Tutorial: Connect to a managed Config Server for Spring in Azure Container Apps

Config Server for Spring provides a centralized location to make configuration data available to multiple applications. In this article, you learn to connect an app hosted in Azure Container Apps to a Java Config Server for Spring instance.

The Config Server for Spring Java component uses a GitHub repository as the source for configuration settings. Configuration values are made available to your container app via a binding between the component and your container app. As values change in the configuration server, they automatically flow to your application, all without requiring you to recompile or redeploy your application.

In this tutorial, you learn to:

Prerequisites

• An Azure account with an active subscription. If you don't already have one, you can can create one for free.
• Azure CLI.

Considerations

When running in Config Server for Spring in Azure Container Apps, be aware of the following details:

Setup

Before you begin to work with the Config Server for Spring, you first need to create the required resources.

This environment is used to host both the Config Server for Spring java component and your container app.

Create the Config Server for Spring Java component

Now that you have a Container Apps environment, you can create your container app and bind it to a Config Server for Spring java component. When you bind your container app, configuration values automatically synchronize from the Config Server component to your application.

Bind your container app to the Config Server for Spring Java component

After the container app and the Config Server component are bound together, configuration changes are automatically synchronized to the container app.

When you visit the app's URL again, the value of connectTimeout is now 10000. This value comes from the Git repository set in the $URI variable originally set as the source of the configuration component. Specifically, this value is drawn from the connectionTimeout property in the repo's application.yml file.

The bind request injects configuration setting into the application as environment variables. These values are now available to the application code to use when fetching configuration settings from the config server.

In this case, the following environment variables are available to the application:

SPRING_CLOUD_CONFIG_URI=http://[JAVA_COMPONENT_INTERNAL_FQDN]:80
SPRING_CLOUD_CONFIG_COMPONENT_URI=http://[JAVA_COMPONENT_INTERNAL_FQDN]:80
SPRING_CONFIG_IMPORT=optional:configserver:$SPRING_CLOUD_CONFIG_URI

If you want to customize your own SPRING_CONFIG_IMPORT, you can refer to the environment variable SPRING_CLOUD_CONFIG_COMPONENT_URI - for example, you can override by command line arguments, like Java -Dspring.config.import=optional:configserver:${SPRING_CLOUD_CONFIG_COMPONENT_URI}?fail-fast=true.

You can also remove a binding from your application.

(Optional) Unbind your container app from the Config Server for Spring Java component

az containerapp update \
    --name $APP_NAME \
    --unbind $JAVA_COMPONENT_NAME \
    --resource-group $RESOURCE_GROUP

When you visit the app's URL again, the value of connectTimeout changes to back to 0.

Clean up resources

The resources created in this tutorial have an effect on your Azure bill. If you aren't going to use these services long-term, run the following command to remove everything created in this tutorial.

az group delete --resource-group $RESOURCE_GROUP

Configuration options

The az containerapp update command uses the --configuration parameter to control how the Config Server for Spring is configured. You can use multiple parameters at once as long as they're separated by a space. For more information, see Spring Cloud Config Server.

The following table describes the different Git backend configuration values available:

The following list describes common configurations:

• Logging related configurations:

  • logging.level.*
  • logging.group.*
  • Any other configurations under the logging.* namespace should be forbidden - for example, writing log files by using logging.file should be forbidden.

• spring.cloud.config.server.overrides

  • Extra map for a property source to be sent to all clients unconditionally.

• spring.cloud.config.override-none

  • You can change the priority of all overrides in the client to be more like default values, letting applications supply their own values in environment variables or System properties, by setting the spring.cloud.config.override-none=true flag - the default is false - in the remote repository.

• spring.cloud.config.allow-override

  • If you enable config first bootstrap, you can allow client applications to override configuration from the config server by placing two properties within the applications configuration coming from the config server.

• spring.cloud.config.server.health.*

  • You can configure the Health Indicator to check more applications along with custom profiles and custom labels.

• spring.cloud.config.server.accept-empty

  • You can set spring.cloud.config.server.accept-empty to false so that the server returns an HTTP 404 status if the application isn't found. By default, this flag is set to true.

• Encryption and decryption (symmetric):

  • encrypt.key
    • Convenient when you use a symmetric key because it's a single property value to configure.
  • spring.cloud.config.server.encrypt.enabled
    • Set this property to false to disable server-side decryption.

Refresh

Services that consume properties need to know about a change before it happens. The default notification method for Config Server for Spring involves manually triggering the refresh event, such as a refresh by call https://<YOUR_CONFIG_CLIENT_HOST_NAME>/actuator/refresh, which might not be feasible if there are many app instances.

Instead, you can automatically refresh values from Config Server by letting the config client poll for changes based on a refresh internal. Use the following steps to automatically refresh values from Config Server:

1. Register a scheduled task to refresh the context in a given interval, as shown in the following example:

   @Configuration
   @AutoConfigureAfter({RefreshAutoConfiguration.class, RefreshEndpointAutoConfiguration.class})
   @EnableScheduling
   public class ConfigClientAutoRefreshConfiguration implements SchedulingConfigurer {
       @Value("${spring.cloud.config.refresh-interval:60}")
       private long refreshInterval;
       @Value("${spring.cloud.config.auto-refresh:false}")
       private boolean autoRefresh;
       private final RefreshEndpoint refreshEndpoint;
       public ConfigClientAutoRefreshConfiguration(RefreshEndpoint refreshEndpoint) {
           this.refreshEndpoint = refreshEndpoint;
       }
       @Override
       public void configureTasks(ScheduledTaskRegistrar scheduledTaskRegistrar) {
           if (autoRefresh) {
               // set minimal refresh interval to 5 seconds
               refreshInterval = Math.max(refreshInterval, 5);
               scheduledTaskRegistrar.addFixedRateTask(refreshEndpoint::refresh,  Duration.ofSeconds(refreshInterval));
           }
       }
   }
   

2. Enable autorefresh and set the appropriate refresh interval in the application.yml file. In the following example, the client polls for a configuration change every 60 seconds, which is the minimum value you can set for a refresh interval.

   By default, autorefresh is set to false and refresh-interval is set to 60 seconds.

   spring:
       cloud:
           config:
           auto-refresh: true
           refresh-interval: 60
   management:
       endpoints:
           web:
           exposure:
               include:
               - refresh
   

3. Add @RefreshScope in your code. In the following example, the variable connectTimeout is automatically refreshed every 60 seconds:

   @RestController
   @RefreshScope
   public class HelloController {
       @Value("${timeout:4000}")
       private String connectTimeout;
   }
   

Encryption and decryption with a symmetric key

Server-side decryption

By default, server-side encryption is enabled. Use the following steps to enable decryption in your application:

1. Add the encrypted property in your .properties file in your Git repository.

   Your file should resemble the following example:

   message={cipher}f43e3df3862ab196a4b367624a7d9b581e1c543610da353fbdd2477d60fb282f
   

2. Update the Config Server for Spring Java component to use the Git repository that has the encrypted property and set the encryption key.

   Before you run the following command, replace placeholders surrounded by <> with your values.

   az containerapp env java-component config-server-for-spring update \
       --environment <ENVIRONMENT_NAME> \
       --resource-group <RESOURCE_GROUP> \
       --name <JAVA_COMPONENT_NAME> \
       --configuration spring.cloud.config.server.git.uri=<URI> encrypt.key=randomKey
   

Client-side decryption

You can use client side decryption of properties by following the steps:

1. Add the encrypted property in your .properties file in your Git repository.

2. Update the Config Server for Spring Java component to use the Git repository that has the encrypted property and disable server-side decryption.

   Before you run the following command, replace placeholders surrounded by <> with your values.

   az containerapp env java-component config-server-for-spring update \
       --environment <ENVIRONMENT_NAME> \
       --resource-group <RESOURCE_GROUP> \
       --name <JAVA_COMPONENT_NAME> \
       --configuration spring.cloud.config.server.git.uri=<URI> spring.cloud.config.server.encrypt.enabled=false
   

3. In your client app, add the decryption key ENCRYPT_KEY=randomKey as an environment variable.

   Alternatively, if you include spring-cloud-starter-bootstrap on the classpath, or set spring.cloud.bootstrap.enabled=true as a system property, set encrypt.key in bootstrap.properties.

   Before you run the following command, replace placeholders surrounded by <> with your values.

   az containerapp update \
       --name <APP_NAME> \
       --resource-group <RESOURCE_GROUP> \
       --set-env-vars "ENCRYPT_KEY=randomKey"
   

   encrypt:
     key: somerandomkey