spring-cloud / spring-cloud-vault

Configuration Integration with HashiCorp Vault
http://cloud.spring.io/spring-cloud-vault/
Apache License 2.0
272 stars 151 forks source link

spring-cloud-vault-config-databases with Spring Boot 2.4.0 Config Data API fails to bind properties #621

Closed desprez closed 2 years ago

desprez commented 2 years ago

I'm using spring-cloud-vault-config-databases with Spring Boot 2.4.0 Config Data API as the prefered mode described here https://stackoverflow.com/questions/64994034/bootstrap-yml-configuration-not-processed-anymore-with-spring-cloud-2020-0 :

1) When I'm using Spring Boot 2.4.0 Config Data API to import configuration from Vault (Preferred) the secret properties are not binded to the spring.datasource.username & spring.datasource.password properties and my postgres cnx fails.

2) When I'm using "Legacy Processing" with the bootstrap configuration property spring.cloud.bootstrap.enabled=true the properties spring.datasource.username & spring.datasource.password properties are well binded to my Vault secret.

What is the expected behaviour of the spring-cloud-vault-config-databases ? Is expected to works with Spring Boot 2.4.0 Config Data API ?

my application.yml

spring.cloud.vault:
  enabled: true
  authentication: CERT
  ssl:
    key-store: file: ...
    key-store-password: ...
    trust-store: ...
    trust-store: ...
    trust-store-password: ...
    cert-auth-path: ...
  uri: https:...
  namespace: ...
  fail-fast: true

  database:
    enabled: true
    role: myPostgresRole
    backend: database/postgres/...
    username-property: spring.datasource.username
    password-property: spring.datasource.password    

spring:
  config:
    import: vault://secret/... , vault://database/postgres/...

Versions used :

spring-boot : 2.4.11

spring-cloud : 2020.0.3

spring-cloud-vault-config-databases : 3.0.3

mp911de commented 2 years ago

Please use spring.config.import: vault://. Otherwise (vault://database/postgres/), Database secrets won't be bound to spring.datasource.username but rather exposed directly as it was a Key-Value secret.