How can I Login to spring cloud Config Server using Hashicorp vault?

82 Views Asked by At

I am currently working on a spring boot microservice application, with a centralized config via the spring cloud config server so that many clients (as services) can access their property files from the spring cloud config server. I decided to secure access to the config server (via spring security with credentials stored in a database). I also saved all database connection details (usernames, passwords, etc for the services), and other login credentials in Hashicorp Vault and was able to connect the spring cloud config server to vault. However, I am not able to login each config client to the config server using the corresponding credentials for each client via Vault. For the config server, the application.yml is:

spring:
    profiles:
        active: git, vault
    
    data:
        mongodb:
            uri: mongodb+srv://${DB_NAME}:${DB_PASS}@myMongoHost

    application:
        name: config-server
    cloud:
        config:
            username: ${CONFIG_SERVER_USERNAME}
            password: ${CONFIG_SERVER_PASSWORD}
            server:
                vault:
                    host: 127.0.0.1
                    port: 8200
                    scheme: http
                    authentication: TOKEN
                    token: 
                    order: 1
                    # kv:
                    # enabled: true
                    profile-separator: '/'
                    backend: secret
                    kvVersion: 2
                git:
                    uri: https://github.com/my-config-server
                    default-label: main
                    username: ${GIT_USER}
                    password: ${GIT_PASSWORD}
                    order: 2

For a given client, the application.yml as follows:

spring:
    application:
        name: configclient

while the bootstrap.ymlfor the config client is given by:

spring:
  application:
    name: configclient
  cloud:
    config:
      token: mytoken
      # uri: http://localhost:8888
  config:
  
      import: configserver:http://${CONFIG_SERVER_USERNAME}:{CONFIG_SERVER_PASSWORD}@${app.config-server.host}:${app.config-server.port}

The login credentials for the configclient is saved using a key/value pair in Vault as follows:

{
CONFIG_SERVER_USERNAME: myConfigServerUsername
CONFIG_SERVER_PASSWORD: myPassword 
}

It is not possible to load the properties for each client using

${CONFIG_SERVER_USERNAME}:${CONFIG_SERVER_PASSWORD}@${app.config-server.host}:${app.config-server.port}

But the client was able to connect and fetch its properties when I replaced the above connection url with

myConfigServerUsername:myPassword@${app.config-server.host}:${app.config-server.port}

My question is: how can I get the clients to connect to the config-server using credentials stored in Vault using ${CONFIG_SERVER_USERNAME} and ${CONFIG_SERVER_PASSWORD} instead of hard coding the username and password into the either the config server or the configclient's application.yml or bootstrap.yml file? Any help will be appreciated.

0

There are 0 best solutions below