Azure / Azure/Azure-Spring-Apps

Starting application fails during initialization of boot layer with java.nio.file.AccessDeniedException: /jca/lib

Open
#54 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
No language data
Stars
9
Forks
11
PR merge metrics
No merged PRs in 30d

Description

**Describe the bug**
We can no longer start our Spring Boot applications deployed to Azure Spring Apps. The apps fail to start with 'Exit code 1'. The console output from the application has:
_Error occurred during initialization of boot layer
java.lang.module.FindException: java.nio.file.AccessDeniedException: /jca/lib_

What I noticed is if we disable loading a Certificate into the trust store (attached screenshot), the application will start. However, we need the Certificate loaded into the trust store so our applications can access resources utilizing the Certificate so this option isn't a viable solution.

We first ran into the error on 11/8/2023 around 2pm EST. We have multiple applications running in Azure Spring. However, we're very afraid that if we restart them, they will fail with this error because we load the same Certificate into the trust store of each application. It appears that something has changed within Azure (Azure Spring or Azure Key Vault) as we haven't changed anything with our applications for a few weeks.

**To Reproduce**
Steps to reproduce the behavior:
1. Create a Spring Boot application deployment in Azure Spring which relies on a Certificate in the trust store
2. Add the Certificate to the application and check 'Load into trust store'
3. Start the Spring Boot application deployment
4. Start should fail with exit code 1

**Expected behavior**
Application starts successfully

**Screenshots**
![AzureSpringTrustStore](https://github.com/Azure/Azure-Spring-Apps/assets/35078136/5868abef-971b-4f37-92a2-033e06df2853)

**Can we contact you for additional details?** Y/N
Y

Contributor guide

No contributing guide indexed for this repository

Research direction

No repository files or tests are named. Start by reproducing the deployment in Azure Spring Apps with a certificate configured to load into the trust store, then inspect the initialization console output for the AccessDeniedException on /jca/lib. Done means the application starts successfully while the certificate remains loaded into the trust store.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, java, spring-boot
Domain
cloud, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.