Overview

What is the Admin Service?

The arya-banking-admin-service is the administrative backbone of the Arya Banking event-driven microservices platform. It serves a triple purpose:

• Infrastructure Administration — Manages HashiCorp Vault secrets, AppRole credentials, and HCL policies programmatically via a REST API.
• Identity Administration — Manages Keycloak realm roles and inter-service OAuth2 clients via the Keycloak Admin Client.
• Kafka Administration — Lists, creates, and describes Confluent Cloud topics via AdminClient (KafkaAdminController, BOM 2.0.2 / common-core 2.0.2).

All APIs are protected by JWT-based OAuth2 Resource Server (Keycloak-issued tokens) and role-checked at the method level via a custom RolePermissionValidator backed by the security.api-roles configuration map.

Service Coordinates

Responsibilities

The admin-service is the only service in the platform that has elevated Vault and Keycloak privileges. Other services receive read-only access; the admin-service provisions, manages, and rotates that access.

Vault Management

• Create, read, update, and delete KV v2 secrets scoped to individual services under secret/arya-banking/{service}/dev
• Full CRUD over Vault AppRoles — including generating fresh roleId / secretId credential pairs
• Full CRUD over Vault ACL policies (create, read, update, delete, list) — policies stored as HCL files in classpath resources (admin-service-policy.hcl, auth-service-policy.hcl, user-service-policy.hcl)

Keycloak Management

• Create confidential OAuth2 clients for inter-service communication (service accounts flow)
• Create, list, and query realm-level roles
• Assign the INTERNAL_SERVICE realm role to the service account of newly-created clients

Kafka Management (kafka-ops → ROLE_ADMIN)

• GET /api/admin/topics — list topics (with listInternal, timeoutMs)
• POST /api/admin/topics — create topic (TopicCreationDto) → ResponseDto("200", ...) or TopicCreationException (TOPIC_CREATION_FAILED_400)
• GET /api/admin/topics/describe — describe topics by name

Security Enhancements

Method-Level Security (MethodSecurityConfig)

The admin-service now enables annotation-based access control via @EnableMethodSecurity(prePostEnabled = true):

@Configuration
@EnableMethodSecurity(prePostEnabled = true)
public class MethodSecurityConfig {
    @Bean
    static AnnotationTemplateExpressionDefaults annotationTemplateExpressionDefaults() {
        return new AnnotationTemplateExpressionDefaults();
    }
}

This allows using @PreAuthorize, @PostAuthorize, @Secured, and @RolesAllowed on service methods and controllers for fine-grained RBAC.

Vault Policy Service (VaultPolicyServiceImpl)

Programmatic management of Vault ACL policies:

Policies are version-controlled in Git and loaded via CommonUtils.loadConfig() at runtime.

Technology Stack