spring-cloud / spring-cloud/spring-cloud-config

Document spring-vault-core as a dependency to use the vault repository

Open
#1,615 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

documentation
Dominant language
Java
Stars
2k
Forks
1.3k
Avg merge
2d 59m
Merged PRs (30d)
16

Description

Description:

  • Spring Boot Version : 2.2.7

  • Spring Cloud Version: Hoxton.SR4

Kubernetes Service Acccount based authentication doesn't work even when all the corresponding properties are specified.

application.properties:

#Server port
server.port = 8888
spring.profiles.active=vault

#Vault prod
spring.cloud.config.server.vault.host=vault.domain.org
spring.cloud.config.server.vault.scheme=https
spring.cloud.config.server.vault.backend=<backend>
spring.cloud.config.server.vault.port=443
spring.cloud.config.server.vault.profile-separator=-
spring.cloud.config.server.vault.default-key=<defaultKey>
spring.cloud.config.server.vault.authentication=KUBERNETES
spring.cloud.config.server.vault.kubernetes.role=<rolename>
spring.cloud.config.server.vault.kubernetes.kubernetes-path=kubernetes
spring.cloud.config.server.vault.kubernetes.service-account-token-file=/var/run/secrets/kubernetes.io/serviceaccount/token
spring.cloud.config.server.vault.kv-version=2
logging.level.org.springframework.web=DEBUG

Token based authentication for Vault works perfectly, but when Kubernetes Service Account based authentication is used, below error is thrown when a Get call is made to the config server

There was an unexpected error (type=Bad Request, status=400). Missing required header in HttpServletRequest: X-Config-Token

This issue gets fixed upon adding the below dependency to the project POM.

<dependency>
	<groupId>org.springframework.vault</groupId>
	<artifactId>spring-vault-core</artifactId>
</dependency>

Is this because "spring-vault-core" dependency has been marked as optional in the spring-cloud-config-server pom.xml?

However, the pom change still doesn't solve the issue completely. The first request made to config server fails. The first request error has already been reported here

Please help me out here and let me know if there there's anything I'm missing.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Read spring-cloud-config-server/pom.xml and the supplied application.properties first. Reproduce a config-server GET using Kubernetes service-account authentication, then determine whether spring-vault-core must be non-optional and how the first-request failure related to issue 1556 affects the result.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, kubernetes, spring, spring-boot
Domain
authentication, backend, cloud
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.