spring-cloud / spring-cloud/spring-cloud-vault

HTTP 502 which happens during Vault login in "KUBERNETES" auth mode is cached indefinitely

Open
#940 0 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Java
Stars
291
Forks
152
Avg merge
11h 24m
Merged PRs (30d)
3

Description

Describe the bug

  1. Spring boot 4.0.5 + Spring cloud vault 5.0.0 (+spring-vault-core 4.0.0) deployed k8s infra
  2. Service uses "KUBERNETES" vault authentication mode
  3. Service uses Vault transit to generate JWT signatures (but this is irrelevant actually)
  4. Service caches Vault token
  5. Vault goes down and all requests to it ends up with 502/504
  6. Vault token in Spring service expires
  7. Spring cloud vault tries to renew the token using logic org.springframework.vault.authentication.ReactiveLifecycleAwareSessionManager#scheduleRenewal
  8. As Vault is unavailable org.springframework.vault.authentication.ReactiveLifecycleAwareSessionManager#doRenewToken catches the exception and cleans the mono cache: org.springframework.vault.authentication.ReactiveLifecycleAwareSessionManager#token
  9. Following getVaultToken() calls (scheduled, or triggered by user interactions) infect Mono cache with a Mono which returns 502/504 and is cached indefinitely: org/springframework/vault/authentication/ReactiveLifecycleAwareSessionManager.java:330

Sample

VaultSessionCachingBugIntegrationTest.java

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with org/springframework/vault/authentication/ReactiveLifecycleAwareSessionManager.java, especially the token cache around line 330 and the renewal flow in scheduleRenewal and doRenewToken. Use the linked VaultSessionCachingBugIntegrationTest.java as the reproduction; done means a transient 502/504 during Vault recovery is not cached indefinitely and token acquisition works after Vault returns.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, kubernetes, spring
Domain
authentication, backend, cloud
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.