Skip to content

feat(spring): support Key Vault certificate alias filters 6x - #50051

Closed
Arnab Nandy (arnabnandy7) wants to merge 1 commit into
Azure:feature/spring-cloud-azure-6.xfrom
arnabnandy7:feature/keyvault-certificate-alias-filter-6x
Closed

feat(spring): support Key Vault certificate alias filters 6x#50051
Arnab Nandy (arnabnandy7) wants to merge 1 commit into
Azure:feature/spring-cloud-azure-6.xfrom
arnabnandy7:feature/keyvault-certificate-alias-filter-6x

Conversation

@arnabnandy7

Copy link
Copy Markdown
Contributor

Description

Adds Spring configuration support for filtering the certificate aliases loaded by the Azure Key Vault JCA provider.

Applications can now configure alias filter patterns independently for an SSL bundle's keystore and truststore:

  • spring.ssl.bundle.keyvault.<bundle-name>.keystore.certificate-alias-filter-patterns
  • spring.ssl.bundle.keyvault.<bundle-name>.truststore.certificate-alias-filter-patterns

The configured list is passed to the JCA provider through the azure.keyvault.jca.certificate-alias-filter-patterns system property. Include patterns are regular expressions, while exclusion patterns use the ! prefix. When the list is empty, all certificate aliases continue to be loaded, preserving the existing behavior.

The JCA system property is cleared between keystore and truststore initialization to prevent filter settings from leaking between SSL bundles or stores.

This change also:

  • Adds Spring configuration binding coverage for the new properties.
  • Adds unit coverage for propagation to the JCA system property.
  • Updates the Spring Cloud Azure and autoconfigure changelogs.

Resolves #50013.

Depends on #49774, which adds the corresponding certificate alias filtering support to azure-security-keyvault-jca.

The focused tests are:

mvn -f sdk/spring/pom.xml -pl spring-cloud-azure-autoconfigure -am \
  -Dtest=AzureKeyVaultJcaAutoConfigurationTests,AzureKeyVaultSslBundleRegistrarTests \
  -Dsurefire.failIfNoSpecifiedTests=false test

All SDK Contribution checklist:

  • The pull request does not introduce [breaking changes]
  • CHANGELOG is updated for new features, bug fixes or other significant changes.
  • I have read the contribution guidelines.

General Guidelines and Best Practices

  • Title of the pull request is clear and informative.
  • There are a small number of commits, each of which have an informative message. This means that previously merged commits do not appear in the history of the PR. For more information on cleaning up the commits in your PR, see this page.

Testing Guidelines

  • Pull request includes test coverage for the included changes.

Signed-off-by: Arnab Nandy <arnab_nandy7@yahoo.com>

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot wasn't able to review this pull request because it exceeds the maximum number of files (300). Try reducing the number of changed files and requesting a review from Copilot again.

@github-actions

github-actions Bot commented Aug 6, 2026

Copy link
Copy Markdown
Contributor

Thank you for your contribution Arnab Nandy (@arnabnandy7)! We will review the pull request and get back to you soon.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

AgriFood AI Agents AI Model Inference AI Projects AI App Configuration Azure.ApplicationModel.Configuration Attestation Azure.Core.AMQP azure-core-amqp Azure.Core azure-core Azure.Identity Azure SDK Tools Label for tracking issues related to Azure SDK Tools azure-spring All azure-spring related issues Batch clientcore Cognitive - Anomaly Detector Cognitive - Face Cognitive - Form Recognizer Cognitive - Health Insights Cognitive - Metrics Advisor Cognitive - Personalizer Cognitive - Text Analytics Cognitive - Translator common common module used by all azure SDKs (e.g. client, Mgmt) Communication - Call Automation Communication - Calling Server Communication - Chat Communication - Common Communication - Email Communication - Identity Communication - Phone Numbers Communication - Rooms Communication - SMS Communication Community Contribution Community members are working on the issue Confidential Ledger Container Registry Cosmos customer-reported Issues that are reported by GitHub users external to the Azure organization. DevCenter Device Update Digital Twins Document Intelligence EngSys This issue is impacting the engineering system. Event Grid Event Hubs Health Deidentification Image Analysis KeyVault Load Testing Mgmt This issue is related to a management-plane library. Models Repository Monitor - Autoconfigure Monitor OpenTelemetry Autoconfigure Monitor Monitor, Monitor Ingestion, Monitor Query Online Experimentation OpenAI OpenTelemetry OpenTelemetry instrumentation Purview Quantum Schema Registry Search Service Bus Storage Storage Service (Queues, Blobs, Files) Tables Track 1 WebPubSub

Projects

Status: Done
Status: Done
Status: Done

Development

Successfully merging this pull request may close these issues.

[FEATURE REQ] Support KeyVault certificate alias filter on Spring side

2 participants