Spring Cloud配置安全实战：使用Jasypt加密敏感信息

<dependency>
    <groupId>com.github.ulisesbocchio</groupId>
    <artifactId>jasypt-spring-boot-starter</artifactId>
    <version>3.0.5</version>
</dependency>

implementation 'com.github.ulisesbocchio:jasypt-spring-boot-starter:3.0.5'

# application.properties
jasypt.encryptor.password=${JASYPT_PASSWORD:defaultKey}

export JASYPT_PASSWORD=your_secure_key
# 或使用启动参数
java -jar app.jar --jasypt.encryptor.password=your_secure_key

@Component
public class JasyptUtil {
    
    @Autowired
    private StringEncryptor stringEncryptor;
    
    /**
     * 加密明文文本
     */
    public String encrypt(String plainText) {
        return "ENC(" + stringEncryptor.encrypt(plainText) + ")";
    }
    
    /**
     * 解密密文文本
     */
    public String decrypt(String encryptedText) {
        if (encryptedText.startsWith("ENC(") && encryptedText.endsWith(")")) {
            String cipherText = encryptedText.substring(4, encryptedText.length() - 1);
            return stringEncryptor.decrypt(cipherText);
        }
        return encryptedText;
    }
    
    /**
     * 批量加密配置项
     */
    public Map<String, String> batchEncrypt(Map<String, String> configMap) {
        return configMap.entrySet().stream()
                .collect(Collectors.toMap(
                    Map.Entry::getKey,
                    entry -> encrypt(entry.getValue())
                ));
    }
}

# application.yml
spring:
  datasource:
    url: ENC(AbcDefGhIjKlMnOpQrStUvWxYz0123456789==)
    username: ENC(xyzABC123def456ghi789==)
    password: ENC(987zyx654wvu321tsr0==)
    
  redis:
    password: ENC(123abc456def789ghi==)
    
custom:
  api-key: ENC(abcdefghijklmnopqrstuvwxyz012345==)

# bootstrap.yml
spring:
  cloud:
    nacos:
      config:
        server-addr: localhost:8848
        file-extension: yaml
        shared-configs[0]:
          data-id: common-config.yaml
          refresh: true
  config:
    import: optional:nacos:application.yaml

jasypt:
  encryptor:
    bean: encryptorBean
    password: ${CONFIG_SERVER_ENCRYPT_KEY:defaultKey}

# 自定义加密器配置
@Bean("encryptorBean")
public StringEncryptor stringEncryptor() {
    PooledPBEStringEncryptor encryptor = new PooledPBEStringEncryptor();
    SimpleStringPBEConfig config = new SimpleStringPBEConfig();
    config.setPassword(System.getenv("CONFIG_SERVER_ENCRYPT_KEY"));
    config.setAlgorithm("PBEWITHHMACSHA512ANDAES_256");
    config.setKeyObtentionIterations("1000");
    config.setPoolSize("1");
    config.setProviderName("SunJCE");
    config.setSaltGeneratorClassName("org.jasypt.salt.RandomSaltGenerator");
    config.setIvGeneratorClassName("org.jasypt.iv.RandomIvGenerator");
    config.setStringOutputType("base64");
    encryptor.setConfig(config);
    return encryptor;
}

# 控制解密行为
jasypt.encryptor.proxy-property-sources=true
jasypt.encryptor.property.prefix=ENC(
jasypt.encryptor.property.suffix=)

@Configuration
public class MultiSourceEncryptConfig {
    
    @Bean
    @Primary
    public ConfigurableEnvironment encryptableEnvironment(ConfigurableEnvironment environment) {
        MutablePropertySources propertySources = environment.getPropertySources();
        for (PropertySource<?> propertySource : propertySources) {
            if (propertySource instanceof MapPropertySource) {
                MapPropertySource encryptedPropertySource = 
                    new EncryptableMapPropertySource(propertySource.getName(), 
                    (Map<String, Object>) propertySource.getSource(), 
                    stringEncryptor());
                propertySources.replace(propertySource.getName(), encryptedPropertySource);
            }
        }
        return environment;
    }
}

# 高度敏感信息 - 必须加密
security:
  oauth2:
    client-secret: ENC(最高级别加密内容)
    
# 中等敏感信息 - 建议加密
database:
  password: ENC(中等级别加密内容)
  
# 低敏感信息 - 可选择加密
logging:
  level: INFO  # 无需加密

@Component
public class ConfigValidator implements ApplicationRunner {
    
    @Value("${spring.datasource.password}")
    private String dbPassword;
    
    @Autowired
    private JasyptUtil jasyptUtil;
    
    @Override
    public void run(ApplicationArguments args) {
        try {
            String decryptedPassword = jasyptUtil.decrypt(dbPassword);
            // 验证解密后的配置是否有效
            if (decryptedPassword == null || decryptedPassword.trim().isEmpty()) {
                throw new IllegalStateException("数据库密码配置解密失败");
            }
        } catch (Exception e) {
            throw new ConfigurationException("配置解密验证失败", e);
        }
    }
}

# 启用解密缓存
jasypt.encryptor.caching=true
jasypt.encryptor.cache-expiration-minutes=30

@Bean
public StringEncryptor customEncryptor() {
    PooledPBEStringEncryptor encryptor = new PooledPBEStringEncryptor();
    SimpleStringPBEConfig config = new SimpleStringPBEConfig();
    config.setPassword(System.getenv("JASYPT_PASSWORD"));
    config.setPoolSize("4");  // 根据CPU核心数调整
    config.setAlgorithm("PBEWITHHMACSHA512ANDAES_256");
    encryptor.setConfig(config);
    return encryptor;
}

<dependency>
    <groupId>com.github.ulisesbocchio</groupId>
    <artifactId>jasypt-spring-boot-starter</artifactId>
    <version>3.0.5</version>
</dependency>

jasypt:
  encryptor:
    password: ${JASYPT_PASSWORD:defaultKey2025}
    algorithm: PBEWithMD5AndDES

@SpringBootTest
class PasswordEncryptTest {
    @Autowired
    private StringEncryptor encryptor;
    
    @Test
    void generateEncryptedPassword() {
        String rawPassword = "OrderDB@2025";
        String encrypted = encryptor.encrypt(rawPassword);
        System.out.println("加密结果: ENC(" + encrypted + ")");
    }
}

spring:
  datasource:
    url: jdbc:mysql://mysql-cluster:3306/order_db
    username: order_user
    password: ENC(4sDc7kOp9MqWxYz2AbC3dE6fG8hJ1kLm)
    driver-class-name: com.mysql.cj.jdbc.Driver

2025-09-21 09:15:23 INFO  o.s.c.a.n.c.NacosPropertySourceBuilder - Loading data from Nacos, dataId: order-service.yml
2025-09-21 09:15:24 DEBUG c.u.j.f.DefaultLazyEncryptor - Decrypted property spring.datasource.password successfully
2025-09-21 09:15:25 INFO  c.a.d.p.DruidDataSource - {dataSource-1} inited

logging:
  level:
    com.ulisesbocchio.jasyptspringboot: DEBUG

export JASYPT_PASSWORD="YourSecureKey2025!"

spring:
  profiles:
    active: ${CURRENT_ENV:dev}

---
spring:
  profiles: dev
jasypt:
  encryptor:
    password: dev_key_2025

---
spring:
  profiles: prod
jasypt:
  encryptor:
    password: ${PROD_JASYPT_PASSWORD}

jasypt:
  encryptor:
    algorithm: PBEWithMD5AndDES
    iv-generator-classname: org.jasypt.iv.NoIvGenerator

jasypt:
  encryptor:
    algorithm: PBEWITHHMACSHA512ANDAES_256
    iv-generator-classname: org.jasypt.iv.RandomIvGenerator

jasypt:
  encryptor:
    password: ${JASYPT_ENCRYPTOR_PASSWORD}

apiVersion: v1
kind: Secret
metadata:
  name: jasypt-key
data:
  password: <base64-encoded-key>

name: Auto Rotate Jasypt Secrets
on:
  schedule:
    - cron: '0 0 1 * *'  # 每月自动执行
jobs:
  rotate-secrets:
    runs-on: ubuntu-latest
    steps:
      - name: Generate new key
        id: generate-key
        run: |
          NEW_KEY=$(openssl rand -base64 32)
          echo "NEW_KEY=$NEW_KEY" >> $GITHUB_ENV
      - name: Update GitHub Secret
        uses: actions/github-script@v6
        with:
          script: |
            github.rest.actions.createOrUpdateRepoSecret({
              owner: context.repo.owner,
              repo: context.repo.repo,
              secret_name: 'JASYPT_ENCRYPTOR_PASSWORD',
              encrypted_value: '${{ env.NEW_KEY }}'
            })

<plugin>
  <groupId>com.github.ulisesbocchio</groupId>
  <artifactId>jasypt-maven-plugin</artifactId>
  <version>3.0.5</version>
  <configuration>
    <password>${env.JASYPT_KEY}</password>
    <algorithm>PBEWITHHMACSHA512ANDAES_256</algorithm>
  </configuration>
  <executions>
    <execution>
      <phase>process-resources</phase>
      <goals>
        <goal>encrypt</goal>
      </goals>
    </execution>
  </executions>
</plugin>

stages:
  - security
  - deploy

encrypt_configs:
  stage: security
  script:
    - mvn jasypt:encrypt -Djasypt.encryptor.password=$ENV_KEY
  rules:
    - if: $CI_COMMIT_BRANCH == "develop"
      variables:
        ENV_KEY: $DEV_JASYPT_KEY
    - if: $CI_COMMIT_BRANCH == "main"  
      variables:
        ENV_KEY: $PROD_JASYPT_KEY

apiVersion: jasypt.operator/v1
kind: EncryptionConfig
metadata:
  name: jasypt-production
spec:
  encryptor:
    algorithm: PBEWITHHMACSHA512ANDAES_256
    keyRotation:
      enabled: true
      schedule: "0 2 * * 0"  # 每周日2点自动轮换
    keySource:
      vault:
        path: "secret/data/jasypt"
        role: "jasypt-operator"
  
  targets:
    - namespace: order-service
      configMaps:
        - name: order-db-config
      secrets:
        - name: order-service-secrets

@Controller
public class JasyptSecretOperator {
    
    @EventListener
    public void onKeyRotation(KeyRotationEvent event) {
        V1SecretList secrets = kubernetesClient.secrets()
            .inNamespace(event.getNamespace())
            .withLabel("jasypt-encrypted", "true")
            .list();
            
        secrets.getItems().forEach(secret -> {
            String currentKey = getCurrentKey(secret);
            String newKey = generateNewKey();
            
            // 重新加密所有使用旧密钥的数据
            reencryptSecretData(secret, currentKey, newKey);
            
            // 更新Kubernetes Secret
            updateKubernetesSecret(secret, newKey);
        });
    }
}

@Bean
public StringEncryptor encryptor() {
    PooledPBEStringEncryptor encryptor = new PooledPBEStringEncryptor();
    encryptor.setPassword("new_password,old_password"); // 支持多密钥
    encryptor.setKeyRotationEnabled(true);
}

apiVersion: batch/v1
kind: CronJob
metadata:
  name: jasypt-key-rotator
spec:
  schedule: "0 0 1 * *"  # 每月1号执行
  jobTemplate:
    spec:
      template:
        spec:
          containers:
          - name: key-rotator
            image: jasypt/key-rotator:2025.09
            env:
              - name: KEY_ROTATION_INTERVAL
                value: "30d"
            command: ["/bin/rotate-keys.sh"]

@Aspect
@Component
public class DecryptionAuditAspect {
    
    @Around("@annotation(DecryptionAudit)")
    public Object auditDecryption(ProceedingJoinPoint joinPoint) throws Throwable {
        Span decryptionSpan = tracer.spanBuilder("jasypt.decryption")
            .setAttribute("env", currentEnvironment)
            .startSpan();
            
        try (Scope scope = decryptionSpan.makeCurrent()) {
            Object result = joinPoint.proceed();
            decryptionSpan.setStatus(StatusCode.OK);
            return result;
        } catch (Exception e) {
            decryptionSpan.recordException(e);
            decryptionSpan.setStatus(StatusCode.ERROR);
            throw e;
        }
    }
}

# jasypt_monitoring.yml
groups:
- name: jasypt_security
  rules:
  - alert: JasyptDecryptionFailure
    expr: rate(jasypt_decryption_failures_total[5m]) > 0.1
    labels:
      severity: critical
    annotations:
      summary: "Jasypt解密失败率异常"

apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: jasypt-multi-cloud
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: cloud-secret-store
    kind: ClusterSecretStore
  target:
    name: jasypt-production-key
  data:
  - secretKey: jasypt-password
    remoteRef:
      key: encryption-keys
      property: jasypt-2025q3

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
  name: jasypt-key-access
spec:
  selector:
    matchLabels:
      app: order-service
  rules:
  - from:
    - source:
        principals: ["cluster.local/ns/security/sa/jasypt-operator"]
    to:
    - operation:
        methods: ["GET"]
        paths: ["/keys/*"]

jasypt:
  encryptor:
    algorithm: PBEWithMD5AndDES
    password: ${JASYPT_PASSWORD}

@Autowired
private Environment env;
// 调试代码中输出密钥
System.out.println("密钥状态：" + env.getProperty("jasypt.encryptor.password"));

@Component("cachedEncryptor")
public class CachedStringEncryptor implements StringEncryptor {
    private final StringEncryptor delegate;
    private final Cache<String, String> cache = Caffeine.newBuilder().build();
    
    @Override
    public String decrypt(String encryptedMessage) {
        return cache.get(encryptedMessage, k -> delegate.decrypt(k));
    }
}

database:
  password: ENC(AbCdEfG123...) # 原始值：prod_db_password_2025

apiVersion: v1
kind: Secret
metadata:
  name: jasypt-key
data:
  password: c2VjcmV0X2tleV8yMDI1 # base64编码的密钥

@Configuration
public class CacheConfig {
    @Value("${redis.password}")
    private String encryptedRedisPassword;
    
    @Bean
    public RedisConnectionFactory redisFactory(StringEncryptor encryptor) {
        String password = encryptor.decrypt(encryptedRedisPassword);
        // 使用解密后的密码构建连接工厂
        return new LettuceConnectionFactory(..., password);
    }
}