spring-cloud / spring-cloud/spring-cloud-vault
Unable to override Vault configuration in profile specific file
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 291
- Forks
- 152
- Avg merge
- 11h 24m
- Merged PRs (30d)
- 3
Description
I’m unable to override Vault configuration in profile specific file in spring-cloud-starter-vault-config 3+ and spring-boot 2.4+
In spring-cloud-starter-vault-config 2+ and spring-boot 2.3.x it was possible to override configuration in profile specific file.
bootstrap.yml
spring:
cloud:
vault:
uri: ${VAULT_URI}
authentication: AWS_IAM
bootstrap-dev.yaml
spring:
cloud:
vault:
authentication: TOKEN
token: ${VAULT_TOKEN}
When application is run with this ^^ configuration and with spring.profiles.active=dev, then the authentication method is TOKEN instead of AWS_IAM. This is no longer possible in spring-boot 2.4+ and spring-cloud 2020.0.+
application.yaml
spring:
config:
import: "vault:"
cloud:
vault:
uri: ${VAULT_URI}
authentication: AWS_IAM
application-dev.yaml
spring:
cloud:
vault:
authentication: TOKEN
token: ${VAULT_TOKEN}
When application is run with this ^^ configuration and with spring.profiles.active=dev, then the expectation is thrown org.springframework.vault.authentication.VaultLoginException: Cannot login using AWS-IAM: missing client token;
However the profile is taken into account when application.yaml is created as multi-document yaml file, such as
application.yaml
spring:
config:
import: "vault:"
cloud:
vault:
uri: ${VAULT_URI}
authentication: AWS_IAM
---
spring:
config:
activate:
on-profile: "dev"
import: "vault:"
cloud:
vault:
authentication: TOKEN
token: ${VAULT_TOKEN}
When application is run with this ^^ configuration and with spring.profiles.active=dev, then the authentication method is TOKEN instead of AWS_IAM.
Another issue is that I’m not able to disable Vault neither in profile specific file nor in multi-document yaml.
application-dev.yaml
spring:
application:
name: demo
config:
import: "optional:vault:"
cloud:
vault:
enabled: false
When application is run with this ^^ configuration and with spring.profiles.active=dev, then the expectation is thrown org.springframework.vault.authentication.VaultLoginException: Cannot login using AWS-IAM: missing client token;
application.yaml
spring:
config:
import: "vault:"
cloud:
vault:
uri: ${VAULT_URI}
authentication: AWS_IAM
---
spring:
config:
activate:
on-profile: "dev"
import: "optional:vault:"
cloud:
vault:
enabled: false
When application is run with this ^^ configuration and with spring.profiles.active=dev, then the app fails with error
Config data location 'vault:' does not exist
Sample
This https://github.com/michalkrajcovic/spring-cloud-vault-demo is a simple app to demonstrate the functionality. More info can be found in the README.md
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the linked spring-cloud-vault demo and its README.md, then reproduce the profile-specific and multi-document configurations described in the issue. Trace how the application import and profile-specific settings are processed; done means Vault authentication can be overridden or disabled per profile without the reported login or missing-location errors.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring-boot
- Domain
- backend, cloud
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100