[plugin-azure-key-vault] Add ability to read property values from Azu…

…re KeyVault

docs/modules/configuration/pages/secrets-management.adoc

@@ -169,3 +169,10 @@ image::vault.png[Secrets in Vault,width=70%]
 db.connection.test.username=HASHI_CORP_VAULT(secret/vividus/test/username)
 db.connection.test.password=HASHI_CORP_VAULT(secret/vividus/test/password)
 ----
+
+=== xref:plugins:plugin-azure-resource-manager.adoc#_secrets_management_tools[Azure Key Vault]
+==== Configuration
+
+Supported getting property values from Azure Key Vault.
+Please see xref:plugins:plugin-azure-resource-manager.adoc#_configuration[Configuration section] to get more
+information on how configure required plugin.

docs/modules/plugins/pages/plugin-azure-resource-manager.adoc

@@ -30,6 +30,50 @@ The supported environments are only:
 Azure subscription must be configured via `AZURE_SUBSCRIPTION_ID` environment variable.
 
 
+=== Secrets Management Tools
+
+==== https://learn.microsoft.com/en-us/azure/key-vault/[Azure Key Vault]
+
+===== Configuration
+
+NOTE: The properties marked with *bold* are mandatory.
+
+[cols="1,3,1", options="header"]
+|===
+|Property
+|Description
+|Example
+|Default value
+
+|[subs=+quotes]`azure.key-vault.processor.enabled`
+|Toggle to enable processor for getting property values from Azure Key Vault
+|`true`
+|`false`
+
+|[subs=+quotes]`*azure.key-vault.name*`
+|Azure Key Vault Name with secret values for properties
+|`autotestkeyvault`
+|
+
+|[subs=+quotes]`azure.key-vault.api-version`
+|Client API version
+|`7.1`
+|`7.5`
+
+|===
+
+===== How to refer Azure Key Vault secrets
+. Find the required secret in Azure Key Vault.
++
+image::azure-key-vault.png[Secrets in Azure Key Vault]
+
+. Put the name to properties using the case-sensitive wrapping `AZURE_KEY_VAULT(...)`
++
+[source,properties]
+----
+db.connection.test.username=AZURE_KEY_VAULT(dev-mysql-analytics-user)
+----
+
 === Steps
 
 ==== Get information about Azure resource

vividus/src/main/java/org/vividus/configuration/AbstractPropertiesProcessor.java → vividus-engine/src/main/java/org/vividus/configuration/AbstractPropertiesProcessor.java

@@ -25,7 +25,7 @@ public abstract class AbstractPropertiesProcessor implements PropertiesProcessor
 {
  private final Pattern propertyPattern;
 
- AbstractPropertiesProcessor(String processorRegexMarker)
+ protected AbstractPropertiesProcessor(String processorRegexMarker)
  {
  this.propertyPattern = Pattern.compile("(" + processorRegexMarker + "\\((.+?)\\)" + ")");
  }

vividus-plugin-azure-resource-manager/build.gradle

@@ -4,6 +4,7 @@ dependencies {
  api project(':vividus-engine')
  implementation project(':vividus-extension-azure')
  implementation project(':vividus-soft-assert')
+ implementation project(':vividus-util')
  implementation(group: 'com.azure.resourcemanager', name: 'azure-resourcemanager-resources', version: '2.43.0')
 
  testImplementation platform(group: 'org.junit', name: 'junit-bom', version: '5.11.1')

vividus-plugin-azure-resource-manager/src/main/java/org/vividus/azure/client/AzureResourceManagerClient.java

@@ -0,0 +1,166 @@
+/*
+ * Copyright 2019-2024 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.vividus.azure.client;
+
+import java.util.Optional;
+import java.util.function.Consumer;
+
+import com.azure.core.credential.TokenCredential;
+import com.azure.core.http.ContentType;
+import com.azure.core.http.HttpHeaderName;
+import com.azure.core.http.HttpMethod;
+import com.azure.core.http.HttpPipeline;
+import com.azure.core.http.HttpRequest;
+import com.azure.core.http.HttpResponse;
+import com.azure.core.management.profile.AzureProfile;
+import com.azure.resourcemanager.resources.fluentcore.utils.HttpPipelineProvider;
+
+import org.apache.commons.lang3.StringUtils;
+import org.vividus.softassert.ISoftAssert;
+
+import io.netty.handler.codec.http.HttpResponseStatus;
+import reactor.core.publisher.Mono;
+
+public class AzureResourceManagerClient
+{
+ private static final String EXECUTION_FAILED = "Azure REST API HTTP request execution is failed: ";
+
+ private final HttpPipeline httpPipeline;
+ private final AzureProfile azureProfile;
+
+ public AzureResourceManagerClient(AzureProfile azureProfile, TokenCredential tokenCredential)
+ {
+ this.azureProfile = azureProfile;
+ this.httpPipeline = HttpPipelineProvider.buildHttpPipeline(tokenCredential, azureProfile);
+ }
+
+ /**
+ * Executes an HTTP request to the specified Azure resource using the provided parameters.
+ * This method constructs the URL for the request, sends the HTTP request, and handles the response
+ * or errors using the provided Consumer and ISoftAssert.
+ *
+ * @param method The HTTP method to be used for the request (e.g., GET, POST, PUT, DELETE).
+ * @param azureResourceIdentifier This is a VIVIDUS-only term. It's used to specify Azure resource uniquely. From
+ * the technical perspective it's a part of Azure resource REST API URL path. For
+ * example, if the full Azure resource URL is
+ * <br>
+ * <code>https://management.azure.com/subscriptions/
+ * 00000000-0000-0000-0000-000000000000/resourceGroups/sample-resource-group/
+ * providers/Microsoft.KeyVault/vaults/sample-vault?api-version=2021-10-01</code>,
+ * <br>
+ * then resource identifier will be
+ * <br>
+ * <code>resourceGroups/sample-resource-group/providers/Microsoft.KeyVault/
+ * vaults/sample-vault</code>.
+ * @param apiVersion Azure resource provider API version. Note API versions may vary depending on
+ * the resource type.
+ * @param azureResourceBody The Azure resource configuration in JSON format.
+ * @param responseBodyConsumer The Consumer that handles the response body if the request is successful.
+ * @param softAssert An implementation of ISoftAssert used for recording assertions on failure.
+ * This allows for error recording without stopping the execution flow.
+ */
+ public void executeHttpRequest(HttpMethod method, String azureResourceIdentifier, String apiVersion,
+ Optional<String> azureResourceBody, Consumer<String> responseBodyConsumer,
+ ISoftAssert softAssert)
+ {
+ String url = String.format("%ssubscriptions/%s%s?api-version=%s",
+ azureProfile.getEnvironment().getResourceManagerEndpoint(), azureProfile.getSubscriptionId(),
+ StringUtils.prependIfMissing(azureResourceIdentifier, "/"), apiVersion);
+ executeHttpRequest(method, url, azureResourceBody, responseBodyConsumer, softAssert::recordFailedAssertion);
+ }
+
+ /**
+ * Executes an HTTP request to the specified URL with the given parameters, handles errors
+ * using a soft assertion mechanism. Can be used for scenarios where need to continue execution
+ * even if the HTTP request fails, but still record the error.
+ *
+ * @param method The HTTP method to be used for the request (e.g., GET, POST, PUT, DELETE).
+ * @param azureResourceUrl It's used to specify Azure resource uniquely. For example:
+ * <ul>
+ * <li><code>https://management.azure.com/subscriptions/
+ * 00000000-0000-0000-0000-000000000000/resourceGroups/sample-resource-group/
+ * providers/Microsoft.KeyVault/vaults/sample-vault?api-version=2021-10-01</code>
+ * <br><i>or</i>
+ * <br>
+ * <li><code>https://api.loganalytics.io/v1/workspaces/00000000-0000-0000-0000-000000000000/
+ * query?query=Syslog</code>
+ * </ul>
+ * @param azureResourceBody The Azure resource configuration in JSON format.
+ * @param responseBodyConsumer The Consumer that handles the response body if the request is successful.
+ * @param softAssert An implementation of ISoftAssert used for recording assertions on failure.
+ * This allows for error recording without stopping the execution flow.
+ */
+ public void executeHttpRequest(HttpMethod method, String azureResourceUrl, Optional<String> azureResourceBody,
+ Consumer<String> responseBodyConsumer, ISoftAssert softAssert)
+ {
+ executeHttpRequest(method, azureResourceUrl, azureResourceBody, responseBodyConsumer,
+ softAssert::recordFailedAssertion);
+ }
+
+ /**
+ * Executes an HTTP request to the specified URL with the given parameters.
+ * This version of the method throws a RuntimeException on any error.
+ *
+ * @param method The HTTP method to be used for the request (e.g., GET, POST, PUT, DELETE).
+ * @param azureResourceUrl It's used to specify Azure resource uniquely. For example:
+ * <ul>
+ * <li><code>https://management.azure.com/subscriptions/
+ * 00000000-0000-0000-0000-000000000000/resourceGroups/sample-resource-group/
+ * providers/Microsoft.KeyVault/vaults/sample-vault?api-version=2021-10-01</code>
+ * <br><i>or</i>
+ * <br>
+ * <li><code>https://api.loganalytics.io/v1/workspaces/00000000-0000-0000-0000-000000000000/
+ * query?query=Syslog</code>
+ * </ul>
+ * @param azureResourceBody The Azure resource configuration in JSON format.
+ * @param responseBodyConsumer The Consumer that handles the response body if the request is successful.
+ */
+ public void executeHttpRequest(HttpMethod method, String azureResourceUrl, Optional<String> azureResourceBody,
+ Consumer<String> responseBodyConsumer)
+ {
+ executeHttpRequest(method, azureResourceUrl, azureResourceBody, responseBodyConsumer,
+ error -> { throw new RuntimeException(error); });
+ }
+
+ private void executeHttpRequest(HttpMethod method, String azureResourceUrl, Optional<String> azureResourceBody,
+ Consumer<String> responseBodyConsumer, Consumer<String> errorCallback)
+ {
+ HttpRequest httpRequest = new HttpRequest(method, azureResourceUrl);
+ azureResourceBody.ifPresent(requestBody -> {
+ httpRequest.setBody(requestBody);
+ httpRequest.setHeader(HttpHeaderName.CONTENT_TYPE, ContentType.APPLICATION_JSON);
+ });
+
+ try (HttpResponse httpResponse = httpPipeline.send(httpRequest).block())
+ {
+ Optional.ofNullable(httpResponse).map(HttpResponse::getBodyAsString).map(Mono::block).ifPresentOrElse(
+ responseBody -> {
+ if (httpResponse.getStatusCode() == HttpResponseStatus.OK.code())
+ {
+ responseBodyConsumer.accept(responseBody);
+ }
+ else
+ {
+ errorCallback.accept(EXECUTION_FAILED + ": " + responseBody);
+ }
+ }, () -> errorCallback.accept(EXECUTION_FAILED + " with empty body and status code: "
+ + httpResponse.getStatusCode()
+ )
+ );
+ }
+ }
+}

vividus-plugin-azure-resource-manager/src/main/java/org/vividus/azure/configuration/AzureKeyVaultPropertiesProcessor.java

@@ -0,0 +1,90 @@
+/*
+ * Copyright 2019-2024 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.vividus.azure.configuration;
+
+import java.util.Map;
+import java.util.Optional;
+import java.util.Properties;
+
+import com.azure.core.http.HttpMethod;
+import com.azure.core.management.AzureEnvironment;
+import com.azure.core.management.profile.AzureProfile;
+
+import org.apache.commons.lang3.Validate;
+import org.vividus.azure.client.AzureResourceManagerClient;
+import org.vividus.azure.identity.CredentialFactory;
+import org.vividus.configuration.AbstractPropertiesProcessor;
+import org.vividus.util.json.JsonPathUtils;
+
+public class AzureKeyVaultPropertiesProcessor extends AbstractPropertiesProcessor
+{
+ private static final String KEY_VAULT_PROCESSOR_ENABLED_PROPERTY = "azure.key-vault.processor.enabled";
+ private static final String ENVIRONMENT_PROPERTY = "azure.environment";
+ private static final String KEY_VAULT_NAME_PROPERTY = "azure.key-vault.name";
+ private static final String KEY_VAULT_API_VERSION_PROPERTY = "azure.key-vault.api-version";
+
+ private static final Map<String, AzureEnvironment> ENVIRONMENT_MAP = Map.of(
+ "AZURE", AzureEnvironment.AZURE,
+ "AZURE_CHINA", AzureEnvironment.AZURE_CHINA,
+ "AZURE_GERMANY", AzureEnvironment.AZURE_GERMANY,
+ "AZURE_US_GOVERNMENT", AzureEnvironment.AZURE_US_GOVERNMENT
+ );
+
+ private AzureEnvironment azureEnvironment;
+ private boolean processorEnabled;
+ private String keyVaultName;
+ private String apiVersion;
+ private AzureResourceManagerClient client;
+
+ public AzureKeyVaultPropertiesProcessor()
+ {
+ super("AZURE_KEY_VAULT");
+ }
+
+ @Override
+ public Properties processProperties(Properties properties)
+ {
+ this.processorEnabled = Boolean.parseBoolean(properties.getProperty(KEY_VAULT_PROCESSOR_ENABLED_PROPERTY));
+ this.azureEnvironment = ENVIRONMENT_MAP.get(properties.getProperty(ENVIRONMENT_PROPERTY));
+ this.keyVaultName = properties.getProperty(KEY_VAULT_NAME_PROPERTY);
+ this.apiVersion = properties.getProperty(KEY_VAULT_API_VERSION_PROPERTY);
+ return super.processProperties(properties);
+ }
+
+ @Override
+ protected String processValue(String propertyName, String partOfPropertyValueToProcess)
+ {
+ return processorEnabled ? getKeyVaultSecretValue(partOfPropertyValueToProcess)
+ : String.format("AZURE_KEY_VAULT(%s)", partOfPropertyValueToProcess);
+ }
+
+ private String getKeyVaultSecretValue(String secretName)
+ {
+ if (client == null)
+ {
+ Validate.notEmpty(keyVaultName, "Provide value into property `%s`", KEY_VAULT_NAME_PROPERTY);
+ this.client = new AzureResourceManagerClient(new AzureProfile(azureEnvironment),
+ CredentialFactory.createTokenCredential());
+ }
+ String[] value = new String[1];
+ client.executeHttpRequest(HttpMethod.GET,
+ String.format("https://%s%s/secrets/%s?api-version=%s", keyVaultName,
+ azureEnvironment.getKeyVaultDnsSuffix(), secretName, apiVersion), Optional.empty(),
+ response -> value[0] = JsonPathUtils.getData(response, "$.value"));
+ return value[0];
+ }
+}