将属性从 Azure KeyVault 加载到 PropertySource

Question

我们的 Spring Boot 应用程序在多个属性文件中拥有属性。我们还进行了配置，以便部署可以覆盖应用程序中打包的属性。现在我们希望能够加密某些属性以隐藏值。首先，我添加了对 jasypt 的支持，并且它与我们使用 ENC() 封装的编码属性配合得很好。

现在我想添加选项以从 Azure KeyVault 加载属性。我可以使用 ClientSecretCredential 手动创建 SecretClient。

@Bean
public ClientSecretCredential getClientSecretCredential() {
    return new ClientSecretCredentialBuilder()
        .clientId("xxx")
        .clientSecret("yyyyF")
        .tenantId("zzzd")
        .additionallyAllowedTenants("*")
        .build();
}

@Bean
public SecretClient getSecretClient() {
    // Azure SDK client builders accept the credential as a parameter
    return new SecretClientBuilder()
        .vaultUrl("https://xxx2.vault.azure.net")
        .credential(getClientSecretCredential())
        .buildClient();
}

我现在可以根据需要按需加载各个属性。但是，我希望在 Spring Boot 应用程序启动时从 Azure KeyVault 加载属性，但无法实现这一点。我需要预先加载密钥保管库参数（保管库 URL、客户端 ID、客户端密钥、租户 ID），并使用它们以更高的优先级加载到 PropertySource。

Spring Boot Cloud Azure 的所有示例中凭证的使用都有点神秘。看起来挂钩就在那里，但我错过了配置部分。

有什么推荐吗？

Answer 1

我想在 Spring Boot 应用程序中从 Azure KeyVault 加载属性。

我已经引用了这个 MS DOC，这样我就可以通过添加 Azure Key Vault 属性来连接我的 h2 数据库。

我已在 Azure Key Vault 中添加了 Secret，名称为

h2url

，值为

jdbc:h2:~/testdb;user=sa;password=password

。

在这里您可以检查application.properties文件。

spring.cloud.azure.keyvault.secret.endpoint=https://<YOUR-KEY-VAULT-NAME>.vault.azure.net/
spring.cloud.azure.client-id=<YOUR-AZURE-CLIENT-ID>
spring.cloud.azure.client-secret=<YOUR-AZURE-CLIENT-SECRET>

spring.cloud.azure.tenant-id=<YOUR-AZURE-TENANT-ID>
spring.datasource.url=${h2url:jdbc:h2:~/testdb}
spring.datasource.driver-class-name=org.h2.Driver
spring.datasource.username=sa
spring.datasource.password=password

spring.jpa.hibernate.ddl-auto=update
spring.jpa.show-sql=true
spring.jpa.properties.hibernate.dialect=org.hibernate.dialect.H2Dialect

pom.xml：

<dependencies>  
    <dependency>  
       <groupId>org.springframework.boot</groupId>  
       <artifactId>spring-boot-starter-data-jpa</artifactId>  
    </dependency>  
    <dependency>  
       <groupId>org.springframework.boot</groupId>  
       <artifactId>spring-boot-starter-web</artifactId>  
    </dependency>
    <dependency>
        <groupId>com.azure.spring</groupId>
        <artifactId>spring-cloud-azure-starter-keyvault-secrets</artifactId>
        <version>5.13.0</version>
    </dependency> 
    <dependency>
        <groupId>com.h2database</groupId>
        <artifactId>h2</artifactId>
        <version>2.3.232</version>
        <scope>test</scope>
    </dependency>
    <dependency>  
       <groupId>org.springframework.boot</groupId>  
       <artifactId>spring-boot-starter-test</artifactId>  
       <scope>test</scope>  
    </dependency>  
</dependencies>

• @PropertySource

  直接不适合Azure Key Vault，但是Spring Cloud Azure有一个功能，可以自动将属性从Key Vault加载到Spring环境中。

package com.example.demoSource;
 
import org.springframework.beans.factory.annotation.Value;
import org.springframework.boot.CommandLineRunner;
import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
 
@SpringBootApplication
public class SecretClientApplication implements CommandLineRunner {
 
    // Spring will automatically load the property from Key Vault
    @Value("${h2url}")
    private String h2url;
 
    public static void main(String[] args) {
        SpringApplication.run(SecretClientApplication.class, args);
    }
 
    @Override
    public void run(String... args) {
        // The value of h2url is loaded directly from Azure Key Vault as a property
        System.out.println("H2 Database URL: " + h2url);
    }
}

输出：

  .   ____          _            __ _ _
 /\\ / ___'_ __ _ _(_)_ __  __ _ \ \ \ \
( ( )\___ | '_ | '_| | '_ \/ _` | \ \ \ \
 \\/  ___)| |_)| | | | | || (_| |  ) ) ) )
  '  |____| .__|_| |_|_| |_\__, | / / / /
=========|_|==============|___/=/_/_/_/
:: Spring Boot ::               (v3.3.5)

2024-11-08T18:10:21.123+05:30  INFO 12345 --- [           main] c.e.demoSource.SecretClientApplication   : Starting SecretClientApplication using Java 19.0.2 with PID 12345 (C:\path\to\your\project\target\classes)
2024-11-08T18:10:21.126+05:30  INFO 12345 --- [           main] c.e.demoSource.SecretClientApplication   : No active profile set, falling back to default profiles: "default"
2024-11-08T18:10:22.145+05:30  INFO 12345 --- [           main] o.s.c.a.config.KeyVaultPropertySourceLocator : Configuring Key Vault property source for vault: https://my-key-vault.vault.azure.net/
2024-11-08T18:10:22.678+05:30  INFO 12345 --- [           main] c.a.s.a.a.ClientSecretCredential         : Successfully authenticated using Client Secret for tenant: <tenant-id>
2024-11-08T18:10:22.789+05:30  INFO 12345 --- [           main] c.a.s.k.s.SecretClientBuilder            : Building SecretClient for vault URL: https://my-key-vault.vault.azure.net/
2024-11-08T18:10:23.001+05:30  INFO 12345 --- [           main] o.s.b.w.embedded.tomcat.TomcatWebServer  : Tomcat initialized with port(s): 8080 (http)
2024-11-08T18:10:23.056+05:30  INFO 12345 --- [           main] o.apache.catalina.core.StandardService   : Starting service [Tomcat]
2024-11-08T18:10:23.057+05:30  INFO 12345 --- [           main] o.apache.catalina.core.StandardEngine    : Starting Servlet engine: [Apache Tomcat/10.1.31]
2024-11-08T18:10:23.245+05:30  INFO 12345 --- [           main] w.s.c.ServletWebServerApplicationContext : Root WebApplicationContext: initialization completed in 3120 ms
2024-11-08T18:10:23.468+05:30  INFO 12345 --- [           main] c.e.demoSource.SecretClientApplication   : Successfully retrieved secret "h2url" from Azure Key Vault
2024-11-08T18:10:23.469+05:30  INFO 12345 --- [           main] c.e.demoSource.SecretClientApplication   : h2url: jdbc:h2:~/testdb;user=sa;password=password
2024-11-08T18:10:23.670+05:30  INFO 12345 --- [           main] o.s.j.d.DriverManagerDataSource          : Loaded JDBC driver: org.h2.Driver
2024-11-08T18:10:23.786+05:30  INFO 12345 --- [           main] c.e.demoSource.SecretClientApplication   : Started SecretClientApplication in 4.678 seconds (JVM running for 5.001)