Spring Cloud Connectors
Pivotal Web Services End of Availability Announced
For more information, see Frequently Asked Questions.
To connect client apps to the Config Server, Spring Cloud Services uses Spring Cloud Connectors, including the Spring Cloud Cloud Foundry Connector, which discovers services bound to apps running in Cloud Foundry.
Service Detection
The connector inspects Cloud Foundry’s VCAP_SERVICES
environment variable, which stores connection and identification information for service instances that are bound to Cloud Foundry apps, to detect available services. Below is an example of a VCAP_SERVICES
entry for the Spring Cloud Services Config Server.
{
"VCAP_SERVICES": {
"p-config-server": [
{
"binding_name": null,
"credentials": {
"access_token_uri": "https://p-spring-cloud-services.uaa.sys.example.com/oauth/token",
"client_id": "p-config-server-example-client-id",
"client_secret": "EXAMPLE_SECRET",
"uri": "https://config-c61e8f98-72d0-444d-abfc-2668ace3af9b.apps.example.com"
},
"instance_name": "cook-config-server",
"label": "p-config-server",
"name": "cook-config-server",
"plan": "standard",
"provider": null,
"syslog_drain_url": null,
"tags": [
"configuration",
"spring-cloud"
],
"volume_mounts": []
}
]
}
}
For each service in the VCAP_SERVICES
variable, the connector considers the following fields:
tags
: Attributes or names of backing technologies behind the service.label
: The service offering’s name (not to be confused with a service instance’s name).credentials.uri
: A URI pertaining to the service instance.credentials.uris
: URIs pertaining to the service instance.
Config Server Detection Criteria
To establish availability of the Config Server, the Spring Cloud Cloud Foundry Connector compares VCAP_SERVICES
service entries against the following criteria:
tags
includingconfiguration
Application Configuration
When the connector detects a Config Server service instance which has been bound to the app, it will automatically set the spring.cloud.config.uri
property in the client app’s environment, using the URL provided in the Config Server instance’s credentials
object. The connector will also set additional security properties to allow the client app to access the Config Server service instance.
HashiCorp Vault Token Renewal
When Spring’s scheduled task execution support is enabled in a client app (using the @EnableScheduling
annotation) and the SPRING_CLOUD_CONFIG_TOKEN
environment variable (or the spring.cloud.config.token
property) is set on the app, the connector enables automatic token renewal for a HashiCorp Vault client token. By default, the token’s Time To Live (TTL) is set at 300000 milliseconds and the connector automatically renews the app’s token every 60000 milliseconds.
You can configure the token’s TTL and the renewal interval using properties under vault.token
, set in the application.yml
or application.properties
file. The TTL is set using the vault.token.ttl
property and the renewal interval is set using the vault.token.renew.rate
property.
The following YAML sets the token TTL to 600000 milliseconds (10 minutes) and sets the renewal interval to 180000 milliseconds (three minutes).
vault:
token:
ttl: 600000
renew:
rate: 180000
HashiCorp Vault Property Source Redaction
In the Spring Boot Actuator /actuator/env
endpoint, property names and values from a HashiCorp Vault property source are redacted for security. By default, the connector redacts properties whose names begin with configService:vault:
, and they are displayed in the output of /actuator/env
as shown in the following example:
"configService:vault:game": {
"******": "Properties from this source are redacted for security reasons"
},
You can configure the pattern used to determine which properties to redact, as well as the message displayed in place of those properties’ values, using properties set in the application.yml
or application.properties
file. The pattern is set using the endpoints.env.mask.sourceNamePatterns
property (wildcards, written as *
, are allowed) and the message is set using the endpoints.env.mask.message
property.
For example, the following YAML sets the redacted property name pattern to match property sources whose names begin with configService:
and sets the message to Redacted for security
.
endpoints:
env:
mask:
sourceNamePatterns: "configService:"
message: "Redacted for security"
See Also
For more information about Spring Cloud Connectors, see the following: