springcloud-config配置中心的安全配置
阿新 • • 發佈:2018-12-24
1.配置中心提供HTTP rest 服務
/{application}/{profile}[/{label}]
/{application}-{profile}.yml
/{label}/{application}-{profile}.yml
/{application}-{profile}.properties
/{label}/{application}-{profile}.properties
{application} maps to "spring.application.name" on the client side;
{profile} maps to "spring.profiles.active" on the client (comma separated list); and
{label} which is a server side feature labelling a "versioned" set of config files.
客戶端配置舉例:
bootstrap.yml 優先於application.yml載入;
spring:
application:
name: foo
profiles:
active: dev,mysql
2. spring-cloud-config 使用GIT服務時,為GIT服務新增使用者名稱密碼
application.yml配置檔案中新增
spring:
cloud:
config:
server:
git:
uri: https://github.com/spring-cloud-samples/config-repo
username: trolley
password: strongpassword
3.spring-cloud-config 的REST 要求進行使用者名稱密碼鑑權
- 服務端
application.yml配置檔案中新增
security.user.password: mysecret
pom.xml 中新增
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-security</artifactId>
</dependency>
- 客戶端
bootstrap.yml
spring:
cloud:
config:
uri: https://user:[email protected].mycompany.com
4.spring-cloud-config 中的配置資訊以密文儲存方式儲存在GIT中
有對稱加密和非對稱加密兩種方式,本文主要講對稱加密的配置
1. application.yml在配置檔案中新增encrypt.key引數,生產環境可以放到JVM啟動引數中或者系統變數裡
To configure a symmetric key you just need to set encrypt.key to a secret String (or use an enviroment variable ENCRYPT_KEY to keep it out of plain text configuration files).
如:application.yml
encrypt.key: foo
to use the encryption and decryption features you need the full-strength JCE installed in your JVM (it’s not there by default).
$ curl localhost:8888/encrypt -d mysecret
682bc583f4641835fa2db009355293665d2647dade3375c0ee201de2a49f7bda
3.git中的配置檔案的配置項可以使用{cipher}開頭,表示客戶端呼叫時,配置服務會使用encrypt.key進行解密操作,使客戶端得到最終資訊
spring.datasource.password: {cipher}682bc583f4641835fa2db009355293665d2647dade3375c0ee201de2a49f7bda
以上步驟解決了GIT倉庫配置資訊明文儲存的問題.
4.當配置服務的客戶端訪問URL時,可以得到解密後的資訊,
$curl localhost:8888/decrypt -d 682bc583f4641835fa2db009355293665d2647dade3375c0ee201de2a49f7bda
mysecret