Skip to content

Commit bbb6e23

Browse files
moarychanmoarychan
committed
Add web client sample
1 parent 8d637a2 commit bbb6e23

File tree

16 files changed

+789
-38
lines changed

16 files changed

+789
-38
lines changed

‎keyvault/spring-cloud-azure-starter-keyvault-jca/keyvault-ssl-bundles-web/README.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -167,7 +167,7 @@ You can debug your sample by adding the saved output values to the tool's enviro
167167
1. Send below inbound HTTPS request:
168168

169169
```bash
170-
curl --insecure https://localhost:8443/ssl-test
170+
curl --insecure https://localhost:8444/ssl-test
171171
```
172172

173173
You will see the following in the console:
@@ -180,7 +180,7 @@ You can debug your sample by adding the saved output values to the tool's enviro
180180

181181
```bash
182182

183-
curl --insecure https://localhost:8443/ssl-test-outbound
183+
curl --insecure https://localhost:8444/ssl-test-outbound
184184
```
185185

186186
you will see console like this:

‎keyvault/spring-cloud-azure-starter-keyvault-jca/keyvault-ssl-bundles-web/src/main/resources/application.yaml‎

Lines changed: 13 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -5,35 +5,31 @@ spring:
55
bundle:
66
azure-keyvault:
77
keyVaultBundle:
8+
keyvault-ref: keyvault1
89
key:
910
alias: self-signed
10-
certificates-refresh-interval: 60s
11-
keyVaultBundle2:
12-
inherit: false
13-
endpoint: ${KEY_VAULT_SSL_BUNDLES_WEB_KEYVAULT_URI_02}
14-
profile:
15-
tenant-id: ${KEY_VAULT_SSL_BUNDLES_WEB_TENANT_ID}
16-
credential:
17-
client-id: ${KEY_VAULT_SSL_BUNDLES_WEB_CLIENT_ID}
18-
client-secret: ${KEY_VAULT_SSL_BUNDLES_WEB_CLIENT_SECRET}
19-
key:
20-
alias: tomcat
11+
certificates-refresh-interval: 120s
2112
myLocalBundle:
22-
inherit: false
13+
keyvault-ref: keyvault2
2314
certificate-paths:
2415
custom: "classpath:local-custom"
2516
cloud:
2617
azure:
2718
keyvault:
2819
jca:
29-
endpoint: ${KEY_VAULT_SSL_BUNDLES_WEB_KEYVAULT_URI_01}
3020
profile:
31-
tenant-id: ${KEY_VAULT_SSL_BUNDLES_WEB_TENANT_ID}
21+
tenant-id: ${KEY_VAULT_SSL_BUNDLES_TENANT_ID}
3222
credential:
33-
client-id: ${KEY_VAULT_SSL_BUNDLES_WEB_CLIENT_ID}
34-
client-secret: ${KEY_VAULT_SSL_BUNDLES_WEB_CLIENT_SECRET}
23+
client-id: ${KEY_VAULT_SSL_BUNDLES_CLIENT_ID}
24+
client-secret: ${KEY_VAULT_SSL_BUNDLES_CLIENT_SECRET}
25+
connections:
26+
keyvault1:
27+
endpoint: ${KEY_VAULT_SSL_BUNDLES_KEYVAULT_URI_01}
28+
keyvault2:
29+
endpoint: ${KEY_VAULT_SSL_BUNDLES_KEYVAULT_URI_02}
30+
3531
server:
36-
port: 8443
32+
port: 8444
3733
ssl:
3834
bundle: "keyVaultBundle"
3935
logging.level:

‎keyvault/spring-cloud-azure-starter-keyvault-jca/keyvault-ssl-bundles-web/terraform/main.tf‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,12 @@ terraform {
1616
}
1717

1818
provider "azurerm" {
19-
features {}
19+
features {
20+
key_vault {
21+
purge_soft_delete_on_destroy = true # Purge soft-deleted vaults when destroyed
22+
recover_soft_deleted_key_vaults = false # Don’t recover, we want to destroy
23+
}
24+
}
2025
}
2126

2227
data "azuread_client_config" "current" {}

‎keyvault/spring-cloud-azure-starter-keyvault-jca/keyvault-ssl-bundles-web/terraform/outputs.tf‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,30 +1,30 @@
1-
output "KEY_VAULT_SSL_BUNDLES_WEB_KEYVAULT_URI_01" {
1+
output "KEY_VAULT_SSL_BUNDLES_KEYVAULT_URI_01" {
22
value = azurerm_key_vault.kv_account_01.vault_uri
33
description = "The key vault uri 01."
44
}
55

6-
output "KEY_VAULT_SSL_BUNDLES_WEB_KEYVAULT_URI_02" {
6+
output "KEY_VAULT_SSL_BUNDLES_KEYVAULT_URI_02" {
77
value = azurerm_key_vault.kv_account_02.vault_uri
88
description = "The key vault uri 02."
99
}
1010

11-
output "KEY_VAULT_SSL_BUNDLES_WEB_TENANT_ID" {
11+
output "KEY_VAULT_SSL_BUNDLES_TENANT_ID" {
1212
value = data.azuread_client_config.current.tenant_id
1313
description = "The tenant id."
1414
}
1515

16-
output "KEY_VAULT_SSL_BUNDLES_WEB_CLIENT_ID" {
16+
output "KEY_VAULT_SSL_BUNDLES_CLIENT_ID" {
1717
value = azuread_application.app.application_id
1818
description = "The application id of service principal."
1919
}
2020

21-
output "KEY_VAULT_SSL_BUNDLES_WEB_CLIENT_SECRET" {
21+
output "KEY_VAULT_SSL_BUNDLES_CLIENT_SECRET" {
2222
value = azuread_application_password.service_principal_password.value
2323
sensitive = true
2424
description = "The client secret of service principal."
2525
}
2626

27-
output "KEY_VAULT_SSL_BUNDLES_WEB_RESOURCE_GROUP_NAME" {
27+
output "KEY_VAULT_SSL_BUNDLES_RESOURCE_GROUP_NAME" {
2828
value = azurerm_resource_group.main.name
2929
description = "The resource group name."
3030
}

‎keyvault/spring-cloud-azure-starter-keyvault-jca/keyvault-ssl-bundles-web/terraform/setup_env.sh‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,13 @@
1-
export KEY_VAULT_SSL_BUNDLES_WEB_KEYVAULT_URI_01=$(terraform -chdir=./terraform output -raw KEY_VAULT_SSL_BUNDLES_WEB_KEYVAULT_URI_01)
2-
export KEY_VAULT_SSL_BUNDLES_WEB_KEYVAULT_URI_02=$(terraform -chdir=./terraform output -raw KEY_VAULT_SSL_BUNDLES_WEB_KEYVAULT_URI_02)
3-
export KEY_VAULT_SSL_BUNDLES_WEB_TENANT_ID=$(terraform -chdir=./terraform output -raw KEY_VAULT_SSL_BUNDLES_WEB_TENANT_ID)
4-
export KEY_VAULT_SSL_BUNDLES_WEB_CLIENT_ID=$(terraform -chdir=./terraform output -raw KEY_VAULT_SSL_BUNDLES_WEB_CLIENT_ID)
5-
export KEY_VAULT_SSL_BUNDLES_WEB_CLIENT_SECRET=$(terraform -chdir=./terraform output -raw KEY_VAULT_SSL_BUNDLES_WEB_CLIENT_SECRET)
6-
export KEY_VAULT_SSL_BUNDLES_WEB_RESOURCE_GROUP_NAME=$(terraform -chdir=./terraform output -raw KEY_VAULT_SSL_BUNDLES_WEB_RESOURCE_GROUP_NAME)
1+
export KEY_VAULT_SSL_BUNDLES_KEYVAULT_URI_01=$(terraform -chdir=./terraform output -raw KEY_VAULT_SSL_BUNDLES_KEYVAULT_URI_01)
2+
export KEY_VAULT_SSL_BUNDLES_KEYVAULT_URI_02=$(terraform -chdir=./terraform output -raw KEY_VAULT_SSL_BUNDLES_KEYVAULT_URI_02)
3+
export KEY_VAULT_SSL_BUNDLES_TENANT_ID=$(terraform -chdir=./terraform output -raw KEY_VAULT_SSL_BUNDLES_TENANT_ID)
4+
export KEY_VAULT_SSL_BUNDLES_CLIENT_ID=$(terraform -chdir=./terraform output -raw KEY_VAULT_SSL_BUNDLES_CLIENT_ID)
5+
export KEY_VAULT_SSL_BUNDLES_CLIENT_SECRET=$(terraform -chdir=./terraform output -raw KEY_VAULT_SSL_BUNDLES_CLIENT_SECRET)
6+
export KEY_VAULT_SSL_BUNDLES_RESOURCE_GROUP_NAME=$(terraform -chdir=./terraform output -raw KEY_VAULT_SSL_BUNDLES_RESOURCE_GROUP_NAME)
77

8-
echo KEY_VAULT_SSL_BUNDLES_WEB_KEYVAULT_URI_01=$KEY_VAULT_SSL_BUNDLES_WEB_KEYVAULT_URI_01
9-
echo KEY_VAULT_SSL_BUNDLES_WEB_KEYVAULT_URI_02=$KEY_VAULT_SSL_BUNDLES_WEB_KEYVAULT_URI_02
10-
echo KEY_VAULT_SSL_BUNDLES_WEB_TENANT_ID=$KEY_VAULT_SSL_BUNDLES_WEB_TENANT_ID
11-
echo KEY_VAULT_SSL_BUNDLES_WEB_CLIENT_ID=$KEY_VAULT_SSL_BUNDLES_WEB_CLIENT_ID
12-
echo KEY_VAULT_SSL_BUNDLES_WEB_CLIENT_SECRET=$KEY_VAULT_SSL_BUNDLES_WEB_CLIENT_SECRET
13-
echo KEY_VAULT_SSL_BUNDLES_WEB_RESOURCE_GROUP_NAME=$KEY_VAULT_SSL_BUNDLES_WEB_RESOURCE_GROUP_NAME
8+
echo KEY_VAULT_SSL_BUNDLES_KEYVAULT_URI_01=$KEY_VAULT_SSL_BUNDLES_KEYVAULT_URI_01
9+
echo KEY_VAULT_SSL_BUNDLES_KEYVAULT_URI_02=$KEY_VAULT_SSL_BUNDLES_KEYVAULT_URI_02
10+
echo KEY_VAULT_SSL_BUNDLES_TENANT_ID=$KEY_VAULT_SSL_BUNDLES_TENANT_ID
11+
echo KEY_VAULT_SSL_BUNDLES_CLIENT_ID=$KEY_VAULT_SSL_BUNDLES_CLIENT_ID
12+
echo KEY_VAULT_SSL_BUNDLES_CLIENT_SECRET=$KEY_VAULT_SSL_BUNDLES_CLIENT_SECRET
13+
echo KEY_VAULT_SSL_BUNDLES_RESOURCE_GROUP_NAME=$KEY_VAULT_SSL_BUNDLES_RESOURCE_GROUP_NAME

‎keyvault/spring-cloud-azure-starter-keyvault-jca/keyvault-ssl-bundles-webflux/README.md‎

Lines changed: 222 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,222 @@
1+
---
2+
page_type: sample
3+
languages:
4+
- java
5+
products:
6+
- azure-key-vault
7+
name: Enable Server and Client SSL from Azure Key Vault SSL Bundles in Spring Boot webflux Application
8+
description: This sample demonstrates how to enable Server and Client SSL via Azure KeyVault SSL bundles in Spring Boot webflux application.
9+
---
10+
11+
# Enable Server and Client SSL from Azure Key Vault SSL Bundles in Spring Boot Web Application
12+
13+
This sample demonstrates how to enable Server and Client SSL via Azure KeyVault SSL bundles in Spring Boot web application. [Link to reference doc](https://learn.microsoft.com/azure/developer/java/spring-framework).
14+
15+
## What You Will Build
16+
17+
You will build an application that use `spring-cloud-azure-starter-keyvault-jca` to retrieve certificates from multiple [Azure Key Vault](https://azure.microsoft.com/services/key-vault/).
18+
19+
## What You Need
20+
21+
- [An Azure subscription](https://azure.microsoft.com/free/)
22+
- [Terraform](https://www.terraform.io/)
23+
- [Azure CLI](https://docs.microsoft.com/cli/azure/install-azure-cli)
24+
- [JDK8](https://www.oracle.com/java/technologies/downloads/) or later
25+
- Maven
26+
- You can also import the code straight into your IDE:
27+
- [IntelliJ IDEA](https://www.jetbrains.com/idea/download)
28+
29+
## Provision Azure Resources Required to Run This Sample
30+
31+
### Authenticate Using the Azure CLI
32+
Terraform must authenticate to Azure to create infrastructure.
33+
34+
In your terminal, use the Azure CLI tool to setup your account permissions locally.
35+
36+
```shell
37+
az login
38+
```
39+
40+
Your browser window will open and you will be prompted to enter your Azure login credentials. After successful authentication, your terminal will display your subscription information. You do not need to save this output as it is saved in your system for Terraform to use.
41+
42+
```shell
43+
You have logged in. Now let us find all the subscriptions to which you have access...
44+
45+
[
46+
{
47+
"cloudName": "AzureCloud",
48+
"homeTenantId": "home-Tenant-Id",
49+
"id": "subscription-id",
50+
"isDefault": true,
51+
"managedByTenants": [],
52+
"name": "Subscription-Name",
53+
"state": "Enabled",
54+
"tenantId": "0envbwi39-TenantId",
55+
"user": {
56+
"name": "[email protected]",
57+
"type": "user"
58+
}
59+
}
60+
]
61+
```
62+
63+
If you have more than one subscription, specify the subscription-id you want to use with command below:
64+
```shell
65+
az account set --subscription <your-subscription-id>
66+
```
67+
68+
### Provision the Resources
69+
After login Azure CLI with your account, now you can use the terraform script to create Azure Resources.
70+
71+
#### Run with Bash
72+
73+
```shell
74+
# In the root directory of the sample
75+
# Initialize your Terraform configuration
76+
terraform -chdir=./terraform init
77+
78+
# Apply your Terraform Configuration
79+
terraform -chdir=./terraform apply -auto-approve
80+
81+
```
82+
83+
#### Run with Powershell
84+
85+
```shell
86+
# In the root directory of the sample
87+
# Initialize your Terraform configuration
88+
terraform -chdir=terraform init
89+
90+
# Apply your Terraform Configuration
91+
terraform -chdir=terraform apply -auto-approve
92+
93+
```
94+
95+
It may take a few minutes to run the script. After successful running, you will see prompt information like below:
96+
97+
```shell
98+
...
99+
azurecaf_name.azurecaf_name_kv_01: Creating...
100+
azurecaf_name.azurecaf_name_kv_02: Creating...
101+
azurecaf_name.resource_group: Creating...
102+
azurecaf_name.azurecaf_name_kv_01: Creation complete after 0s [id=tsnjmjbuwvumasse]
103+
azurecaf_name.resource_group: Creation complete after 0s [id=ddeodontheybkwgm]
104+
azurecaf_name.azurecaf_name_kv_02: Creation complete after 0s [id=tsnjmjbuwvumasse]
105+
azuread_application.app: Creating...
106+
azuread_application.app: Creation complete after 3s [id=37a44efb-1cd2-44e4-a149-d9bb9c315d6f]
107+
azuread_application_password.service_principal_password: Creating...
108+
azuread_service_principal.service_principal: Creating...
109+
110+
111+
Apply complete! Resources: 11 added, 0 changed, 0 destroyed.
112+
113+
Outputs:
114+
115+
...
116+
117+
```
118+
119+
You can go to [Azure portal](https://ms.portal.azure.com/) in your web browser to check the resources you created.
120+
121+
### Export Output to Your Local Environment
122+
Running the command below to export environment values:
123+
124+
#### Run with Bash
125+
126+
```shell
127+
source ./terraform/setup_env.sh
128+
```
129+
130+
#### Run with Powershell
131+
132+
```shell
133+
terraform\setup_env.ps1
134+
```
135+
136+
If you want to run the sample in debug mode, you can save the output value.
137+
138+
```shell
139+
KEY_VAULT_SSL_BUNDLE_CLIENT_ID=
140+
KEY_VAULT_SSL_BUNDLE_CLIENT_SECRET=
141+
KEY_VAULT_SSL_BUNDLE_KEYVAULT_URI_01=
142+
KEY_VAULT_SSL_BUNDLE_KEYVAULT_URI_02=
143+
KEY_VAULT_SSL_BUNDLE_RESOURCE_GROUP_NAME=
144+
KEY_VAULT_SSL_BUNDLE_TENANT_ID=
145+
```
146+
147+
## Run Locally
148+
149+
### Run the sample with Maven
150+
151+
In your terminal, run `mvn clean spring-boot:run`.
152+
153+
```shell
154+
mvn clean spring-boot:run
155+
```
156+
157+
### Run the sample in IDEs
158+
159+
You can debug your sample by adding the saved output values to the tool's environment variables or the sample's `application.yaml` file.
160+
161+
* If your tool is `IDEA`, please refer to [Debug your first Java application](https://www.jetbrains.com/help/idea/debugging-your-first-java-application.html) and [add environment variables](https://www.jetbrains.com/help/objc/add-environment-variables-and-program-arguments.html#add-environment-variables).
162+
163+
* If your tool is `ECLIPSE`, please refer to [Debugging the Eclipse IDE for Java Developers](https://www.eclipse.org/community/eclipse_newsletter/2017/june/article1.php) and [Eclipse Environment Variable Setup](https://examples.javacodegeeks.com/desktop-java/ide/eclipse/eclipse-environment-variable-setup-example/).
164+
165+
## Verify This Sample
166+
167+
This sample required an SSL server, you can use sample [keyvault-ssl-bundles-web](../keyvault-ssl-bundles-web) as the target server, which means the https://localhost:8444/ssl-test is available.For Azure resource usage, you can share the output environment variable of [keyvault-ssl-bundles-web](../keyvault-ssl-bundles-web) or create the new resources and shared to [keyvault-ssl-bundles-web](../keyvault-ssl-bundles-web) as they use the same environment variables.
168+
169+
1. Send below request to acquire a resource with TLS connection:
170+
171+
```bash
172+
curl http://localhost:8080/webclient/tls
173+
```
174+
175+
You will see the following in the console:
176+
177+
```console
178+
Response from webClient tls "https://localhost:8444/ssl-test": Inbound TLS is working!
179+
```
180+
181+
2. Send below request to acquire a resource with mTLS connection:
182+
183+
```bash
184+
185+
curl http://localhost:8080/webclient/mtls
186+
```
187+
188+
you will see console like this:
189+
190+
```console
191+
Response from webClient mtls "https://localhost:8444/ssl-test": Inbound TLS is working!
192+
```
193+
194+
## Clean Up Resources
195+
After running the sample, if you don't want to run the sample, remember to destroy the Azure resources you created to avoid unnecessary billing.
196+
197+
The terraform destroy command terminates resources managed by your Terraform project.
198+
To destroy the resources you created.
199+
200+
#### Run with Bash
201+
202+
```shell
203+
terraform -chdir=./terraform destroy -auto-approve
204+
```
205+
206+
#### Run with Powershell
207+
208+
```shell
209+
terraform -chdir=terraform destroy -auto-approve
210+
```
211+
212+
## (Optional) Retrieve specific secrets
213+
214+
If you don't want to load all secrets from Azure Key Vault. You can specify the secrets you want to load by setting the `spring.cloud.azure.keyvault.secret.property-sources.secret-keys=secret1,secret2...` property in the `application.yaml` file.
215+
216+
For this sample, run locally with the command `mvn clean spring-boot:run -Dspring-boot.run.profiles=secrets` to activate the [application-secrets.yml](./src/main/resources/application-secrets.yml) profile file.
217+
218+
[Verify This Sample](#verify-this-sample).
219+
220+
## Deploy to Azure Spring Apps
221+
222+
Now that you have the Spring Boot application running locally, it's time to move it to production. [Azure Spring Apps](https://learn.microsoft.com/azure/spring-apps/overview) makes it easy to deploy Spring Boot applications to Azure without any code changes. The service manages the infrastructure of Spring applications so developers can focus on their code. Azure Spring Apps provides lifecycle management using comprehensive monitoring and diagnostics, configuration management, service discovery, CI/CD integration, blue-green deployments, and more. To deploy your application to Azure Spring Apps, see [Deploy your first application to Azure Spring Apps](https://learn.microsoft.com/azure/spring-apps/quickstart?tabs=Azure-CLI).

0 commit comments

Comments
 (0)