spring-cloud / spring-cloud/spring-cloud-vault
static database roles auto rotation support
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 291
- Forks
- 152
- Avg merge
- 11h 24m
- Merged PRs (30d)
- 3
Description
Is your feature request related to a problem? Please describe.
We are using vault to manage existing database account. The roles are not created by vault, but vault will manage the passwords for these roles. We have add "spring-cloud-starter-vault-config" and "spring-clould-vault-config-databases" dependencies, no issue to retrieve the username/password from our springboot application. However in terms of password rotation, looks spring clould valut doesn't support auto refresh datasouce bean when password got rotated on vault end for these static database role.
So we want this can be supported.
For our vault setup, I could see following:
- In the response of calling vault database credential retrieve API, I could see following:
{
...
lease_id: "",
renewable: false,
lease_duration: 0,
data: {
...
username: xxx
password: yyy
rotation_period: 15552000,
ttl: 4274939
}
mount_type: "database"
...
}
Here the ttl tell the remaining time that the password will get rotated.
- On valut end, there is a rotation API configured so that client application can call it to rotate the password proactively before just before the password get rotated by vault based on TTL value.
The applicaitons cache the passwords in-memory to avoid repeated calls to Hashicorp vault to read the passwords. In such scenarios, if the vault rotates the password on its own, application functionality will fail as the cached password and the new one will not be in sync. Hence a controlled rotation of password via API will always gives the added assurance to the applications.
Describe the solution you'd like
The spring clould vault database library can support the database password rotation by calling the vault rotation API endpoint before it gets expired.
Describe alternatives you've considered
Since currently looks spring clould vault doesn't support rotation for static database role, we have to stop using it which is configuraiton-driven solution, and writing code to retrive password and do the rotation and bean refresh.
Additional context
Add any other context or screenshots about the feature request here.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No repository files or tests are named. Start by tracing the spring-cloud-starter-vault-config and spring-cloud-vault-config-databases integration, including static-role credential retrieval, the rotation API endpoint, and datasource bean refresh. Done means proactive rotation and refreshed credentials work before the Vault TTL expires.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring
- Domain
- backend, cloud, databases
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100