Quarkus vault configuration with database credentials provider not working if application.properties externalized

[philippegoncalves]

Describe the bug

Hi,

in order to decouple dev and prod configuration files, we are trying to start our Quarkus application using the config quarkus.config.locations when running on prod. Our prod config file contains all the vault and database information used to connect to our database and it is not known by developers. Unfortunately it looks like external configurations are loaded after db connection is done through the credentials provider from vault, causing the app to not start and printing multiple exceptions. I have tried many combination and so far what is working:

• having all the vault + database configuration in src/main/resources/application.properties (compile time)
• having the configuration in /config/application.properties where the app is started (run time)
• passing the configuration in command line, except quarkus.vault.credentials-provider.mydatabase.credentials-mount=database (run time)

Expected behavior

Vault configurations fro dynamic credentials provider could be externalized in a configuration file known at runtime.

Actual behavior

Starting the application without the dynamic credentials provider vault configuration in src/main/resources/application.properties does not work

How to Reproduce?

Issue can be reproduced easily:

• Follow instruction to start a vault container https://quarkiverse.github.io/quarkiverse-docs/quarkus-vault/dev/index.html
• Continue on "Dynamic Database Credentials" https://quarkiverse.github.io/quarkiverse-docs/quarkus-vault/dev/vault-datasource.html
• Start the quarkus app in dev mode, app can be started
• Remove the configurations from inside src/main/resources/applications.properties and move them to /test/application.properties
• Start the quarkus app in dev mode passing -Dquarkus.config.locations=/test, app cannot be started and print out exceptions
• Start the quarkus app in dev mode passing all the command line parameters from the original application.properties, app cannot be started
• Put back quarkus.vault.credentials-provider.mydatabase.credentials-mount=database in src/main/resources/applications.properties
• Start the quarkus app in dev mode passing all the command line parameters from the original application.properties, app can be started

Note that the issue is not met if using regular user/password without vault.

Output of uname -a or ver

Linux laptop 5.13.0-39-generic #44-Ubuntu SMP Thu Mar 24 15:35:05 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux

Output of java -version

openjdk version "1.8.0_312"

GraalVM version (if different from Java)

No response

Quarkus version or git rev

2.6.3.Final

Build tool (ie. output of mvnw --version or gradlew --version)

Gradle 7.3.3

Additional information

No response

[quarkus-bot]

/cc @vsevel

[vsevel]

hello, this may have been be already fixed by @radcortez in #24673, as it looks similar to #24465
please wait for 2.9 and test again your reproducer, or follow the above issue to see if it gets backported to one of the 2.8.x.
/cc @gsmet

[geoand]

#24673 has the backport label, so it should be included in 2.8.1.Final.

I am going to proactively close this as it does seem to be fixed already, but if it still fails when 2.8.1 is released, please comment and I'll reopen