spring-cloud / spring-cloud/spring-cloud-vault

Vault database - datasource username and password not populated when multiple databases use same vault db role

Open
#920 0 comments 5 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Java
Stars
291
Forks
152
Avg merge
11h 24m
Merged PRs (30d)
3

Description

Describe the bug

When using cloud.vault.databases to configure multiple datasources, it appears that username/password datasource properties don't get set if more than one entry refers to the same vault database role.

Our use case is an application that uses 2 separate databases in some environments, while in other environments rather than using 2 different databases, the application uses 2 different schemas co-located in the same database.

Spring cloud version: 2025.0.0

Sample

Highly abstracted, of course

Does not work:

  cloud:
    vault:
      databases:
        primary:
          enabled: true
          role: db1-dbuser
          backend: database/
          static-role: true
          username-property: spring.datasource.username
          password-property: spring.datasource.password
        other-database:
          enabled: true
          role: db1-dbuser
          backend: database/
          static-role: true
          username-property: spring.secondary-datasource.username
          password-property: spring.secondary-datasource.password

Works:

  cloud:
    vault:
      databases:
        primary:
          enabled: true
          role: db1-dbuser
          backend: database/
          static-role: true
          username-property: spring.datasource.username
          password-property: spring.datasource.password
        other-database:
          enabled: true
          role: db2-dbuser
          backend: database/
          static-role: true
          username-property: spring.secondary-datasource.username
          password-property: spring.secondary-datasource.password

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by tracing the cloud.vault.databases configuration path and the code that populates datasource username and password properties for each database entry. Reproduce the supplied configuration with two entries sharing db1-dbuser, then compare it with distinct roles. Done means both entries receive their configured credentials when they share a Vault database role.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, spring
Domain
database
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.