anchor.diff:  |Name | Default | Description
   
   |spring.cloud.vault.app-id.app-id-path | `app-id` | Mount path of the AppId authentication backend.
  -|spring.cloud.vault.app-id.network-interface | `` | Network interface hint for the "MAC_ADDRESS" UserId mechanism.
  +|spring.cloud.vault.app-id.network-interface |  | Network interface hint for the "MAC_ADDRESS" UserId mechanism.
   |spring.cloud.vault.app-id.user-id | `MAC_ADDRESS` | UserId mechanism. Can be either "MAC_ADDRESS", "IP_ADDRESS", a string or a class name.
   |spring.cloud.vault.app-role.app-role-path | `approle` | Mount path of the AppRole authentication backend.
  -|spring.cloud.vault.app-role.role | `` | Name of the role, optional, used for pull-mode.
  -|spring.cloud.vault.app-role.role-id | `` | The RoleId.
  -|spring.cloud.vault.app-role.secret-id | `` | The SecretId.
  +|spring.cloud.vault.app-role.role |  | Name of the role, optional, used for pull-mode.
  +|spring.cloud.vault.app-role.role-id |  | The RoleId.
  +|spring.cloud.vault.app-role.secret-id |  | The SecretId.
   |spring.cloud.vault.application-name | `application` | Application name for AppId authentication.
  -|spring.cloud.vault.authentication | `` | 
  +|spring.cloud.vault.authentication |  | 
   |spring.cloud.vault.aws-ec2.aws-ec2-path | `aws-ec2` | Mount path of the AWS-EC2 authentication backend.
   |spring.cloud.vault.aws-ec2.identity-document | `http://169.254.169.254/latest/dynamic/instance-identity/pkcs7` | URL of the AWS-EC2 PKCS7 identity document.
  -|spring.cloud.vault.aws-ec2.nonce | `` | Nonce used for AWS-EC2 authentication. An empty nonce defaults to nonce generation.
  -|spring.cloud.vault.aws-ec2.role | `` | Name of the role, optional.
  +|spring.cloud.vault.aws-ec2.nonce |  | Nonce used for AWS-EC2 authentication. An empty nonce defaults to nonce generation.
  +|spring.cloud.vault.aws-ec2.role |  | Name of the role, optional.
   |spring.cloud.vault.aws-iam.aws-path | `aws` | Mount path of the AWS authentication backend.
  -|spring.cloud.vault.aws-iam.endpoint-uri | `` | STS server URI. @since 2.2
  -|spring.cloud.vault.aws-iam.role | `` | Name of the role, optional. Defaults to the friendly IAM name if not set.
  -|spring.cloud.vault.aws-iam.server-name | `` | Name of the server used to set {@code X-Vault-AWS-IAM-Server-ID} header in the headers of login requests.
  +|spring.cloud.vault.aws-iam.endpoint-uri |  | STS server URI. @since 2.2
  +|spring.cloud.vault.aws-iam.role |  | Name of the role, optional. Defaults to the friendly IAM name if not set.
  +|spring.cloud.vault.aws-iam.server-name |  | Name of the server used to set {@code X-Vault-AWS-IAM-Server-ID} header in the headers of login requests.
   |spring.cloud.vault.aws.access-key-property | `cloud.aws.credentials.accessKey` | Target property for the obtained access key.
   |spring.cloud.vault.aws.backend | `aws` | aws backend path.
   |spring.cloud.vault.aws.enabled | `false` | Enable aws backend usage.
  -|spring.cloud.vault.aws.role | `` | Role name for credentials.
  +|spring.cloud.vault.aws.role |  | Role name for credentials.
   |spring.cloud.vault.aws.secret-key-property | `cloud.aws.credentials.secretKey` | Target property for the obtained secret key.
   |spring.cloud.vault.azure-msi.azure-path | `azure` | Mount path of the Azure MSI authentication backend.
  -|spring.cloud.vault.azure-msi.identity-token-service | `` | Identity token service URI. @since 3.0
  -|spring.cloud.vault.azure-msi.metadata-service | `` | Instance metadata service URI. @since 3.0
  -|spring.cloud.vault.azure-msi.role | `` | Name of the role.
  +|spring.cloud.vault.azure-msi.identity-token-service |  | Identity token service URI. @since 3.0
  +|spring.cloud.vault.azure-msi.metadata-service |  | Instance metadata service URI. @since 3.0
  +|spring.cloud.vault.azure-msi.role |  | Name of the role.
   |spring.cloud.vault.cassandra.backend | `cassandra` | Cassandra backend path.
   |spring.cloud.vault.cassandra.enabled | `false` | Enable cassandra backend usage.
   |spring.cloud.vault.cassandra.password-property | `spring.data.cassandra.password` | Target property for the obtained password.
  -|spring.cloud.vault.cassandra.role | `` | Role name for credentials.
  +|spring.cloud.vault.cassandra.role |  | Role name for credentials.
   |spring.cloud.vault.cassandra.static-role | `false` | Enable static role usage. @since 2.2
   |spring.cloud.vault.cassandra.username-property | `spring.data.cassandra.username` | Target property for the obtained username.
   |spring.cloud.vault.config.lifecycle.enabled | `true` | Enable lifecycle management.
  -|spring.cloud.vault.config.lifecycle.expiry-threshold | `` | The expiry threshold. {@link Lease} is renewed the given {@link Duration} before it expires. @since 2.2
  -|spring.cloud.vault.config.lifecycle.lease-endpoints | `` | Set the {@link LeaseEndpoints} to delegate renewal/revocation calls to. {@link LeaseEndpoints} encapsulates differences between Vault versions that affect the location of renewal/revocation endpoints. Can be {@link LeaseEndpoints#SysLeases} for version 0.8 or above of Vault or {@link LeaseEndpoints#Legacy} for older versions (the default). @since 2.2
  -|spring.cloud.vault.config.lifecycle.min-renewal | `` | The time period that is at least required before renewing a lease. @since 2.2
  +|spring.cloud.vault.config.lifecycle.expiry-threshold |  | The expiry threshold. {@link Lease} is renewed the given {@link Duration} before it expires. @since 2.2
  +|spring.cloud.vault.config.lifecycle.lease-endpoints |  | Set the {@link LeaseEndpoints} to delegate renewal/revocation calls to. {@link LeaseEndpoints} encapsulates differences between Vault versions that affect the location of renewal/revocation endpoints. Can be {@link LeaseEndpoints#SysLeases} for version 0.8 or above of Vault or {@link LeaseEndpoints#Legacy} for older versions (the default). @since 2.2
  +|spring.cloud.vault.config.lifecycle.min-renewal |  | The time period that is at least required before renewing a lease. @since 2.2
   |spring.cloud.vault.config.order | `0` | Used to set a {@link org.springframework.core.env.PropertySource} priority. This is useful to use Vault as an override on other property sources. @see org.springframework.core.PriorityOrdered
   |spring.cloud.vault.connection-timeout | `5000` | Connection timeout.
   |spring.cloud.vault.consul.backend | `consul` | Consul backend path.
   |spring.cloud.vault.consul.enabled | `false` | Enable consul backend usage.
  -|spring.cloud.vault.consul.role | `` | Role name for credentials.
  +|spring.cloud.vault.consul.role |  | Role name for credentials.
   |spring.cloud.vault.consul.token-property | `spring.cloud.consul.token` | Target property for the obtained token.
   |spring.cloud.vault.couchbase.backend | `database` | Couchbase backend path.
   |spring.cloud.vault.couchbase.enabled | `false` | Enable couchbase backend usage.
   |spring.cloud.vault.couchbase.password-property | `spring.couchbase.password` | Target property for the obtained password.
  -|spring.cloud.vault.couchbase.role | `` | Role name for credentials.
  +|spring.cloud.vault.couchbase.role |  | Role name for credentials.
   |spring.cloud.vault.couchbase.static-role | `false` | Enable static role usage.
   |spring.cloud.vault.couchbase.username-property | `spring.couchbase.username` | Target property for the obtained username.
   |spring.cloud.vault.database.backend | `database` | Database backend path.
   |spring.cloud.vault.database.enabled | `false` | Enable database backend usage.
   |spring.cloud.vault.database.password-property | `spring.datasource.password` | Target property for the obtained password.
  -|spring.cloud.vault.database.role | `` | Role name for credentials.
  +|spring.cloud.vault.database.role |  | Role name for credentials.
   |spring.cloud.vault.database.static-role | `false` | Enable static role usage.
   |spring.cloud.vault.database.username-property | `spring.datasource.username` | Target property for the obtained username.
   |spring.cloud.vault.discovery.enabled | `false` | Flag to indicate that Vault server discovery is enabled (vault server URL will be looked up via discovery).
  
positive.code: |spring.cloud.vault.session.lifecycle.expiry-threshold | `7s` | The expiry threshold for a {@link LoginToken}. The threshold represents a minimum TTL duration to consider a login token as valid. Tokens with a shorter TTL are considered expired and are not used anymore. Should be greater than {@code refreshBeforeExpiry} to prevent token expiry.
  |spring.cloud.vault.session.lifecycle.refresh-before-expiry | `5s` | The time period that is at least required before renewing the {@link LoginToken}.
  |spring.cloud.vault.ssl.cert-auth-path | `cert` | Mount path of the TLS cert authentication backend.
  |spring.cloud.vault.ssl.key-store | `` | Trust store that holds certificates and private keys.
  |spring.cloud.vault.ssl.key-store-password | `` | Password used to access the key store.
  |spring.cloud.vault.ssl.key-store-type | `` | Type of the key store. @since 3.0
  |spring.cloud.vault.ssl.trust-store | `` | Trust store that holds SSL certificates.
  |spring.cloud.vault.ssl.trust-store-password | `` | Password used to access the trust store.
  |spring.cloud.vault.ssl.trust-store-type | `` | Type of the trust store. @since 3.0
  |spring.cloud.vault.token | `` | Static vault token. Required if {@link #authentication} is {@code TOKEN}.
  |spring.cloud.vault.uri | `` | Vault URI. Can be set with scheme, host and port.
  
  |===
negative.code: |spring.cloud.vault.elasticsearch.backend | `database` | Database backend path.
  |spring.cloud.vault.elasticsearch.enabled | `false` | Enable elasticsearch backend usage.
  |spring.cloud.vault.elasticsearch.password-property | `spring.elasticsearch.rest.password` | Target property for the obtained password.
  |spring.cloud.vault.elasticsearch.role |  | Role name for credentials.
  |spring.cloud.vault.elasticsearch.static-role | `false` | Enable static role usage.
  |spring.cloud.vault.elasticsearch.username-property | `spring.elasticsearch.rest.username` | Target property for the obtained username.
  |spring.cloud.vault.enabled | `true` | Enable Vault config server.
  |spring.cloud.vault.fail-fast | `false` | Fail fast if data cannot be obtained from Vault.
  |spring.cloud.vault.gcp-gce.gcp-path | `gcp` | Mount path of the Kubernetes authentication backend.
  |spring.cloud.vault.gcp-gce.role |  | Name of the role against which the login is being attempted.
  |spring.cloud.vault.gcp-gce.service-account |  | Optional service account id. Using the default id if left unconfigured.
  |spring.cloud.vault.gcp-iam.credentials.encoded-key |  | The base64 encoded contents of an OAuth2 account private key in JSON format.
  |spring.cloud.vault.gcp-iam.credentials.location |  | Location of the OAuth2 credentials private key. <p> Since this is a Resource, the private key can be in a multitude of locations, such as a local file system, classpath, URL, etc.
  |spring.cloud.vault.gcp-iam.gcp-path | `gcp` | Mount path of the Kubernetes authentication backend.
  |spring.cloud.vault.gcp-iam.jwt-validity | `15m` | Validity of the JWT token.
  |spring.cloud.vault.gcp-iam.project-id |  | Overrides the GCP project Id.
  |spring.cloud.vault.gcp-iam.role |  | Name of the role against which the login is being attempted.
  |spring.cloud.vault.gcp-iam.service-account-id |  | Overrides the GCP service account Id.
  |spring.cloud.vault.host | `localhost` | Vault server host.
  |spring.cloud.vault.kubernetes.kubernetes-path | `kubernetes` | Mount path of the Kubernetes authentication backend.
  |spring.cloud.vault.kubernetes.role |  | Name of the role against which the login is being attempted.
  |spring.cloud.vault.kubernetes.service-account-token-file | `/var/run/secrets/kubernetes.io/serviceaccount/token` | Path to the service account token file.
  |spring.cloud.vault.kv.application-name | `application` | Application name to be used for the context.
  |spring.cloud.vault.kv.backend | `secret` | Name of the default backend.
  