Class RotatingSecretsConfig

java.lang.Object

com.maybeitssquid.rotatingsecrets.spring.RotatingSecretsConfig

@Configuration
public class RotatingSecretsConfig
extends Object

Spring configuration that creates and starts the credential provider.

Every UpdatableCredential<String> bean in the context is registered with the provider, so an application needs no bean names. Any subset of pools works: one, the other, or both.

Configuration Properties

• k8s.secrets.path - Directory with the username and password files (default: /var/run/secrets/database)
• k8s.secrets.refresh-interval - Fallback re-check interval. Accepts 30s, 2m, 1h, 1d, an ISO-8601 duration such as PT30S, or a bare number of milliseconds (default: 30s)

See Also:

• CredentialsProviderService

Constructor Summary

Constructors

Constructor	Description
RotatingSecretsConfig()	Default constructor.

Method Summary

Modifier and Type	Method	Description
com.maybeitssquid.rotatingsecrets.CredentialsProviderService	credentialsProvider(String secretsPath, String refreshInterval, org.springframework.beans.factory.ObjectProvider<com.maybeitssquid.rotatingsecrets.UpdatableCredential<String>> updatables)	Creates the credential provider, registers every updater bean, and starts it.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

RotatingSecretsConfig

public RotatingSecretsConfig()

Default constructor.

Method Details

credentialsProvider

@Bean(initMethod="start",
      destroyMethod="stop")
public com.maybeitssquid.rotatingsecrets.CredentialsProviderService credentialsProvider(@Value("${k8s.secrets.path:/var/run/secrets/database}")
 String secretsPath,
 @Value("${k8s.secrets.refresh-interval:30s}")
 String refreshInterval,
 org.springframework.beans.factory.ObjectProvider<com.maybeitssquid.rotatingsecrets.UpdatableCredential<String>> updatables)

Creates the credential provider, registers every updater bean, and starts it.

Updaters are discovered by type. Registration happens before start(), so the first credential read reaches every updater.

Parameters:

secretsPath - directory with the username and password files

refreshInterval - fallback re-check interval, parsed by parseRefreshInterval(String)

updatables - all UpdatableCredential<String> beans in the context

Returns:

the started credential provider