Integrate HashiCorp Vault with Spring Boot application

In this section, we will learn how to integrate HashiCorp Vault with Spring Boot application and how to use HashiCorp vault to store secret in Spring Boot application.

Assume in production environment we need to setup secure storage for our application database credentials, passwords, API keys or any other secret and sensitive data.

HashiCorp vault allows us to secure applications and protect sensitive data with reduce the risk of breaches and data exposure with identity-based security automation and encryption-as-a-service.

Let's begin,

1. HashiCorp vault local installation

First, you should install hashicorp vault in your local machine.  

Please refer installation guide (macOS, Windows, Linux) to setup vault locally.

2. Start the vault server

After installed the vault, execute following command to start vault server:

vault server -dev

If everything goes fine, you will find similar output in the console like below: 

Copy Root token for future purpose.

If you need to set custom root token on starting server, execute following command.

vault server -dev --dev-root-token-id="35789350-5b69-61ed-75e9-m5830358e351"

3. Creating Secrets on Vault

After vault started, we can access vault web UI on http://localhost:8200/.

Enter Root token and click on "Sign In" button,

You will be taken to a page like the below image, then click on the "secret/" link.

You will be taken to a page like the below image, then click on the "Create secret" button.

You will be taken to a page like the below image, then enter secret data's, 

Specify Path for this secret as "spring-boot-hashicorp-vault-sample".

1.  knf.secret1 = This is Secret 1 
2.  knf.secret2 = This is Secret 2

and finally click on "Save" button.

4. Creating a simple spring boot web application

First, open the Spring initializr https://start.spring.io/ 

Then, Provide the Group and Artifact name. We have provided Group name com.knf.dev.demo and Artifact spring-boot-hashicorp-vault-sample. Here I selected the Maven project - language Java 17 - Spring Boot 3.0.5 and add Spring web dependency and Vault Configuration.

Then, click on the Generate button. When we click on the Generate button, it starts packing the project in a .zip(spring-boot-hashicorp-vault-sample) file and downloads the project. Then, Extract the Zip file. 

Then, import the project on your favourite IDE.

Final Project directory:

Complete pom.xml

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
   xsi:schemaLocation="http://maven.apache.org/POM/4.0.0
   https://maven.apache.org/xsd/maven-4.0.0.xsd">
   <modelVersion>4.0.0</modelVersion>
   <parent>
      <groupId>org.springframework.boot</groupId>
      <artifactId>spring-boot-starter-parent</artifactId>
      <version>3.0.5</version>
      <relativePath/> <!-- lookup parent from repository -->
   </parent>
   <groupId>com.knf.dev.demo</groupId>
   <artifactId>spring-boot-hashicorp-vault-sample</artifactId>
   <version>0.0.1-SNAPSHOT</version>
   <name>spring-boot-hashicorp-vault-sample</name>
   <description>Demo project for Spring Boot</description>
   <properties>
      <java.version>17</java.version>
      <spring-cloud.version>2022.0.1</spring-cloud.version>
   </properties>
   <dependencies>
      <dependency>
         <groupId>org.springframework.boot</groupId>
         <artifactId>spring-boot-starter-web</artifactId>
      </dependency>
      <dependency>
         <groupId>org.springframework.cloud</groupId>
         <artifactId>spring-cloud-starter-vault-config</artifactId>
      </dependency>

      <dependency>
         <groupId>org.springframework.boot</groupId>
         <artifactId>spring-boot-starter-test</artifactId>
         <scope>test</scope>
      </dependency>
   </dependencies>
   <dependencyManagement>
      <dependencies>
         <dependency>
            <groupId>org.springframework.cloud</groupId>
            <artifactId>spring-cloud-dependencies</artifactId>
            <version>${spring-cloud.version}</version>
            <type>pom</type>
            <scope>import</scope>
         </dependency>
      </dependencies>
   </dependencyManagement>

   <build>
      <plugins>
         <plugin>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-maven-plugin</artifactId>
         </plugin>
      </plugins>
   </build>

</project>

application.properties

spring.application.name=spring-boot-hashicorp-vault-sample
spring.cloud.vault.token=hvs.hwiyGMfXljRFzsDuSLiAtY6P
spring.cloud.vault.uri=http://localhost:8200
spring.config.import: vault://

MyController.java

package com.knf.dev.demo.controller;

import org.springframework.beans.factory.annotation.Value;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;

import java.util.HashMap;
import java.util.Map;

@RestController
public class MyController {

    @Value("${knf.secret1}")
    String secret1;

    @Value("${knf.secret2}")
    String secret2;

    @GetMapping("/secret")
    public Map<String,String> getSecret()
    {
        Map<String,String> map = new HashMap<>();
        map.put("Secret 1",secret1);
        map.put("Secret 2",secret2);

        return map;
    }
}

Here we are injecting values from vault into the fields secret1 and secret2.

Run the application - Application.java

package com.knf.dev.demo;

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;

@SpringBootApplication
public class Application {

   public static void main(String[] args) {
      SpringApplication.run(Application.class, args);
   }

}

Application is the entry point that sets up the Spring Boot application. The @SpringBootApplication annotation enables auto-configuration and component scanning.

Step1: Download or clone the source code from GitHub to a local machine - Click here!

Step 2: mvn clean install

Step 3: Run the Spring Boot application - mvn spring-boot:run

OR 

Run this Spring boot application from 

• IntelliJ IDEA IDE by right click - Run 'Application.main()' 
• Eclipse/STS - You can right click the project or the Application.java file and run as java application or Spring boot application.

5. Testing the API using Postman

Source code - click here!