search

spring-projects / spring-vault

Provides familiar Spring abstractions for HashiCorp Vault
https://spring.io/projects/spring-vault
Apache License 2.0
284 stars 186 forks source link

fix-comparison #841

Open refark opened 11 months ago

refark commented 11 months ago

Hello,

I'm using Spring Cloud AWS in prod to retrieve ROTATE credentials for connecting to the OpenSearch service, but it's not working as expected. I can see, that Spring Cloud loads new credentials every hour, but the environment variables don't seem to be updating. To achieve the desired behavior, I had to make a small, specific change. For me it seems like a small bag fix.

pivotal-cla commented 11 months ago

@refark Please sign the Contributor License Agreement!

Click here to manually synchronize the status of this Pull Request.

See the FAQ for frequently asked questions.

pivotal-cla commented 11 months ago

@refark Thank you for signing the Contributor License Agreement!

mp911de commented 11 months ago

I wonder why the secret instance is no longer the same as the requested one. Did you find out by chance why the secret instance has changed?

refark commented 11 months ago

No, I didn't. I have a guess. AWS credentials are requested twice at the service start. At some point, one of the credentials becomes revoked, and the app continues to work with one secret instance (based on my understanding of the logs). It's worth mentioning that we have a custom properties source locator to copy some properties from the postgres table into the environment. Maybe this is the cause of the second credentials request.