Skip to content

feat(spring): support Key Vault certificate alias filters 6x - #50052

Open
Arnab Nandy (arnabnandy7) wants to merge 1 commit into
Azure:feature/spring-cloud-azure-6.xfrom
arnabnandy7:feature/keyvault-certificate-alias-filter-6x-clone
Open

feat(spring): support Key Vault certificate alias filters 6x#50052
Arnab Nandy (arnabnandy7) wants to merge 1 commit into
Azure:feature/spring-cloud-azure-6.xfrom
arnabnandy7:feature/keyvault-certificate-alias-filter-6x-clone

Conversation

@arnabnandy7

Copy link
Copy Markdown
Contributor

Description

Adds Spring configuration support for filtering the certificate aliases loaded by the Azure Key Vault JCA provider.

Applications can now configure alias filter patterns independently for an SSL bundle's keystore and truststore:

  • spring.ssl.bundle.keyvault.<bundle-name>.keystore.certificate-alias-filter-patterns
  • spring.ssl.bundle.keyvault.<bundle-name>.truststore.certificate-alias-filter-patterns

The configured list is passed to the JCA provider through the azure.keyvault.jca.certificate-alias-filter-patterns system property. Include patterns are regular expressions, while exclusion patterns use the ! prefix. When the list is empty, all certificate aliases continue to be loaded, preserving the existing behavior.

The JCA system property is cleared between keystore and truststore initialization to prevent filter settings from leaking between SSL bundles or stores.

This change also:

  • Adds Spring configuration binding coverage for the new properties.
  • Adds unit coverage for propagation to the JCA system property.
  • Updates the Spring Cloud Azure and autoconfigure changelogs.

Resolves #50013.

Depends on #49774, which adds the corresponding certificate alias filtering support to azure-security-keyvault-jca.

The focused tests are:

mvn -f sdk/spring/pom.xml -pl spring-cloud-azure-autoconfigure -am \
  -Dtest=AzureKeyVaultJcaAutoConfigurationTests,AzureKeyVaultSslBundleRegistrarTests \
  -Dsurefire.failIfNoSpecifiedTests=false test

All SDK Contribution checklist:

  • The pull request does not introduce [breaking changes]
  • CHANGELOG is updated for new features, bug fixes or other significant changes.
  • I have read the contribution guidelines.

General Guidelines and Best Practices

  • Title of the pull request is clear and informative.
  • There are a small number of commits, each of which have an informative message. This means that previously merged commits do not appear in the history of the PR. For more information on cleaning up the commits in your PR, see this page.

Testing Guidelines

  • Pull request includes test coverage for the included changes.

Signed-off-by: Arnab Nandy <arnab_nandy7@yahoo.com>
@azure-pipelines

Copy link
Copy Markdown
Azure Pipelines:
Successfully started running 3 pipeline(s).
31 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

@github-actions github-actions Bot added azure-spring All azure-spring related issues Community Contribution Community members are working on the issue customer-reported Issues that are reported by GitHub users external to the Azure organization. labels Aug 6, 2026
@github-actions

github-actions Bot commented Aug 6, 2026

Copy link
Copy Markdown
Contributor

Thank you for your contribution Arnab Nandy (@arnabnandy7)! We will review the pull request and get back to you soon.

@arnabnandy7 Arnab Nandy (arnabnandy7) changed the title feat(spring): support Key Vault certificate alias filters feat(spring): support Key Vault certificate alias filters 6x Aug 6, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

azure-spring All azure-spring related issues Community Contribution Community members are working on the issue customer-reported Issues that are reported by GitHub users external to the Azure organization.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant