[BUG] KeyVaultEnvironmentPostProcessor cannot load configured property-sources in Spring Boot 4 AOT / GraalVM native image

Aperta
  • Qualcosa non va?
#51,209 2 commenti 2 reazioni 1 assegnatario Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

@moarychan ci sta già lavorando.

Dal 11/11/2026.

  • #51238 di @arnabnandy7 — aperta

Valutazione

Questa issue non è ancora stata valutata.

Descrizione

azure-spring bug Client customer-reported needs-team-attention

Describe the bug

When using Spring Cloud Azure Key Vault Secrets with Spring Boot 4.1.x and GraalVM native image, KeyVaultEnvironmentPostProcessor runs during native/AOT startup before the configured Key Vault property-sources are available in the Environment.
The same configuration works correctly when the application is started normally on the JVM.
During native startup, the processor logs:
KeyVaultEnvironmentPostProcessor : Skip configuring Key Vault PropertySource because spring.cloud.azure.keyvault.secret.property-sources is empty.
However, later during the same application startup, the configuration is present in the Spring Environment:

spring.cloud.azure.keyvault.secret.property-source-enabled=true
spring.cloud.azure.keyvault.secret.property-sources[0].name=vault
spring.cloud.azure.keyvault.secret.property-sources[0].endpoint=https://example.vault.azure.net/

As a result, the Key Vault PropertySource is never registered and placeholders referring to Key Vault secrets remain unresolved.
For example:
clientSecret=${IClientSecret}
remains the literal value ${IClientSecret} in the native image, whereas on the JVM the secret is resolved correctly.

Exception or Stack Trace
No exception is thrown by KeyVaultEnvironmentPostProcessor.
Instead, during Spring Boot AOT / GraalVM native startup, the processor silently skips Key Vault configuration:

DEBUG KeyVaultEnvironmentPostProcessor :
Skip configuring Key Vault PropertySource because spring.cloud.azure.keyvault.secret.property-sources is empty.

Later during the same startup, the same configuration is present in the Spring Environment:

spring.cloud.azure.keyvault.secret.property-source-enabled=true
spring.cloud.azure.keyvault.secret.property-sources[0].name=vault
spring.cloud.azure.keyvault.secret.property-sources[0].endpoint=https://example.vault.azure.net/

As a consequence, the Key Vault PropertySource is never registered and the secret placeholder remains unresolved:

secretPresent=true
secretLength=15
secretUnresolved=true

For reference, 15 is the length of the unresolved literal:

To Reproduce
Steps to reproduce the behavior:

  1. Use the following versions:
    Spring Boot: 4.1.2
    Spring Cloud Azure: 7.4.0
    spring-cloud-azure-starter-keyvault-secrets: 7.4.0
    azure-identity: 1.18.4
    azure-security-keyvault-secrets: 4.11.1
    Java: 25
    GraalVM Native Image: Java 25
    GraalVM Native Build Tools: 1.1.14
  2. Configure Key Vault Secrets in application.yml:
spring:
  cloud:
    azure:
      keyvault:
        secret:
          property-source-enabled: true
          property-sources:
            - name: vault
              endpoint: "${KEYVAULT_ENDPOINT}"
  1. Reference a secret from Key Vault:
  insights:
    security:
      clientSecret: "${IClientSecret}"
  1. Run the application normally on the JVM.
    The Key Vault property source is registered successfully:
PropertySource: vault
(com.azure.spring.cloud.autoconfigure.implementation.keyvault.environment.KeyVaultPropertySource)

The secret is resolved correctly:

secretPresent=true
secretUnresolved=false
  1. Build and run the same application as a GraalVM native image using Spring AOT.
    The native application logs:
    Skip configuring Key Vault PropertySource because spring.cloud.azure.keyvault.secret.property-sources is empty.
    but later the same properties are visible in the Spring Environment.
    We also verified processor ordering:
ConfigDataEnvironmentPostProcessor.getOrder()
= -2147483638

KeyVaultEnvironmentPostProcessor.getOrder()
= -2147483637

The Azure processor is therefore ordered after Spring Boot ConfigData processing.
The native executable also contains the expected Azure spring.factories registration, and KeyVaultEnvironmentPostProcessor is definitely executed.

Code Snippet

Minimal configuration : 
spring:
  cloud:
    azure:
      keyvault:
        secret:
          property-source-enabled: true
          property-sources:
            - name: vault
              endpoint: "${KEYVAULT_ENDPOINT}"

frauscher:
  insights:
    security:
      clientSecret: "${IClientSecret}"

Diagnostic code used to verify the behavior:

println(
    "secretUnresolved=" +
        securityProperties.clientSecret?.contains("\${")
)

environment.propertySources.forEach {
    println("PropertySource: ${it.name} (${it.javaClass.name})")
}

println(
    "property-source-enabled=" +
        environment.getProperty(
            "spring.cloud.azure.keyvault.secret.property-source-enabled"
        )
)

println(
    "property-sources[0].name=" +
        environment.getProperty(
            "spring.cloud.azure.keyvault.secret.property-sources[0].name"
        )
)

println(
    "property-sources[0].endpoint=" +
        environment.getProperty(
            "spring.cloud.azure.keyvault.secret.property-sources[0].endpoint"
        )
)

Expected behavior
The GraalVM native application should behave the same as the JVM application.
KeyVaultEnvironmentPostProcessor should see the configured property-sources, register the Key Vault PropertySource, and resolve Key Vault-backed placeholders at runtime.
The native image should remain environment-independent, with Key Vault endpoint and credentials supplied at deployment/runtime.

Screenshots
Not applicable. Relevant DEBUG output is included above.

Setup (please complete the following information):

  • OS: Linux
  • IDE: IntelliJ
  • Library/Libraries:
    Spring Boot: 4.1.2 ,Spring Framework: 7.0.x, Spring Cloud Azure: 7.4.0, spring-cloud-azure-starter-keyvault-secrets:7.4.0, spring-cloud-azure-autoconfigure:7.4.0, Azure Identity: 1.18.4, Azure Key Vault Secrets SDK: 4.11.1, Java: 25, GraalVM Native Image: Java 25 / GraalVM 25.x,
    GraalVM Native Build Tools: 1.1.14
Lingua principale
Java
Stelle
2.6k
Fork
2.2k
Merge medio
1g 17h
PR unite (30g)
259

Preparare l'ambiente

Apri in Codespaces

Avvia il container di sviluppo del progetto nel browser, con il tuo account GitHub.

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di Azure/azure-sdk-for-java

Tutte le issue di Azure/azure-sdk-for-java

Issue simili

Altre issue su Java

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.