3

我想连接到 Vault 服务器并在 spring 应用程序中读取我的秘密

保险库配置：

spring:
  application:
    name: inquiry
  profiles:
    active: dev
  cloud:
    vault:
      kv:
        enabled: true
        backend: secret
        profile-separator: '/'
        application-name: inquiry
      host: development
      port: 8200
      scheme: https
      authentication: token
      token: my-token
      ssl:
        trust-store: development-truststore.jks
        trust-store-password: pass

在保险库中，我有查询策略添加附件查询令牌

vault policy read inquiry
path "secret/*" {
  capabilities = ["read", "list"]
}

path "secret/data/inquiry/*" {
  capabilities = ["read", "create", "update"]
}

curl --header "X-Vault-Token:my-token" -k https://localhost:8200/v1/secret/data/inquiry/dev

返回我的数据

{"request_id":"35548b9e-3422-201b-6243-a600d7f61fc3","lease_id":"","renewable":false,"lease_duration":0,"data":{"data":{"DBPassword":"pass","DBUser":"user"},"metadata":{"created_time":"2020-07-08T09:02:42.237713857Z","deletion_time":"","destroyed":false,"version":1}},"wrap_info":null,"warnings":null,"auth":null}

但在春天我得到了这个错误：

2020-07-08 13:55:50.131  INFO 83792 --- [           main] o.s.v.a.LifecycleAwareSessionManager     : Scheduling Token renewal
2020-07-08 13:55:50.159  INFO 83792 --- [           main] o.s.v.c.e.LeaseAwareVaultPropertySource  : Vault location [secret/inquiry] not resolvable: Not found
2020-07-08 13:55:50.167  INFO 83792 --- [           main] o.s.v.c.e.LeaseAwareVaultPropertySource  : Vault location [secret/application/dev] not resolvable: Not found
2020-07-08 13:55:50.174  INFO 83792 --- [           main] o.s.v.c.e.LeaseAwareVaultPropertySource  : Vault location [secret/application] not resolvable: Not found
2020-07-08 13:55:50.175  INFO 83792 --- [           main] b.c.PropertySourceBootstrapConfiguration : Located property source: [BootstrapPropertySource {name='bootstrapProperties-secret/inquiry/dev'}, BootstrapPropertySource {name='bootstrapProperties-secret/inquiry'}, BootstrapPropertySource {name='bootstrapProperties-secret/application/dev'}, BootstrapPropertySource {name='bootstrapProperties-secret/application'}]
2020-07-08 13:55:50.181  INFO 83792 --- [           main] i.c.i.sepam.inquiry.InquiryApplication   : The following profiles are active: dev

我用的是jdk14。我该如何解决呢，谢谢

4

1 回答 1

0

问题出在您的保险柜政策中。

path "secret/data/inquiry/*" {
  capabilities = ["read", "create", "update"]
}

删除尾随/，让secret/data/inquiry* Spring 在查询时寻找对 ak/v 存储的访问权限，而不是在子目录中。

Spring 请求访问位于 和 的 k/ secret/app-namevsecret/application存储secret/app-name/spring-active-profile。对于每条路径，它都需要一个包含所有秘密的 k/v 存储。

我假设这个问题在不久前被海报解决了，但是当我有一个不熟悉 spring 的人设置我的应用程序的权限时，我遇到了同样的事情。

于 2020-11-28T16:13:14.720 回答