VaultConfigSource implements ConfigSource { public static Builder builder() { return new Builder(); } private  VaultConfigSource(VaultInvoker vault, Collection<String> secretsPaths); @Override Map<String, ConfigProperty> loadConfig(); static Builder builder();  }
@Test void testInvalidToken() { VaultConfigSource vaultConfigSource = VaultConfigSource.builder() .config(c -> c.token("zzzzzz")) .config(c -> c.address("http: .addSecretsPath("secrets/unknown/path") .build(); assertThrows(ConfigSourceNotAvailableException.class, vaultConfigSource::loadConfig); }
@Test void shouldWorkWhenRegistryIsReloadedAndVaultIsRunning() throws InterruptedException { VaultInstance vaultInstance = vaultContainerExtension.startNewVaultInstance(); vaultInstance.putSecrets( VAULT_SECRETS_PATH1, "top_secret=password1", "db_password=dbpassword1"); String address = vaultInstance.address(); String rootToken = vaultInstance.rootToken(); ConfigRegistrySettings settings = ConfigRegistrySettings.builder() .addLastSource( "vault", VaultConfigSource.builder() .config(vaultConfig -> vaultConfig.address(address).token(rootToken)) .addSecretsPath(VAULT_SECRETS_PATH1) .build()) .jmxEnabled(false) .reloadIntervalSec(1) .build(); ConfigRegistry configRegistry = ConfigRegistry.create(settings); StringConfigProperty configProperty = configRegistry.stringProperty("top_secret"); assertThat(configProperty.value().get(), containsString("password1")); vaultInstance.putSecrets(VAULT_SECRETS_PATH1, " top_secret=new_password"); TimeUnit.SECONDS.sleep(2); assertThat(configProperty.value().get(), containsString("new_password")); }
@Test void shouldWorkWhenRegistryIsReloadedAndVaultIsDown() { String PASSWORD_PROPERTY_NAME = "password"; String PASSWORD_PROPERTY_VALUE = "123456"; String secret = PASSWORD_PROPERTY_NAME + "=" + PASSWORD_PROPERTY_VALUE; VaultInstance vaultInstance = vaultContainerExtension.startNewVaultInstance(); vaultInstance.putSecrets(VAULT_SECRETS_PATH1, secret); String address = vaultInstance.address(); String rootToken = vaultInstance.rootToken(); ConfigRegistrySettings settings = ConfigRegistrySettings.builder() .addLastSource( "vault", VaultConfigSource.builder() .config(vaultConfig -> vaultConfig.address(address).token(rootToken)) .addSecretsPath(VAULT_SECRETS_PATH1) .build()) .jmxEnabled(false) .reloadIntervalSec(1) .build(); ConfigRegistry configRegistry = ConfigRegistry.create(settings); StringConfigProperty configProperty = configRegistry.stringProperty(PASSWORD_PROPERTY_NAME); configProperty.addValidator(Objects::nonNull); vaultInstance.close(); assertFalse(vaultInstance.container().isRunning()); try { TimeUnit.SECONDS.sleep(2); } catch (InterruptedException e) { fail(e); } assertThat(configProperty.value().get(), containsString(PASSWORD_PROPERTY_VALUE)); }
@Test void shouldWorkWhenRegistryIsReloadedAndVaultIsUnSealed() throws InterruptedException { VaultInstance sealedVaultInstance = vaultContainerExtension.startNewVaultInstance(); sealedVaultInstance.putSecrets( VAULT_SECRETS_PATH1, "top_secret=password1", "db_password=dbpassword1"); String address = sealedVaultInstance.address(); String unsealKey = sealedVaultInstance.unsealKey(); String rootToken = sealedVaultInstance.rootToken(); ConfigRegistrySettings settings = ConfigRegistrySettings.builder() .addLastSource( "vault", VaultConfigSource.builder() .config(vaultConfig -> vaultConfig.address(address).token(rootToken)) .secretsPath(VAULT_SECRETS_PATH1) .build()) .jmxEnabled(false) .reloadIntervalSec(1) .build(); ConfigRegistry configRegistry = ConfigRegistry.create(settings); StringConfigProperty configProperty = configRegistry.stringProperty("top_secret"); assertThat( "initial value of top_secret", configProperty.value().get(), containsString("password1")); Vault vault = sealedVaultInstance.vault(); Map<String, Object> newValues = new HashMap<>(); newValues.put(configProperty.name(), "new_password"); try { vault.logical().write(VAULT_SECRETS_PATH1, newValues); vault.seal().seal(); assumeTrue(vault.seal().sealStatus().getSealed(), "vault seal status"); } catch (VaultException vaultException) { fail(vaultException.getMessage()); } TimeUnit.SECONDS.sleep(2); assumeFalse( configProperty.value().isPresent() && configProperty.value().get().contains("new_password"), "new value was unexpectedly set"); try { vault.seal().unseal(unsealKey); assumeFalse(vault.seal().sealStatus().getSealed(), "vault seal status"); } catch (VaultException vaultException) { fail(vaultException.getMessage()); } TimeUnit.SECONDS.sleep(2); assertThat(configProperty.value().get(), containsString("new_password")); }
@Test void testMissingTenant() { VaultConfigSource vaultConfigSource = VaultConfigSource.builder() .config(c -> c.token(vaultContainerExtension.vaultInstance().rootToken())) .config(c -> c.address(vaultContainerExtension.vaultInstance().address())) .addSecretsPath("secrets/unknown/path") .build(); assertThrows(ConfigSourceNotAvailableException.class, vaultConfigSource::loadConfig); }
@Test void testInvalidAddress() { VaultConfigSource vaultConfigSource = VaultConfigSource.builder() .config(c -> c.token(vaultContainerExtension.vaultInstance().rootToken())) .config(c -> c.address("http: .addSecretsPath(VAULT_SECRETS_PATH1) .build(); assertThrows(ConfigSourceNotAvailableException.class, vaultConfigSource::loadConfig); }