search

spring-cloud / spring-cloud-vault

Configuration Integration with HashiCorp Vault
http://cloud.spring.io/spring-cloud-vault/
Apache License 2.0
274 stars 152 forks source link

Incorrect Requested secret path (path='secret/application') . This should be path='abc/kv/Team1' as mentioned in bootstrap.yaml #549

Closed thakur-mohit closed 3 years ago

thakur-mohit commented 3 years ago

Using spring-cloud.version =Hoxton.SR8 , spring boot 2.3.4 When application starts , it tries to read secrets from vault using incorrect path "secret/application". It should be path='abc/kv/Team1' (mentioned in bootstrap.yaml backend property). I haven't declared path "secret/application" in my application. From where it's picking this path. How can i disable it. Below are the logs.

2020-12-02 17:17:27.841  INFO 1 --- [           main] o.s.v.a.LifecycleAwareSessionManager     : Scheduling Token renewal
2020-12-02 17:17:28.060  WARN 1 --- [           main] LeaseEventPublisher$LoggingErrorListener : [RequestedSecret [path='secret/application', mode=ROTATE]] Lease [leaseId='null', leaseDuration=PT0S, renewable=false] Status 403 Forbidden [secret/application]: 1 error occurred:
    * permission denied

; nested exception is org.springframework.web.client.HttpClientErrorException$Forbidden: 403 Forbidden: [{"errors":["1 error occurred:\n\t* permission denied\n\n"]}
]

org.springframework.vault.VaultException: Status 403 Forbidden [secret/application]: 1 error occurred:
    * permission denied

; nested exception is org.springframework.web.client.HttpClientErrorException$Forbidden: 403 Forbidden: [{"errors":["1 error occurred:\n\t* permission denied\n\n"]}
]
    at org.springframework.vault.client.VaultResponses.buildException(VaultResponses.java:86) ~[spring-vault-core-2.2.0.RELEASE.jar!/:2.2.0.RELEASE]
    at org.springframework.vault.core.VaultTemplate.lambda$doRead$5(VaultTemplate.java:409) ~[spring-vault-core-2.2.0.RELEASE.jar!/:2.2.0.RELEASE]
    at org.springframework.vault.core.VaultTemplate.doWithSession(VaultTemplate.java:388) ~[spring-vault-core-2.2.0.RELEASE.jar!/:2.2.0.RELEASE]
    at org.springframework.vault.core.VaultTemplate.doRead(VaultTemplate.java:398) ~[spring-vault-core-2.2.0.RELEASE.jar!/:2.2.0.RELEASE]
    at org.springframework.vault.core.VaultTemplate.read(VaultTemplate.java:290) ~[spring-vault-core-2.2.0.RELEASE.jar!/:2.2.0.RELEASE]
    at org.springframework.vault.core.lease.SecretLeaseContainer.doGetSecrets(SecretLeaseContainer.java:662) [spring-vault-core-2.2.0.RELEASE.jar!/:2.2.0.RELEASE]
    at org.springframework.vault.core.lease.SecretLeaseContainer.start(SecretLeaseContainer.java:396) [spring-vault-core-2.2.0.RELEASE.jar!/:2.2.0.RELEASE]
    at org.springframework.vault.core.lease.SecretLeaseContainer.addRequestedSecret(SecretLeaseContainer.java:355) [spring-vault-core-2.2.0.RELEASE.jar!/:2.2.0.RELEASE]
    at org.springframework.vault.core.env.LeaseAwareVaultPropertySource.loadProperties(LeaseAwareVaultPropertySource.java:184) [spring-vault-core-2.2.0.RELEASE.jar!/:2.2.0.RELEASE]
    at org.springframework.vault.core.env.LeaseAwareVaultPropertySource.<init>(LeaseAwareVaultPropertySource.java:169) [spring-vault-core-2.2.0.RELEASE.jar!/:2.2.0.RELEASE]
    at org.springframework.vault.core.env.LeaseAwareVaultPropertySource.<init>(LeaseAwareVaultPropertySource.java:122) [spring-vault-core-2.2.0.RELEASE.jar!/:2.2.0.RELEASE]
    at org.springframework.cloud.vault.config.LeasingVaultPropertySourceLocator.createVaultPropertySource(LeasingVaultPropertySourceLocator.java:157) [spring-cloud-vault-config-2.2.5.RELEASE.jar!/:2.2.5.RELEASE]
    at org.springframework.cloud.vault.config.LeasingVaultPropertySourceLocator.createVaultPropertySource(LeasingVaultPropertySourceLocator.java:89) [spring-cloud-vault-config-2.2.5.RELEASE.jar!/:2.2.5.RELEASE]
    at org.springframework.cloud.vault.config.VaultPropertySourceLocatorSupport.doCreatePropertySources(VaultPropertySourceLocatorSupport.java:162) [spring-cloud-vault-config-2.2.5.RELEASE.jar!/:2.2.5.RELEASE]
    at org.springframework.cloud.vault.config.VaultPropertySourceLocatorSupport.createCompositePropertySource(VaultPropertySourceLocatorSupport.java:138) [spring-cloud-vault-config-2.2.5.RELEASE.jar!/:2.2.5.RELEASE]
    at org.springframework.cloud.vault.config.VaultPropertySourceLocatorSupport.locate(VaultPropertySourceLocatorSupport.java:111) [spring-cloud-vault-config-2.2.5.RELEASE.jar!/:2.2.5.RELEASE]
    at org.springframework.cloud.bootstrap.config.PropertySourceLocator.locateCollection(PropertySourceLocator.java:52) [spring-cloud-context-2.2.5.RELEASE.jar!/:2.2.5.RELEASE]
    at org.springframework.cloud.bootstrap.config.PropertySourceLocator.locateCollection(PropertySourceLocator.java:47) [spring-cloud-context-2.2.5.RELEASE.jar!/:2.2.5.RELEASE]
    at org.springframework.cloud.bootstrap.config.PropertySourceBootstrapConfiguration.initialize(PropertySourceBootstrapConfiguration.java:98) [spring-cloud-context-2.2.5.RELEASE.jar!/:2.2.5.RELEASE]
    at org.springframework.boot.SpringApplication.applyInitializers(SpringApplication.java:626) [spring-boot-2.3.4.RELEASE.jar!/:2.3.4.RELEASE]
    at org.springframework.boot.SpringApplication.prepareContext(SpringApplication.java:370) [spring-boot-2.3.4.RELEASE.jar!/:2.3.4.RELEASE]
    at org.springframework.boot.SpringApplication.run(SpringApplication.java:314) [spring-boot-2.3.4.RELEASE.jar!/:2.3.4.RELEASE]
    at org.springframework.boot.SpringApplication.run(SpringApplication.java:1237) [spring-boot-2.3.4.RELEASE.jar!/:2.3.4.RELEASE]
    at org.springframework.boot.SpringApplication.run(SpringApplication.java:1226) [spring-boot-2.3.4.RELEASE.jar!/:2.3.4.RELEASE]
    at com.loblaw.eds.fileprocessor.FileProcessorApplication.main(FileProcessorApplication.java:16) [classes!/:0.0.1-SNAPSHOT]
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[na:1.8.0_272]
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[na:1.8.0_272]
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[na:1.8.0_272]
    at java.lang.reflect.Method.invoke(Method.java:498) ~[na:1.8.0_272]
    at org.springframework.boot.loader.MainMethodRunner.run(MainMethodRunner.java:49) [fileprocessor-0.0.1-SNAPSHOT.jar:0.0.1-SNAPSHOT]
    at org.springframework.boot.loader.Launcher.launch(Launcher.java:107) [fileprocessor-0.0.1-SNAPSHOT.jar:0.0.1-SNAPSHOT]
    at org.springframework.boot.loader.Launcher.launch(Launcher.java:58) [fileprocessor-0.0.1-SNAPSHOT.jar:0.0.1-SNAPSHOT]
    at org.springframework.boot.loader.JarLauncher.main(JarLauncher.java:88) [fileprocessor-0.0.1-SNAPSHOT.jar:0.0.1-SNAPSHOT]
Caused by: org.springframework.web.client.HttpClientErrorException$Forbidden: 403 Forbidden: [{"errors":["1 error occurred:\n\t* permission denied\n\n"]}
]
    at org.springframework.web.client.HttpClientErrorException.create(HttpClientErrorException.java:109) ~[spring-web-5.2.9.RELEASE.jar!/:5.2.9.RELEASE]
    at org.springframework.web.client.DefaultResponseErrorHandler.handleError(DefaultResponseErrorHandler.java:184) ~[spring-web-5.2.9.RELEASE.jar!/:5.2.9.RELEASE]
    at org.springframework.web.client.DefaultResponseErrorHandler.handleError(DefaultResponseErrorHandler.java:125) ~[spring-web-5.2.9.RELEASE.jar!/:5.2.9.RELEASE]
    at org.springframework.web.client.ResponseErrorHandler.handleError(ResponseErrorHandler.java:63) ~[spring-web-5.2.9.RELEASE.jar!/:5.2.9.RELEASE]
    at org.springframework.web.client.RestTemplate.handleResponse(RestTemplate.java:782) ~[spring-web-5.2.9.RELEASE.jar!/:5.2.9.RELEASE]
    at org.springframework.web.client.RestTemplate.doExecute(RestTemplate.java:740) ~[spring-web-5.2.9.RELEASE.jar!/:5.2.9.RELEASE]
    at org.springframework.web.client.RestTemplate.execute(RestTemplate.java:674) ~[spring-web-5.2.9.RELEASE.jar!/:5.2.9.RELEASE]
    at org.springframework.web.client.RestTemplate.getForObject(RestTemplate.java:315) ~[spring-web-5.2.9.RELEASE.jar!/:5.2.9.RELEASE]
    at org.springframework.vault.core.VaultTemplate.lambda$doRead$5(VaultTemplate.java:401) ~[spring-vault-core-2.2.0.RELEASE.jar!/:2.2.0.RELEASE]
    ... 31 common frames omitted

2020-12-02 17:17:28.061  INFO 1 --- [           main] o.s.v.c.e.LeaseAwareVaultPropertySource  : Vault location [secret/application] not resolvable: Status 403 Forbidden [secret/application]: 1 error occurred:
    * permission denied

; nested exception is org.springframework.web.client.HttpClientErrorException$Forbidden: 403 Forbidden: [{"errors":["1 error occurred:\n\t* permission denied\n\n"]}
]
2020-12-02 17:17:28.062  INFO 1 --- [           main] b.c.PropertySourceBootstrapConfiguration : Located property source: [BootstrapPropertySource {name='bootstrapProperties-abc/kv/Team1/openshift/dev'}, BootstrapPropertySource {name='bootstrapProperties-secret/application'}]

Also, from where it's picking BootstrapPropertySource {name='bootstrapProperties-secret/application'} . I only need bootstrapProperties-abc/kv/Team1/openshift/dev.

Below is bootstrap.yml.

spring.cloud.vault:
    host: ${VAULT_ADDR}
    port: ${VAULT_PORT:443}
    scheme: https
    namespace: test
    authentication: KUBERNETES
    kubernetes:
        kubernetes-path: ${VAULT_AUTH_PATH} 
        role: ${VAULT_ROLE}
        service-account-token-file: /var/run/secrets/kubernetes.io/serviceaccount/token
    kv:
      enabled: true
      backend: abc/kv/Team1
      profile-separator: '/'
      default-context: openshift/${VAULT_ENV}
      application-name: openshift/${VAULT_ENV}
    config:
        order: 10
logging.level.org.springframework: info

I'm not able to set spring.cloud.vault.generic.enabled=false as it's been deprecated.

mp911de commented 3 years ago

spring.cloud.vault.generic is enabled by default. You need to disable it via spring.cloud.vault.generic.enabled=false.