Spring Vault

Spring Vault provides client-side support for accessing, storing and revoking secrets. With HashiCorp Vault you have a central place to manage external secret data for applications across all environments. Vault can manage static and dynamic secrets such as application data, username/password for remote applications/resources and provide credentials for external services such as MySQL, PostgreSQL, Apache Cassandra, Consul, AWS and more.

Our primary goals are:

• Provide a Java configuration model for the Vault client, including SSL and proxy support.

• Provide imperative and reactive VaultTemplate implementations to read, write and delete secrets and to work with secrets engines such as Key/Value, Transit and PKI.

• Support Vault authentication methods including Token, AppRole, AWS, Azure, GCP, Kubernetes, JWT, TLS certificates and Cubbyhole.

• Expose secrets as Spring Environment properties through @VaultPropertySource.

• Renew and rotate leased secrets transparently.

Installation and Getting Started

The reference documentation includes a getting started guide and describes the dependencies to add to your build.

Add the Maven dependency:

<dependency>
  <groupId>org.springframework.vault</groupId>
  <artifactId>spring-vault-core</artifactId>
  <version>${version}</version>
</dependency>

Releases and milestones are available from Maven Central. Snapshots of upcoming versions are available from the Spring snapshot repository.

Here is a quick teaser of a Spring Vault configuration and a component that reads and writes secrets through VaultTemplate:

@Configuration
public class AppConfig extends AbstractVaultConfiguration {

	@Override
	public VaultEndpoint vaultEndpoint() {
		return VaultEndpoint.create("localhost", 8200);
	}

	@Override
	public ClientAuthentication clientAuthentication() {
		return new TokenAuthentication("…");
	}

}

@Component
public class SecretsClient {

	private final VaultOperations vaultOperations;

	public SecretsClient(VaultOperations vaultOperations) {
		this.vaultOperations = vaultOperations;
	}

	public void useVault() {

		vaultOperations.write("secret/myapp", new Secrets("hello", "world"));

		VaultResponseSupport<Secrets> response = vaultOperations.read("secret/myapp", Secrets.class);
		System.out.println(response.getRequiredData().username());

		vaultOperations.delete("secret/myapp");
	}

	record Secrets(String username, String password) {
	}

}

Spring Boot users can use Spring Cloud Vault, which builds on Spring Vault to provide auto-configuration and Vault-backed configuration properties.

Getting Help

Are you having trouble with Spring Vault? We want to help!

• Check the reference documentation and the Javadoc.

• Learn the Vault basics — Spring Vault builds on HashiCorp Vault; the Vault documentation explains secrets engines, authentication methods and leases.

• If you are upgrading, read the release notes for upgrade instructions and "new and noteworthy" features.

• Ask a question — we monitor stackoverflow.com for questions tagged with spring-vault.

• Report bugs with Spring Vault at github.com/spring-projects/spring-vault/issues.

Contributing

We welcome contributions of all kinds! Please read our contribution guidelines before submitting a pull request.

Reporting Issues

Spring Vault uses GitHub’s integrated issue tracking system to record bugs and feature requests. If you want to raise an issue, please follow the recommendations below:

• Before you log a bug, please search the issue tracker to see if someone has already reported the problem.

• If the issue doesn’t already exist, create a new issue.

• Please provide as much information as possible with the issue report. We like to know the Spring Vault version, the Vault server version, operating system, and JVM version you’re using.

• If you need to paste code or include a stack trace, use Markdown. ``` escapes before and after your text.

• If possible, try to create a test case or project that replicates the problem and attach it to the issue.

Building from Source

You don’t need to build from source to use Spring Vault. If you want to try out the latest and greatest, Spring Vault can be built and installed into your local Maven cache using the Maven wrapper. You also need JDK 17.

$ ./mvnw install -DskipTests

This command builds all modules and installs them into your local Maven cache. It won’t run any of the tests. The integration tests require a Vault server listening on localhost:8200. The scripts in src/test/bash download, configure and start one for you. If you want to build everything, start Vault and run the full build:

$ ./src/test/bash/start.sh
$ ./mvnw install

See Working with the Code on the wiki for details on the Vault setup, building the documentation, and IDE configuration.

License

Spring Vault is Open Source software released under the Apache 2.0 license.