I am currently working on a spring boot microservice application, with a centralized config via the spring cloud config server so that many clients (as services) can access their property files from the spring cloud config server. I decided to secure access to the config server (via spring security with credentials stored in a database). I also saved all database connection details (usernames, passwords, etc for the services), and other login credentials in Hashicorp Vault and was able to connect the spring cloud config server to vault. However, I am not able to login each config client to the config server using the corresponding credentials for each client via Vault. For the config server, the application.yml
is:
spring:
profiles:
active: git, vault
data:
mongodb:
uri: mongodb+srv://${DB_NAME}:${DB_PASS}@myMongoHost
application:
name: config-server
cloud:
config:
username: ${CONFIG_SERVER_USERNAME}
password: ${CONFIG_SERVER_PASSWORD}
server:
vault:
host: 127.0.0.1
port: 8200
scheme: http
authentication: TOKEN
token:
order: 1
# kv:
# enabled: true
profile-separator: '/'
backend: secret
kvVersion: 2
git:
uri: https://github.com/my-config-server
default-label: main
username: ${GIT_USER}
password: ${GIT_PASSWORD}
order: 2
For a given client, the application.yml
as follows:
spring:
application:
name: configclient
while the bootstrap.yml
for the config client is given by:
spring:
application:
name: configclient
cloud:
config:
token: mytoken
# uri: http://localhost:8888
config:
import: configserver:http://${CONFIG_SERVER_USERNAME}:{CONFIG_SERVER_PASSWORD}@${app.config-server.host}:${app.config-server.port}
The login credentials for the configclient is saved using a key/value pair in Vault as follows:
{
CONFIG_SERVER_USERNAME: myConfigServerUsername
CONFIG_SERVER_PASSWORD: myPassword
}
It is not possible to load the properties for each client using
${CONFIG_SERVER_USERNAME}:${CONFIG_SERVER_PASSWORD}@${app.config-server.host}:${app.config-server.port}
But the client was able to connect and fetch its properties when I replaced the above connection url with
myConfigServerUsername:myPassword@${app.config-server.host}:${app.config-server.port}
My question is: how can I get the clients to connect to the config-server using credentials stored in Vault using ${CONFIG_SERVER_USERNAME}
and ${CONFIG_SERVER_PASSWORD}
instead of hard coding the username and password into the either the config server or the configclient's application.yml
or bootstrap.yml
file? Any help will be appreciated.