Spring Boot应用无法从Vault读取配置的问题求助

问题描述 #

在Spring Boot应用中尝试从HashiCorp Vault读取username和password两个配置值，但运行后输出始终为null。相关代码与配置如下：

pom.xml #

<?xml version="1.0" encoding="UTF-8"?>
<project
    xmlns="http://maven.apache.org/POM/4.0.0"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>
    <parent>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <version>3.2.0</version>
        <relativePath/>
        <!-- lookup parent from repository -->
    </parent>
    <groupId>com.company</groupId>
    <artifactId>vaultdemo</artifactId>
    <version>0.0.1-SNAPSHOT</version>
    <packaging>pom</packaging>
    <name>vaultdemo</name>
    <description>vaultdemo</description>
    <properties>
        <java.version>17</java.version>
        <spring-cloud.version>2023.0.0</spring-cloud.version>
        <maven.compiler.source>17</maven.compiler.source>
        <maven.compiler.target>17</maven.compiler.target>
    </properties>
    <dependencies>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-web</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.cloud</groupId>
            <artifactId>spring-cloud-starter-vault-config</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-tomcat</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.vault</groupId>
            <artifactId>spring-vault-core</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-test</artifactId>
            <scope>test</scope>
        </dependency>
    </dependencies>
    <dependencyManagement>
        <dependencies>
            <dependency>
                <groupId>org.springframework.cloud</groupId>
                <artifactId>spring-cloud-dependencies</artifactId>
                <version>${spring-cloud.version}</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>
        </dependencies>
    </dependencyManagement>
    <build>
        <plugins>
            <plugin>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-maven-plugin</artifactId>
            </plugin>
        </plugins>
    </build>
</project>

VaultConfiguration.java #

@ConfigurationProperties(value = "knf")
public class VaultConfiguration {

    private String username;
    private String password;

    public VaultConfiguration(String username, String password) {
        this.username = username;
        this.password = password;
    }

    public String getUsername() {
        return username;
    }

    public void setUsername(String username) {
        this.username = username;
    }

    public String getPassword() {
        return password;
    }

    public void setPassword(String password) {
        this.password = password;
    }
}

VaultdemoApplication.java #

@SpringBootApplication
@EnableConfigurationProperties(VaultConfiguration.class)
public class VaultdemoApplication {


    public static void main(String[] args) {
        ConfigurableApplicationContext context = SpringApplication.run(VaultdemoApplication.class, args);
        VaultConfiguration bean =  context.getBean(VaultConfiguration.class);
        System.out.println(bean.getUsername());
        System.out.println(bean.getPassword());
    }

}

application.properties #

spring.application.name=spring-boot-hashicorp-vault-sample
spring.cloud.vault.token=hvs.blomXkLGAvs6sXTHcLFYgbqb
spring.cloud.vault.scheme=http
spring.cloud.vault.enabled=true
spring.cloud.vault.uri=http://127.0.0.1:8200
spring.cloud.vault.port=8200
spring.cloud.vault.kv.enabled=true
spring.cloud.vault.kv.backend=secret

Vault存储的键值对 #

解决思路 #

1. 修复VaultConfiguration的构造函数问题 #

@ConfigurationProperties依赖无参构造函数和setter方法注入属性。当前类定义了带参构造函数，Spring无法通过默认方式实例化并注入属性，导致username和password始终为null。

修改后的VaultConfiguration.java：

@ConfigurationProperties(prefix = "knf")
public class VaultConfiguration {

    private String username;
    private String password;

    // 添加无参构造函数
    public VaultConfiguration() {}

    public String getUsername() {
        return username;
    }

    public void setUsername(String username) {
        this.username = username;
    }

    public String getPassword() {
        return password;
    }

    public void setPassword(String password) {
        this.password = password;
    }
}

2. 确保Vault路径与配置匹配 #

Spring Cloud Vault默认按以下规则拼接读取路径：
${spring.cloud.vault.kv.backend}/${spring.application-name}
即当前配置默认读取路径是secret/spring-boot-hashicorp-vault-sample。

根据Vault截图，若键值对存储在secret/knf路径下，需调整配置：
在application.properties中添加：

spring.cloud.vault.kv.application-name=knf

或者修改spring.application.name=knf，让默认路径匹配存储位置。

如果Vault中的username和password直接存储在secret/spring-boot-hashicorp-vault-sample下，需移除@ConfigurationProperties的prefix，直接绑定根属性：

@ConfigurationProperties
public class VaultConfiguration {
    // 其余代码不变
}

3. 验证Vault Token的权限 #

确保使用的token拥有读取目标路径（如secret/knf或secret/spring-boot-hashicorp-vault-sample）的权限。可通过Vault CLI测试：

vault kv get secret/knf

若返回权限错误，需调整对应policy赋予该token读取权限。

4. 开启调试日志排查请求细节 #

在application.properties中添加日志配置，查看Vault交互的详细过程：

logging.level.org.springframework.cloud.vault=DEBUG
logging.level.org.springframework.vault=DEBUG

启动应用后，观察日志中的请求URL和响应内容，确认是否成功获取配置数据。

内容的提问来源于stack exchange，提问作者mahdad aioby