search

spring-cloud / spring-cloud-vault

Configuration Integration with HashiCorp Vault
http://cloud.spring.io/spring-cloud-vault/
Apache License 2.0
270 stars 151 forks source link

Add support for GCP Secret Engine to retrieve GCP Secret Key #646

Closed jjathman closed 1 year ago

jjathman commented 1 year ago

I looked through the documentation and I don't believe this is supported yet.

Similar to how database secrets can be retrieved from vault using a secret engine, we would like to utilize the GCP secret engine so that an application can retrieve its service account key at startup. This has the nice security benefit if limiting the lifespan of secret keys.

The easy alternative is to just download a secret key and base64 encode it and store it within Vault, but this key is now static and generally would need a very long lifespan.

I would love to see built in support for retrieving the spring.cloud.gcp.credentials.encoded-key from Vault's GCP secret engine, and periodic renewal of that lease with Vault until the application shuts down.

mp911de commented 1 year ago

Thanks for reaching out. We do not support the GCP backend because we do not have a Google Cloud integration on our side. It would make sense to host such an integration in Spring Cloud GCP.