultEndpoint vaultEndpoint = VaultEndpoint.from(new URI(vaultAddress));
  VaultEndpointProvider vaultEndpointProvider = SimpleVaultEndpointProvider.of(vaultEndpoint);
  ClientOptions clientOptions = new ClientOptions();
  SslConfiguration sslConfiguration = SslConfiguration.unconfigured();
  ClientHttpRequestFactory clientHttpRequestFactory = ClientHttpRequestFactoryFactory.create(
      clientOptions, sslConfiguration);
  return VaultClients.createRestTemplate(vaultEndpointProvider, clientHttpRequestFactory);
}
 

@Bean
@ConditionalOnMissingBean
@ConditionalOnProperty(name = "spring.cloud.vault.enabled", matchIfMissing = true)
public VaultEndpointProvider vaultEndpointProvider(
		VaultServiceInstanceProvider instanceProvider) {

	String serviceId = this.vaultProperties.getDiscovery().getServiceId();
	String fallbackScheme;

	if (StringUtils.hasText(this.vaultProperties.getUri())) {
		fallbackScheme = URI.create(this.vaultProperties.getUri()).getScheme();
	}
	else {
		fallbackScheme = this.vaultProperties.getScheme();
	}

	ServiceInstance server = instanceProvider.getVaultServerInstance(serviceId);

	VaultEndpoint vaultEndpoint = VaultEndpoint.create(server.getHost(),
			server.getPort());

	if (server.getMetadata().containsKey("scheme")) {
		vaultEndpoint.setScheme(server.getMetadata().get("scheme"));
	}
	else {
		vaultEndpoint.setScheme(server.isSecure() ? "https" : fallbackScheme);
	}

	return () -> vaultEndpoint;
}
 

public VaultReactiveBootstrapConfiguration(BeanFactory beanFactory,
		VaultProperties vaultProperties,
		ObjectProvider<VaultEndpointProvider> endpointProvider,
		ObjectProvider<List<WebClientCustomizer>> webClientCustomizers) {

	this.beanFactory = beanFactory;
	this.vaultProperties = vaultProperties;

	VaultEndpointProvider provider = endpointProvider.getIfAvailable();

	if (provider == null) {
		provider = SimpleVaultEndpointProvider
				.of(VaultConfigurationUtil.createVaultEndpoint(vaultProperties));
	}

	this.webClientBuilder = WebClientBuilder.builder()
			.httpConnector(createConnector(this.vaultProperties))
			.endpointProvider(provider);
	List<WebClientCustomizer> customizers = new ArrayList<>(
			webClientCustomizers.getIfAvailable(Collections::emptyList));
	AnnotationAwareOrderComparator.sort(customizers);

	customizers.forEach(this.webClientBuilder::customizers);

	if (StringUtils.hasText(this.vaultProperties.getNamespace())) {
		this.webClientBuilder.defaultHeader(VaultHttpHeaders.VAULT_NAMESPACE,
				this.vaultProperties.getNamespace());
	}
}
 

/**
 * Create a new {@link ReactiveVaultTemplate} with a {@link VaultEndpointProvider} and
 * {@link ClientHttpConnector}. This constructor does not use a
 * {@link VaultTokenSupplier}. It is intended for usage with Vault Agent to inherit
 * Vault Agent's authentication without using the {@link VaultHttpHeaders#VAULT_TOKEN
 * authentication token header}.
 * @param endpointProvider must not be {@literal null}.
 * @param connector must not be {@literal null}.
 * @since 2.2.1
 */
public ReactiveVaultTemplate(VaultEndpointProvider endpointProvider, ClientHttpConnector connector) {

	Assert.notNull(endpointProvider, "VaultEndpointProvider must not be null");
	Assert.notNull(connector, "ClientHttpConnector must not be null");

	WebClient webClient = doCreateWebClient(endpointProvider, connector);

	this.vaultTokenSupplier = NoTokenSupplier.INSTANCE;
	this.statelessClient = webClient;
	this.sessionClient = webClient;
}
 

/**
 * Create a new {@link VaultTemplate} with a {@link VaultEndpointProvider},
 * {@link ClientHttpRequestFactory} and {@link SessionManager}.
 * @param endpointProvider must not be {@literal null}.
 * @param requestFactory must not be {@literal null}.
 * @param sessionManager must not be {@literal null}.
 * @since 1.1
 */
public VaultTemplate(VaultEndpointProvider endpointProvider, ClientHttpRequestFactory requestFactory,
		SessionManager sessionManager) {

	Assert.notNull(endpointProvider, "VaultEndpointProvider must not be null");
	Assert.notNull(requestFactory, "ClientHttpRequestFactory must not be null");
	Assert.notNull(sessionManager, "SessionManager must not be null");

	this.sessionManager = sessionManager;
	this.dedicatedSessionManager = false;
	this.statelessTemplate = doCreateRestTemplate(endpointProvider, requestFactory);
	this.sessionTemplate = doCreateSessionTemplate(endpointProvider, requestFactory);
}
 

/**
 * Create a new {@link VaultTemplate} with a {@link VaultEndpointProvider},
 * {@link ClientHttpRequestFactory} and {@link SessionManager}. This constructor does
 * not use a {@link ClientAuthentication} mechanism. It is intended for usage with
 * Vault Agent to inherit Vault Agent's authentication without using the
 * {@link VaultHttpHeaders#VAULT_TOKEN authentication token header}.
 * @param endpointProvider must not be {@literal null}.
 * @param requestFactory must not be {@literal null}.
 * @since 2.2.1
 */
public VaultTemplate(VaultEndpointProvider endpointProvider, ClientHttpRequestFactory requestFactory) {

	Assert.notNull(endpointProvider, "VaultEndpointProvider must not be null");
	Assert.notNull(requestFactory, "ClientHttpRequestFactory must not be null");

	RestTemplate restTemplate = doCreateRestTemplate(endpointProvider, requestFactory);

	this.sessionManager = NoSessionManager.INSTANCE;
	this.dedicatedSessionManager = false;
	this.statelessTemplate = restTemplate;
	this.sessionTemplate = restTemplate;
}
 

/**
 * Create a {@link RestTemplateBuilder} initialized with {@link VaultEndpointProvider}
 * and {@link ClientHttpRequestFactory}. May be overridden by subclasses.
 * @return the {@link RestTemplateBuilder}.
 * @see #vaultEndpointProvider()
 * @see #clientHttpRequestFactoryWrapper()
 * @since 2.3
 */
protected RestTemplateBuilder restTemplateBuilder(VaultEndpointProvider endpointProvider,
		ClientHttpRequestFactory requestFactory) {

	ObjectProvider<RestTemplateCustomizer> customizers = getBeanFactory()
			.getBeanProvider(RestTemplateCustomizer.class);

	RestTemplateBuilder builder = RestTemplateBuilder.builder().endpointProvider(endpointProvider)
			.requestFactory(requestFactory);

	builder.customizers(customizers.stream().toArray(RestTemplateCustomizer[]::new));

	return builder;
}
 

@Override
protected RestTemplateBuilder restTemplateBuilder(VaultEndpointProvider endpointProvider,
		ClientHttpRequestFactory requestFactory) {
	return super.restTemplateBuilder(endpointProvider, requestFactory)
			.defaultHeader(VaultHttpHeaders.VAULT_NAMESPACE, "marketing");
}
 

/**
 * Create a new {@link VaultTemplate} with a {@link VaultEndpoint} and
 * {@link ClientAuthentication}.
 * @param vaultEndpoint must not be {@literal null}.
 * @param clientAuthentication must not be {@literal null}.
 */
public VaultTemplate(VaultEndpoint vaultEndpoint, ClientAuthentication clientAuthentication) {

	Assert.notNull(vaultEndpoint, "VaultEndpoint must not be null");
	Assert.notNull(clientAuthentication, "ClientAuthentication must not be null");

	this.sessionManager = new SimpleSessionManager(clientAuthentication);
	this.dedicatedSessionManager = true;

	ClientHttpRequestFactory requestFactory = new SimpleClientHttpRequestFactory();

	VaultEndpointProvider endpointProvider = SimpleVaultEndpointProvider.of(vaultEndpoint);

	this.statelessTemplate = doCreateRestTemplate(endpointProvider, requestFactory);
	this.sessionTemplate = doCreateSessionTemplate(endpointProvider, requestFactory);
}
 

/**
 * Create a session-bound {@link RestTemplate} to be used by {@link VaultTemplate} for
 * Vault communication given {@link VaultEndpointProvider} and
 * {@link ClientHttpRequestFactory} for calls that require an authenticated context.
 * {@link VaultEndpointProvider} is used to contribute host and port details for
 * relative URLs typically used by the Template API. Subclasses may override this
 * method to customize the {@link RestTemplate}.
 * @param endpointProvider must not be {@literal null}.
 * @param requestFactory must not be {@literal null}.
 * @return the {@link RestTemplate} used for Vault communication.
 * @since 2.1
 */
protected RestTemplate doCreateSessionTemplate(VaultEndpointProvider endpointProvider,
		ClientHttpRequestFactory requestFactory) {

	return RestTemplateBuilder.builder().endpointProvider(endpointProvider).requestFactory(requestFactory)
			.customizers(restTemplate -> restTemplate.getInterceptors().add(getSessionInterceptor())).build();
}
 

/**
 * Create a {@link WebClient} to be used by {@link ReactiveVaultTemplate} for Vault
 * communication given {@link VaultEndpointProvider} and {@link ClientHttpConnector}.
 * {@link VaultEndpointProvider} is used to contribute host and port details for
 * relative URLs typically used by the Template API. Subclasses may override this
 * method to customize the {@link WebClient}.
 * @param endpointProvider must not be {@literal null}.
 * @param connector must not be {@literal null}.
 * @return the {@link WebClient} used for Vault communication.
 * @since 2.1
 */
protected WebClient doCreateWebClient(VaultEndpointProvider endpointProvider, ClientHttpConnector connector) {

	Assert.notNull(endpointProvider, "VaultEndpointProvider must not be null");
	Assert.notNull(connector, "ClientHttpConnector must not be null");

	return WebClientBuilder.builder().httpConnector(connector).endpointProvider(endpointProvider).build();
}
 

/**
 * Create a session-bound {@link WebClient} to be used by {@link VaultTemplate} for
 * Vault communication given {@link VaultEndpointProvider} and
 * {@link ClientHttpConnector} for calls that require an authenticated context.
 * {@link VaultEndpointProvider} is used to contribute host and port details for
 * relative URLs typically used by the Template API. Subclasses may override this
 * method to customize the {@link WebClient}.
 * @param endpointProvider must not be {@literal null}.
 * @param connector must not be {@literal null}.
 * @return the {@link WebClient} used for Vault communication.
 * @since 2.1
 */
protected WebClient doCreateSessionWebClient(VaultEndpointProvider endpointProvider,
		ClientHttpConnector connector) {

	Assert.notNull(endpointProvider, "VaultEndpointProvider must not be null");
	Assert.notNull(connector, "ClientHttpConnector must not be null");

	ExchangeFilterFunction filter = getSessionFilter();

	return WebClientBuilder.builder().httpConnector(connector).endpointProvider(endpointProvider).filter(filter)
			.build();
}
 

/**
 * Create a {@link RestTemplate} to be used by {@link VaultTemplate} for Vault
 * communication given {@link VaultEndpointProvider} and
 * {@link ClientHttpRequestFactory}. {@link VaultEndpointProvider} is used to
 * contribute host and port details for relative URLs typically used by the Template
 * API. Subclasses may override this method to customize the {@link RestTemplate}.
 * @param endpointProvider must not be {@literal null}.
 * @param requestFactory must not be {@literal null}.
 * @return the {@link RestTemplate} used for Vault communication.
 * @since 2.1
 */
protected RestTemplate doCreateRestTemplate(VaultEndpointProvider endpointProvider,
		ClientHttpRequestFactory requestFactory) {

	return RestTemplateBuilder.builder().endpointProvider(endpointProvider).requestFactory(requestFactory).build();
}
 

/**
 * Create a {@link WebClientBuilder} initialized with {@link VaultEndpointProvider}
 * and {@link ClientHttpConnector}. May be overridden by subclasses.
 * @return the {@link WebClientBuilder}.
 * @see #reactiveVaultEndpointProvider()
 * @see #clientHttpConnector()
 * @since 2.2
 */
protected WebClientBuilder webClientBuilder(VaultEndpointProvider endpointProvider,
		ClientHttpConnector httpConnector) {
	return webClientBuilder(ReactiveVaultClients.wrap(endpointProvider), httpConnector);
}
 

/**
 * @return a {@link VaultEndpointProvider} returning the value of
 * {@link #vaultEndpoint()}.
 * @since 1.1
 */
public VaultEndpointProvider vaultEndpointProvider() {
	return SimpleVaultEndpointProvider.of(vaultEndpoint());
}