Auto reload secrets from vault

[devlsc]

Is your feature request related to a problem? Please describe.
We are adding in some services secrets over time, and we need to restart the service/or refresh the context externally via actuator endpoint, after updating the secrets in vault. Introducing a auto reload mechanism would improve the workflow.

Describe the solution you'd like
Integrating the hashicorp/vault documenteted solution natively into the spring-cloud-vault-config library. Maybe with additionally checking if the secret version has changed.

Describe alternatives you've considered
Implementing it myself into services/creating a company wide library to realize this feature.

[mp911de]

Currently, you can register renewable Key/Value property sources through

SecretBackendConfigurer on VaultConfigurer.

Here's an example using VaultBootstrapper.fromConfigurer(…):

SpringApplication application = new SpringApplication(…);
application.addBootstrapRegistryInitializer(
		VaultBootstrapper.fromConfigurer(configurer -> configurer.add(RequestedSecret.rotating("secret/my-secrets"))));

The path secret/customized will be mounted into Environment as PropertySource.

Alternatively, you can use @VaultPropertySource via

@Configuration
@VaultPropertySource(propertyNamePrefix = "my-secrets.", value = "secret/my-secrets",
		renewal = VaultPropertySource.Renewal.ROTATE)
public class RotatingGenericSecretsIntegrationTestConfiguration {

Note that secret-based rotation only works for the Key Value backend v1, versioned secrets don't support the TTL-based lease duration propagation, see hashicorp/vault#6274.

[devlsc]

Thanks a lot for the response @mp911de,
we are unfortunately using KVv2 secrets.