From d7c5cfd13e14f6c5e2f5dd4b4386e7b61c7ed5ca Mon Sep 17 00:00:00 2001 From: ZhangKai Date: Mon, 7 Mar 2022 22:29:34 +0800 Subject: [PATCH] #32 Spring vault --- docs/en/spring-vault/spring-vault.md | 122 ++++++++--------- docs/spring-vault/spring-vault.md | 196 +++++++++++++-------------- 2 files changed, 159 insertions(+), 159 deletions(-) diff --git a/docs/en/spring-vault/spring-vault.md b/docs/en/spring-vault/spring-vault.md index f1e8cac..b3d4951 100644 --- a/docs/en/spring-vault/spring-vault.md +++ b/docs/en/spring-vault/spring-vault.md @@ -1,6 +1,6 @@ # Spring Vault - Reference Documentation -# [](#preface)Preface +# Preface The Spring Vault project applies core Spring concepts to the development of solutions using HashiCorp Vault. We provide a "template" as a high-level abstraction for storing and querying documents. You will notice similarities to the REST support in the Spring Framework. @@ -10,7 +10,7 @@ This part of the reference documentation explains the core functionality offered [Vault support](#vault.core) introduces the Vault module feature set. -## [](#preface.document-structure)1. Document Structure +## 1. Document Structure This section provides basic introduction to Spring and Vault. It contains details about following development and how to get support. @@ -18,7 +18,7 @@ It contains details about following development and how to get support. The rest of the document refers to Spring Vault features and assumes the user is familiar with [HashiCorp Vault](https://www.vaultproject.io)as well as Spring concepts. -## [](#get-started:first-steps:spring)2. Knowing Spring +## 2. Knowing Spring Spring Vault uses Spring framework’s [core](https://docs.spring.io/spring/docs/5.3.4/spring-framework-reference/core.html) functionality, such as [IoC](https://docs.spring.io/spring/docs/5.3.4/spring-framework-reference//core.html) container. While it is not important to know the Spring APIs, understanding the concepts behind them is. At a minimum, the idea behind IoC should be familiar for whatever IoC container you choose to use. @@ -26,7 +26,7 @@ The core functionality of the Vault support can be used directly, with no need t To learn more about Spring, you can refer to the comprehensive (and sometimes disarming) documentation that explains in detail the Spring Framework. There are a lot of articles, blog entries and books on the matter - take a look at the Spring framework [home page ](https://spring.io/docs) for more information. -## [](#get-started:first-steps:vault)3. Knowing Vault +## 3. Knowing Vault Security and working with secrets is a concern of every developer working with databases, user credentials or API keys. Vault steps in by providing a secure storage combined with access control, revocation, key rolling and auditing. In short: Vault is a service for securely accessing and storing secrets. A secret is anything that you want to tightly control access to, such as API keys, passwords, certificates, and more. @@ -47,35 +47,35 @@ Vault can manage static and dynamic secrets such as application data, username/password for remote applications/resources and provide credentials for external services such as MySQL, PostgreSQL, Apache Cassandra, Consul, AWS and more. -## [](#requirements)4. Requirements +## 4. Requirements Spring Vault 2.x binaries requires JDK level 8.0 and above, and [Spring Framework](https://spring.io/docs) 5.3.4 and above. In terms of Vault, [Vault](https://www.vaultproject.io/) at least 0.6. -## [](#get-started:additional-help)5. Additional Help Resources +## 5. Additional Help Resources Learning a new framework is not always straight forward. In this section, we try to provide what we think is an easy to follow guide for starting with Spring Vault module. However, if you encounter issues or you are just looking for advice, feel free to use one of the links below: -### [](#get-started:help)5.1. Support +### 5.1. Support There are a few support options available: -#### [](#get-started:help:community)5.1.1. Community Forum +#### 5.1.1. Community Forum Post questions questions regarding Spring Vault on [Stackoverflow](https://stackoverflow.com/questions/tagged/spring-vault) to share information and help each other. Note that registration is needed **only** for posting. -#### [](#get-started:help:professional)5.1.2. Professional Support +#### 5.1.2. Professional Support Professional, from-the-source support, with guaranteed response time, is available from [Pivotal Sofware, Inc.](https://pivotal.io/), the company behind Spring Vault and Spring. -### [](#get-started:up-to-date)5.2. Following Development +### 5.2. Following Development For information on the Spring Vault source code repository, nightly builds and snapshot artifacts please see the [Spring Vault homepage](https://projects.spring.io/spring-vault/). You can help make Spring Vault best serve the needs of the Spring community by interacting with developers through the Community on [Stackoverflow](https://stackoverflow.com/questions/tagged/spring-vault). If you encounter a bug or want to suggest an improvement, please create a ticket on the Spring Vault issue [tracker](https://github.com/spring-projects/spring-vault/issues). To stay up to date with the latest news and announcements in the Spring ecosystem, subscribe to the Spring Community [Portal](https://spring.io). Lastly, you can follow the Spring [blog ](https://spring.io/blog)or the project team on Twitter ([SpringCentral](https://twitter.com/springcentral)). -## [](#new-features)6. New & Noteworthy +## 6. New & Noteworthy -### [](#new-features.2-3-0)6.1. What’s new in Spring Vault 2.3 +### 6.1. What’s new in Spring Vault 2.3 * Support for PEM-encoded certificates for keystore and truststore usage. @@ -93,7 +93,7 @@ For information on the Spring Vault source code repository, nightly builds and s * `AbstractVaultConfiguration.threadPoolTaskScheduler()` bean type changed to `TaskSchedulerWrapper` instead of `ThreadPoolTaskScheduler`. -### [](#new-features.2-2-0)6.2. What’s new in Spring Vault 2.2 +### 6.2. What’s new in Spring Vault 2.2 * Support for Key-Value v2 (versioned backend) secrets through `@VaultPropertySource`. @@ -112,7 +112,7 @@ For information on the Spring Vault source code repository, nightly builds and s * Kotlin Coroutines support for `ReactiveVaultOperations`. -### [](#new-features.2-1-0)6.3. What’s new in Spring Vault 2.1 +### 6.3. What’s new in Spring Vault 2.1 * [GCP Compute](#vault.authentication.gcpgce), [GCP IAM](#vault.authentication.gcpiam), and [Azure](#vault.authentication.azuremsi) authentication. @@ -122,7 +122,7 @@ For information on the Spring Vault source code repository, nightly builds and s * Improved Exception hierarchy for Vault login failures. -### [](#new-features.2-0-0)6.4. What’s new in Spring Vault 2.0 +### 6.4. What’s new in Spring Vault 2.0 * Authentication steps DSL to [compose authentication flows](#vault.authentication.steps). @@ -142,7 +142,7 @@ For information on the Spring Vault source code repository, nightly builds and s * [Spring Security integration](#vault.misc.spring-security) with transit backend-based `BytesKeyGenerator` and `BytesEncryptor`. -### [](#new-features.1-1-0)6.5. What’s new in Spring Vault 1.1.0 +### 6.5. What’s new in Spring Vault 1.1.0 * [AWS IAM authentication](#vault.authentication.awsiam). @@ -154,13 +154,13 @@ For information on the Spring Vault source code repository, nightly builds and s * TTL-based generic secret rotation. -### [](#new-features.1-0-0)6.6. What’s new in Spring Vault 1.0 +### 6.6. What’s new in Spring Vault 1.0 * Initial Vault support. -# [](#reference-documentation)Reference documentation +# Reference documentation -## [](#vault.core)7. Vault support +## 7. Vault support The Vault support contains a wide range of features which are summarized below. @@ -176,7 +176,7 @@ administrative commands. `VaultTemplate` also provides callback methods so that get a hold of the low-level API artifacts such as `RestTemplate` to communicate directly with Vault. -### [](#dependencies)7.1. Dependencies +### 7.1. Dependencies The easiest way to find compatible versions of Spring Vault dependencies is by relying on the Spring Vault BOM we ship with the compatible versions defined. In a Maven project you would declare this dependency in the`` section of your `pom.xml`: @@ -217,14 +217,14 @@ Example 2. Declaring a dependency to Spring Vault ``` -### [](#dependencies.spring-framework)7.2. Spring Framework +### 7.2. Spring Framework The current version of Spring Vault requires Spring Framework in version 5.3.4 or better. The modules might also work with an older bugfix version of that minor version. However, using the most recent version within that generation is highly recommended. -## [](#vault.core.getting-started)8. Getting Started +## 8. Getting Started Spring Vault support requires Vault 0.6 or higher and Java SE 6 or higher. An easy way to bootstrap setting up a working environment is to create a @@ -355,7 +355,7 @@ Even in this simple example, there are few things to take notice of * If the constructor argument names match the field names of the stored document, they will be used to instantiate the object. -## [](#vault.core.template)9. Introduction to VaultTemplate +## 9. Introduction to VaultTemplate The class `VaultTemplate`, located in the package `org.springframework.vault.core`, is the central class of the Spring’s Vault support providing a rich feature set to @@ -389,7 +389,7 @@ Please see the section [Execution Callbacks](#vault.core.executioncallback) for Now let’s look at a examples of how to work with Vault in the context of the Spring container. -### [](#vault.core.template.beans)9.1. Registering and configuring Spring Vault beans +### 9.1. Registering and configuring Spring Vault beans Using Spring Vault does not require a Spring Context. However, instances of `VaultTemplate` and `SessionManager` registered inside a managed context will participate in [lifecycle events](https://docs.spring.io/spring/docs/5.3.4/spring-framework-reference/core.html#beans-factory-nature)provided by the Spring IoC container. This is useful to dispose active Vault sessions upon @@ -468,7 +468,7 @@ public class AppConfig extends AbstractVaultConfiguration { | |Creating a custom configuration class might be cumbersome in some cases.
Take a look at `EnvironmentVaultConfiguration` that allows configuration by using
properties from existing property sources and Spring’s `Environment`. Read more
in [Using `EnvironmentVaultConfiguration`](#vault.core.environment-vault-configuration).| |---|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -### [](#vault.core.template.sessionmanagement)9.2. Session Management +### 9.2. Session Management Spring Vault requires a `ClientAuthentication` to login and access Vault. See [Authentication Methods](#vault.core.authentication) on details regarding authentication. @@ -482,7 +482,7 @@ obtains a token, about revocation and renewal. Spring Vault comes with two imple renewal if a token is renewable and revoke a login token on disposal. Renewal is scheduled with an `AsyncTaskExecutor`. `LifecycleAwareSessionManager`is configured by default if using `AbstractVaultConfiguration`. -### [](#vault.core.environment-vault-configuration)9.3. Using `EnvironmentVaultConfiguration` +### 9.3. Using `EnvironmentVaultConfiguration` Spring Vault includes `EnvironmentVaultConfiguration` configure the Vault client from Spring’s `Environment` and a set of predefined property keys. `EnvironmentVaultConfiguration` supports frequently applied configurations. Other configurations are supported by deriving from the most appropriate configuration class. Include `EnvironmentVaultConfiguration` with `@Import(EnvironmentVaultConfiguration.class)` to existing @@ -585,7 +585,7 @@ No configuration options. * Path to service account token file: `vault.kubernetes.service-account-token-file` (defaults to `/var/run/secrets/kubernetes.io/serviceaccount/token`) -### [](#vault.core.executioncallback)9.4. Execution callbacks +### 9.4. Execution callbacks One common design feature of all Spring template classes is that all functionality is routed into one of the templates execute callback methods. This helps ensure that exceptions and any resource management that maybe required are performed consistency. @@ -617,7 +617,7 @@ vaultOperations.doWithVault(new RestOperationsCallbackSee [Authentication Methods](#vault.core.authentication) for details on supported authentication methods.| -### [](#vault.core.reactive.template.sessionmanagement)11.4. Session Management +### 11.4. Session Management Spring Vault requires a token to authenticate Vault requests. See [Authentication Methods](#vault.core.authentication) on details regarding authentication. @@ -1041,7 +1041,7 @@ Vault login should not occur on each authenticated Vault interaction but the session token should be kept across a session. This aspect is handled by a session manager implementing `ReactiveSessionManager`, such as `ReactiveLifecycleAwareSessionManager`. -### [](#vault.core.reactive.executioncallback)11.5. Execution callbacks +### 11.5. Execution callbacks One common design feature of all Spring template classes is that all functionality is routed into one of the templates execute callback methods. This helps ensure @@ -1072,7 +1072,7 @@ reactiveVaultOperations.doWithVault(webClient -> { }); ``` -## [](#vault.core.propertysupport)12. Vault Property Source Support +## 12. Vault Property Source Support Vault can be used in many different ways. One specific use-case is using Vault to store encrypted properties. Spring Vault supports Vault as property @@ -1189,7 +1189,7 @@ In such cases - and if overriding is important - it is recommended that the user fall back to using the programmatic PropertySource API. See [`ConfigurableEnvironment`](https://docs.spring.io/spring-framework/docs/current/javadoc-api/org/springframework/core/env/ConfigurableEnvironment.html) and[`MutablePropertySources`](https://docs.spring.io/spring/docs/current/javadoc-api/org/springframework/core/env/MutablePropertySources.html) for details. -## [](#vault.repositories)13. Vault Repositories +## 13. Vault Repositories Working with `VaultTemplate` and responses mapped to Java classes allows basic data operations like read, write and delete. Vault repositories apply Spring Data’s repository concept on top of Vault. @@ -1199,7 +1199,7 @@ the Id property, paging and sorting. | |Read more about Spring Data Repositories in the [Spring Data Commons reference documentation](https://docs.spring.io/spring-data/commons/docs/current/reference/html/#repositories). The reference documentation will give you an introduction to Spring Data repositories.| |---|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -### [](#vault.repositories.usage)13.1. Usage +### 13.1. Usage To access domain entities stored in Vault you can leverage repository support that eases implementing those quite significantly. @@ -1317,7 +1317,7 @@ public void basicCrudOperations() { |**3**| Counts the total number of entities available within the keyspace *credentials* defined by `@Secret` on `Credentials`. | |**4**| Removes the key for the given object from Vault. | -### [](#vault.repositories.mapping)13.2. Object to Vault JSON Mapping +### 13.2. Object to Vault JSON Mapping Vault repositories store objects in Vault using JSON as interchange format. Object mapping between JSON and the entity is done by `VaultConverter`. The converter reads and writes `SecretDocument` that contains the body @@ -1362,7 +1362,7 @@ You can customize the mapping behavior by registering a `Converter` in `VaultCus Those converters can take care of converting from/to a type such as `LocalDate` as well as `SecretDocument`whereas the first one is suitable for converting simple properties and the last one complex types to their JSON representation. The second option offers full control over the resulting `SecretDocument`. Writing objects to `Vault`will delete the content and re-create the whole entry, so not mapped data will be lost. -### [](#vault.repositories.queries)13.3. Queries and Query Methods +### 13.3. Queries and Query Methods Query methods allow automatic derivation of simple queries from the method name. Vault has no query engine but requires direct access of HTTP context paths. Vault query methods translate Vault’s API possibilities to queries. @@ -1426,7 +1426,7 @@ public interface CredentialsRepository extends PagingAndSortingRepository ``` -### [](#vault.client-ssl)14.3. Vault Client SSL configuration +### 14.3. Vault Client SSL configuration SSL can be configured using `SslConfiguration` by setting various properties. You can set either `javax.net.ssl.trustStore` to configure @@ -1553,7 +1553,7 @@ SslConfiguration configuration = SslConfiguration.forTrustStore(keystore); PEM files may contain one or more certificates (blocks of `-----BEGIN CERTIFICATE-----` and `-----END CERTIFICATE-----`). Certificates added to the underlying `KeyStore` use the full subject name as alias. -## [](#vault.core.authentication)15. Authentication Methods +## 15. Authentication Methods Different organizations have different requirements for security and authentication. Vault reflects that need by shipping multiple authentication @@ -1594,7 +1594,7 @@ public class Config extends AbstractVaultConfiguration { See [`SecurePropertyUsage.java`](https://github.com/spring-projects/spring-vault/blob/master/spring-vault-core/src/test/java/org/springframework/vault/demo/SecurePropertyUsage.java)for a sample on referencing properties in components and other property sources. -### [](#vault.authentication.token)15.2. Token authentication +### 15.2. Token authentication Tokens are the core method for authentication within Vault. Token authentication requires a static token to be provided. @@ -1628,7 +1628,7 @@ See also: * [Vault Documentation: Using the Token auth backend](https://www.vaultproject.io/docs/auth/token.html) -### [](#vault.authentication.appid)15.3. AppId authentication +### 15.3. AppId authentication | |AppId authentication is deprecated by Vault. Use [AppRole authentication](#vault.authentication.approle) instead.| |---|-----------------------------------------------------------------------------------------------------------------| @@ -1732,7 +1732,7 @@ public class MyUserIdMechanism implements AppIdUserIdMechanism { See also: [Vault Documentation: Using the App ID auth backend](https://www.vaultproject.io/docs/auth/app-id.html) -### [](#vault.authentication.approle)15.4. AppRole authentication +### 15.4. AppRole authentication [AppRole](https://www.vaultproject.io/docs/auth/app-id.html) allows machine authentication, like the deprecated (since Vault 0.6.1) [AppId authentication](#vault.authentication.appid). @@ -1792,7 +1792,7 @@ class AppConfig extends AbstractVaultConfiguration { See also: [Vault Documentation: Using the AppRole auth backend](https://www.vaultproject.io/docs/auth/approle.html) -### [](#vault.authentication.awsec2)15.5. AWS-EC2 authentication +### 15.5. AWS-EC2 authentication The [aws-ec2](https://www.vaultproject.io/docs/auth/aws-ec2.html)auth backend provides a secure introduction mechanism for AWS EC2 instances, allowing automated retrieval of a Vault @@ -1837,7 +1837,7 @@ it in `AwsEc2AuthenticationOptions`. See also: [Vault Documentation: Using the AWS-EC2 auth backend](https://www.vaultproject.io/docs/auth/aws-ec2.html) -### [](#vault.authentication.awsiam)15.6. AWS-IAM authentication +### 15.6. AWS-IAM authentication The [aws](https://www.vaultproject.io/docs/auth/aws.html)auth backend allows Vault login by using existing AWS IAM credentials. @@ -1900,7 +1900,7 @@ See also: * [AWS Documentation: STS GetCallerIdentity](https://docs.aws.amazon.com/STS/latest/APIReference/API_GetCallerIdentity.html) -### [](#vault.authentication.azuremsi)15.7. Azure (MSI) authentication +### 15.7. Azure (MSI) authentication The [azure](https://www.vaultproject.io/docs/auth/azure.html)auth backend provides a secure introduction mechanism for Azure VM instances, allowing automated retrieval of a Vault @@ -1941,7 +1941,7 @@ See also: * [Azure Documentation: Managed Service Identity](https://docs.microsoft.com/en-us/azure/active-directory/managed-service-identity/overview) -### [](#vault.authentication.gcpgce)15.8. GCP-GCE authentication +### 15.8. GCP-GCE authentication The [gcp](https://www.vaultproject.io/docs/auth/gcp.html)auth backend allows Vault login by using existing GCP (Google Cloud Platform) IAM and GCE credentials. @@ -1985,7 +1985,7 @@ See also: * [GCP Documentation: Verifying the Identity of Instances](https://cloud.google.com/compute/docs/instances/verifying-instance-identity) -### [](#vault.authentication.gcpiam)15.9. GCP-IAM authentication +### 15.9. GCP-IAM authentication The [gcp](https://www.vaultproject.io/docs/auth/gcp.html)auth backend allows Vault login by using existing GCP (Google Cloud Platform) IAM and GCE credentials. @@ -2033,7 +2033,7 @@ See also: * [GCP Documentation: projects.serviceAccounts.signJwt](https://cloud.google.com/iam/reference/rest/v1/projects.serviceAccounts/signJwt)[]() -### [](#vault.authentication.pcf)15.10. PCF authentication +### 15.10. PCF authentication The [pcf](https://www.vaultproject.io/docs/auth/pcf.html)auth backend allows Vault login for PCF instances. It leverages [PCF’s App and Container Identity Assurance](https://content.pivotal.io/blog/new-in-pcf-2-1-app-container-identity-assurance-via-automatic-cert-rotation). @@ -2072,7 +2072,7 @@ See also: * [Vault Documentation: Using the PCF auth backend](https://www.vaultproject.io/docs/auth/pcf.html) -### [](#vault.authentication.clientcert)15.11. TLS certificate authentication +### 15.11. TLS certificate authentication The `cert` auth backend allows authentication using SSL/TLS client certificates that are either signed by a CA or self-signed. @@ -2105,7 +2105,7 @@ class AppConfig extends AbstractVaultConfiguration { See also: [Vault Documentation: Using the Cert auth backend](https://www.vaultproject.io/docs/auth/cert.html) -### [](#vault.authentication.cubbyhole)15.12. Cubbyhole authentication +### 15.12. Cubbyhole authentication Cubbyhole authentication uses Vault primitives to provide a secured authentication workflow. Cubbyhole authentication uses tokens as primary login method. @@ -2226,7 +2226,7 @@ See also: * [Vault Documentation: Response Wrapping](https://www.vaultproject.io/docs/concepts/response-wrapping.html) -### [](#vault.authentication.kubernetes)15.13. Kubernetes authentication +### 15.13. Kubernetes authentication Vault supports since 0.8.3 [kubernetes](https://www.vaultproject.io/docs/auth/kubernetes.html)-based authentication using Kubernetes tokens. @@ -2264,7 +2264,7 @@ See also: * [Kubernetes Documentation: Configure Service Accounts for Pods](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/) -### [](#vault.authentication.steps)15.14. Authentication Steps +### 15.14. Authentication Steps `ClientAuthentication` objects describe the authentication flow and perform the actual authentication steps. Pre-composed authentications are easy to use and to configure with @@ -2328,7 +2328,7 @@ AuthenticationStepsExecutor executor = new AuthenticationStepsExecutor(steps, re VaultToken token = executor.login(); ``` -### [](#vault.authentication.session)15.15. Token Lifecycle +### 15.15. Token Lifecycle Vault’s tokens can be associated with a time to live. Tokens obtained by an authentication method are intended to be used as long as the session is active and should not expire while the application is active. @@ -2345,11 +2345,11 @@ Authentication methods such as [`TokenAuthentication`](https://docs.spring.io/sp Authentication methods creating `LoginToken` directly (all login-based authentication methods) already provide all necessary details to setup token renewal. Tokens obtained from a login are revoked by `LifecycleAwareSessionManager` if the session manager is shut down. -## [](#vault.misc)16. Miscellaneous +## 16. Miscellaneous Learn in this chapter about details worth mentioning like the Spring Security integration. -### [](#vault.misc.spring-security)16.1. Spring Security +### 16.1. Spring Security Spring Vault integrates with Spring Security by providing implementations for [`BytesKeyGenerator`](https://docs.spring.io/spring-security/site/docs/current/reference/htmlsingle/#spring-security-crypto-keygenerators) and [`BytesEncryptor`](https://docs.spring.io/spring-security/site/docs/current/reference/htmlsingle/#spring-security-crypto-encryption). Both implementations use Vault’s `transit` backend. diff --git a/docs/spring-vault/spring-vault.md b/docs/spring-vault/spring-vault.md index 2eca942..1a0ec3c 100644 --- a/docs/spring-vault/spring-vault.md +++ b/docs/spring-vault/spring-vault.md @@ -1,6 +1,6 @@ # Spring 保险库-参考文献 -# [](#preface)序言 +# 序言 Spring Vault 项目将核心 Spring 概念应用于使用 HashiCorpVault 的解决方案的开发。我们提供了一个“模板”作为存储和查询文档的高级抽象。你将注意到与 Spring 框架中的 REST 支持的相似之处。 @@ -10,13 +10,13 @@ Spring Vault 项目将核心 Spring 概念应用于使用 HashiCorpVault 的解 [保险库支持](#vault.core)介绍了 Vault 模块功能集。 -## [](#preface.document-structure)1。文件结构 +## 1.文件结构 这一部分提供了 Spring 和 Vault 的基本介绍。它包含有关后续开发和如何获得支持的详细信息。 文档的其余部分引用了 Spring Vault 特性，并假定用户熟悉[HashiCorp 保险库](https://www.vaultproject.io)以及 Spring 概念。 -## [](#get-started:first-steps:spring)2。知道 Spring +## 2.知道 Spring Spring Vault 使用 Spring Framework 的[core](https://docs.spring.io/spring/docs/5.3.4/spring-framework-reference/core.html)功能，例如[IoC](https://docs.spring.io/spring/docs/5.3.4/spring-framework-reference//core.html)容器。虽然了解 Spring API 并不重要，但了解它们背后的概念是重要的。至少，对于你选择使用的任何 IOC 容器，IOC 背后的思想应该是熟悉的。 @@ -24,7 +24,7 @@ Vault 支持的核心功能可以直接使用，而不需要调用 Spring 容器 要了解有关 Spring 的更多信息，你可以参考详细解释 Spring 框架的全面（有时是解除武装）文档。有很多关于这个问题的文章、博客条目和书籍--看看 Spring 框架[home page ](https://spring.io/docs)，了解更多信息。 -## [](#get-started:first-steps:vault)3。知道保险库 +## 3.知道保险库 安全性和处理秘密是每个处理数据库、用户凭据或 API 密钥的开发人员关心的问题。Vault 通过提供与访问控制、撤销、密钥滚动和审计相结合的安全存储来介入。简而言之：Vault 是一种安全访问和存储秘密的服务。秘密是你想要严格控制访问权限的任何东西，例如 API 密钥、密码、证书等等。 @@ -40,35 +40,35 @@ Vault 支持的核心功能可以直接使用，而不需要调用 Spring 容器 Spring Vault 提供了用于访问、存储和撤销秘密的客户端支持。有了[HashiCorp 的保险库](https://www.vaultproject.io)，你就有了一个中心位置来管理跨所有环境的应用程序的外部秘密数据。Vault 可以管理静态和动态秘密，例如应用程序数据、远程应用程序/资源的用户名/密码，并为外部服务（例如 MySQL、PostgreSQL、 Apache Cassandra、Consul、AWS 等）提供凭据。 -## [](#requirements)4。所需经费 +## 4.所需经费 Spring Vault2.x 二进制文件要求 JDK 级别为 8.0 及以上，并且[Spring Framework](https://spring.io/docs)5.3.4 及以上。 -就保险库而言，[Vault](https://www.vaultproject.io/)至少为 0.6。 +就保险库而言，[Vault](https://www.vaultproject.io/)至少为 0.6. -## [](#get-started:additional-help)5。额外的帮助资源 +## 5.额外的帮助资源 学习一个新的框架并不总是直截了当的。在这一部分中，我们试图提供一种我们认为易于遵循的指南，用于从 Spring Vault 模块开始。然而，如果你遇到问题或你只是在寻求建议，请使用以下链接之一： -### [](#get-started:help)5.1。支持 +### 5.1.支持 有几个可用的支持选项： -#### [](#get-started:help:community)5.1.1。社区论坛 +#### 5.1.1.社区论坛 在[StackOverflow](https://stackoverflow.com/questions/tagged/spring-vault)上发布有关 Spring Vault 的问题，以共享信息并相互帮助。请注意，需要注册**只有**才能发布。 -#### [](#get-started:help:professional)5.1.2。专业支持 +#### 5.1.2.专业支持 Spring Vault 和 Spring 背后的公司[Pivotal Software，Inc.](https://pivotal.io/)提供专业的、源代码支持，并保证响应时间。 -### [](#get-started:up-to-date)5.2。后续发展 +### 5.2.后续发展 有关 Spring Vault 源代码库、夜间构建和快照工件的信息，请参见[Spring Vault homepage](https://projects.spring.io/spring-vault/)。通过在[StackOverflow](https://stackoverflow.com/questions/tagged/spring-vault)上通过社区与开发人员进行交互，你可以帮助使 Spring Vault 最好地满足 Spring 社区的需求。如果你遇到错误或希望提出改进建议，请在 Spring vault 问题[tracker](https://github.com/spring-projects/spring-vault/issues)上创建一个票证。要了解 Spring 生态系统中的最新消息和公告，请订阅 Spring 社区[Portal](https://spring.io)。最后，你可以关注 Spring [blog ](https://spring.io/blog)或 Twitter 上的项目团队（[SpringCentral](https://twitter.com/springcentral)）。 -## [](#new-features)6。新的和值得注意的 +## 6.新的和值得注意的 -### [](#new-features.2-3-0)6.1。最新更新在 Spring Vault2.3 中 +### 6.1.最新更新在 Spring Vault2.3 中 * 支持用于密钥库和信任库使用的 PEM 编码证书。 @@ -86,7 +86,7 @@ Spring Vault 和 Spring 背后的公司[Pivotal Software，Inc.](https://pivotal * `AbstractVaultConfiguration.threadPoolTaskScheduler()` Bean 类型更改为`TaskSchedulerWrapper`而不是`ThreadPoolTaskScheduler`。 -### [](#new-features.2-2-0)6.2。最新更新在 Spring Vault2.2 中 +### 6.2.最新更新在 Spring Vault2.2 中 * 通过`@VaultPropertySource`支持键值 v2（版本控制的后端）秘密。 @@ -104,7 +104,7 @@ Spring Vault 和 Spring 背后的公司[Pivotal Software，Inc.](https://pivotal * Kotlin 协程支持`ReactiveVaultOperations`。 -### [](#new-features.2-1-0)6.3。最新更新在 Spring Vault2.1 中 +### 6.3.最新更新在 Spring Vault2.1 中 * [GCP 计算](#vault.authentication.gcpgce)，[GCP IAM](#vault.authentication.gcpiam)，以及[Azure](#vault.authentication.azuremsi)身份验证。 @@ -114,7 +114,7 @@ Spring Vault 和 Spring 背后的公司[Pivotal Software，Inc.](https://pivotal * 改进了保险库登录失败的异常层次结构。 -### [](#new-features.2-0-0)6.4。最新更新在 Spring Vault2.0 中 +### 6.4.最新更新在 Spring Vault2.0 中 * 身份验证步骤 dsl 到[组合认证流](#vault.authentication.steps)。 @@ -134,7 +134,7 @@ Spring Vault 和 Spring 背后的公司[Pivotal Software，Inc.](https://pivotal * [Spring Security integration](#vault.misc.spring-security)基于传输后端的`BytesKeyGenerator`和`BytesEncryptor`。 -### [](#new-features.1-1-0)6.5。最新更新在 Spring Vault1.1.0 中 +### 6.5.最新更新在 Spring Vault1.1.0 中 * [AWS IAM 身份验证](#vault.authentication.awsiam). @@ -146,13 +146,13 @@ Spring Vault 和 Spring 背后的公司[Pivotal Software，Inc.](https://pivotal * 基于 TTL 的通用秘密旋转。 -### [](#new-features.1-0-0)6.6。最新更新在 Spring Vault1.0 中 +### 6.6.最新更新在 Spring Vault1.0 中 * 最初的保险库支持。 -# [](#reference-documentation)参考文献 +# 参考文献 -## [](#vault.core)7。保险库支持 +## 7.保险库支持 Vault 支持包含一系列广泛的功能，这些功能概述如下。 @@ -162,11 +162,11 @@ Vault 支持包含一系列广泛的功能，这些功能概述如下。 对于大多数任务，你会发现自己正在使用`VaultTemplate`，它利用了丰富的通信功能。`VaultTemplate`是查找访问功能（例如从 Vault 读取数据或发出管理命令）的位置。`VaultTemplate`还提供了回调方法，这样你就可以轻松地获得低级 API 工件，例如`RestTemplate`，从而直接与 Vault 通信。 -### [](#dependencies)7.1。依赖关系 +### 7.1.依赖关系 查找 Spring Vault 依赖关系的兼容版本的最简单的方法是依赖于我们提供的 Spring Vault BOM 以及定义的兼容版本。在 Maven 项目中，你将在你的`pom.xml`的``部分中声明此依赖项： -例 1。使用 Spring 保险库 BOM +例 1.使用 Spring 保险库 BOM ``` @@ -190,7 +190,7 @@ Vault 支持包含一系列广泛的功能，这些功能概述如下。 * `RC1`，`RC2`等-释放候选项 -例 2。声明对 Spring Vault 的依赖关系 +例 2.声明对 Spring Vault 的依赖关系 ``` @@ -201,11 +201,11 @@ Vault 支持包含一系列广泛的功能，这些功能概述如下。 ``` -### [](#dependencies.spring-framework)7.2。 Spring 框架 +### 7.2. Spring 框架 Spring Vault 的当前版本需要版本 5.3.4 或更好的 Spring 框架。这些模块还可以与该小版本的旧 Bugfix 版本一起工作。但是，强烈建议你在这一代中使用最新的版本。 -## [](#vault.core.getting-started)8。开始 +## 8.开始 Spring Vault 支持需要 Vault0.6 或更高版本和 Java SE6 或更高版本。引导设置工作环境的一种简单方法是在[STS](https://spring.io/tools/sts)中创建一个基于 Spring 的项目。 @@ -215,7 +215,7 @@ Spring Vault 支持需要 Vault0.6 或更高版本和 Java SE6 或更高版本 然后将以下内容添加到`pom.xml`依赖关系部分。 -例 3。添加 Spring 保险库依赖项 +例 3.添加 Spring 保险库依赖项 ``` @@ -261,7 +261,7 @@ Spring Vault 支持需要 Vault0.6 或更高版本和 Java SE6 或更高版本 创建一个简单的`Secrets`类以持久存在： -例 4。映射数据对象 +例 4.映射数据对象 ``` package org.spring.vault.example; @@ -283,7 +283,7 @@ public class Secrets { 以及要运行的主应用程序 -例 5。使用 Spring Vault 的示例应用程序 +例 5.使用 Spring Vault 的示例应用程序 ``` package org.springframework.vault.example; @@ -326,7 +326,7 @@ public class VaultApp { * 如果构造函数参数名称与存储文档的字段名称匹配，则将使用它们实例化对象。 -## [](#vault.core.template)9。VaultTemplate 简介 +## 9.VaultTemplate 简介 类`VaultTemplate`位于包`org.springframework.vault.core`中，是 Spring 的 Vault 支持的中心类，提供了与 Vault 交互的丰富功能集。该模板提供了在 Vault 中读、写和删除数据的方便操作，并提供了域对象和 Vault 数据之间的映射。 @@ -344,7 +344,7 @@ Vault 文档和域类之间的映射是通过委托给`RestTemplate`来完成的 现在，让我们来看看如何在 Spring 容器的上下文中使用 Vault 的示例。 -### [](#vault.core.template.beans)9.1。注册和配置 Spring Vault bean +### 9.1.注册和配置 Spring Vault bean 使用 Spring Vault 不需要 Spring 上下文。但是，在托管上下文中注册的`VaultTemplate`和`SessionManager`实例将参与由 Spring IOC 容器提供的[生命周期事件](https://docs.spring.io/spring/docs/5.3.4/spring-framework-reference/core.html#beans-factory-nature)。这对于在应用程序关闭时处理活动的 Vault 会话非常有用。你还可以在应用程序中重用相同的`VaultTemplate`实例。 @@ -352,7 +352,7 @@ Spring Vault 附带了一个支持配置类，该配置类提供了 Bean 用于 从`AbstractVaultConfiguration`扩展需要实现` VaultEndpoint vaultEndpoint()`和`ClientAuthentication clientAuthentication()`方法。 -例 6。使用基于 Java 的 Bean 元数据注册 Spring Vault 对象 +例 6.使用基于 Java 的 Bean 元数据注册 Spring Vault 对象 ``` @Configuration @@ -382,7 +382,7 @@ public class AppConfig extends AbstractVaultConfiguration { |-----|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------| |**2**|此示例使用`TokenAuthentication`快速启动。
有关支持的身份验证方法的详细信息，请参见[认证方法](#vault.core.authentication)。| -例 7。使用注入的财产登记 Spring 保险库 +例 7.使用注入的财产登记 Spring 保险库 ``` @Configuration @@ -417,7 +417,7 @@ public class AppConfig extends AbstractVaultConfiguration { | |在某些情况下，创建自定义配置类可能很麻烦。
看看`EnvironmentVaultConfiguration`，它允许使用现有属性源的
属性和 Spring 的`Environment`进行配置。在[using`EnvironmentVaultConfiguration`]（#vault.core.environment-vault-configuration）中阅读更多
。| |---|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -### [](#vault.core.template.sessionmanagement)9.2。会话管理 +### 9.2.会话管理 Spring Vault 需要`ClientAuthentication`才能登录和访问 Vault。有关身份验证的详细信息，请参见[认证方法](#vault.core.authentication)。Vault 登录不应该发生在每个经过身份验证的 Vault 交互上，而是必须在整个会话中重用。该方面由`SessionManager`实现来处理。a`SessionManager`决定它获得令牌的频率，关于撤销和更新。 Spring Vault 有两种实现方式： @@ -425,11 +425,11 @@ Spring Vault 需要`ClientAuthentication`才能登录和访问 Vault。有关身 * `LifecycleAwareSessionManager`:如果令牌是可更新的，则此`SessionManager`调度令牌更新，并在处置时撤销登录令牌。更新计划使用`AsyncTaskExecutor`。如果使用`AbstractVaultConfiguration`，则默认配置`LifecycleAwareSessionManager`。 -### [](#vault.core.environment-vault-configuration)9.3。使用`EnvironmentVaultConfiguration` +### 9.3.使用`EnvironmentVaultConfiguration` Spring Vault 包括从 Spring 的`Environment`中配置 Vault 客户端的`EnvironmentVaultConfiguration`和一组预定义的属性键。`EnvironmentVaultConfiguration`支持经常应用的配置。从最合适的配置类派生支持其他配置。将`EnvironmentVaultConfiguration`与`@Import(EnvironmentVaultConfiguration.class)`一起包含到现有的基于 Java 的配置类中，并通过 Spring 的`PropertySource`s 中的任何一个提供配置属性。 -例 8。对属性文件使用 EnvironmentVaultConfiguration +例 8.对属性文件使用 EnvironmentVaultConfiguration 基于 Java 的配置类 @@ -525,7 +525,7 @@ vault.token=00000000-0000-0000-0000-000000000000 * 服务帐户令牌文件的路径：`vault.kubernetes.service-account-token-file`（默认为`/var/run/secrets/kubernetes.io/serviceaccount/token`） -### [](#vault.core.executioncallback)9.4。执行回调 +### 9.4.执行回调 所有 Spring 模板类的一个常见设计特征是，所有功能都被路由到一个模板执行回调方法。这有助于确保执行异常和可能需要的任何资源管理的一致性。虽然在 JDBC 和 JMS 的情况下，这比 Vault 的需要大得多，但它仍然为访问和日志记录的发生提供了一个单一的位置。因此，使用 Execute Callback 是访问 Vault API 的首选方式，以执行我们尚未作为`VaultTemplate`上的方法公开的不常见操作。 @@ -553,7 +553,7 @@ vaultOperations.doWithVault(new RestOperationsCallback有关支持的身份验证方法的详细信息，请参见[认证方法](#vault.core.authentication)。| -### [](#vault.core.reactive.template.sessionmanagement)11.4。会话管理 +### 11.4.会话管理 Spring Vault 需要令牌来验证 Vault 请求。有关身份验证的详细信息，请参见[认证方法](#vault.core.authentication)。反应式客户端需要一个非阻塞令牌供应商，其契约定义在`VaultTokenSupplier`中。令牌可以是静态的，也可以通过[声明的身份验证流程](#vault.authentication.steps)获得。Vault 登录不应该发生在每个经过身份验证的 Vault 交互上，但是会话令牌应该在会话上保存。该方面由实现`ReactiveSessionManager`的会话管理器处理，例如`ReactiveLifecycleAwareSessionManager`。 -### [](#vault.core.reactive.executioncallback)11.5。执行回调 +### 11.5.执行回调 Spring 所有模板类的一个常见设计特征是，所有功能都被路由到一个模板中执行回调方法。这有助于确保执行异常和可能需要的任何资源管理的一致性。虽然在 JDBC 和 JMS 的情况下，这比 Vault 的需要大得多，但它仍然为访问和日志记录的发生提供了一个单一的位置。因此，使用 Execute 回调是访问 Vault API 的首选方式，以执行我们在`ReactiveVaultTemplate`上没有作为方法公开的不常见操作。 @@ -937,7 +937,7 @@ reactiveVaultOperations.doWithVault(webClient -> { }); ``` -## [](#vault.core.propertysupport)12。保险库财产来源支持 +## 12.保险库财产来源支持 保险库可以有许多不同的使用方式。一个特定的用例是使用 Vault 存储加密的属性。 Spring Vault 支持 Vault 作为属性源，以使用 Spring 的[PropertySource 抽象](https://docs.spring.io/spring/docs/5.3.4/spring-framework-reference/core.html#beans-property-source-abstraction)获得配置属性。 @@ -965,7 +965,7 @@ sources.addFirst(new VaultPropertySource(vaultTemplate, "secret/my-application") `@VaultPropertySource`采用 vault 路径，如`secret/my-application`，并公开存储在节点`PropertySource`中的数据。`@VaultPropertySource`支持与租赁相关的秘密的租赁续订（即来自`mysql`后端的凭据）和在终端租赁到期时的凭据旋转。默认情况下，租约续订是禁用的。 -例 10。存储在保险库中的属性 +例 10.存储在保险库中的属性 ``` { @@ -982,7 +982,7 @@ sources.addFirst(new VaultPropertySource(vaultTemplate, "secret/my-application") } ``` -例 11。声明`@VaultPropertySource` +例 11.声明`@VaultPropertySource` ``` @Configuration @@ -1001,7 +1001,7 @@ public class AppConfig { } ``` -例 12。声明带有凭据旋转和前缀的`@VaultPropertySource` +例 12.声明带有凭据旋转和前缀的`@VaultPropertySource` ``` @Configuration @@ -1021,7 +1021,7 @@ public class AppConfig { 在`@VaultPropertySource`路径中存在的任何`${…​}`占位符都将根据已经针对该环境注册的一组属性源进行解析，如下例所示： -例 13。使用占位符声明`@VaultPropertySource`路径 +例 13.使用占位符声明`@VaultPropertySource`路径 ``` @Configuration @@ -1036,18 +1036,18 @@ public class AppConfig { 在某些情况下，当使用`@VaultPropertySource`注释时，严格控制属性源排序可能是不可能的或不实用的。例如，如果上面的`@Configuration`类是通过组件扫描注册的，那么排序是很难预测的。在这种情况下（如果重写很重要），建议用户回到使用 PropertySource API。详见[`ConfigurableEnvironment`]（https://DOCS. Spring.io/ Spring-framework/DOCS/current/javadoc-api/org/springframework/core/core/ENV/confirablebletermnirtonment.html）和[]（https://DOCS. Spring.io/ Spring/DOCS/current/javadoc-api/org/springframework/core/env/mutablepropertysources.html）） -## [](#vault.repositories)13。保险库 +## 13.保险库 使用`VaultTemplate`和映射到 Java 类的响应可以实现基本的数据操作，如读、写和删除。 Spring Vault 存储库在 Vault 之上应用了数据存储库的概念。Vault 存储库公开了基本的增删改查功能，并支持使用限制 ID 属性、分页和排序的谓词进行查询派生。 | |在[Spring Data Commons reference documentation](https://docs.spring.io/spring-data/commons/docs/current/reference/html/#repositories)中阅读有关 Spring 数据存储库的更多信息。参考文档将向你介绍 Spring 数据存储库。| |---|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -### [](#vault.repositories.usage)13.1。用法 +### 13.1.用法 要访问存储在 Vault 中的域实体，你可以利用存储库支持，从而大大简化这些实现。 -例 14。示例凭据实体 +例 14.示例凭据实体 ``` @Secret @@ -1067,7 +1067,7 @@ public class Credentials { 下一步是声明一个使用域对象的存储库接口。 -例 15。`Credentials`实体的基本存储库接口 +例 15.`Credentials`实体的基本存储库接口 ``` public interface CredentialsRepository extends CrudRepository { @@ -1081,7 +1081,7 @@ public interface CredentialsRepository extends CrudRepository @@ -1117,7 +1117,7 @@ public interface CredentialsRepository extends CrudRepository { @@ -1242,7 +1242,7 @@ public interface CredentialsRepository extends CrudRepository { @@ -1253,7 +1253,7 @@ public interface CredentialsRepository extends PagingAndSortingRepository @@ -1295,7 +1295,7 @@ Java 的内置`HttpURLConnection`是开箱即用的，不需要额外的配置 | |Apache HttpClient 的[电汇测井](https://hc.apache.org/httpcomponents-client-4.5.x/logging.html)可以通过日志配置来启用。确保不会意外地启用有线日志，因为日志可能会以纯文本的形式暴露应用程序和保险库之间的流量（令牌和秘密）。| |---|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -例 22。内蒂依赖 +例 22.内蒂依赖 ``` @@ -1304,7 +1304,7 @@ Java 的内置`HttpURLConnection`是开箱即用的，不需要额外的配置 ``` -例 23。Square OkHTTP3 +例 23.Square OkHTTP3 ``` @@ -1313,7 +1313,7 @@ Java 的内置`HttpURLConnection`是开箱即用的，不需要额外的配置 ``` -例 24。反应堆网状结构 +例 24.反应堆网状结构 ``` @@ -1322,7 +1322,7 @@ Java 的内置`HttpURLConnection`是开箱即用的，不需要额外的配置 ``` -例 25。 Jetty +例 25. Jetty ``` @@ -1331,7 +1331,7 @@ Java 的内置`HttpURLConnection`是开箱即用的，不需要额外的配置 ``` -### [](#vault.client-ssl)14.3。Vault 客户端 SSL 配置 +### 14.3.Vault 客户端 SSL 配置 通过设置各种属性，可以使用`SslConfiguration`配置 SSL。你可以设置`javax.net.ssl.trustStore`来配置 JVM 范围内的 SSL 设置，也可以设置`SslConfiguration`来仅为 Spring Vault 设置 SSL 设置。 @@ -1370,7 +1370,7 @@ SslConfiguration configuration = SslConfiguration.forTrustStore(keystore); PEM 文件可以包含一个或多个证书（块`-----BEGIN CERTIFICATE-----`和`-----END CERTIFICATE-----`）。添加到底层`KeyStore`的证书使用完整的主题名称作为别名。 -## [](#vault.core.authentication)15。认证方法 +## 15.认证方法 不同的组织对安全性和身份验证有不同的要求。Vault 通过提供多种身份验证方法来反映这种需求。 Spring Vault 支持多种身份验证机制。 @@ -1382,7 +1382,7 @@ PEM 文件可以包含一个或多个证书（块`-----BEGIN CERTIFICATE-----` Spring 的[PropertySource 抽象](https://docs.spring.io/spring/docs/5.3.4/spring-framework-reference/core.html#beans-property-source-abstraction)是将配置保持在应用程序代码之外的一种自然适合。你可以使用系统属性、环境变量或属性文件来存储登录凭据。每种方法都有自己的特性。请记住，可以通过适当的 OS 访问级别来内省命令行和环境属性。 -例 26。将`vault.token`外部化到属性文件 +例 26.将`vault.token`外部化到属性文件 ``` @PropertySource("configuration.properties") @@ -1401,7 +1401,7 @@ public class Config extends AbstractVaultConfiguration { 参见[`SecurePropertyUsage.java`]（https://github.com/ Spring-projects/ Spring-vault/blob/master/ Spring-vault-core/SRC/test/java/org/springframework/vault/demo/securepropertyusage.java），以获取在组件和其他属性源中引用属性的示例。 -### [](#vault.authentication.token)15.2。令牌认证 +### 15.2.令牌认证 令牌是在 Vault 中进行身份验证的核心方法。令牌身份验证需要提供一个静态令牌。 @@ -1431,7 +1431,7 @@ class AppConfig extends AbstractVaultConfiguration { * [Vault 文档：使用令牌身份验证后端](https://www.vaultproject.io/docs/auth/token.html) -### [](#vault.authentication.appid)15.3。APPID 身份验证 +### 15.3.APPID 身份验证 | |Appid 身份验证被 Vault 反对。用[Approle 身份验证](#vault.authentication.approle)代替。| |---|-----------------------------------------------------------------------------------------------------------------| @@ -1521,7 +1521,7 @@ public class MyUserIdMechanism implements AppIdUserIdMechanism { 另见：[Vault 文档：使用应用程序 ID Auth 后台](https://www.vaultproject.io/docs/auth/app-id.html) -### [](#vault.authentication.approle)15.4。Approle 身份验证 +### 15.4.Approle 身份验证 [AppRole](https://www.vaultproject.io/docs/auth/app-id.html)允许机器身份验证，就像不推荐的（自 Vault0.6.1）[APPID 身份验证](#vault.authentication.appid)一样。Approle 身份验证由两个难以猜测的（秘密）令牌组成：ROLEID 和 SECTROTID。 @@ -1575,7 +1575,7 @@ class AppConfig extends AbstractVaultConfiguration { 另见：[Vault 文档：使用 Approle Auth 后端](https://www.vaultproject.io/docs/auth/approle.html) -### [](#vault.authentication.awsec2)15.5。AWS-EC2 身份验证 +### 15.5.AWS-EC2 身份验证 [aws-ec2](https://www.vaultproject.io/docs/auth/aws-ec2.html)Auth 后端为 AWS EC2 实例提供了一种安全的引入机制，允许自动检索保险库令牌。与大多数 Vault 身份验证后端不同，该后端不需要首次部署或提供安全敏感的凭据（令牌、用户名/密码、客户端证书等）。相反，它将 AWS 视为受信任的第三方，并使用以密码签名的动态元数据信息来唯一地表示每个 EC2 实例。 @@ -1604,7 +1604,7 @@ AWS-EC2 身份验证角色是可选的，并且是 AMI 的默认值。可以通 另见：[Vault 文档：使用 AWS-EC2Auth 后端](https://www.vaultproject.io/docs/auth/aws-ec2.html) -### [](#vault.authentication.awsiam)15.6。AWS-IAM 身份验证 +### 15.6.AWS-IAM 身份验证 [aws](https://www.vaultproject.io/docs/auth/aws.html)Auth 后台允许使用现有的 AWS IAM 凭据进行 Vault 登录。 @@ -1631,7 +1631,7 @@ class AppConfig extends AbstractVaultConfiguration { } ``` -例 27。使用 AWS-EC2 实例配置文件作为凭证源 +例 27.使用 AWS-EC2 实例配置文件作为凭证源 ``` @Configuration @@ -1662,7 +1662,7 @@ class AppConfig extends AbstractVaultConfiguration { * [AWS 文档：STS GetCallerIdentity](https://docs.aws.amazon.com/STS/latest/APIReference/API_GetCallerIdentity.html) -### [](#vault.authentication.azuremsi)15.7。Azure（MSI）认证 +### 15.7.Azure（MSI）认证 [azure](https://www.vaultproject.io/docs/auth/azure.html)Auth 后端为 Azure VM 实例提供了一种安全的引入机制，允许自动检索 Vault 令牌。与大多数 Vault 身份验证后端不同，该后端不需要首次部署或提供安全敏感的凭据（令牌、用户名/密码、客户端证书等）。相反，它将 Azure 视为受信任的第三方，并使用可绑定到 VM 实例的托管服务标识和实例元数据信息。 @@ -1693,7 +1693,7 @@ Azure 身份验证需要有关 VM 环境的详细信息（订阅 ID、资源组 * [Azure 文档：托管服务标识](https://docs.microsoft.com/en-us/azure/active-directory/managed-service-identity/overview) -### [](#vault.authentication.gcpgce)15.8。GCP-GCE 认证 +### 15.8.GCP-GCE 认证 [gcp](https://www.vaultproject.io/docs/auth/gcp.html)Auth 后端允许 Vault 通过使用现有的 GCP（Google Cloud Platform）IAM 和 GCE 凭据登录。 @@ -1729,7 +1729,7 @@ class AppConfig extends AbstractVaultConfiguration { * [GCP 文件：验证实例的身份](https://cloud.google.com/compute/docs/instances/verifying-instance-identity) -### [](#vault.authentication.gcpiam)15.9。GCP-IAM 认证 +### 15.9.GCP-IAM 认证 [gcp](https://www.vaultproject.io/docs/auth/gcp.html)Auth 后端允许 Vault 通过使用现有的 GCP（Google Cloud Platform）IAM 和 GCE 凭据登录。 @@ -1770,7 +1770,7 @@ class AppConfig extends AbstractVaultConfiguration { * [GCP 文档：projects.serviceaccounts.signjwt](https://cloud.google.com/iam/reference/rest/v1/projects.serviceAccounts/signJwt)[]() -### [](#vault.authentication.pcf)15.10。PCF 认证 +### 15.10.PCF 认证 [pcf](https://www.vaultproject.io/docs/auth/pcf.html)Auth 后端允许对 PCF 实例进行 Vault 登录。它利用[PCF 的应用程序和容器身份保证](https://content.pivotal.io/blog/new-in-pcf-2-1-app-container-identity-assurance-via-automatic-cert-rotation)。 @@ -1806,7 +1806,7 @@ class AppConfig extends AbstractVaultConfiguration { * [Vault 文档：使用 PCF Auth 后端](https://www.vaultproject.io/docs/auth/pcf.html) -### [](#vault.authentication.clientcert)15.11。TLS 证书认证 +### 15.11.TLS 证书认证 `cert`Auth 后端允许使用 SSL/TLS 客户机证书进行身份验证，这些证书由 CA 签名或自签名。 @@ -1837,7 +1837,7 @@ class AppConfig extends AbstractVaultConfiguration { 另见：[Vault 文档：使用 CERTAuth 后端](https://www.vaultproject.io/docs/auth/cert.html) -### [](#vault.authentication.cubbyhole)15.12。空穴身份验证 +### 15.12.空穴身份验证 Cubbyhole 身份验证使用 Vault 原语提供安全的身份验证工作流。Cubbyhole 身份验证使用令牌作为主要登录方法。一个短暂的令牌用于从 Vault 的 Cubbyhole 秘密后端获得第二个登录 VaultToken。登录令牌通常寿命更长，并用于与 Vault 交互。可以从包装的响应或`data`部分检索登录令牌。 @@ -1846,7 +1846,7 @@ Cubbyhole 身份验证使用 Vault 原语提供安全的身份验证工作流。 | |令牌创建的响应包装需要 Vault0.6.0 或更高版本。| |---|--------------------------------------------------------------------| -例 28。排版和存储令牌 +例 28.排版和存储令牌 ``` $ vault token-create -wrap-ttl="10m" @@ -1858,7 +1858,7 @@ wrapping_token_creation_time: 2016-09-18 20:29:48.652957077 +0200 CEST wrapped_accessor: 46b6aebb-187f-932a-26d7-4f3d86a68319 ``` -例 29。包装的令牌响应用法 +例 29.包装的令牌响应用法 ``` @Configuration @@ -1884,7 +1884,7 @@ class AppConfig extends AbstractVaultConfiguration { **使用存储令牌** -例 30。排版和存储令牌 +例 30.排版和存储令牌 ``` $ vault token create @@ -1909,7 +1909,7 @@ $ export VAULT_TOKEN=895cb88b-aef4-0e33-ba65-d50007290780 $ vault write cubbyhole/token token=f9e30681-d46a-cdaf-aaa0-2ae0a9ad0819 ``` -例 31。存储令牌响应用法 +例 31.存储令牌响应用法 ``` @Configuration @@ -1947,7 +1947,7 @@ class AppConfig extends AbstractVaultConfiguration { * [保险库文档：响应包装](https://www.vaultproject.io/docs/concepts/response-wrapping.html) -### [](#vault.authentication.kubernetes)15.13。Kubernetes 认证 +### 15.13.Kubernetes 认证 Vault 支持使用 Kubernetes 令牌的基于 0.8.3[kubernetes](https://www.vaultproject.io/docs/auth/kubernetes.html)的身份验证。 @@ -1982,7 +1982,7 @@ class AppConfig extends AbstractVaultConfiguration { * [Kubernetes 文档：为 PODS 配置服务帐户](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/) -### [](#vault.authentication.steps)15.14。认证步骤 +### 15.14.认证步骤 `ClientAuthentication`对象描述身份验证流程并执行实际的身份验证步骤。预先组合的身份验证很容易使用，并通过与同步执行的紧密绑定进行配置。 @@ -1990,7 +1990,7 @@ class AppConfig extends AbstractVaultConfiguration { 身份验证步骤提供了公共身份验证活动的可重用性。通过`AuthenticationSteps`创建的步骤以功能风格描述了一个身份验证流程，将实际的身份验证执行留给了特定的执行者。 -例 32。存储令牌验证流. +例 32.存储令牌验证流. ``` AuthenticationSteps.just(VaultToken.of(…)); (1) @@ -2001,7 +2001,7 @@ AuthenticationSteps.just(VaultToken.of(…)); (1) 可以从单个输入创建单步身份验证流。声明多个身份验证步骤的流以`Supplier`或`HttpRequest`开始，这些流提供了一个身份验证状态对象，可用于将其映射或发布到 Vault 以进行登录。 -例 33。Approle 认证流程 +例 33.Approle 认证流程 ``` AuthenticationSteps.fromSupplier( (1) @@ -2024,7 +2024,7 @@ AuthenticationSteps.fromSupplier( (1) 许多`ClientAuthentication`都带有静态工厂方法，可以为它们的身份验证特定选项创建`AuthenticationSteps`: -例 34。同步`AuthenticationSteps`执行 +例 34.同步`AuthenticationSteps`执行 ``` CubbyholeAuthenticationOptions options = … @@ -2037,7 +2037,7 @@ AuthenticationStepsExecutor executor = new AuthenticationStepsExecutor(steps, re VaultToken token = executor.login(); ``` -### [](#vault.authentication.session)15.15。令牌生命周期 +### 15.15.令牌生命周期 Vault 的令牌可以与生存时间相关联。通过身份验证方法获得的令牌旨在在会话处于活动状态时使用，并且在应用程序处于活动状态时不应过期。 @@ -2053,15 +2053,15 @@ Spring Vault 提供了[`LifecycleAwareSessionManager`]（https://DOCS. Spring.io 直接创建`LoginToken`的身份验证方法（所有基于登录的身份验证方法）已经为设置令牌更新提供了所有必要的详细信息。如果会话Manager 被关闭，则`LifecycleAwareSessionManager`将撤销从登录中获得的令牌。 -## [](#vault.misc)16。杂项 +## 16.杂项 在本章中学习一些值得一提的细节，比如 Spring 安全集成。 -### [](#vault.misc.spring-security)16.1。 Spring 安全 +### 16.1. Spring 安全 Spring Vault 通过为[`BytesKeyGenerator`]（https://DOCS. Spring.io/ Spring-security/site/DOCS/current/reference/htmlsingle/# Spring-security-crypto-keygenerators）和[<<`BytesEncryptor`]（https://DOCS. Spring.io/ Spring-security/site/DOCS/current/reference/htmlsingle/# Spring-security-crypto-crypto-cryp 这两种实现都使用 Vault 的`transit`后端。 -例 35。`VaultBytesKeyGenerator`示例 +例 35.`VaultBytesKeyGenerator`示例 ``` VaultOperations operations = …; @@ -2070,7 +2070,7 @@ VaultBytesKeyGenerator generator = new VaultBytesKeyGenerator(operations); byte[] key = generator.generateKey(); ``` -例 36。`VaultBytesEncryptor`示例 +例 36.`VaultBytesEncryptor`示例 ``` VaultTransitOperations transit = …; -- GitLab