使用微服务 AppRole 到 Spring 云配置服务器和 Vault 集成

Question

How to connect a Microservice with AppRole[in vault] to Spring Cloud Config Server with Vault backend.

I can see examples using the root token like curl -X GET http://localhost:8888/my-service/default -H "X-Config-Token: s.TmqaRA2lASdNhJZqqZy7y8pX". But I could not find any example that use approle to connect spring cloud config service.

But I do not want pass root token from micro services to spring cloud config server, instead each service will have app role defined which should be able to connect the spring cloud config which in turn connect to Vault and get data.

Answer 1

I had the same issue when using a Spring Cloud Config Server as a central configuration broker.

I found the followingGitHub issue which provided a solution. In short you have to add the spring-vault-core dependency to your dependencies in order to add a valid token resolver for the AppRole authentication:

Maven:

<dependency>
    <groupId>org.springframework.vault</groupId>
    <artifactId>spring-vault-core</artifactId>
</dependency>

Gradle:

implementation "org.springframework.vault:spring-vault-core"

This should fix the issue directly. Of course the following configuration has to bet set then:

spring:
  cloud:
    config:
      server:
        vault:
          port: 443
          host: myvault.domain.com
          scheme: https
          backend: mybackend
          kv-version: 2 #required if secrets engine version is v2 (default: v1/1)
          timeout: 5 #seconds
          authentication: APPROLE
          app-role:
            secret-id: 1234567-234567-23456-12341
            role-id: 987654-3456-9865-1235
            role: my-role-name #optional
            app-role-path: approle #optional if non default (default: approle)

After adding the dependency, configuring and starting the service, the following log message appears:

2021-04-30 12:40:31.211 INFO 53327 --- [nio-8888-exec-2] osvaLifecycleAwareSessionManager: Scheduling Token renewal

The X-Config-Token header is then not required anymore.

For more information regardin the Vault setup, visit:

1. AppRole Auth Method
2. Setting up the AppRole auth method for a service