{"schemaVersion":"1.0","type":"TechArticle","types":["Article","TechArticle"],"slug":"centralized-secret-management-with-spring-cloud-config-vault-a-production-guide-zic98","url":"https://zyvop.com/centralized-secret-management-with-spring-cloud-config-vault-a-production-guide-zic98","title":"Centralized Secret Management with Spring Cloud Config & Vault: A Production Guide","subtitle":"How to manage environment properties and encrypted database secrets across microservices without rebuilding containers.","tldr":"Hardcoding DB credentials, JWT secrets or API keys inside application.yml or Docker images is a security disaster waiting to happen. Learn how to set up a production-grade Spring Cloud Config Server integrated with HashiCorp Vault for zero-downtime secret rotation across microservices.","keywords":["backend","springcloud","security","springboot","java","Microservices","Tutorial","Production-Grade Microservices Architecture with Java & Spring Boot"],"entities":["Shubham Bhati","Java Backend Engineer | Microservices","backend","springcloud","security","springboot","java","Microservices","Tutorial","Production-Grade Microservices Architecture with Java & Spring Boot","ZyVOP"],"keyTakeaways":["Spring Cloud Config and Vault provide production-grade secret management and zero-downtime property updates across distributed microservices."],"headings":["🔍 Why Centralized Configuration Management?","🛠️ Step 1: Setting Up the Spring Cloud Config Server","Maven Dependencies (pom.xml)","Application Main Class","Server Configuration (application.yml)","📡 Step 2: Binding Microservice Clients to Config Server","Client Configuration (application.yml)","⚡ Step 3: Dynamic Refresh without Restart (@RefreshScope)","🚀 Production Best Practices","🎯 Summary"],"outboundLinks":[],"contentText":"Hardcoding DB credentials, JWT secrets or API keys inside application.yml or Docker images is a security disaster waiting to happen. Rotating a password shouldn't require rebuilding 10 microservice containers and triggering a full redeployment pipeline. In Part 2 of our Spring Boot Microservices series, we will build a centralized configuration server using Spring Cloud Config integrated with HashiCorp Vault for secret encryption. 🔍 Why Centralized Configuration Management? In microservices architectures, centralized config management solves three critical challenges: Zero-Downtime Secret Rotation: Change database passwords or API keys in Vault without restarting microservices. Environment Isolation: Maintain separate profile configurations (dev, staging, prod) in a single Git or Vault backend. Audit Logging: Every secret read or modification is logged with timestamps and identity tokens. 🛠️ Step 1: Setting Up the Spring Cloud Config Server Create a standalone Spring Boot application for your Config Server. Maven Dependencies (pom.xml) <dependency> <groupId>org.springframework.cloud</groupId> <artifactId>spring-cloud-config-server</artifactId> </dependency> <dependency> <groupId>org.springframework.cloud</groupId> <artifactId>spring-cloud-starter-vault-config</artifactId> </dependency> Application Main Class Enable config server functionality with @EnableConfigServer: package com.tracker.configserver; import org.springframework.boot.SpringApplication; import org.springframework.boot.autoconfigure.SpringBootApplication; import org.springframework.cloud.config.server.EnableConfigServer; @SpringBootApplication @EnableConfigServer public class ConfigServerApplication { public static void main(String[] args) { SpringApplication.run(ConfigServerApplication.class, args); } } Server Configuration (application.yml) server: port: 8888 spring: application: name: config-server profiles: active: vault cloud: vault: host: localhost port: 8200 scheme: http authentication: TOKEN token: s.myProductionVaultTokenSecret 📡 Step 2: Binding Microservice Clients to Config Server Connect your microservice (payment-service) to pull properties dynamically at startup. Client Configuration (application.yml) spring: application: name: payment-service config: import: \"configserver:http://localhost:8888\" profiles: active: prod ⚡ Step 3: Dynamic Refresh without Restart (@RefreshScope) Annotate beans that consume dynamic properties with @RefreshScope: package com.tracker.payment.config; import org.springframework.beans.factory.annotation.Value; import org.springframework.cloud.context.config.annotation.RefreshScope; import org.springframework.stereotype.Component; @Component @RefreshScope public class PaymentGatewayConfig { @Value(\"${payment.stripe.secret-key}\") private String stripeSecretKey; public String getStripeSecretKey() { return stripeSecretKey; } } When you update a property in Vault, trigger a POST request to http://localhost:8082/actuator/refresh to reload the bean instantly without restarting the container! 🚀 Production Best Practices 💡 Production Tip: Centralized config servers can be hosted on minimal 250MB heap RAM instances (costing under ₹100/month) while securing sensitive production microservices. Vault Lease Renewal: Set TTLs on Vault database credentials so DB passwords auto-rotate every 24 hours. Fail-Fast Configuration: Set spring.cloud.config.fail-fast: true so a microservice immediately fails startup if it cannot connect to the Config Server rather than running with missing properties. 🎯 Summary Spring Cloud Config and Vault provide production-grade secret management and zero-downtime property updates across distributed microservices.","contentHash":"sha256:6567294e80aaf2f6b0563078c126089f85facb37ef48952a71fb4e38a6c00ca7","authorName":"Shubham Bhati","authorUrl":"https://zyvop.com/author/shubham","authorSameAs":["https://shubhambhati.is-a.dev","https://github.com/Shubh2-0","https://www.linkedin.com/in/bhatishubham"],"category":"Tutorial","tags":["backend","springcloud","security","springboot","java","Microservices"],"audience":"Developers, software engineers, and students learning Tutorial","tone":"Instructional, practical, code-first","readingTimeMinutes":2,"wordCount":467,"faqs":null,"primaryTopic":"Tutorial","publishedAt":"2026-08-01T18:25:34.868Z","updatedAt":"2026-08-21T17:40:00.533Z","canonicalUrl":"https://zyvop.com/centralized-secret-management-with-spring-cloud-config-vault-a-production-guide-zic98"}