Closed matiasah closed 3 years ago
Spring Vault removes the lease by calling sys/revoke
with the lease on shutdown. Looking at the ACL, this entry is missing.
I guess looking at the logs where it says mode=RENEW deceived me. Is there a template for all the necessary ACL's for Spring Vault?
No, there's nothing in the docs. It would make sense to add a bit of documentation. Let me convert this issue into a docs issue.
I tried the following ACL and it seems to work fine with no errors on Spring Cloud 2.3.5.RELEASE with HashiCorp Vault 1.5.4.
# Mount the AppRole auth method path "sys/auth/approle" { capabilities = [ "read" ] } # Revoke path "sys/revoke" { capabilities = [ "update" ] } # Key-Value path "secret/spring.application.name" { capabilities = [ "read" ] } path "secret/spring.application.name/*" { capabilities = [ "read" ] } # Application path "secret/application" { capabilities = [ "read" ] } path "secret/application/*" { capabilities = [ "read" ] } # Database path "spring.cloud.vault.*.backend/creds/spring.cloud.vault.*.role" { capabilities = [ "read" ] }
Although I only used spring-cloud-vault-config-databases
and spring-cloud-starter-vault-config
.
Replacing spring.application.name
, spring.cloud.vault.*.backend
, spring.cloud.vault.*.role
with the values from the properties.
We've updated our documentation with context paths and operations so one can derive their policy from the capabilities. We're happy to improve further if someone wants to supply ACL policy samples for the individual sections.
Describe the bug Spring Cloud Vault Databases in 2.3.5.RELEASE throws an exception every time when I stop the spring application or restart it using dev-tools.
Sample I created a database secrets: database/incidence-mysql with the role incidence-service.
The exception trace
I'm using AppRole authentication.
With the following ACL policy
However, when I manually generate the token with the command:
I am able to generate a token:
I consume the token to manually renew the lease, and to see if the error was due to the ACL policy:
But the lease does get renewed, so I'm guessing this issue is related to Spring and not to my ACL policy:
What does the error 403 mean in this case? Am I doing something wrong?