GoogleCloudPlatform / GoogleCloudPlatform/spring-cloud-gcp

SecretManager ignores spring.cloud.gcp.secretmanager.enabled=false where properties file has properties referenced with secret manager prefix

Open
#3,725 3 comments 0 reactions 0 assignees View on GitHub
priority: p3 secret-manager type: bug
Dominant language
Java
Stars
551
Forks
349
Avg merge
1d 13h
Merged PRs (30d)
14

Description

I have been battling with this for a number of days now. We are trying to use spring-cloud-gcp-starter-secretmanager in an application, with the following in application.yml:

```
spring:
config:
import: sm@

app:
config:
randomProperty: sm@fakeProperty
```

Originally, I was trying to use @TestConfiguration in a @SpringBootTest to override the SecretManagerServiceClient or the SecretManagerTemplate with a mock, but this doesn't seem to work at all as the real implementation is always used.

I gave up on this, and attempted to turn off secretmanager by using the following in application-test.yml and later in bootstrap-test.yml with a Spring Profile called 'test', and this still doesn't disable secretmanager.

```
spring:
cloud:
gcp:
secretmanager:
enabled: false
core:
enabled: false
```

A suggestion from a colleague is to put "sm@fakeProperty" inside an env var and refer to it in the properties file as `"${${fakePropertyEnvVar}:defaultValue}"` so that it only attempts to call secret manager if that env var is set (which we just wouldn't do for a test), but it feels like setting `enabled` to `false` should really turn off the functionality completely.

I am also keen to know if it is possible to mock the Template/Client in a @SpringBootTest as this seems the way to get the most control in tests.

Contributor guide

Open the contributing guide

Research direction

Start with the SecretManagerServiceClient and SecretManagerTemplate behavior in a @SpringBootTest, comparing application.yml with application-test.yml and bootstrap-test.yml. Reproduce the case where spring.cloud.gcp.secretmanager.enabled=false is set while a property uses the sm@ prefix. Done means confirming whether the setting should prevent secret resolution and documenting or fixing the test-mocking behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, spring
Domain
backend, testing
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.