Spring 云服务器无法从 Vault 后端访问所有配置文件

Question

I am new to HashiCorp Vault and setting up spring cloud config server having Vault as a backend for storing secrets, keys, etc.

The problem is I am able to access the secrets that are stored at default level like :

curl -X "GET" "http://localhost:8888/myapp/default" -H "X-Config-Token: XXX"

However, I am unable to access the profile specific secrets that I stored in Vault. No matter which profile I store the secrets in, the API always returns default values and not profile specific values.

for eg:

curl -X "GET" "http://localhost:8888/myapp/prod" -H "X-Config-Token: XXX"

Here are my secrets stored on dev instance of Vault(ver 1.1.3):

1. vault kv put secret/myapp foo=myappsdefault
2. vault kv put secret/myapp/prod foo=myappsprod

Spring cloud config server application.yml:

spring:
  profiles:
    active: vault
  cloud.config.server.vault.kvVersion: 2
server:
  port: 8888

Spring cloud server pom.xml:

            <parent>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-starter-parent</artifactId>
                <version>2.0.6.RELEASE</version>
                <relativePath/>
            </parent>

            <properties>
                <spring-cloud.version>Finchley.SR2</spring-cloud.version>
            </properties>

            <dependencies>
                <dependency>
                    <groupId>org.springframework.cloud</groupId>
                    <artifactId>spring-cloud-config-server</artifactId>
                </dependency>

                <dependency>
                    <groupId>org.springframework.boot</groupId>
                    <artifactId>spring-boot-starter-test</artifactId>
                    <scope>test</scope>
                </dependency>
            </dependencies>    

Expected:

curl -X "GET" "http://localhost:8888/myapp/prod" -H "X-Config-Token: XXX"

{
"name": "myapp",
"profiles": [
  "prod"
],
"label": null,
"version": null,
"state": null,
"propertySources": [
  {
"name": "vault:myapp",
"source": {
"foo": "myappsprod"
}
}
],
}

Actual:

{
"name": "myapp",
"profiles": [
  "prod"
],
"label": null,
"version": null,
"state": null,
"propertySources": [
  {
"name": "vault:myapp",
"source": {
"foo": "myappsdefault"
}
}
],
}

Here are vault outputs:

vault kv get secret/myapp/prod


=== Data ===
Key    Value
---    -----
foo    myappsprod


vault kv get secret/myapp

=== Data ===
Key    Value
---    -----
foo    myappsdefault

So the question becomes why is spring cloud server only querying default profile secrets and not environment specific?

Just as a side note, the profiles are getting applied to GIT files that I stored in repo, while integrating the spring cloud server with GIT as backend and I am expecting something similar with Vault.

Answer 1

After much struggling with configurations. I tried adding additional properties in my application.yml, and this helped in my case.

Snapshot of application.yml:

server:
  port: 8888

spring:
  profiles:
    active: vault
  cloud:
    config:
      server:
        vault:
          port: 8200
          host: 127.0.0.1
          kvVersion: 1
          backend: kv
          profileSeparator: /
          #skipSslValidation: true
          #defaultKey: signing

management:
  endpoints:
    web:
      exposure:
        include: '*'

The additonal things are: 1. I changed the backend from secret to kv(my custom secrets engine) 2. Profile separator as / (Use / in .yml)

In my case 'profileSeparator' key did the trick

Answer 2

This is not working as well, the app always returns default profile output. Here is the bootstrap.yaml

spring:
  application:
    name: myapp
  cloud:
     vault:
          host: 127.0.0.1
          port: 8200
          scheme: http
          token: ****
          kvVersion: 2
          backend: kv
          profileSeparator: "/"
          kv:
             enabled: true

The POM.xml has the below dependencies

<parent>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-parent</artifactId>
    <version>2.3.4.RELEASE</version>
    <relativePath/> <!-- lookup parent from repository -->
  </parent>
<properties>
    <spring.cloud-version>Hoxton.SR9</spring.cloud-version>
</properties>
 <dependency>
      <groupId>org.springframework.cloud</groupId>
      <artifactId>spring-cloud-vault-config</artifactId>
    </dependency>
    <dependency>
      <groupId>org.springframework.cloud</groupId>
      <artifactId>spring-cloud-starter-vault-config</artifactId>
    </dependency>

Any clues will be useful