Skip to content

Commit 8f08c15

Browse files
KarlEricksonKarlErickson
committed
edits
1 parent d5d1211 commit 8f08c15

File tree

1 file changed

+91
-83
lines changed

1 file changed

+91
-83
lines changed

‎articles/spring-apps/migration/migrate-to-azure-container-apps-custom-domain.md

Lines changed: 91 additions & 83 deletions
Original file line numberDiff line numberDiff line change
@@ -117,7 +117,7 @@ For more information, see the [Peer-to-peer encryption](../../container-apps/net
117117

118118
## Traffic to external services
119119

120-
This sample shows how to enable TLS and mTLS for traffic to external services by loading the certificate from Azure Key Vault using the `spring-cloud-azure-starter-keyvault-jca` library. Your Java project must use Spring Boot 3.1+ and include the following dependency in `pom.xml`:
120+
This sample shows how to enable TLS and mTLS for traffic to external services by loading the certificate from Azure Key Vault using the `spring-cloud-azure-starter-keyvault-jca` library. Your Java project must use Spring Boot 3.1+ and include the following dependency in your **pom.xml** file:
121121

122122
```xml
123123
<dependency>
@@ -127,104 +127,112 @@ This sample shows how to enable TLS and mTLS for traffic to external services by
127127
</dependency>
128128
```
129129

130-
### Load certificate into truststore from Key Vault with SSL bundle
130+
### Load a certificate into the truststore from Key Vault with SSL bundle
131+
132+
Use the following steps to load a certificate into the truststore from Azure Key Vault using the `spring-cloud-azure-starter-keyvault-jca` library:
131133

132134
1. Generate or import certificates in Azure Key Vault. For more information, see [Create and import certificates in Azure Key Vault](/azure/key-vault/certificates/certificate-scenarios#creating-and-importing-certificates).
135+
133136
1. Enable managed identity in your container app. To enable managed identity in your container app, see [Managed identities in Azure Container Apps](../../container-apps/managed-identity.md).
137+
134138
1. Grant the `Key Vault Certificate User` role to the managed identity in your Key Vault. For more information, see [Best Practices for individual keys, secrets, and certificates role assignments](/azure/key-vault/general/rbac-guide#best-practices-for-individual-keys-secrets-and-certificates-role-assignments).
135-
1. Configure `application.yml`:
136-
137-
```yml
138-
spring:
139-
ssl:
140-
bundle:
141-
keyvault:
142-
tlsClientBundle:
143-
truststore:
144-
keyvault-ref: keyvault1
145-
cloud:
146-
azure:
147-
keyvault:
148-
jca:
149-
vaults:
150-
keyvault1:
151-
endpoint: ${KEY_VAULT_SSL_BUNDLES_KEYVAULT_URI_01}
152-
credential:
153-
client-id: ${KEY_VAULT_SSL_BUNDLES_CLIENT_ID} # Required for user-assigned managed identity
154-
managed-identity-enabled: true
155-
```
156139

157-
1. To apply the Key Vault SSL bundle, update your `RestTemplate` or `WebClient` bean configuration:
140+
1. Add the following configuration to your **application.yml** file:
141+
142+
```yml
143+
spring:
144+
ssl:
145+
bundle:
146+
keyvault:
147+
tlsClientBundle:
148+
truststore:
149+
keyvault-ref: keyvault1
150+
cloud:
151+
azure:
152+
keyvault:
153+
jca:
154+
vaults:
155+
keyvault1:
156+
endpoint: ${KEY_VAULT_SSL_BUNDLES_KEYVAULT_URI_01}
157+
credential:
158+
client-id: ${KEY_VAULT_SSL_BUNDLES_CLIENT_ID} # Required for user-assigned managed identity
159+
managed-identity-enabled: true
160+
```
158161

159-
```java
160-
// For RestTemplate
161-
@Bean
162-
RestTemplate restTemplateWithTLS(RestTemplateBuilder restTemplateBuilder, SslBundles sslBundles) {
163-
return restTemplateBuilder.sslBundle(sslBundles.getBundle("tlsClientBundle")).build();
164-
}
162+
1. To apply the Key Vault SSL bundle, update your `RestTemplate` or `WebClient` bean configuration, as shown in the following example:
165163

166-
// For WebClient
167-
@Bean
168-
WebClient webClientWithTLS(WebClientSsl ssl) {
169-
return WebClient.builder().apply(ssl.fromBundle("tlsClientBundle")).build();
170-
}
171-
```
164+
```java
165+
// For RestTemplate
166+
@Bean
167+
RestTemplate restTemplateWithTLS(RestTemplateBuilder restTemplateBuilder, SslBundles sslBundles) {
168+
return restTemplateBuilder.sslBundle(sslBundles.getBundle("tlsClientBundle")).build();
169+
}
170+
171+
// For WebClient
172+
@Bean
173+
WebClient webClientWithTLS(WebClientSsl ssl) {
174+
return WebClient.builder().apply(ssl.fromBundle("tlsClientBundle")).build();
175+
}
176+
```
172177

173178
### Enable mTLS communication
174179

175-
Set up mTLS for two-way authentication between client and server.
180+
Use the following steps to set up mTLS for two-way authentication between client and server:
176181

177182
1. Generate or import both client and server certificates to Azure Key Vault. For more information, see [Create and import certificates in Azure Key Vault](/azure/key-vault/certificates/certificate-scenarios#creating-and-importing-certificates).
183+
178184
1. Enable managed identity for your container app. To enable managed identity in your container app, see [Managed identities in Azure Container Apps](../../container-apps/managed-identity.md).
179-
1. Grant `Key Vault Certificate User` role to the managed identity for both Key Vaults. For more information, see [Best Practices for individual keys, secrets, and certificates role assignments](/azure/key-vault/general/rbac-guide#best-practices-for-individual-keys-secrets-and-certificates-role-assignments).
180-
1. Configure `application.yml` for mTLS:
181-
182-
```yml
183-
spring:
184-
ssl:
185-
bundle:
186-
keyvault:
187-
mtlsClientBundle:
188-
key:
189-
alias: client
190-
for-client-auth: true
191-
keystore:
192-
keyvault-ref: keyvault2
193-
truststore:
194-
keyvault-ref: keyvault1
195-
cloud:
196-
azure:
197-
keyvault:
198-
jca:
199-
vaults:
200-
keyvault1:
201-
endpoint: ${KEY_VAULT_SSL_BUNDLES_KEYVAULT_URI_01}
202-
credential:
203-
client-id: ${KEY_VAULT_SSL_BUNDLES_CLIENT_ID} # Required for user-assigned managed identity
204-
managed-identity-enabled: true
205-
keyvault2:
206-
endpoint: ${KEY_VAULT_SSL_BUNDLES_KEYVAULT_URI_02}
207-
credential:
208-
client-id: ${KEY_VAULT_SSL_BUNDLES_CLIENT_ID} # Required for user-assigned managed identity
209-
managed-identity-enabled: true
210-
```
211185

212-
1. To apply the Key Vault SSL bundle, update your `RestTemplate` or `WebClient` bean configuration:
186+
1. Grant the `Key Vault Certificate User` role to the managed identity for both key vaults. For more information, see [Best Practices for individual keys, secrets, and certificates role assignments](/azure/key-vault/general/rbac-guide#best-practices-for-individual-keys-secrets-and-certificates-role-assignments).
187+
188+
1. Add the following configuration to your **application.yml** file for mTLS:
189+
190+
```yml
191+
spring:
192+
ssl:
193+
bundle:
194+
keyvault:
195+
mtlsClientBundle:
196+
key:
197+
alias: client
198+
for-client-auth: true
199+
keystore:
200+
keyvault-ref: keyvault2
201+
truststore:
202+
keyvault-ref: keyvault1
203+
cloud:
204+
azure:
205+
keyvault:
206+
jca:
207+
vaults:
208+
keyvault1:
209+
endpoint: ${KEY_VAULT_SSL_BUNDLES_KEYVAULT_URI_01}
210+
credential:
211+
client-id: ${KEY_VAULT_SSL_BUNDLES_CLIENT_ID} # Required for user-assigned managed identity
212+
managed-identity-enabled: true
213+
keyvault2:
214+
endpoint: ${KEY_VAULT_SSL_BUNDLES_KEYVAULT_URI_02}
215+
credential:
216+
client-id: ${KEY_VAULT_SSL_BUNDLES_CLIENT_ID} # Required for user-assigned managed identity
217+
managed-identity-enabled: true
218+
```
213219

214-
```java
215-
// For RestTemplate
216-
@Bean
217-
RestTemplate restTemplateWithMTLS(RestTemplateBuilder restTemplateBuilder, SslBundles sslBundles) {
218-
return restTemplateBuilder.sslBundle(sslBundles.getBundle("mtlsClientBundle")).build();
219-
}
220+
1. To apply the Key Vault SSL bundle, update your `RestTemplate` or `WebClient` bean configuration, as shown in the following example:
220221

221-
// For WebClient
222-
@Bean
223-
WebClient webClientWithMTLS(WebClientSsl ssl) {
224-
return WebClient.builder().apply(ssl.fromBundle("mtlsClientBundle")).build();
225-
}
226-
```
222+
```java
223+
// For RestTemplate
224+
@Bean
225+
RestTemplate restTemplateWithMTLS(RestTemplateBuilder restTemplateBuilder, SslBundles sslBundles) {
226+
return restTemplateBuilder.sslBundle(sslBundles.getBundle("mtlsClientBundle")).build();
227+
}
228+
229+
// For WebClient
230+
@Bean
231+
WebClient webClientWithMTLS(WebClientSsl ssl) {
232+
return WebClient.builder().apply(ssl.fromBundle("mtlsClientBundle")).build();
233+
}
234+
```
227235

228-
For more information on using the `spring-cloud-azure-starter-keyvault-jca` in your Spring Boot application, see [Introducing Spring Cloud Azure Starter Key Vault JCA: Streamlined TLS and mTLS for Spring Boot](https://devblogs.microsoft.com/azure-sdk/introducing-spring-cloud-azure-starter-key-vault-jca-streamlined-tls-and-mtls-for-spring-boot/).
236+
For more information on using the `spring-cloud-azure-starter-keyvault-jca` library in your Spring Boot application, see [Introducing Spring Cloud Azure Starter Key Vault JCA: Streamlined TLS and mTLS for Spring Boot](https://devblogs.microsoft.com/azure-sdk/introducing-spring-cloud-azure-starter-key-vault-jca-streamlined-tls-and-mtls-for-spring-boot/).
229237

230238
By following these steps, you can successfully migrate your custom domain with TLS/SSL from Azure Spring Apps to Azure Container Apps, maintaining secure and efficient communication across all traffic types.

0 commit comments

Comments
 (0)