Implementing Configuration Management
1. Designing Configuration Hierarchy
| Source | Priority (high to low) |
|---|---|
| Command-line args | 1 |
| Environment variables | 2 |
| External config (vault/server) | 3 |
| Profile-specific file | 4 |
| Default file (application.yml) | 5 |
2. Implementing Externalized Configuration
| Tool | Use |
|---|---|
| Spring Cloud Config | Centralized git-backed |
| Consul / etcd | Distributed KV |
| AWS Parameter Store / Secrets Manager | Cloud-native |
| HashiCorp Vault | Secrets + dynamic |
3. Using Environment-Specific Configs
Example: Spring profiles
# application.yml (defaults)
server:
port: 8080
---
spring:
config:
activate:
on-profile: prod
server:
port: 80
logging:
level:
root: WARN4. Implementing Configuration Encryption
| Approach | Detail |
|---|---|
| Jasypt | Encrypt values in YAML/properties |
| Sealed Secrets | Kubernetes-native |
| Vault Transit | Encryption-as-a-service |
| SOPS | Mozilla, age/PGP/KMS backed |
5. Implementing Feature Flags
| Type | Use |
|---|---|
| Release toggle | Hide unfinished feature |
| Experiment | A/B test |
| Ops toggle | Kill switch |
| Permission | Per-user/tenant |
Example: Flag check
if (flags.isEnabled("checkout.v2", userContext)) {
return checkoutV2.run(cart);
}
return checkoutV1.run(cart);6. Using Configuration Profiles
| Profile | Purpose |
|---|---|
| local / dev | Developer machine |
| test | CI / integration tests |
| staging | Pre-prod parity |
| prod | Production |
7. Implementing Dynamic Configuration Refresh
| Mechanism | Detail |
|---|---|
Spring @RefreshScope | Beans re-instantiated on refresh event |
| Polling | Periodic fetch of latest |
| Push (websocket/SSE) | Server pushes changes |
| Watch streams | Consul/etcd watch APIs |
8. Implementing Configuration Validation
Example: @ConfigurationProperties + @Validated
@ConfigurationProperties("app.payment")
@Validated
public record PaymentConfig(
@NotBlank String apiKey,
@Min(1) int connectTimeoutMs,
@Min(1) int readTimeoutMs,
@NotNull Duration retryBackoff) {}9. Using Environment Variables
| Convention | Detail |
|---|---|
| UPPER_SNAKE | DATABASE_URL |
| Spring mapping | app.payment.api-key → APP_PAYMENT_API_KEY |
| 12-factor | Config in env, not code |
| Don't log | Especially secrets |
10. Implementing Configuration Binding
| Approach | Detail |
|---|---|
@Value | Single property; no validation |
@ConfigurationProperties | Type-safe, validated, IDE autocomplete |
| Records | Immutable config bean |
11. Implementing Secret Management
| Practice | Detail |
|---|---|
| Never commit | git-secrets, gitleaks pre-commit |
| Vault / KMS | Fetch at startup or runtime |
| Rotation | Auto-rotate; support multiple active |
| Least privilege | Per-service IAM role |
| Audit access | Log who fetched what |
12. Implementing Configuration Auditing
| Track | Detail |
|---|---|
| Who | Actor |
| What | Key, before/after value (mask secrets) |
| When | Timestamp |
| Why | Optional reason / ticket |