Skip to content

Latest commit

 

History

History
143 lines (141 loc) · 13.8 KB

_configprops.adoc

File metadata and controls

143 lines (141 loc) · 13.8 KB
Name Default Description

spring.cloud.vault.app-id.app-id-path

app-id

Mount path of the AppId authentication backend.

spring.cloud.vault.app-id.network-interface

Network interface hint for the "MAC_ADDRESS" UserId mechanism.

spring.cloud.vault.app-id.user-id

MAC_ADDRESS

UserId mechanism. Can be either "MAC_ADDRESS", "IP_ADDRESS", a string or a class name.

spring.cloud.vault.app-role.app-role-path

approle

Mount path of the AppRole authentication backend.

spring.cloud.vault.app-role.role

Name of the role, optional, used for pull-mode.

spring.cloud.vault.app-role.role-id

The RoleId.

spring.cloud.vault.app-role.secret-id

The SecretId.

spring.cloud.vault.application-name

application

Application name for AppId authentication.

spring.cloud.vault.authentication

spring.cloud.vault.aws-ec2.aws-ec2-path

aws-ec2

Mount path of the AWS-EC2 authentication backend.

spring.cloud.vault.aws-ec2.identity-document

http://169.254.169.254/latest/dynamic/instance-identity/pkcs7

URL of the AWS-EC2 PKCS7 identity document.

spring.cloud.vault.aws-ec2.nonce

Nonce used for AWS-EC2 authentication. An empty nonce defaults to nonce generation.

spring.cloud.vault.aws-ec2.role

Name of the role, optional.

spring.cloud.vault.aws-iam.aws-path

aws

Mount path of the AWS authentication backend.

spring.cloud.vault.aws-iam.endpoint-uri

STS server URI. @since 2.2

spring.cloud.vault.aws-iam.role

Name of the role, optional. Defaults to the friendly IAM name if not set.

spring.cloud.vault.aws-iam.server-name

Name of the server used to set {@code X-Vault-AWS-IAM-Server-ID} header in the headers of login requests.

spring.cloud.vault.aws.access-key-property

cloud.aws.credentials.accessKey

Target property for the obtained access key.

spring.cloud.vault.aws.backend

aws

aws backend path.

spring.cloud.vault.aws.credential-type

aws credential type

spring.cloud.vault.aws.enabled

false

Enable aws backend usage.

spring.cloud.vault.aws.role

Role name for credentials.

spring.cloud.vault.aws.role-arn

Role arn for assumed_role in case we have multiple roles associated with the vault role. @since 3.0.2

spring.cloud.vault.aws.secret-key-property

cloud.aws.credentials.secretKey

Target property for the obtained secret key.

spring.cloud.vault.aws.session-token-key-property

cloud.aws.credentials.sessionToken

Target property for the obtained secret key.

spring.cloud.vault.aws.ttl

0

TTL for sts tokens. Defaults to whatever the vault Role may have for Max. Also limited to what AWS supports to be the max for STS. @since 3.0.2

spring.cloud.vault.azure-msi.azure-path

azure

Mount path of the Azure MSI authentication backend.

spring.cloud.vault.azure-msi.identity-token-service

Identity token service URI. @since 3.0

spring.cloud.vault.azure-msi.metadata-service

Instance metadata service URI. @since 3.0

spring.cloud.vault.azure-msi.role

Name of the role.

spring.cloud.vault.cassandra.backend

cassandra

Cassandra backend path.

spring.cloud.vault.cassandra.enabled

false

Enable cassandra backend usage.

spring.cloud.vault.cassandra.password-property

spring.data.cassandra.password

Target property for the obtained password.

spring.cloud.vault.cassandra.role

Role name for credentials.

spring.cloud.vault.cassandra.static-role

false

Enable static role usage. @since 2.2

spring.cloud.vault.cassandra.username-property

spring.data.cassandra.username

Target property for the obtained username.

spring.cloud.vault.config.lifecycle.enabled

true

Enable lifecycle management.

spring.cloud.vault.config.lifecycle.expiry-threshold

The expiry threshold. {@link Lease} is renewed the given {@link Duration} before it expires. @since 2.2

spring.cloud.vault.config.lifecycle.lease-endpoints

Set the {@link LeaseEndpoints} to delegate renewal/revocation calls to. {@link LeaseEndpoints} encapsulates differences between Vault versions that affect the location of renewal/revocation endpoints. Can be {@link LeaseEndpoints#SysLeases} for version 0.8 or above of Vault or {@link LeaseEndpoints#Legacy} for older versions (the default). @since 2.2

spring.cloud.vault.config.lifecycle.min-renewal

The time period that is at least required before renewing a lease. @since 2.2

spring.cloud.vault.config.order

0

Used to set a {@link org.springframework.core.env.PropertySource} priority. This is useful to use Vault as an override on other property sources. @see org.springframework.core.PriorityOrdered

spring.cloud.vault.connection-timeout

5000

Connection timeout.

spring.cloud.vault.consul.backend

consul

Consul backend path.

spring.cloud.vault.consul.enabled

false

Enable consul backend usage.

spring.cloud.vault.consul.role

Role name for credentials.

spring.cloud.vault.consul.token-property

spring.cloud.consul.token

Target property for the obtained token.

spring.cloud.vault.couchbase.backend

database

Couchbase backend path.

spring.cloud.vault.couchbase.enabled

false

Enable couchbase backend usage.

spring.cloud.vault.couchbase.password-property

spring.couchbase.password

Target property for the obtained password.

spring.cloud.vault.couchbase.role

Role name for credentials.

spring.cloud.vault.couchbase.static-role

false

Enable static role usage.

spring.cloud.vault.couchbase.username-property

spring.couchbase.username

Target property for the obtained username.

spring.cloud.vault.database.backend

database

Database backend path.

spring.cloud.vault.database.enabled

false

Enable database backend usage.

spring.cloud.vault.database.password-property

spring.datasource.password

Target property for the obtained password.

spring.cloud.vault.database.role

Role name for credentials.

spring.cloud.vault.database.static-role

false

Enable static role usage.

spring.cloud.vault.database.username-property

spring.datasource.username

Target property for the obtained username.

spring.cloud.vault.databases

spring.cloud.vault.discovery.enabled

false

Flag to indicate that Vault server discovery is enabled (vault server URL will be looked up via discovery).

spring.cloud.vault.discovery.service-id

vault

Service id to locate Vault.

spring.cloud.vault.elasticsearch.backend

database

Database backend path.

spring.cloud.vault.elasticsearch.enabled

false

Enable elasticsearch backend usage.

spring.cloud.vault.elasticsearch.password-property

spring.elasticsearch.rest.password

Target property for the obtained password.

spring.cloud.vault.elasticsearch.role

Role name for credentials.

spring.cloud.vault.elasticsearch.static-role

false

Enable static role usage.

spring.cloud.vault.elasticsearch.username-property

spring.elasticsearch.rest.username

Target property for the obtained username.

spring.cloud.vault.enabled

true

Enable Vault config server.

spring.cloud.vault.fail-fast

false

Fail fast if data cannot be obtained from Vault.

spring.cloud.vault.gcp-gce.gcp-path

gcp

Mount path of the Kubernetes authentication backend.

spring.cloud.vault.gcp-gce.role

Name of the role against which the login is being attempted.

spring.cloud.vault.gcp-gce.service-account

Optional service account id. Using the default id if left unconfigured.

spring.cloud.vault.gcp-iam.credentials.encoded-key

The base64 encoded contents of an OAuth2 account private key in JSON format.

spring.cloud.vault.gcp-iam.credentials.location

Location of the OAuth2 credentials private key. <p> Since this is a Resource, the private key can be in a multitude of locations, such as a local file system, classpath, URL, etc.

spring.cloud.vault.gcp-iam.gcp-path

gcp

Mount path of the Kubernetes authentication backend.

spring.cloud.vault.gcp-iam.jwt-validity

15m

Validity of the JWT token.

spring.cloud.vault.gcp-iam.project-id

Overrides the GCP project Id.

spring.cloud.vault.gcp-iam.role

Name of the role against which the login is being attempted.

spring.cloud.vault.gcp-iam.service-account-id

Overrides the GCP service account Id.

spring.cloud.vault.host

localhost

Vault server host.

spring.cloud.vault.kubernetes.kubernetes-path

kubernetes

Mount path of the Kubernetes authentication backend.

spring.cloud.vault.kubernetes.role

Name of the role against which the login is being attempted.

spring.cloud.vault.kubernetes.service-account-token-file

/var/run/secrets/kubernetes.io/serviceaccount/token

Path to the service account token file.

spring.cloud.vault.kv.application-name

application

Application name to be used for the context.

spring.cloud.vault.kv.backend

secret

Name of the default backend.

spring.cloud.vault.kv.backend-version

2

Key-Value backend version. Currently supported versions are: <ul> <li>Version 1 (unversioned key-value backend).</li> <li>Version 2 (versioned key-value backend).</li> </ul>

spring.cloud.vault.kv.default-context

application

Name of the default context.

spring.cloud.vault.kv.enabled

true

Enable the kev-value backend.

spring.cloud.vault.kv.profile-separator

/

Profile-separator to combine application name and profile.

spring.cloud.vault.kv.profiles

List of active profiles. @since 3.0

spring.cloud.vault.mongodb.backend

mongodb

MongoDB backend path.

spring.cloud.vault.mongodb.enabled

false

Enable mongodb backend usage.

spring.cloud.vault.mongodb.password-property

spring.data.mongodb.password

Target property for the obtained password.

spring.cloud.vault.mongodb.role

Role name for credentials.

spring.cloud.vault.mongodb.static-role

false

Enable static role usage. @since 2.2

spring.cloud.vault.mongodb.username-property

spring.data.mongodb.username

Target property for the obtained username.

spring.cloud.vault.mysql.backend

mysql

mysql backend path.

spring.cloud.vault.mysql.enabled

false

Enable mysql backend usage.

spring.cloud.vault.mysql.password-property

spring.datasource.password

Target property for the obtained username.

spring.cloud.vault.mysql.role

Role name for credentials.

spring.cloud.vault.mysql.username-property

spring.datasource.username

Target property for the obtained username.

spring.cloud.vault.namespace

Vault namespace (requires Vault Enterprise).

spring.cloud.vault.pcf.instance-certificate

Path to the instance certificate (PEM). Defaults to {@code CF_INSTANCE_CERT} env variable.

spring.cloud.vault.pcf.instance-key

Path to the instance key (PEM). Defaults to {@code CF_INSTANCE_KEY} env variable.

spring.cloud.vault.pcf.pcf-path

pcf

Mount path of the Kubernetes authentication backend.

spring.cloud.vault.pcf.role

Name of the role against which the login is being attempted.

spring.cloud.vault.port

8200

Vault server port.

spring.cloud.vault.postgresql.backend

postgresql

postgresql backend path.

spring.cloud.vault.postgresql.enabled

false

Enable postgresql backend usage.

spring.cloud.vault.postgresql.password-property

spring.datasource.password

Target property for the obtained username.

spring.cloud.vault.postgresql.role

Role name for credentials.

spring.cloud.vault.postgresql.username-property

spring.datasource.username

Target property for the obtained username.

spring.cloud.vault.rabbitmq.backend

rabbitmq

rabbitmq backend path.

spring.cloud.vault.rabbitmq.enabled

false

Enable rabbitmq backend usage.

spring.cloud.vault.rabbitmq.password-property

spring.rabbitmq.password

Target property for the obtained password.

spring.cloud.vault.rabbitmq.role

Role name for credentials.

spring.cloud.vault.rabbitmq.username-property

spring.rabbitmq.username

Target property for the obtained username.

spring.cloud.vault.reactive.enabled

true

Flag to indicate that reactive discovery is enabled

spring.cloud.vault.read-timeout

15000

Read timeout.

spring.cloud.vault.retry.initial-interval

1000

Initial retry interval in milliseconds.

spring.cloud.vault.retry.multiplier

1.1

Multiplier for next interval.

spring.cloud.vault.retry.max-interval

2000

Maximum interval for backoff.

spring.cloud.vault.retry.max-attempts

6

Maximum number of attempts.

spring.cloud.vault.scheme

https

Protocol scheme. Can be either "http" or "https".

spring.cloud.vault.session.lifecycle.enabled

true

Enable session lifecycle management.

spring.cloud.vault.session.lifecycle.expiry-threshold

7s

The expiry threshold for a {@link LoginToken}. The threshold represents a minimum TTL duration to consider a login token as valid. Tokens with a shorter TTL are considered expired and are not used anymore. Should be greater than {@code refreshBeforeExpiry} to prevent token expiry.

spring.cloud.vault.session.lifecycle.refresh-before-expiry

5s

The time period that is at least required before renewing the {@link LoginToken}.

spring.cloud.vault.ssl.cert-auth-path

cert

Mount path of the TLS cert authentication backend.

spring.cloud.vault.ssl.enabled-cipher-suites

List of enabled SSL/TLS cipher suites. @since 3.0.2

spring.cloud.vault.ssl.enabled-protocols

List of enabled SSL/TLS protocol. @since 3.0.2

spring.cloud.vault.ssl.key-store

Trust store that holds certificates and private keys.

spring.cloud.vault.ssl.key-store-password

Password used to access the key store.

spring.cloud.vault.ssl.key-store-type

Type of the key store. @since 3.0

spring.cloud.vault.ssl.trust-store

Trust store that holds SSL certificates.

spring.cloud.vault.ssl.trust-store-password

Password used to access the trust store.

spring.cloud.vault.ssl.trust-store-type

Type of the trust store. @since 3.0

spring.cloud.vault.token

Static vault token. Required if {@link #authentication} is {@code TOKEN}.

spring.cloud.vault.uri

Vault URI. Can be set with scheme, host and port.