Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Make sure all contents in readme is included for secret management module #802

Closed
wants to merge 6 commits into from
Closed
Changes from 2 commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
93 changes: 63 additions & 30 deletions docs/src/main/asciidoc/secret-management.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -9,8 +9,8 @@ spring-cloud-azure-starter-keyvault-secrets adds Azure Key Vault as one of the S
[source,xml]
----
<dependency>
<groupId>com.azure.spring</groupId>
<artifactId>spring-cloud-azure-starter-keyvault-secrets</artifactId>
<groupId>com.azure.spring</groupId>
<artifactId>spring-cloud-azure-starter-keyvault-secrets</artifactId>
</dependency>
----

Expand Down Expand Up @@ -39,6 +39,7 @@ NOTE: If you choose to use a security principal to authenticate and authorize wi
==== One property source

===== Property configuration
If you want to authenticate by `client-id` and `client-secret`, the following properties are required:

[source,yml]
----
Expand All @@ -56,23 +57,25 @@ spring:
endpoint: ${AZURE_KEYVAULT_ENDPOINT}
----

If your application is authenticated by other methods like Managed Identity or Azure CLI, properties like `tenant-id`, `client-id`, `client-secret` is not necessary. But if these properties are configured, then these properties have higher priority. Please refer to link:authentication.html[Authentication section] to get more information.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

properties like tenant-id, client-id, client-secret is not necessary --> properties like tenant-id, client-id, client-secret are not necessary

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Updated.


===== Java code

[source,java]
----
@SpringBootApplication
public class KeyVaultSample implements CommandLineRunner {

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Have you tested it?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No, it's just code snippet, not project, no need to test, I think.

@Value("${your-property-name}")
private String mySecretProperty;
@Value("${sampleProperty}")
private String sampleProperty;

public static void main(String[] args) {
SpringApplication.run(KeyVaultSample.class, args);
}

@Override
public void run(String... args) {
System.out.println("property your-property-name value is: " + mySecretProperty);
System.out.println("property sampleProperty value is: " + sampleProperty);
}
}
----
Expand All @@ -90,24 +93,25 @@ spring:
secret:
property-source-enabled: true
property-sources:
-
name: key-vault-1
endpoint: ${ENDPOINT_1}
profile:
tenant-id: ${AZURE_TENANT_ID_1}
credential:
client-id: ${AZURE_CLIENT_ID_1}
client-secret: ${AZURE_CLIENT_SECRET_1}
-
name: key-vault-2
endpoint: ${ENDPOINT_2}
profile:
tenant-id: ${AZURE_TENANT_ID_2}
credential:
client-id: ${AZURE_CLIENT_ID_2}
client-secret: ${AZURE_CLIENT_SECRET_2}
-
name: key-vault-1
endpoint: ${ENDPOINT_1}
profile:
tenant-id: ${AZURE_TENANT_ID_1}
credential:
client-id: ${AZURE_CLIENT_ID_1}
client-secret: ${AZURE_CLIENT_SECRET_1}
-
name: key-vault-2
endpoint: ${ENDPOINT_2}
profile:
tenant-id: ${AZURE_TENANT_ID_2}
credential:
client-id: ${AZURE_CLIENT_ID_2}
client-secret: ${AZURE_CLIENT_SECRET_2}

----
Same as above, properties like `tenant-id`, `client-id`, `client-secret` is not necessary if authenticate by other methods.

===== Java code

Expand All @@ -116,26 +120,55 @@ spring:
@SpringBootApplication
public class SampleApplication implements CommandLineRunner {

@Value("${secret-name-in-key-vault-1}")
private String secretNameInKeyVault1;
@Value("${secret-name-in-key-vault-2}")
private String secretNameInKeyVault2;
@Value("${secret-name-in-key-vault-both}")
private String secretNameInKeyVaultBoth;
@Value("${sampleProperty1}")
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why do you change the names here, if you are willing to do this change, will you also update the names in samples?
image

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

private String sampleProperty1;
@Value("${sampleProperty2}")
private String sampleProperty2;
@Value("${samplePropertyInMultipleKeyVault}")
private String samplePropertyInMultipleKeyVault;

public static void main(String[] args) {
SpringApplication.run(SampleApplication.class, args);
}

public void run(String[] args) {
System.out.println("secretNameInKeyVault1: " + secretNameInKeyVault1);
System.out.println("secretNameInKeyVault2: " + secretNameInKeyVault2);
System.out.println("secretNameInKeyVaultBoth: " + secretNameInKeyVaultBoth);
System.out.println("sampleProperty1: " + sampleProperty1);
System.out.println("sampleProperty2: " + sampleProperty2);
System.out.println("samplePropertyInMultipleKeyVault: " + samplePropertyInMultipleKeyVault);
}

}
----

=== Advanced Usage

==== Special characters in property name
Key Vault secret name only support characters in `[0-9a-zA-Z-]`. Refs: link:https://docs.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates#vault-name-and-object-name[Vault-name and Object-name]. If your property name contains other characters, you can use these workarounds:

===== Use `-` instead of `.` in secret name

`.` is not supported in secret name. If your application have property name which contain `.`, like `spring.datasource.url`, just replace `.` to `-` when save secret in Azure Key Vault. For example: Save `spring-datasource-url` in Azure Key Vault. In your application, you can still use `spring.datasource.url` to retrieve property value.

===== Use property placeholders
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

An other question is,
I think ==== is for title, do you think we should use the same pattern(Style) for titles, refer here.
image

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Updated.

And I created an issue to update all titles: Azure/azure-sdk-for-java#26458


For example: setting this property in your application.properties:
[source,properties]
----
property.with.special.character__=${propertyWithoutSpecialCharacter}
----

The application will get `propertyWithoutSpecialCharacter` key name and assign its value to `property.with.special.character__`.

==== Case Sensitive

To enable case-sensitive mode, you can set the following property:

[source,properties]
----
spring.cloud.azure.keyvault.secret.property-sources[].case-sensitive=true
----


=== Samples

Please refer to link:https://github.com/Azure-Samples/azure-spring-boot-samples/tree/spring-cloud-azure_4.0[azure-spring-boot-samples] for more details.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think it's better to link the keyvault samples here.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Updated.

Expand Down