{"id":15430498,"url":"https://github.com/lenisha/spring-pcf-akv","last_synced_at":"2025-08-16T10:51:19.792Z","repository":{"id":116070932,"uuid":"205056261","full_name":"lenisha/spring-pcf-akv","owner":"lenisha","description":"Demo using Azure KeyVault from PCF springboot app","archived":false,"fork":false,"pushed_at":"2019-09-03T03:46:21.000Z","size":53,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":2,"default_branch":"master","last_synced_at":"2024-10-18T06:16:03.674Z","etag":null,"topics":["azure","keyvault","pcf","springboot"],"latest_commit_sha":null,"homepage":"","language":"Java","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/lenisha.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2019-08-29T01:37:07.000Z","updated_at":"2019-09-03T15:12:25.000Z","dependencies_parsed_at":null,"dependency_job_id":"5a45b3bb-f47e-435a-bf7a-4adf9580bfef","html_url":"https://github.com/lenisha/spring-pcf-akv","commit_stats":{"total_commits":3,"total_committers":1,"mean_commits":3.0,"dds":0.0,"last_synced_commit":"25f3a6f7227cb2779a6e5a3de36199b7625b8bd5"},"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/lenisha/spring-pcf-akv","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lenisha%2Fspring-pcf-akv","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lenisha%2Fspring-pcf-akv/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lenisha%2Fspring-pcf-akv/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lenisha%2Fspring-pcf-akv/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/lenisha","download_url":"https://codeload.github.com/lenisha/spring-pcf-akv/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lenisha%2Fspring-pcf-akv/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":270702479,"owners_count":24630873,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-08-16T02:00:11.002Z","response_time":91,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["azure","keyvault","pcf","springboot"],"created_at":"2024-10-01T18:16:43.730Z","updated_at":"2025-08-16T10:51:19.766Z","avatar_url":"https://github.com/lenisha.png","language":"Java","funding_links":[],"categories":[],"sub_categories":[],"readme":"\n## Demo PCF SpringBoot app with Azure KeyVault Secrets\n\nFor many Azure services OSBA or Meta Azure Service Broker provide functionality to manage Azure resource lifecycle and credentials.\nFor example it will create database (or connect to existing one) when service is created and provide user credentials to the application that binds to it. \n\nAzure KeyVault and secrets lifecycle are typically managed by different groups responsible for security in the organization.\nIn this case it might be sufficient to make use of cloud foundry user -provided service with specifies credentials required to retrieve secrets\n\n### User-provided service\n\nAs per Microsoft docs [How to use the Spring Boot Starter for Azure Key Vault](https://docs.microsoft.com/en-us/java/azure/spring-framework/configure-spring-boot-starter-java-app-with-azure-key-vault?view=azure-java-stable)\n\n- Create or get info for service principal that is granted access to secrets in the Azure KeyVault ( see doc above on steps to create Vault,grant permissions etc)\n- Add secret to Vault with name `my-very-secret`\n- Create `json` file with CF service credential definition as below ( saved as `akv-service.json` in this project) \n```json\n{\n  \"clientId\":\"\u003cSP clientId\u003e\",\n  \"clientSecret\":\"\u003cSP client Secret\u003e\",\n  \"vaultUri\":\"https://\u003cvaultname\u003e.vault.azure.net\"\n}\n``` \n- Create CF User Provided Service named `azure-vault-service` instance by running CF CUPS command\n```shell\n cf cups azure-vault-service -p akv-service.json\n```\n\n### Spring boot AKV starter\nNow that we have credentials to establish connection to AKV available in CF service, we will use Spring Boot Starter use this credentials to get secrets from Azure Key Vault\n\n- Add Azure Key Vault starter to the project `pom.xml`\n```xml\n\u003cdependency\u003e\n    \u003cgroupId\u003ecom.microsoft.azure\u003c/groupId\u003e\n    \u003cartifactId\u003eazure-keyvault-secrets-spring-boot-starter\u003c/artifactId\u003e\n\u003c/dependency\u003e\n``` \n- Add to the application settings in `application.yaml` to the `cloud` profile activated in CloudFoundry Service Principle and Vault details\nthat will be read from CF User Provided Service. \n\n```yml\n\n---\nspring.profiles: cloud\n\n# running on PCF - read from VCAP service\nazure:\n  keyvault:\n    uri: ${vcap.services.azure-vault-service.credentials.vaultUri}\n    client-id: ${vcap.services.azure-vault-service.credentials.clientId}\n    client-key: ${vcap.services.azure-vault-service.credentials.clientSecret}\n```\n\nNote: CF CUPS service data is available as flattened spring boot environment properties with following notation \n`vcap.services.\u003cname of service\u003e.credentials.\u003cname of key\u003e`\n\n- Now we can read Azure KeyVault secrets as any other Spring boot configuration properties ,( as Key Vault will be bound as custom Properties Datasource)\nExample in `TestController.java`, where `@Value(\"${my-very-secret}\")` is read from Azure KeyVault.\n\n```java\n@RestController\n@RequestMapping(\"/v1\")\npublic class TestController {\n\n    @Value(\"${my-very-secret}\")\n    private String secretValue;\n\n    @Value(\"${my-not-secret}\")\n    private String nosecretValue;\n\n    @GetMapping(\"/values\")\n    public String[] Values() {\n        return  new String[] { secretValue, nosecretValue};\n    }\n}\n```\n\n\n- Compile, package and push application with binding to CF CUPS service created above, here is our `manifest.yml`\n\n```yaml\n\n---\napplications:\n- name: spring-akv\n  path: target/akv-0.0.1-SNAPSHOT.jar\n  buildpack: java_buildpack\n  services:\n   - azure-vault-service\n\n```\n\n```sbtshell\nmvn clean package\ncf push\n```\n\n\n### References\n[Meta Azure Service Broker AKV docs](https://github.com/Azure/meta-azure-service-broker/tree/master/docs/user-provided-services)\n\n[Azure Spring Boot Starter for AKV ](https://github.com/microsoft/azure-spring-boot/tree/master/azure-spring-boot-samples/azure-keyvault-secrets-spring-boot-sample)\n\n[Azure OSBA](https://github.com/Azure/open-service-broker-azure)","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Flenisha%2Fspring-pcf-akv","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Flenisha%2Fspring-pcf-akv","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Flenisha%2Fspring-pcf-akv/lists"}