Reference by URI

app:
  db:
    password: !secret "vault://kv/prod/app#dbPassword"
  gemini:
    apiKey: !secret "gcp://projects/foo/secrets/gemini-key/versions/latest"
Advertisement

Resolver chain

SecretResolver resolver = SecretResolver.chain(
    new VaultResolver(vaultClient),
    new GcpSecretResolver(gcpClient),
    new AwsSecretResolver(awsClient)
);
Advertisement

Fetch at startup + rotate

Load secrets once at boot. Watchers refresh periodically. Rotation without restart.