Improving Spring Boot Configuration Security with Hashicorp Vault

--- a/compose.yaml
+++ b/compose.yaml
@@ -11,6 +11,33 @@ services: # listed roughly by boot order
+  vault:
+    image: docker.io/hashicorp/vault:latest
+    cap_add: [IPC_LOCK]
+    # ^ see https://man7.org/linux/man-pages/man7/capabilities.7.html#:~:text=the%20calling%20process.-,cap_ipc_lock,-%E2%80%A2%20%20Lock%20memory%20(mlock
+    ports: ["8200:8200"]
+    environment:
+      - VAULT_DEV_ROOT_TOKEN_ID=my-vault-root-token
+      - VAULT_DEV_LISTEN_ADDRESS=0.0.0.0:8200
+    command: server -dev
+    healthcheck:
+      test: [CMD, vault, status, "-address=http://0.0.0.0:8200"]
+      interval: 2s
+      timeout: 30s
+      retries: 10
+      start_period: 1s
   app:
     build: .
     ports: [ "8080:8080" ]

#!/bin/sh
set -u # fail on any reference to an undefined variable
set -e # fail on any unhandled nonzero return code

# see https://developer.hashicorp.com/vault/docs/secrets/databases/mysql-maria
vault secrets enable database

DB_NAME=my-mysql-database
# ^ this only affects the path of the database configuration in Vault;
# it doesn't have to match the database name
ROLE_NAME="my_role"

vault write database/config/$DB_NAME \
    plugin_name=mysql-database-plugin \
    connection_url="{{username}}:{{password}}@tcp(mysql:3306)/" \
    allowed_roles=$ROLE_NAME \
    username="root" \
    password="$MYSQL_ROOT_PASSWORD"

vault write database/roles/$ROLE_NAME \
    db_name=$DB_NAME \
    creation_statements="
      CREATE USER '{{name}}'@'%' IDENTIFIED BY '{{password}}';
      GRANT ALL ON *.* TO '{{name}}'@'%';
    " \
    default_ttl="30s" # short to demonstrate lease renewal

--- a/compose.yaml
+++ b/compose.yaml
@@ -11,6 +11,33 @@ vault:
      timeout: 30s
      retries: 10
      start_period: 1s
+  vault-init:
+    image: docker.io/hashicorp/vault:latest
+    depends_on: 
+      vault: {condition: service_healthy}
+      mysql: {condition: service_healthy}
+    environment:
+      - MYSQL_ROOT_PASSWORD=my_password
+      - VAULT_TOKEN=my-vault-root-token # for demo only
+      - VAULT_ADDR=http://vault:8200
+    volumes:
+      - ./scripts/vault-init.sh:/vault-init.sh
+    command: sh /vault-init.sh
   app:
     build: .
     ports: [ "8080:8080" ]
       mysql: {condition: service_healthy}
+      vault: {condition: service_healthy}
+      vault-init: {condition: service_completed_successfully}
     volumes:

--- a/pom.xml
+++ b/pom.xml
@@ -51,6 +51,21 @@
       <artifactId>spring-boot-starter-test</artifactId>
       <scope>test</scope>
     </dependency>
+    <dependency>
+      <groupId>org.springframework.cloud</groupId>
+      <artifactId>spring-cloud-starter-vault-config</artifactId>
+      <version>4.2.0</version>
+    </dependency>
+    <dependency>
+      <groupId>org.springframework.vault</groupId>
+      <artifactId>spring-vault-core</artifactId>
+      <version>3.1.1</version>
+    </dependency>
+    <dependency>
+      <groupId>org.springframework.cloud</groupId>
+      <artifactId>spring-cloud-vault-config-databases</artifactId>
+      <version>4.2.0</version>
+    </dependency>
     <dependency>
       <groupId>com.mysql</groupId>
       <artifactId>mysql-connector-j</artifactId>

--- a/config/application.yaml
+++ b/config/application.yaml
@@ -6,5 +6,27 @@ spring:
       # when the server first boots.
   datasource:
     url: jdbc:mysql://mysql:3306/my_db
-    username: root
-    password: my_password
+  cloud:
+    vault:
+      token: ${VAULT_TOKEN}
+      fail-fast: true # interrupt boot if Spring can't connect to Vault
+      uri: ${SPRING_CLOUD_VAULT_URI:http://vault:8200}
+      database:
+        # see https://cloud.spring.io/spring-cloud-vault/reference/html/#vault.config.backends.database
+        enabled: true
+        role: my_role # this is the name of the database role **in vault**. SHOULD correspond to database/roles/my-role
+        backend: database
+        username-property: "spring.datasource.username"
+        password-property: "spring.datasource.password"
+  config:
+    import: "vault://"

--- a/compose.yaml
+++ b/compose.yaml
@@ -43,9 +42,11 @@ services: # listed roughly by boot order
   app:
     build: .
     ports: [ "8080:8080" ]
     depends_on: 
       mysql: {condition: service_healthy}
       vault: {condition: service_healthy}
       vault-init: {condition: service_completed_successfully}
+    environment:
+      - VAULT_TOKEN=my-vault-root-token # for demo only
     volumes:
       - ./config/application.yaml:/opt/app/config/application.yaml:ro
       # mount an external config file in a location that Spring Boot will check
       # see https://docs.spring.io/spring-boot/reference/features/external-config.html#features.external-config.files

mysql() {
  docker compose exec mysql \
    mysql --user=root --password=my_password my_db \
    -e "$1"
}

mysql 'select count(*) from kvpair;' | sed 's/^/# /g'
# count(*)
# 0

# make an API call to create some data
curl -X POST http://localhost:8080/kv/foo -d value=bar # => bar

# then the data should appear in the database
mysql 'select * from kvpair;' | sed 's/^/# /g'
# k    v
# foo  bar