Spring Cloud Services config server instances gets unauthorized response with vault as backend

Products

• Support Only for Spring

Issue/Introduction

When having a config server with vault as its backend, despite the fact that it serves all the required properties and it's online when you check the manage section of the config server, the logs show many occurrences of following error:

2020-04-21T17:29:17.89+0200 [APP/PROC/WEB/0] OUT 2020-04-21 15:29:17.892 ERROR 27 --- [nio-8080-exec-2] i.p.s.cf.CloudControllerServiceImpl : GET https://api.run-04.haas-59.pez.pivotal.io/v2/service_instances/d248b95c-c262-40ad-a763-52fb95976556/permissions resulted in response code 401 2020-04-21T17:29:17.90+0200 [RTR/0] OUT config-d248b95c-c262-40ad-a763-52fb95976556.cfapps-04.haas-59.pez.pivotal.io - [2020-04-21T15:29:17.866231740Z] "POST /vault/v1/auth/token/renew-self HTTP/1.1" 200 17 393 "-" "Java/1.8.0_242" "10.193.69.250:42806" "10.193.69.26:61054" x_forwarded_for:"10.193.69.25, 10.193.69.250" x_forwarded_proto:"https" vcap_request_id:"1207ab4f-ada9-4824-6269-fe6345a12d28" response_time:0.034804 gorouter_time:0.000228 app_id:"85775bd7-5230-4967-a8d3-6e9429fa9488" app_index:"0" x_b3_traceid:"0107c801a569f117" x_b3_spanid:"0107c801a569f117" x_b3_parentspanid:"-" b3:"0107c801a569f117-0107c801a569f117"

This error will be preceded by a vault refresh token request:

 2020-04-21T20:44:49.88+0200 [RTR/0] OUT config-d248b95c-c262-40ad-a763-52fb95976556.cfapps-04.haas-59.pez.pivotal.io - [2020-04-21T18:44:49.855952280Z] "POST /vault/v1/auth/token/renew-self HTTP/1.1" 200 17 393 "-" "Java/1.8.0_242" "10.193.69.250:54200" "10.193.69.25:61038" x_forwarded_for:"10.193.69.24, 10.193.69.250" x_forwarded_proto:"https" vcap_request_id:"2be4e211-5c45-4606-61e5-f0e1184bf15d" response_time:0.032440 gorouter_time:0.000363 app_id:"2e7572b1-1650-43b6-bbca-d66b43929f3a" app_index:"0" x_b3_traceid:"50362f64a5492b09" x_b3_spanid:"50362f64a5492b09" x_b3_parentspanid:"-" b3:"50362f64a5492b09-50362f64a5492b09"

Environment

Product Version: 2.1

Resolution

This is a known cosmetic issue that doesn't prevent the config server instance from working properly. It will be fixed in future releases.