When run within CloudFoundry and bound to the CredHub Service Broker any established secrets will be presented to the container in a modified VCAP_SERVICES JSON.
This mapping is handled by CloudFoundry transparently to the application, so no other special libraries/tools are needed (just the ability to parse VCAP_SERVICES).
SpringBoot automatically parses the VCAP_SERVICES and adds the results to the Environment (and can therefore be used in standard SPEL expressions and configuration properties).
./gradlew clean build
$ cf push demo-credhub -p build/libs/cf-credhub-0.0.1-SNAPSHOT.jar
$ curl http://demo-credhub.<your-domain>/secrets^ you should see the defaults "unknown#"
$ cf create-service credhub default my-secrets -c '{"secret-list":"foo,bar,baz"}'
$ cf restage demo-credhub^ you should see the "foo,bar,baz" secrets