Spring Boot访问HashiCorp Vault Cubbyhole密钥失败问题排查

异常信息 #

org.springframework.vault.authentication.VaultLoginException: Cannot login using Cubbyhole: []

Caused by: org.springframework.web.client.HttpClientErrorException$NotFound: 404 Not Found: "{\"errors\":[]}<EOL>"

环境说明 #

使用以下命令以开发模式启动Vault：

./vault.exe server --dev --dev-root-token-id="mytoken"

相关代码 #

配置类（VaultConfig.java） #

@Configuration
public class VaultConfig extends AbstractVaultConfiguration {

    public static VaultEndpoint vaultEndpoint;
    private static RestOperations restOperations;
    public static VaultTemplate vaultTemplate;

    @EventListener(ApplicationReadyEvent.class)
    public void init() {
        VaultConfig.restOperations = restOperations();
        VaultConfig.vaultEndpoint = vaultEndpoint();
        VaultConfig.vaultTemplate = vaultTemplate();
    }

    @Override
    public VaultEndpoint vaultEndpoint() {
        VaultEndpoint vaultEndpoint = VaultEndpoint.create("localhost", 8200);
        vaultEndpoint.setScheme("http");
        return vaultEndpoint;
    }

    @Override
    public ClientAuthentication clientAuthentication() {
        return new TokenAuthentication("mytoken");
    }

    public static CubbyholeAuthentication getCubbyholeAuthentication(String token) {
        CubbyholeAuthenticationOptions options = CubbyholeAuthenticationOptions.builder()
                .initialToken(VaultToken.of(token))
                .path("cubbyhole/token")
                .build();
        return new CubbyholeAuthentication(options, VaultConfig.restOperations);
    }
}

服务实现类（CubbyHoleService.java） #

@Service
public class CubbyHoleService {

    @EventListener(ApplicationReadyEvent.class)
    public void init() {
        String cubbyholeToken = getCubbyholeToken().getToken().getToken();
        String uuid = UUID.randomUUID().toString();
        cubbyHoleWrite(uuid, cubbyholeToken);
        cubbyHoleRead(uuid, cubbyholeToken);
    }

    public void cubbyHoleWrite(String uuid, String token) {
        VaultTemplate vaultTemplate = getVaultTemplate(token);
        VaultKeyValueOperations vaultKeyValueOperations = vaultTemplate
                .opsForKeyValue("cubbyhole", VaultKeyValueOperationsSupport.KeyValueBackend.KV_1);
        vaultKeyValueOperations.put(uuid, new Secrets("john_cubby", "wick_value"));
        System.out.println("CubbyHole Data Saved");
    }

    public void cubbyHoleRead(String uuid, String token) {
        VaultTemplate vaultTemplate = getVaultTemplate(token);
        VaultKeyValueOperations vaultKeyValueOperations = vaultTemplate
                .opsForKeyValue("cubbyhole", VaultKeyValueOperationsSupport.KeyValueBackend.KV_1);
        VaultResponseSupport<Secrets> responseSupport = vaultKeyValueOperations.get(uuid, Secrets.class);
        if (responseSupport == null) {
            System.out.println("CubbyHole Data not found");
            return;
        }
        System.out.println("CubbyHole Data found");
        Secrets secrets = responseSupport.getData();
        System.out.println(secrets.toString());
    }

    private VaultTemplate getVaultTemplate(String token) {
        return new VaultTemplate(VaultConfig.vaultEndpoint, VaultConfig.getCubbyholeAuthentication(token));
    }

    private VaultTokenResponse getCubbyholeToken(){
        List<String> policies = Arrays.asList("default", "cubbyhole-policy", "cubbyhole-policy-token");
        VaultTokenRequest tokenRequest = VaultTokenRequest.builder()
                .ttl(120, TimeUnit.MINUTES).numUses(100).policies(policies).renewable(true)
                .build();
        return VaultConfig.vaultTemplate.opsForToken().create(tokenRequest);
    }
}

Secrets实体类 #

@Data
@AllArgsConstructor
@NoArgsConstructor
public class Secrets {
    private String key;
    private String value;
}

已创建的策略 #

cubbyhole-policy.hcl #

path "cubbyhole/data/*" {
    capabilities = ["read", "create", "update", "delete", "list"]
}

cubbyhole-policy-token.hcl #

path "cubbyhole/token/*" {
   capabilities = ["read", "create", "update", "delete", "list"]
}

调试定位 #

问题出在CubbyholeAuthentication.java的lookupToken()方法中，无法完成登录操作。

内容的提问来源于stack exchange，提问作者sam