Keep your secrets away from code (Consul + Spring boot)

posted on

November 23, 2018

Overview

This blog will walk you through the need of consul and how to integrate with your Spring boot application.

Consul:

Consul is a distributed service mesh to connect, secure, and configure services across any runtime platform and public or private cloud

You can read more about consul here

Now, we are going to focus on key/value store in consul. KV store is one of the major feature available in consul to have all your application configuration properties in one place.

Problem:

Generally, we all are practiced to have our application related configuration in application.properties file, whenever we need to change the value, then we will be changing it in the file and have to rebuild and re-deploy the application to make changes to effect in the application.

In case, assume you are having a secret key or password in your application.properties file, then if there is any attack happened to your server and the code leaks all your critical information and your system will become vulnerable.

Solution :

Consul will actually help you to avoid the above-stated problems.

Why Consul KV:

You will be storing all your configuration properties in consul KV store which eliminates code leakage
Whenever there is a change in key/value, you are not required to re-deploy or reboot your server.
Spring boot has an efficiency to reflect the values in your application instantly
One consul Instance is sufficient to have all your environment properties like (dev, stage, production)

Install Consul

There are multiple ways to install,

You can install it using docker Click here
You can Download and run Click here

I have used the second approach, I have downloaded the file and extract it into your local directory

Steps to Start Consul

Open terminal
Go to the directory where you have extracted the consul
Run the below commands

root $ ./consul agent -server -bootstrap-expect=1 -data-dir=consul-data -ui -bind=127.0.0.1

1	root $ ./consul agent -server -bootstrap-expect=1 -data-dir=consul-data -ui -bind=127.0.0.1

4. Open browser and type http://localhost:8500

Now you will be seeing a consul screen

Create KV in consul

You can insert your KV in consul in two ways

Using the command line tool
Using Browser

Using the command line tool

Run the below command to insert single key

root $  ./consul kv put config/testapplication/testkey testvalue

1	root $ ./consul kv put config/testapplication/testkey testvalue

Note: You need to maintain the standard i.e config is mandatory followed by your application name and followed by your key name

2. Run the below command to insert multiple keys

Create a .json file as follows

[
   {
     "key" : "config/testApplication/testkey",
      "value" : "dGVzdFZhbHVl"   
   },
   {
      "key"  : "config/testApplication/testkey2",
      "value" : "dGVzdFZhbHVls",
   }

]

[

{

"key" : "config/testApplication/testkey",

"value" : "dGVzdFZhbHVl"

{

"key" : "config/testApplication/testkey2",

"value" : "dGVzdFZhbHVls",

}

]

Note: The value should be base-64 ENCODED strinG

Then run the below commands to import data’s to consul
root $ ./consul kv import @/your-file-path/filename.json

1

root $ ./consul kv import @/your-file-path/filename.json

To know more about consul KV commands click here

Using Browser

open http://localhost:8500 in your browser
click key/value from the menu

Click Create button
enter key as follows
config/testApplication/testkey

1

config/testApplication/testkey
enter the value as follow
test value

1

test value

NOTE: You don’t have to decode the string in case of UI

That’s it, now your consul is ready to integrate with your application.

Steps to Integrate with your Spring Application:

Assuming that you already having a spring application up and running, if not then you can create one from here
Add the below dependency build.gradle file

dependencies{

    compile group : 'org.springframework.cloud', name :'spring-cloud-starter-consul-       config'

   compile group : 'org.springframework.cloud', name :'spring-cloud-starter-consul-discovery'

   compile group : 'org.springframework.boot', name : 'spring-boot-starter-actuator' 

}

dependencies{

compile group : 'org.springframework.cloud', name :'spring-cloud-starter-consul- config'

compile group : 'org.springframework.cloud', name :'spring-cloud-starter-consul-discovery'

compile group : 'org.springframework.boot', name : 'spring-boot-starter-actuator'

}

Spring – actuator is mandatory so that consul will keep checking the health status of your application.

3. Add dependency management to build.gradle file

dependencyManagement {
   imports {
      mavenBom "org.springframework.cloud:spring-cloud-dependencies:Finchley.SR1"
   }
}

dependencyManagement {

imports {

mavenBom "org.springframework.cloud:spring-cloud-dependencies:Finchley.SR1"

}

4. Create a bootstarp.yml file under src/main/resources as follows

spring:
 application: {name: 'testApplication'}
 cloud:
  consul:
   enabled: 'true'
   host: http://localhost
   port: 8500
   discovery: {healthCheckInterval: 300s}

spring:

application: {name: 'testApplication'}

cloud:

consul:

enabled: 'true'

host: http://localhost

port: 8500

discovery: {healthCheckInterval: 300s}

Note: The application name should be matched with the folder name you created in consul under the config directory

5. User @Value annotation to bind the values from consul as follow

@Component
@RefreshScope
public Class AppConfig(){

    @Value("${testKey}")
    private String values;


}

@Component

@RefreshScope

public Class AppConfig(){

@Value("${testKey}")

private String values;

}

That’s it Spring Consul will take care of binding the values from consul to your application.

Note: @RefreshScope annotation is used in the above class, which will say that, if there any changes in the consul then it will immediately refresh the values in the application without restarting. If you havent use @RefreshScope then you need to manually restart the system to apply your config changes

@RefreshScope will work with annotations like (@component, @service, @controller,@repository etc,)

Know more about @RefreshScope

6. Add @EnableDiscoveryClient into your main class

@EnableAutoConfiguration
@EnableDiscoveryClient
@SpringBootApplication
public class TestApplication {

    public static void main(String[] args) {
        new TestApplication(TestApplication.class).run(args);
    }
    
}

@EnableAutoConfiguration

@EnableDiscoveryClient

@SpringBootApplication

public class TestApplication {

public static void main(String[] args) {

new TestApplication(TestApplication.class).run(args);

}

7. Now Run your application, it will look for the consul and values will be bound

Conclusion:

That’s all !!! Now you learned the importance of Consul KV store and how to integrate it with your spring boot application.

Keep your secrets away from code (Consul + Spring boot)

Overview

Consul:

Problem:

Solution :

Why Consul KV:

Install Consul

Steps to Start Consul

Create KV in consul

Using the command line tool

Note: You need to maintain the standard i.e config is mandatory followed by your application name and followed by your key name

Note: The value should be base-64 ENCODED strinG

Using Browser

NOTE: You don’t have to decode the string in case of UI

Steps to Integrate with your Spring Application:

Note: The application name should be matched with the folder name you created in consul under the config directory

Conclusion:

Krishnan Gopal

You may also like

Basic Principle of Kerberos

Hystrix – Bane or Boon

Configuring Spring Boot application with multiple Datasources

Consul Deployment – Single and Multiple IP Scenarios

Appium Parallel & Distribution Of Test Cases

@Scale – Part I (Task Queues)

Leave a Reply Cancel reply