[BUG] KeyVaultEnvironmentPostProcessor cannot load configured property-sources in Spring Boot 4 AOT / GraalVM native image

Abierto
  • ¿Algo no está bien?
#51,209 2 comentarios 2 reacciones 1 asignado Ver en GitHub

Los mantenedores suelen responder en 1 día

@moarychan ya está trabajando en esto.

Desde el 11/11/2026.

  • #51238 de @arnabnandy7 — abierto

Evaluación

Este issue todavía no se ha evaluado.

Descripción

azure-spring bug Client customer-reported needs-team-attention

Describe the bug

When using Spring Cloud Azure Key Vault Secrets with Spring Boot 4.1.x and GraalVM native image, KeyVaultEnvironmentPostProcessor runs during native/AOT startup before the configured Key Vault property-sources are available in the Environment.
The same configuration works correctly when the application is started normally on the JVM.
During native startup, the processor logs:
KeyVaultEnvironmentPostProcessor : Skip configuring Key Vault PropertySource because spring.cloud.azure.keyvault.secret.property-sources is empty.
However, later during the same application startup, the configuration is present in the Spring Environment:

spring.cloud.azure.keyvault.secret.property-source-enabled=true
spring.cloud.azure.keyvault.secret.property-sources[0].name=vault
spring.cloud.azure.keyvault.secret.property-sources[0].endpoint=https://example.vault.azure.net/

As a result, the Key Vault PropertySource is never registered and placeholders referring to Key Vault secrets remain unresolved.
For example:
clientSecret=${IClientSecret}
remains the literal value ${IClientSecret} in the native image, whereas on the JVM the secret is resolved correctly.

Exception or Stack Trace
No exception is thrown by KeyVaultEnvironmentPostProcessor.
Instead, during Spring Boot AOT / GraalVM native startup, the processor silently skips Key Vault configuration:

DEBUG KeyVaultEnvironmentPostProcessor :
Skip configuring Key Vault PropertySource because spring.cloud.azure.keyvault.secret.property-sources is empty.

Later during the same startup, the same configuration is present in the Spring Environment:

spring.cloud.azure.keyvault.secret.property-source-enabled=true
spring.cloud.azure.keyvault.secret.property-sources[0].name=vault
spring.cloud.azure.keyvault.secret.property-sources[0].endpoint=https://example.vault.azure.net/

As a consequence, the Key Vault PropertySource is never registered and the secret placeholder remains unresolved:

secretPresent=true
secretLength=15
secretUnresolved=true

For reference, 15 is the length of the unresolved literal:

To Reproduce
Steps to reproduce the behavior:

  1. Use the following versions:
    Spring Boot: 4.1.2
    Spring Cloud Azure: 7.4.0
    spring-cloud-azure-starter-keyvault-secrets: 7.4.0
    azure-identity: 1.18.4
    azure-security-keyvault-secrets: 4.11.1
    Java: 25
    GraalVM Native Image: Java 25
    GraalVM Native Build Tools: 1.1.14
  2. Configure Key Vault Secrets in application.yml:
spring:
  cloud:
    azure:
      keyvault:
        secret:
          property-source-enabled: true
          property-sources:
            - name: vault
              endpoint: "${KEYVAULT_ENDPOINT}"
  1. Reference a secret from Key Vault:
  insights:
    security:
      clientSecret: "${IClientSecret}"
  1. Run the application normally on the JVM.
    The Key Vault property source is registered successfully:
PropertySource: vault
(com.azure.spring.cloud.autoconfigure.implementation.keyvault.environment.KeyVaultPropertySource)

The secret is resolved correctly:

secretPresent=true
secretUnresolved=false
  1. Build and run the same application as a GraalVM native image using Spring AOT.
    The native application logs:
    Skip configuring Key Vault PropertySource because spring.cloud.azure.keyvault.secret.property-sources is empty.
    but later the same properties are visible in the Spring Environment.
    We also verified processor ordering:
ConfigDataEnvironmentPostProcessor.getOrder()
= -2147483638

KeyVaultEnvironmentPostProcessor.getOrder()
= -2147483637

The Azure processor is therefore ordered after Spring Boot ConfigData processing.
The native executable also contains the expected Azure spring.factories registration, and KeyVaultEnvironmentPostProcessor is definitely executed.

Code Snippet

Minimal configuration : 
spring:
  cloud:
    azure:
      keyvault:
        secret:
          property-source-enabled: true
          property-sources:
            - name: vault
              endpoint: "${KEYVAULT_ENDPOINT}"

frauscher:
  insights:
    security:
      clientSecret: "${IClientSecret}"

Diagnostic code used to verify the behavior:

println(
    "secretUnresolved=" +
        securityProperties.clientSecret?.contains("\${")
)

environment.propertySources.forEach {
    println("PropertySource: ${it.name} (${it.javaClass.name})")
}

println(
    "property-source-enabled=" +
        environment.getProperty(
            "spring.cloud.azure.keyvault.secret.property-source-enabled"
        )
)

println(
    "property-sources[0].name=" +
        environment.getProperty(
            "spring.cloud.azure.keyvault.secret.property-sources[0].name"
        )
)

println(
    "property-sources[0].endpoint=" +
        environment.getProperty(
            "spring.cloud.azure.keyvault.secret.property-sources[0].endpoint"
        )
)

Expected behavior
The GraalVM native application should behave the same as the JVM application.
KeyVaultEnvironmentPostProcessor should see the configured property-sources, register the Key Vault PropertySource, and resolve Key Vault-backed placeholders at runtime.
The native image should remain environment-independent, with Key Vault endpoint and credentials supplied at deployment/runtime.

Screenshots
Not applicable. Relevant DEBUG output is included above.

Setup (please complete the following information):

  • OS: Linux
  • IDE: IntelliJ
  • Library/Libraries:
    Spring Boot: 4.1.2 ,Spring Framework: 7.0.x, Spring Cloud Azure: 7.4.0, spring-cloud-azure-starter-keyvault-secrets:7.4.0, spring-cloud-azure-autoconfigure:7.4.0, Azure Identity: 1.18.4, Azure Key Vault Secrets SDK: 4.11.1, Java: 25, GraalVM Native Image: Java 25 / GraalVM 25.x,
    GraalVM Native Build Tools: 1.1.14
Lenguaje dominante
Java
Estrellas
2.6k
Forks
2.2k
Merge medio
1 d 17 h
PR fusionados (30 d)
259

Preparar el entorno

Abrir en Codespaces

Inicia el contenedor de desarrollo del proyecto en tu navegador, con tu propia cuenta de GitHub.

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de Azure/azure-sdk-for-java

Todos los issues de Azure/azure-sdk-for-java

Issues similares

Más issues de Java

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.