├── .gitignore ├── LICENSE ├── README.md ├── build.gradle.kts ├── env-scripts ├── configure_db_in_vault.sh ├── db_init.sql ├── init_db.sh ├── run.sh ├── start_vault.sh ├── stop.sh └── vault.hcl ├── gradle └── wrapper │ ├── gradle-wrapper.jar │ └── gradle-wrapper.properties ├── gradlew ├── gradlew.bat ├── settings.gradle.kts ├── src └── main │ ├── kotlin │ └── com │ │ └── secrets_as_a_service │ │ └── springvaultdatabaserotate │ │ ├── Application.kt │ │ ├── config │ │ └── VaultConfig.kt │ │ ├── controller │ │ └── Controller.kt │ │ ├── entity │ │ └── Customer.kt │ │ └── repository │ │ └── UserRepository.kt │ └── resources │ ├── application.yml │ └── bootstrap.yml └── vault.env /.gitignore: -------------------------------------------------------------------------------- 1 | .gradle 2 | build/ 3 | !gradle/wrapper/gradle-wrapper.jar 4 | !**/src/main/** 5 | !**/src/test/** 6 | 7 | ### STS ### 8 | .apt_generated 9 | .classpath 10 | .factorypath 11 | .project 12 | .settings 13 | .springBeans 14 | .sts4-cache 15 | 16 | ### IntelliJ IDEA ### 17 | .idea 18 | *.iws 19 | *.iml 20 | *.ipr 21 | out/ 22 | 23 | ### NetBeans ### 24 | /nbproject/private/ 25 | /nbbuild/ 26 | /dist/ 27 | /nbdist/ 28 | /.nb-gradle/ 29 | 30 | ### VS Code ### 31 | .vscode/ 32 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | Apache License 2 | Version 2.0, January 2004 3 | http://www.apache.org/licenses/ 4 | 5 | TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION 6 | 7 | 1. Definitions. 8 | 9 | "License" shall mean the terms and conditions for use, reproduction, 10 | and distribution as defined by Sections 1 through 9 of this document. 11 | 12 | "Licensor" shall mean the copyright owner or entity authorized by 13 | the copyright owner that is granting the License. 14 | 15 | "Legal Entity" shall mean the union of the acting entity and all 16 | other entities that control, are controlled by, or are under common 17 | control with that entity. For the purposes of this definition, 18 | "control" means (i) the power, direct or indirect, to cause the 19 | direction or management of such entity, whether by contract or 20 | otherwise, or (ii) ownership of fifty percent (50%) or more of the 21 | outstanding shares, or (iii) beneficial ownership of such entity. 22 | 23 | "You" (or "Your") shall mean an individual or Legal Entity 24 | exercising permissions granted by this License. 25 | 26 | "Source" form shall mean the preferred form for making modifications, 27 | including but not limited to software source code, documentation 28 | source, and configuration files. 29 | 30 | "Object" form shall mean any form resulting from mechanical 31 | transformation or translation of a Source form, including but 32 | not limited to compiled object code, generated documentation, 33 | and conversions to other media types. 34 | 35 | "Work" shall mean the work of authorship, whether in Source or 36 | Object form, made available under the License, as indicated by a 37 | copyright notice that is included in or attached to the work 38 | (an example is provided in the Appendix below). 39 | 40 | "Derivative Works" shall mean any work, whether in Source or Object 41 | form, that is based on (or derived from) the Work and for which the 42 | editorial revisions, annotations, elaborations, or other modifications 43 | represent, as a whole, an original work of authorship. For the purposes 44 | of this License, Derivative Works shall not include works that remain 45 | separable from, or merely link (or bind by name) to the interfaces of, 46 | the Work and Derivative Works thereof. 47 | 48 | "Contribution" shall mean any work of authorship, including 49 | the original version of the Work and any modifications or additions 50 | to that Work or Derivative Works thereof, that is intentionally 51 | submitted to Licensor for inclusion in the Work by the copyright owner 52 | or by an individual or Legal Entity authorized to submit on behalf of 53 | the copyright owner. For the purposes of this definition, "submitted" 54 | means any form of electronic, verbal, or written communication sent 55 | to the Licensor or its representatives, including but not limited to 56 | communication on electronic mailing lists, source code control systems, 57 | and issue tracking systems that are managed by, or on behalf of, the 58 | Licensor for the purpose of discussing and improving the Work, but 59 | excluding communication that is conspicuously marked or otherwise 60 | designated in writing by the copyright owner as "Not a Contribution." 61 | 62 | "Contributor" shall mean Licensor and any individual or Legal Entity 63 | on behalf of whom a Contribution has been received by Licensor and 64 | subsequently incorporated within the Work. 65 | 66 | 2. Grant of Copyright License. Subject to the terms and conditions of 67 | this License, each Contributor hereby grants to You a perpetual, 68 | worldwide, non-exclusive, no-charge, royalty-free, irrevocable 69 | copyright license to reproduce, prepare Derivative Works of, 70 | publicly display, publicly perform, sublicense, and distribute the 71 | Work and such Derivative Works in Source or Object form. 72 | 73 | 3. Grant of Patent License. Subject to the terms and conditions of 74 | this License, each Contributor hereby grants to You a perpetual, 75 | worldwide, non-exclusive, no-charge, royalty-free, irrevocable 76 | (except as stated in this section) patent license to make, have made, 77 | use, offer to sell, sell, import, and otherwise transfer the Work, 78 | where such license applies only to those patent claims licensable 79 | by such Contributor that are necessarily infringed by their 80 | Contribution(s) alone or by combination of their Contribution(s) 81 | with the Work to which such Contribution(s) was submitted. If You 82 | institute patent litigation against any entity (including a 83 | cross-claim or counterclaim in a lawsuit) alleging that the Work 84 | or a Contribution incorporated within the Work constitutes direct 85 | or contributory patent infringement, then any patent licenses 86 | granted to You under this License for that Work shall terminate 87 | as of the date such litigation is filed. 88 | 89 | 4. Redistribution. You may reproduce and distribute copies of the 90 | Work or Derivative Works thereof in any medium, with or without 91 | modifications, and in Source or Object form, provided that You 92 | meet the following conditions: 93 | 94 | (a) You must give any other recipients of the Work or 95 | Derivative Works a copy of this License; and 96 | 97 | (b) You must cause any modified files to carry prominent notices 98 | stating that You changed the files; and 99 | 100 | (c) You must retain, in the Source form of any Derivative Works 101 | that You distribute, all copyright, patent, trademark, and 102 | attribution notices from the Source form of the Work, 103 | excluding those notices that do not pertain to any part of 104 | the Derivative Works; and 105 | 106 | (d) If the Work includes a "NOTICE" text file as part of its 107 | distribution, then any Derivative Works that You distribute must 108 | include a readable copy of the attribution notices contained 109 | within such NOTICE file, excluding those notices that do not 110 | pertain to any part of the Derivative Works, in at least one 111 | of the following places: within a NOTICE text file distributed 112 | as part of the Derivative Works; within the Source form or 113 | documentation, if provided along with the Derivative Works; or, 114 | within a display generated by the Derivative Works, if and 115 | wherever such third-party notices normally appear. The contents 116 | of the NOTICE file are for informational purposes only and 117 | do not modify the License. You may add Your own attribution 118 | notices within Derivative Works that You distribute, alongside 119 | or as an addendum to the NOTICE text from the Work, provided 120 | that such additional attribution notices cannot be construed 121 | as modifying the License. 122 | 123 | You may add Your own copyright statement to Your modifications and 124 | may provide additional or different license terms and conditions 125 | for use, reproduction, or distribution of Your modifications, or 126 | for any such Derivative Works as a whole, provided Your use, 127 | reproduction, and distribution of the Work otherwise complies with 128 | the conditions stated in this License. 129 | 130 | 5. Submission of Contributions. Unless You explicitly state otherwise, 131 | any Contribution intentionally submitted for inclusion in the Work 132 | by You to the Licensor shall be under the terms and conditions of 133 | this License, without any additional terms or conditions. 134 | Notwithstanding the above, nothing herein shall supersede or modify 135 | the terms of any separate license agreement you may have executed 136 | with Licensor regarding such Contributions. 137 | 138 | 6. Trademarks. This License does not grant permission to use the trade 139 | names, trademarks, service marks, or product names of the Licensor, 140 | except as required for reasonable and customary use in describing the 141 | origin of the Work and reproducing the content of the NOTICE file. 142 | 143 | 7. Disclaimer of Warranty. Unless required by applicable law or 144 | agreed to in writing, Licensor provides the Work (and each 145 | Contributor provides its Contributions) on an "AS IS" BASIS, 146 | WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or 147 | implied, including, without limitation, any warranties or conditions 148 | of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A 149 | PARTICULAR PURPOSE. You are solely responsible for determining the 150 | appropriateness of using or redistributing the Work and assume any 151 | risks associated with Your exercise of permissions under this License. 152 | 153 | 8. Limitation of Liability. In no event and under no legal theory, 154 | whether in tort (including negligence), contract, or otherwise, 155 | unless required by applicable law (such as deliberate and grossly 156 | negligent acts) or agreed to in writing, shall any Contributor be 157 | liable to You for damages, including any direct, indirect, special, 158 | incidental, or consequential damages of any character arising as a 159 | result of this License or out of the use or inability to use the 160 | Work (including but not limited to damages for loss of goodwill, 161 | work stoppage, computer failure or malfunction, or any and all 162 | other commercial damages or losses), even if such Contributor 163 | has been advised of the possibility of such damages. 164 | 165 | 9. Accepting Warranty or Additional Liability. While redistributing 166 | the Work or Derivative Works thereof, You may choose to offer, 167 | and charge a fee for, acceptance of support, warranty, indemnity, 168 | or other liability obligations and/or rights consistent with this 169 | License. However, in accepting such obligations, You may act only 170 | on Your own behalf and on Your sole responsibility, not on behalf 171 | of any other Contributor, and only if You agree to indemnify, 172 | defend, and hold each Contributor harmless for any liability 173 | incurred by, or claims asserted against, such Contributor by reason 174 | of your accepting any such warranty or additional liability. 175 | 176 | END OF TERMS AND CONDITIONS 177 | 178 | APPENDIX: How to apply the Apache License to your work. 179 | 180 | To apply the Apache License to your work, attach the following 181 | boilerplate notice, with the fields enclosed by brackets "[]" 182 | replaced with your own identifying information. (Don't include 183 | the brackets!) The text should be enclosed in the appropriate 184 | comment syntax for the file format. We also recommend that a 185 | file or class name and description of purpose be included on the 186 | same "printed page" as the copyright notice for easier 187 | identification within third-party archives. 188 | 189 | Copyright 2020 Balthasar Biedermann 190 | 191 | Licensed under the Apache License, Version 2.0 (the "License"); 192 | you may not use this file except in compliance with the License. 193 | You may obtain a copy of the License at 194 | 195 | http://www.apache.org/licenses/LICENSE-2.0 196 | 197 | Unless required by applicable law or agreed to in writing, software 198 | distributed under the License is distributed on an "AS IS" BASIS, 199 | WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 200 | See the License for the specific language governing permissions and 201 | limitations under the License. 202 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # Rotate dynamic relational database credentials of a Spring Boot app when the Hashicorp Vault `max_ttl` expires 2 | 3 | This code example is used in my blog post 4 | [Heavy Rotation of Relational Hashicorp Vault Database Secrets in Spring](https://secrets-as-a-service.com/posts/hashicorp-vault/rotate-dynamic-relational-database-connection-in-spring-at-runtime/) 5 | on https://secrets-as-a-service.com/. 6 | 7 | It ensures that the Spring Boot application is rotating the the dynamic database credentials, whenever they expire. 8 | This approach only works for relational databases using HikariCP as connection pool, which only supports JDBC. -------------------------------------------------------------------------------- /build.gradle.kts: -------------------------------------------------------------------------------- 1 | import org.jetbrains.kotlin.gradle.tasks.KotlinCompile 2 | 3 | //tag::plugins[] 4 | plugins { 5 | //tag::ignore_plugins[] 6 | id("se.patrikerdes.use-latest-versions") version "0.2.13" 7 | id("com.github.ben-manes.versions") version "0.28.0" 8 | kotlin("jvm") version "1.3.61" 9 | kotlin("plugin.spring") version "1.3.61" 10 | kotlin("plugin.jpa") version "1.3.61" 11 | 12 | //end::ignore_plugins[] 13 | id("org.springframework.boot") version "2.2.4.RELEASE" // <1> 14 | id("io.spring.dependency-management") version "1.0.9.RELEASE" // <2> 15 | } 16 | 17 | //end::plugins[] 18 | 19 | group = "com.secrets_as_a_service.blog" 20 | version = "0.0.1" 21 | java.sourceCompatibility = JavaVersion.VERSION_1_8 22 | 23 | repositories { 24 | mavenCentral() 25 | } 26 | 27 | extra["springCloudVersion"] = "Hoxton.SR1" 28 | 29 | //tag::dependencies[] 30 | dependencies { 31 | implementation("org.springframework.boot:spring-boot-starter-data-jpa") // <3> 32 | //tag::ignore_dependencies[] 33 | implementation("org.springframework.boot:spring-boot-starter-web") 34 | implementation("org.springframework.cloud:spring-cloud-vault-config-databases") 35 | implementation("org.jetbrains.kotlin:kotlin-stdlib-jdk8") 36 | implementation("com.fasterxml.jackson.module:jackson-module-kotlin") 37 | implementation(group = "io.github.microutils", name = "kotlin-logging", version = "1.7.8") 38 | //end::ignore_dependencies[] 39 | runtimeOnly("org.postgresql:postgresql") // <4> 40 | } 41 | //end::dependencies[] 42 | 43 | dependencyManagement { 44 | imports { 45 | mavenBom("org.springframework.cloud:spring-cloud-dependencies:${property("springCloudVersion")}") 46 | } 47 | } 48 | 49 | tasks.withType { 50 | useJUnitPlatform() 51 | } 52 | 53 | tasks.withType { 54 | kotlinOptions { 55 | freeCompilerArgs = listOf("-Xjsr305=strict") 56 | jvmTarget = "1.8" 57 | } 58 | } 59 | -------------------------------------------------------------------------------- /env-scripts/configure_db_in_vault.sh: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | 3 | . ../vault.env 4 | 5 | echo '### Enabling db plugin' 6 | vault secrets enable database 7 | echo '### Configuring postgres' 8 | vault write database/config/postgres plugin_name=postgresql-database-plugin allowed_roles="readonly" \ 9 | connection_url="postgresql://{{username}}:{{password}}@localhost:5432/?sslmode=disable" username="testuser" \ 10 | password="testpassword" 11 | echo '### Create "readonly" db role' 12 | vault write database/roles/readonly db_name=postgres \ 13 | creation_statements="CREATE ROLE \"{{name}}\" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}'; \ 14 | GRANT SELECT ON ALL TABLES IN SCHEMA public TO \"{{name}}\";" default_ttl="15" max_ttl="30" -------------------------------------------------------------------------------- /env-scripts/db_init.sql: -------------------------------------------------------------------------------- 1 | CREATE TABLE customer (id INTEGER PRIMARY KEY, name VARCHAR, address VARCHAR); 2 | INSERT INTO customer VALUES (1, 'Ford Prefect', 'Betelgeuse Five'); 3 | INSERT INTO customer VALUES (2, 'Tricia Marie McMillan', 'Earth'); -------------------------------------------------------------------------------- /env-scripts/init_db.sh: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | 3 | echo "Starting postgres container" 4 | docker run --rm --name postgres -p5432:5432 -e POSTGRES_PASSWORD=testpassword -e POSTGRES_USER=testuser -d postgres:12.1 5 | 6 | echo "Waiting Postgres to launch ..." 7 | #while ! pg_isready -h localhost -U testuser >/dev/null; do 8 | while ! docker exec postgres pg_isready -h localhost -U testuser ; do 9 | sleep 0.1 10 | done 11 | 12 | echo "Initialize table" 13 | export PGPASSWORD=testpassword 14 | psql -h localhost -U testuser -f db_init.sql 15 | -------------------------------------------------------------------------------- /env-scripts/run.sh: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | 3 | echo '### Stopping environment' 4 | ./stop.sh 5 | echo '### Starting vault' 6 | ./start_vault.sh & 7 | 8 | echo "Waiting Vault to launch on 8080..." 9 | while ! nc -z localhost 8200; do 10 | sleep 0.1 11 | done 12 | 13 | echo '### Initialize the DB' 14 | ./init_db.sh 15 | echo '### Configure the database secrets plugin in vault' 16 | ./configure_db_in_vault.sh 17 | -------------------------------------------------------------------------------- /env-scripts/start_vault.sh: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | 3 | vault server --dev --dev-root-token-id="00000000-0000-0000-0000-000000000000" 4 | #vault server -config vault.hcl -------------------------------------------------------------------------------- /env-scripts/stop.sh: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | 3 | killall vault 4 | docker stop postgres -------------------------------------------------------------------------------- /env-scripts/vault.hcl: -------------------------------------------------------------------------------- 1 | storage "file" { 2 | path = "./vault-storage" 3 | } 4 | 5 | listener "tcp" { 6 | address = "127.0.0.1:8200" 7 | tls_disable = 1 8 | } 9 | 10 | max_lease_ttl = "3000h" -------------------------------------------------------------------------------- /gradle/wrapper/gradle-wrapper.jar: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/usr42/spring-vault-database-rotate/0f4718b9ea59b7d0bd66364c303b0abf90b28a45/gradle/wrapper/gradle-wrapper.jar -------------------------------------------------------------------------------- /gradle/wrapper/gradle-wrapper.properties: -------------------------------------------------------------------------------- 1 | distributionBase=GRADLE_USER_HOME 2 | distributionPath=wrapper/dists 3 | distributionUrl=https\://services.gradle.org/distributions/gradle-6.2-all.zip 4 | zipStoreBase=GRADLE_USER_HOME 5 | zipStorePath=wrapper/dists 6 | -------------------------------------------------------------------------------- /gradlew: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env sh 2 | 3 | # 4 | # Copyright 2015 the original author or authors. 5 | # 6 | # Licensed under the Apache License, Version 2.0 (the "License"); 7 | # you may not use this file except in compliance with the License. 8 | # You may obtain a copy of the License at 9 | # 10 | # https://www.apache.org/licenses/LICENSE-2.0 11 | # 12 | # Unless required by applicable law or agreed to in writing, software 13 | # distributed under the License is distributed on an "AS IS" BASIS, 14 | # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 15 | # See the License for the specific language governing permissions and 16 | # limitations under the License. 17 | # 18 | 19 | ############################################################################## 20 | ## 21 | ## Gradle start up script for UN*X 22 | ## 23 | ############################################################################## 24 | 25 | # Attempt to set APP_HOME 26 | # Resolve links: $0 may be a link 27 | PRG="$0" 28 | # Need this for relative symlinks. 29 | while [ -h "$PRG" ] ; do 30 | ls=`ls -ld "$PRG"` 31 | link=`expr "$ls" : '.*-> \(.*\)$'` 32 | if expr "$link" : '/.*' > /dev/null; then 33 | PRG="$link" 34 | else 35 | PRG=`dirname "$PRG"`"/$link" 36 | fi 37 | done 38 | SAVED="`pwd`" 39 | cd "`dirname \"$PRG\"`/" >/dev/null 40 | APP_HOME="`pwd -P`" 41 | cd "$SAVED" >/dev/null 42 | 43 | APP_NAME="Gradle" 44 | APP_BASE_NAME=`basename "$0"` 45 | 46 | # Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script. 47 | DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"' 48 | 49 | # Use the maximum available, or set MAX_FD != -1 to use that value. 50 | MAX_FD="maximum" 51 | 52 | warn () { 53 | echo "$*" 54 | } 55 | 56 | die () { 57 | echo 58 | echo "$*" 59 | echo 60 | exit 1 61 | } 62 | 63 | # OS specific support (must be 'true' or 'false'). 64 | cygwin=false 65 | msys=false 66 | darwin=false 67 | nonstop=false 68 | case "`uname`" in 69 | CYGWIN* ) 70 | cygwin=true 71 | ;; 72 | Darwin* ) 73 | darwin=true 74 | ;; 75 | MINGW* ) 76 | msys=true 77 | ;; 78 | NONSTOP* ) 79 | nonstop=true 80 | ;; 81 | esac 82 | 83 | CLASSPATH=$APP_HOME/gradle/wrapper/gradle-wrapper.jar 84 | 85 | # Determine the Java command to use to start the JVM. 86 | if [ -n "$JAVA_HOME" ] ; then 87 | if [ -x "$JAVA_HOME/jre/sh/java" ] ; then 88 | # IBM's JDK on AIX uses strange locations for the executables 89 | JAVACMD="$JAVA_HOME/jre/sh/java" 90 | else 91 | JAVACMD="$JAVA_HOME/bin/java" 92 | fi 93 | if [ ! -x "$JAVACMD" ] ; then 94 | die "ERROR: JAVA_HOME is set to an invalid directory: $JAVA_HOME 95 | 96 | Please set the JAVA_HOME variable in your environment to match the 97 | location of your Java installation." 98 | fi 99 | else 100 | JAVACMD="java" 101 | which java >/dev/null 2>&1 || die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH. 102 | 103 | Please set the JAVA_HOME variable in your environment to match the 104 | location of your Java installation." 105 | fi 106 | 107 | # Increase the maximum file descriptors if we can. 108 | if [ "$cygwin" = "false" -a "$darwin" = "false" -a "$nonstop" = "false" ] ; then 109 | MAX_FD_LIMIT=`ulimit -H -n` 110 | if [ $? -eq 0 ] ; then 111 | if [ "$MAX_FD" = "maximum" -o "$MAX_FD" = "max" ] ; then 112 | MAX_FD="$MAX_FD_LIMIT" 113 | fi 114 | ulimit -n $MAX_FD 115 | if [ $? -ne 0 ] ; then 116 | warn "Could not set maximum file descriptor limit: $MAX_FD" 117 | fi 118 | else 119 | warn "Could not query maximum file descriptor limit: $MAX_FD_LIMIT" 120 | fi 121 | fi 122 | 123 | # For Darwin, add options to specify how the application appears in the dock 124 | if $darwin; then 125 | GRADLE_OPTS="$GRADLE_OPTS \"-Xdock:name=$APP_NAME\" \"-Xdock:icon=$APP_HOME/media/gradle.icns\"" 126 | fi 127 | 128 | # For Cygwin or MSYS, switch paths to Windows format before running java 129 | if [ "$cygwin" = "true" -o "$msys" = "true" ] ; then 130 | APP_HOME=`cygpath --path --mixed "$APP_HOME"` 131 | CLASSPATH=`cygpath --path --mixed "$CLASSPATH"` 132 | JAVACMD=`cygpath --unix "$JAVACMD"` 133 | 134 | # We build the pattern for arguments to be converted via cygpath 135 | ROOTDIRSRAW=`find -L / -maxdepth 1 -mindepth 1 -type d 2>/dev/null` 136 | SEP="" 137 | for dir in $ROOTDIRSRAW ; do 138 | ROOTDIRS="$ROOTDIRS$SEP$dir" 139 | SEP="|" 140 | done 141 | OURCYGPATTERN="(^($ROOTDIRS))" 142 | # Add a user-defined pattern to the cygpath arguments 143 | if [ "$GRADLE_CYGPATTERN" != "" ] ; then 144 | OURCYGPATTERN="$OURCYGPATTERN|($GRADLE_CYGPATTERN)" 145 | fi 146 | # Now convert the arguments - kludge to limit ourselves to /bin/sh 147 | i=0 148 | for arg in "$@" ; do 149 | CHECK=`echo "$arg"|egrep -c "$OURCYGPATTERN" -` 150 | CHECK2=`echo "$arg"|egrep -c "^-"` ### Determine if an option 151 | 152 | if [ $CHECK -ne 0 ] && [ $CHECK2 -eq 0 ] ; then ### Added a condition 153 | eval `echo args$i`=`cygpath --path --ignore --mixed "$arg"` 154 | else 155 | eval `echo args$i`="\"$arg\"" 156 | fi 157 | i=$((i+1)) 158 | done 159 | case $i in 160 | (0) set -- ;; 161 | (1) set -- "$args0" ;; 162 | (2) set -- "$args0" "$args1" ;; 163 | (3) set -- "$args0" "$args1" "$args2" ;; 164 | (4) set -- "$args0" "$args1" "$args2" "$args3" ;; 165 | (5) set -- "$args0" "$args1" "$args2" "$args3" "$args4" ;; 166 | (6) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" ;; 167 | (7) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" ;; 168 | (8) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" "$args7" ;; 169 | (9) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" "$args7" "$args8" ;; 170 | esac 171 | fi 172 | 173 | # Escape application args 174 | save () { 175 | for i do printf %s\\n "$i" | sed "s/'/'\\\\''/g;1s/^/'/;\$s/\$/' \\\\/" ; done 176 | echo " " 177 | } 178 | APP_ARGS=$(save "$@") 179 | 180 | # Collect all arguments for the java command, following the shell quoting and substitution rules 181 | eval set -- $DEFAULT_JVM_OPTS $JAVA_OPTS $GRADLE_OPTS "\"-Dorg.gradle.appname=$APP_BASE_NAME\"" -classpath "\"$CLASSPATH\"" org.gradle.wrapper.GradleWrapperMain "$APP_ARGS" 182 | 183 | # by default we should be in the correct project dir, but when run from Finder on Mac, the cwd is wrong 184 | if [ "$(uname)" = "Darwin" ] && [ "$HOME" = "$PWD" ]; then 185 | cd "$(dirname "$0")" 186 | fi 187 | 188 | exec "$JAVACMD" "$@" 189 | -------------------------------------------------------------------------------- /gradlew.bat: -------------------------------------------------------------------------------- 1 | @rem 2 | @rem Copyright 2015 the original author or authors. 3 | @rem 4 | @rem Licensed under the Apache License, Version 2.0 (the "License"); 5 | @rem you may not use this file except in compliance with the License. 6 | @rem You may obtain a copy of the License at 7 | @rem 8 | @rem https://www.apache.org/licenses/LICENSE-2.0 9 | @rem 10 | @rem Unless required by applicable law or agreed to in writing, software 11 | @rem distributed under the License is distributed on an "AS IS" BASIS, 12 | @rem WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 | @rem See the License for the specific language governing permissions and 14 | @rem limitations under the License. 15 | @rem 16 | 17 | @if "%DEBUG%" == "" @echo off 18 | @rem ########################################################################## 19 | @rem 20 | @rem Gradle startup script for Windows 21 | @rem 22 | @rem ########################################################################## 23 | 24 | @rem Set local scope for the variables with windows NT shell 25 | if "%OS%"=="Windows_NT" setlocal 26 | 27 | set DIRNAME=%~dp0 28 | if "%DIRNAME%" == "" set DIRNAME=. 29 | set APP_BASE_NAME=%~n0 30 | set APP_HOME=%DIRNAME% 31 | 32 | @rem Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script. 33 | set DEFAULT_JVM_OPTS="-Xmx64m" "-Xms64m" 34 | 35 | @rem Find java.exe 36 | if defined JAVA_HOME goto findJavaFromJavaHome 37 | 38 | set JAVA_EXE=java.exe 39 | %JAVA_EXE% -version >NUL 2>&1 40 | if "%ERRORLEVEL%" == "0" goto init 41 | 42 | echo. 43 | echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH. 44 | echo. 45 | echo Please set the JAVA_HOME variable in your environment to match the 46 | echo location of your Java installation. 47 | 48 | goto fail 49 | 50 | :findJavaFromJavaHome 51 | set JAVA_HOME=%JAVA_HOME:"=% 52 | set JAVA_EXE=%JAVA_HOME%/bin/java.exe 53 | 54 | if exist "%JAVA_EXE%" goto init 55 | 56 | echo. 57 | echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME% 58 | echo. 59 | echo Please set the JAVA_HOME variable in your environment to match the 60 | echo location of your Java installation. 61 | 62 | goto fail 63 | 64 | :init 65 | @rem Get command-line arguments, handling Windows variants 66 | 67 | if not "%OS%" == "Windows_NT" goto win9xME_args 68 | 69 | :win9xME_args 70 | @rem Slurp the command line arguments. 71 | set CMD_LINE_ARGS= 72 | set _SKIP=2 73 | 74 | :win9xME_args_slurp 75 | if "x%~1" == "x" goto execute 76 | 77 | set CMD_LINE_ARGS=%* 78 | 79 | :execute 80 | @rem Setup the command line 81 | 82 | set CLASSPATH=%APP_HOME%\gradle\wrapper\gradle-wrapper.jar 83 | 84 | @rem Execute Gradle 85 | "%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -classpath "%CLASSPATH%" org.gradle.wrapper.GradleWrapperMain %CMD_LINE_ARGS% 86 | 87 | :end 88 | @rem End local scope for the variables with windows NT shell 89 | if "%ERRORLEVEL%"=="0" goto mainEnd 90 | 91 | :fail 92 | rem Set variable GRADLE_EXIT_CONSOLE if you need the _script_ return code instead of 93 | rem the _cmd.exe /c_ return code! 94 | if not "" == "%GRADLE_EXIT_CONSOLE%" exit 1 95 | exit /b 1 96 | 97 | :mainEnd 98 | if "%OS%"=="Windows_NT" endlocal 99 | 100 | :omega 101 | -------------------------------------------------------------------------------- /settings.gradle.kts: -------------------------------------------------------------------------------- 1 | rootProject.name = "spring-vault-database-rotate" 2 | -------------------------------------------------------------------------------- /src/main/kotlin/com/secrets_as_a_service/springvaultdatabaserotate/Application.kt: -------------------------------------------------------------------------------- 1 | package com.secrets_as_a_service.springvaultdatabaserotate 2 | 3 | import org.springframework.boot.autoconfigure.SpringBootApplication 4 | import org.springframework.boot.context.properties.ConfigurationPropertiesScan 5 | import org.springframework.boot.runApplication 6 | 7 | @SpringBootApplication 8 | @ConfigurationPropertiesScan 9 | class Application { 10 | companion object { 11 | @JvmStatic 12 | fun main(args: Array) { 13 | runApplication(*args) 14 | } 15 | } 16 | } 17 | -------------------------------------------------------------------------------- /src/main/kotlin/com/secrets_as_a_service/springvaultdatabaserotate/config/VaultConfig.kt: -------------------------------------------------------------------------------- 1 | package com.secrets_as_a_service.springvaultdatabaserotate.config 2 | 3 | import com.zaxxer.hikari.HikariDataSource 4 | import mu.KotlinLogging 5 | import org.springframework.beans.factory.annotation.Value 6 | import org.springframework.boot.autoconfigure.condition.ConditionalOnBean 7 | import org.springframework.context.ConfigurableApplicationContext 8 | import org.springframework.context.annotation.Configuration 9 | import org.springframework.vault.core.lease.SecretLeaseContainer 10 | import org.springframework.vault.core.lease.domain.RequestedSecret.Mode.RENEW 11 | import org.springframework.vault.core.lease.domain.RequestedSecret.Mode.ROTATE 12 | import org.springframework.vault.core.lease.event.SecretLeaseCreatedEvent 13 | import org.springframework.vault.core.lease.event.SecretLeaseEvent 14 | import org.springframework.vault.core.lease.event.SecretLeaseExpiredEvent 15 | import javax.annotation.PostConstruct 16 | 17 | @ConditionalOnBean(SecretLeaseContainer::class) 18 | // tag::autowire[] 19 | // tag::complete[] 20 | @Configuration 21 | class VaultConfig( 22 | //tag::ignore_autowire[] 23 | private val applicationContext: ConfigurableApplicationContext, 24 | //tag::ignore_autowire2[] 25 | private val hikariDataSource: HikariDataSource, 26 | //end::ignore_autowire2[] 27 | //end::ignore_autowire[] 28 | private val leaseContainer: SecretLeaseContainer, 29 | @Value("\${spring.cloud.vault.database.role}") 30 | private val databaseRole: String 31 | ) { 32 | // end::autowire[] 33 | 34 | // tag::detect_expiring[] 35 | @PostConstruct 36 | private fun postConstruct() { 37 | val vaultCredsPath = "database/creds/$databaseRole" 38 | leaseContainer.addLeaseListener { event -> 39 | if (event.path == vaultCredsPath) { 40 | log.info { "Lease change for DB: ($event) : (${event.lease})" } 41 | // tag::request_rotate[] 42 | // tag::get_rotated_secret[] 43 | if (event.isLeaseExpired && event.mode == RENEW) { 44 | // tag::ignore_todo_rotate[] 45 | // tag::ignore_complete[] 46 | // TODO Rotate the credentials here <1> 47 | // end::ignore_complete[] 48 | // end::ignore_todo_rotate[] 49 | // tag::ignore_detect_expiring[] 50 | log.info { "Replace RENEW for expired credential with ROTATE" } 51 | leaseContainer.requestRotatingSecret(vaultCredsPath) // <1> 52 | // tag::ignore2_request_rotate[] 53 | } else if (event is SecretLeaseCreatedEvent && event.mode == ROTATE) { // <2> 54 | val credentials = event.credentials // <3> 55 | // tag::ignore_complete[] 56 | // TODO Update database connection 57 | // end::ignore_complete[] 58 | // tag::ignore_update_credentials[] 59 | // tag::handle_no_credentials[] 60 | if (credentials == null) { 61 | log.error { "Cannot get updated DB credentials. Shutting down." } 62 | applicationContext.close() // <1> 63 | return@addLeaseListener // <2> 64 | } 65 | refreshDatabaseConnection(credentials) // <3> 66 | // end::handle_no_credentials[] 67 | // end::ignore_update_credentials[] 68 | // end::ignore_detect_expiring[] 69 | // end::ignore2_request_rotate[] 70 | } 71 | // end::get_rotated_secret[] 72 | // end::request_rotate[] 73 | } 74 | } 75 | } 76 | // end::detect_expiring[] 77 | 78 | // tag::refresh_credentials[] 79 | private fun refreshDatabaseConnection(credential: Credential) { 80 | updateDbProperties(credential) // <1> 81 | updateDataSource(credential) // <2> 82 | } 83 | // end::refresh_credentials[] 84 | 85 | private val SecretLeaseEvent.path get() = source.path 86 | private val SecretLeaseEvent.isLeaseExpired 87 | get() = this is SecretLeaseExpiredEvent 88 | private val SecretLeaseEvent.mode get() = source.mode 89 | 90 | // tag::credentials_property_extension[] 91 | private val SecretLeaseCreatedEvent.credentials: Credential? 92 | get() { 93 | val username = get("username") ?: return null // <1> 94 | val password = get("password") ?: return null // <1> 95 | return Credential(username, password) 96 | } 97 | 98 | private fun SecretLeaseCreatedEvent.get(param: String): String? { 99 | return secrets[param] as? String // <2> 100 | } 101 | 102 | // tag::ignore_credentials_property_extension[] 103 | // tag::refresh_credentials_methods[] 104 | private fun updateDbProperties(credential: Credential) { // <1> 105 | val (username, password) = credential 106 | System.setProperty("spring.datasource.username", username) 107 | System.setProperty("spring.datasource.password", password) 108 | } 109 | 110 | private fun updateDataSource(credential: Credential) { 111 | val (username, password) = credential 112 | log.info { "==> Update database credentials" } 113 | hikariDataSource.hikariConfigMXBean.apply { // <2> 114 | setUsername(username) 115 | setPassword(password) 116 | } 117 | hikariDataSource.hikariPoolMXBean?.softEvictConnections() // <3> 118 | ?.also { log.info { "Soft Evict Hikari Data Source Connections" } } 119 | ?: log.warn { "CANNOT Soft Evict Hikari Data Source Connections" } 120 | } 121 | // end::refresh_credentials_methods[] 122 | 123 | companion object { 124 | private val log = KotlinLogging.logger { } 125 | } 126 | 127 | // end::ignore_credentials_property_extension[] 128 | private data class Credential(val username: String, val password: String) 129 | // end::credentials_property_extension[] 130 | } 131 | // end::complete[] -------------------------------------------------------------------------------- /src/main/kotlin/com/secrets_as_a_service/springvaultdatabaserotate/controller/Controller.kt: -------------------------------------------------------------------------------- 1 | package com.secrets_as_a_service.springvaultdatabaserotate.controller 2 | 3 | import com.secrets_as_a_service.springvaultdatabaserotate.entity.Customer 4 | import com.secrets_as_a_service.springvaultdatabaserotate.repository.UserRepository 5 | import org.springframework.web.bind.annotation.GetMapping 6 | import org.springframework.web.bind.annotation.RestController 7 | import javax.sql.DataSource 8 | 9 | @RestController 10 | class Controller( 11 | private val userRepository: UserRepository, 12 | private val dataSource: DataSource 13 | ) { 14 | @GetMapping("/customers") 15 | fun getCustomers(): List = userRepository.findAll() 16 | 17 | @GetMapping("/dbuser") 18 | fun getDbUser(): String = dataSource.connection.use { connection -> 19 | connection.createStatement().use { statement -> 20 | statement.executeQuery("SELECT CURRENT_USER;").apply { next() }.use { 21 | it.getString(1) 22 | } 23 | } 24 | } 25 | } -------------------------------------------------------------------------------- /src/main/kotlin/com/secrets_as_a_service/springvaultdatabaserotate/entity/Customer.kt: -------------------------------------------------------------------------------- 1 | package com.secrets_as_a_service.springvaultdatabaserotate.entity 2 | 3 | import javax.persistence.Entity 4 | import javax.persistence.Id 5 | 6 | @Entity 7 | data class Customer(@Id val id: Int, val name: String, val address: String) -------------------------------------------------------------------------------- /src/main/kotlin/com/secrets_as_a_service/springvaultdatabaserotate/repository/UserRepository.kt: -------------------------------------------------------------------------------- 1 | package com.secrets_as_a_service.springvaultdatabaserotate.repository 2 | 3 | import com.secrets_as_a_service.springvaultdatabaserotate.entity.Customer 4 | import org.springframework.data.jpa.repository.JpaRepository 5 | 6 | interface UserRepository : JpaRepository -------------------------------------------------------------------------------- /src/main/resources/application.yml: -------------------------------------------------------------------------------- 1 | spring: 2 | jpa: 3 | properties: 4 | hibernate: 5 | dialect: org.hibernate.dialect.PostgreSQLDialect 6 | datasource: 7 | url: jdbc:postgresql://localhost:5432/testuser 8 | username: testuser 9 | password: testpassword 10 | -------------------------------------------------------------------------------- /src/main/resources/bootstrap.yml: -------------------------------------------------------------------------------- 1 | spring: 2 | application: 3 | name: spring-vault-database-rotate 4 | cloud: 5 | vault: 6 | # enabled: false 7 | scheme: http 8 | uri: http://localhost:8200 9 | token: 00000000-0000-0000-0000-000000000000 10 | fail-fast: true 11 | database: 12 | enabled: true 13 | role: readonly -------------------------------------------------------------------------------- /vault.env: -------------------------------------------------------------------------------- 1 | export VAULT_TOKEN="00000000-0000-0000-0000-000000000000" 2 | export VAULT_ADDR="http://127.0.0.1:8200" --------------------------------------------------------------------------------