spring-cloud / spring-cloud/spring-cloud-vault
Vault database - datasource username and password not populated when multiple databases use same vault db role
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 291
- Forks
- 152
- Avg merge
- 11h 24m
- Merged PRs (30d)
- 3
Description
Describe the bug
When using cloud.vault.databases to configure multiple datasources, it appears that username/password datasource properties don't get set if more than one entry refers to the same vault database role.
Our use case is an application that uses 2 separate databases in some environments, while in other environments rather than using 2 different databases, the application uses 2 different schemas co-located in the same database.
Spring cloud version: 2025.0.0
Sample
Highly abstracted, of course
Does not work:
cloud:
vault:
databases:
primary:
enabled: true
role: db1-dbuser
backend: database/
static-role: true
username-property: spring.datasource.username
password-property: spring.datasource.password
other-database:
enabled: true
role: db1-dbuser
backend: database/
static-role: true
username-property: spring.secondary-datasource.username
password-property: spring.secondary-datasource.password
Works:
cloud:
vault:
databases:
primary:
enabled: true
role: db1-dbuser
backend: database/
static-role: true
username-property: spring.datasource.username
password-property: spring.datasource.password
other-database:
enabled: true
role: db2-dbuser
backend: database/
static-role: true
username-property: spring.secondary-datasource.username
password-property: spring.secondary-datasource.password
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing the cloud.vault.databases configuration path and the code that populates datasource username and password properties for each database entry. Reproduce the supplied configuration with two entries sharing db1-dbuser, then compare it with distinct roles. Done means both entries receive their configured credentials when they share a Vault database role.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring
- Domain
- database
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100