spring-cloud / spring-cloud/spring-cloud-vault

unable to load secrets from vault when spring.cloud.vault.config.lifecycle.enabled is set to false

Open
#634 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Java
Stars
291
Forks
152
Avg merge
11h 24m
Merged PRs (30d)
3

Description

Hi, I am using spring cloud starter vault config of version 2.2.5.RELEASE for connecting to my secured vault server which is working on approle authentication mechanism, i observed that if i setup value to false for property spring.cloud.vault.config.lifecycle.enabled spring is unable to load secrets from vault its failing with below error:

17:27:05.823 DEBUG [ main] o.s.v.a.AppRoleAuthentication - - Login successful using AppRole authentication
17:27:06.121 WARN [ main] o.s.c.v.config.VaultConfigTemplate - - Could not locate PropertySource: Status 403 Forbidden [/*/local]: 1 error occurred:
* permission denied

below is my bootstrap.properties configuration:
#Project Details
info.app.name = ****
info.app.version = @project.version@

spring.application.name = ***

logging.level.org.springframework.vault = TRACE

spring.cloud.vault.app-role.auth-path=approle
spring.cloud.vault.app-role.role-id=****
spring.cloud.vault.app-role.secret-id=****
spring.cloud.vault.authentication=APPROLE
spring.cloud.vault.generic.application-name=****
spring.cloud.vault.generic.backend=***
spring.cloud.vault.generic.enabled=false
spring.cloud.vault.host=****
spring.cloud.vault.kv.application-name=****
spring.cloud.vault.kv.backend=****
spring.cloud.vault.kv.enabled=true
spring.cloud.vault.kv.profile-separator=/
spring.cloud.vault.port=8200
spring.cloud.vault.scheme=https
spring.cloud.vault.ssl.trust-store=.jks
spring.cloud.vault.ssl.trust-store-password=
***
management.health.vault.enabled = false
spring.cloud.vault.config.lifecycle.enabled=false

Note if spring.cloud.vault.config.lifecycle.enabled is set to true then it is able to load secrets from vault.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the issue with Spring Cloud Vault 2.2.5.RELEASE using the bootstrap.properties configuration and spring.cloud.vault.config.lifecycle.enabled=false, then compare it with the setting enabled. Start by tracing VaultConfigTemplate and AppRoleAuthentication around the successful login and subsequent 403 response. Done means the configured Vault secrets load successfully with the lifecycle setting disabled.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
cloud, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.