spring-cloud / spring-cloud-vault

Configuration Integration with HashiCorp Vault
http://cloud.spring.io/spring-cloud-vault/
Apache License 2.0
272 stars 151 forks source link

Fail application startup when could not find a secret at path (Vault location is not resolvable/Not found) #589

Closed Asky-GH closed 3 years ago

Asky-GH commented 3 years ago

We are all human beings and occasionally may accidentally make a typo when enumerating our secret paths. Sometimes values of some properties that are stored in certain paths can be ignored and a simple info message about an unresolvable path could be enough (such functionality currently present), but not when the value of that property is critical for my application and in such cases I want my application to fail on startup instead.

Currently, I can not think of a good solution but I have noticed some interesting code in LeaseAwareVaultPropertySource class. It has a property called ignoreSecretNotFound which seems to be always true. And if we take a look at line 178 we can see there such piece of code:

Exception loadError = this.loadError;
if (this.notFound || loadError != null) {

    String msg = String.format("Vault location [%s] not resolvable", this.requestedSecret.getPath());

    if (this.ignoreSecretNotFound) {
        if (logger.isInfoEnabled()) {
            logger.info(String.format("%s: %s", msg, loadError != null ? loadError.getMessage() : "Not found"));
        }
    }
    else {
        if (loadError != null) {
            throw new VaultPropertySourceNotFoundException(msg, loadError);
        }
        throw new VaultPropertySourceNotFoundException(msg);
    }
}

So maybe some kind of configuration property could be added which will enable switching the value of ignoreSecretNotFound?

mp911de commented 3 years ago

The easiest was to ensure a failure is referencing the key in a @value property injection.

Asky-GH commented 3 years ago

But what about the code snippet that I've posted? Seems like else clause is never executed...