Hashi Corp KV Secrets Manager integration with SpringBoot Application

Securing your secrets inside application is not an easy task. Typically applications deployed to multiple environments, and developers have to maintain separate credentials for each environment in configuration files, if there is no encryption mechanism (most of the time :( ) those username and passwords or secrets for token generation (API keys), database connections are stored as plain text. If there is a security breach, sensitive data can be compromised and lose millions of your business, because of not having encryption in place.

To address this there are various solutions available in the market. The most popular ones are the AWS Secret Manager, HashiCorp, Google Cloud KMS etc. Most of these services provide Authorization to secret vaults, Verification of Usage of Keys, Encryption data at rest, Automated Key Rotation etc. Selecting a suitable application is depend on your requirement of the organization or by the features of the service. If you are using AWS and deployed your application is cloud, AWS Secret Manager is one best possibility, since the management overhead is minimal. But for some companies which having serious security concerns, they tend to use on premise solution, and Hashi Corp can be a suitable choice. 

The scope of this post is to how to configure and use HashiCorp KV Secret Engine, and consume those secrets inside a SpringBoot application.

Image source - https://www.vaultproject.io/

Configuring the Hashi Corp Vault.
1. Download the community version from [1]. https://www.vaultproject.io/downloads.html
2. Extract and set the path to the vault bin

export PATH=$PATH:/home/aruna/vault/bin

3. Start the vault with dev configuration

vault server --dev --dev-root-token-id="12345678" // use secure token to seed

 4. Now open another terminal and put some secrets to the vault, In KV secrets engine version 2 write operation has changed to put.

export PATH=$PATH:/home/aruna/vault/bin
vault kv put secret/my-secret username=spring-user password=se3ret

5. You can test the values are saved to vault using following curl command.

 curl --header "X-Vault-Token: 12345678"        http://127.0.0.1:8200/v1/secret/data/my-secret

      If the request is a success should get the below response.

{  
   "request_id":"b0a0f055-3eed-b3c1-353f-427de8f61bcd",
   "lease_id":"",
   "renewable":false,
   "lease_duration":0,
   "data":{  
      "data":{  
         "password":"se3ret",
         "username":"spring-user"
      },
      "metadata":{  
         "created_time":"2018-11-14T09:21:46.812937558Z",
         "deletion_time":"",
         "destroyed":false,
         "version":2
      }
   },
   "wrap_info":null,
   "warnings":null,
   "auth":null
}

More about the rest API can be found here.
[2]. https://www.vaultproject.io/api/secret/kv/kv-v2.html

Setting up the SpringBoot project to consume the secret stored above.

Add the following properties to your bootstrap.properties file. Before starting the application, these values should be injected to the spring vault to work.

spring.application.name=my-secret // name of the KV secrets engine
spring.cloud.vault.token=12345678 //token value set for server
spring.cloud.vault.scheme=http
spring.cloud.vault.kv.enabled=true

Then load the properties as follows.

@ConfigurationProperties
public class SecretConfiguration {

    private String username;
    private String password;

    public String getUsername() {
        return username;
    }

    public void setUsername(String username) {
        this.username = username;
    }

    public String getPassword() 
        return password;
    }

    public void setPassword(String password) {
        this.password = password;
    }
}

Full sample can be found here. [3]. https://github.com/arunasujith/hashi-corp-vault-sample
That's it for this article, hope you to see you in another exciting post.

Dependency Injection Simplified

Dependency Injection or Dependency Inversion is a design pattern to decouple objects to overcome the dependency relation in objects. Say there are objects tied to each other for example there is a Drawing application.  

Lets say there are two Circle and Triangle Classes which has a draw method in both classes. So when ever I want to use the draw method in my application I have to call the method as below specifically saying the object type.

    Circle circle = new Circle();

    circle.draw();

    Triangle triangle = new Triangle();

    triangle.draw();

Using Polymorphism

Polymorphism Example

Introducing Shape interface or the parent class called Shape, both the draw methods in the Circle and Triangle Classes will override the draw method in the Shape Class.

Removing Dependency (Method Parameter)

To remove the dependency we can introduce a drawMethod() which will take shape as the parameter. Since both Circle and Triangle classes are inherited the dependency have been removed.

   public void  drawMethod(Shape shape){

      shape.draw();

   }

What ever object pass into the drawMethod() it will draw the shape accordingly. But still we haven't fully solve the problem.

 Removing Dependency (Using Drawing Class)

public class Drawing{

         private Shape shape;

         public void setShape(Shape shape){

                  this.shape = shape;

         }  

        public void drawShape(){

                  this.shape.draw();

        }     

}                                                                

Now the advantage of having this Drawing class is that it if fully independent from the type of the Shape. As long as the passed variable is inherited from the Shape Class. The idea is you are separating all the dependency out of a class. If the object you have to draw you don't have to care because the class Drawing has no idea of the type of the object which you are drawing. Drawing class doesn't holding the relationship. Dependency is injected through a different class to the Drawing class.  

So to use the Drawing Class

      Triangle triangle = new Triangle();

      drawing.setShape(triangle);

      drawing.drawShape();

Dependency is not hard coded to the class. It is actually injected by an entity outside the class. The Spring Framework makes it very easy to use this dependency Injection so before hand it's better you understand these concepts properly.