Some times properties are not set on bean creation

In some case when my beans definitions function are run, properties are not already loaded, so I have some NullPointerException. This happen randomly and can work after many restart. This happend on computer with limited resources. I use vault to load properties.

I start spring cloud vault on a bootstrap.yaml like that

spring:
  application:
    name: my-app
  # Default configuration for vault
  cloud.vault:
    enabled: true # Disabled by default, activate it in specific profile
    uri: ---
    namespace: ---
    authentication: APPROLE
    app-role:
      role-id: ---
      secret-id: ---
      app-role-path: approle
    fail-fast: true
    connection-timeout: 5000
    read-timeout: 15000
    config:
      order: -10
      lifecycle:
        enabled: true
        min-renewal: 10s
        expiry-threshold: 1m
        lease-endpoints: Legacy
    generic:
      enabled: false
    kv:
      enabled: true
      backend: secret
      profile-separator: "/"
      default-context: application/global
      application-name: application

My JVM start on 0.5 cpu with this memory data

VM settings:
    Stack Size: 256.00K
    Max. Heap Size (Estimated): 247.50M
    Using VM: OpenJDK 64-Bit Server VM

It seems that happen since my last spring cloud upgrade (from spring-cloud-vault-config 2.2.0 to 2.2.3). I have a feeling that setting config.lifecycle.enabled to false fix the issue, but I don’t understand why.

Can you help to understand this issue? Thanks

[domingogomez-asto]

I have the same issue and I was able to replicate here: demo.zip What I think it’s happening is that https://github.com/spring-projects/spring-vault/blob/f46ca3d0f1149b70e029f3ed48802a482cf8d464/spring-vault-core/src/main/java/org/springframework/vault/core/env/LeaseAwareVaultPropertySource.java#L228 is sending a SecretLeaseExpiredEvent which clears the properties and right after a SecretLeaseCreatedEvent that repopulates the properties.

That is usually fine but manifests easier in low cpu environments and larger apps. config.lifecycle.enabled does indeed fix the issue but may limit your app if you are using database backends or anything that depends on lease renewals.

[mp911de]

would it be an option to renew the lease before it expires so SecretLeaseCreatedEvent is sent so the lease is replaced and there is no need to send a SecretLeaseExpiredEvent?

I concluded this would be probably the best option. However, we need to take into account, that rotation of secrets may fail (that’s where we typically see a gap).

After reconsidering, it would probably even make sense to introduce a new event SecretRotatedEvent (subclass of SecretLeaseCreatedEvent) that gets emitted when a secret is rotated, holding references to the old and new lease.

If rotation fails, we emit SecretLeaseExpiredEvent followed by SecretLeaseErrorEvent.

All this needs to happen in Spring Vault. Can you file a new ticket there so we can close this ticket and apply the changes to Spring Vault?