spring-cloud / spring-cloud/spring-cloud-vault
Unable to fetch properties via spring cloud vault using username and password
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 291
- Forks
- 152
- Avg merge
- 11h 24m
- Merged PRs (30d)
- 3
Description
I am working on a microservices spring boot application using spring cloud config as a centralized properties server. I decided to add a database backend to the spring config server so that services can connect using a username and password before fetching properties from the config server. I also decided to save secrets (username, password, etc) for all services on Hashicorp vault. Everything works fine if I pass the actual values (for my username and passwords) via spring.config.import or spring.config.uri. But I am unable to fetch the properties when I replace the actual username and password values with their corresponding keys (stored in the Hashicorp Vault Secrets). The configurations on my spring config server ```application.yml`` are:
erver:
port: 8888
error:
include-message: always
include-binding-errors: always
spring:
profiles:
active: git, vault
# security config
data:
mongodb:
uri: mongodb+srv://${DB_NAME}:${DB_PASS}@host:port
# application name
application:
name: config-server
cloud:
config:
server:
vault:
host: 127.0.0.1
port: 8200
scheme: http
authentication: TOKEN
token:
order: 1
# kv:
# enabled: true
profile-separator: '/'
backend: secret
kvVersion: 2
git:
uri: https://github.com/ENate/repo-config-server
default-label: main
username: ${GIT_USER}
password: ${GIT_PASSWORD}
order: 2
While on a spring boot microservice, I am unable to connect or fetch properties if I use:
spring:
# profiles:
# active: git
application:
name: spring-boot-service
cloud:
# vault:
# authentication: TOKEN
# token: hvs.mytokenvalue
config:
username: ${CONFIG_SERVER_USR}
password: ${CONFIG_SERVER_PWD}
fail-fast: true
retry:
initial-interval: 3000
multiplier: 1.3
max-interval: 10000
max-attempts: 20
# uri: http://${CONFIG_SERVER_USR}:${CONFIG_SERVER_PWD}@${app.config-server.host}:${app.config-server.port}
config:
import: configserver:http://${CONFIG_SERVER_USR}:${CONFIG_SERVER_PWD}@${app.config-server.host}:${app.config-server.port}
But passing the username and password directly like so:
spring:
config:
import: configserver:http://myUsername:myPassword@localhost:8888
seem to work. How can I fix this issue: so as to pass the keys (for username and password) I saved in the Vault server instead of hard coding their values in the bootstrap.yml and/or ```application.yml`` files? Thanks
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the application.yml and bootstrap.yml configuration snippets, focusing on spring.config.import, spring.cloud.config credentials, and the Vault server settings. Reproduce the difference between literal credentials and ${...} values, then trace how credentials are resolved before the config-server import. Done means the service fetches its configuration using Vault-backed credentials without hard-coded username or password values.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring-boot
- Domain
- authentication, backend, cloud
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100