Embedded self-configuring Spring-Cloud-Config server startup fails if configuration contains encrypted entries

Question

I'm currently playing around with Spring-Cloud-Config and stumbled over a problem trying to run an embedded config server configuring itself from its repository. Everything works fine until I add an encrypted value to the server's configuration file. As soon as I do that, server startup fails with this exception:

java.lang.IllegalStateException: Cannot decrypt: key=config-server.test.prop
    at org.springframework.cloud.bootstrap.encrypt.EnvironmentDecryptApplicationInitializer.decrypt(EnvironmentDecryptApplicationInitializer.java:201) ~[spring-cloud-context-1.1.5.RELEASE.jar:1.1.5.RELEASE]
    at org.springframework.cloud.bootstrap.encrypt.EnvironmentDecryptApplicationInitializer.decrypt(EnvironmentDecryptApplicationInitializer.java:165) ~[spring-cloud-context-1.1.5.RELEASE.jar:1.1.5.RELEASE]
    at org.springframework.cloud.bootstrap.encrypt.EnvironmentDecryptApplicationInitializer.initialize(EnvironmentDecryptApplicationInitializer.java:95) ~[spring-cloud-context-1.1.5.RELEASE.jar:1.1.5.RELEASE]
    at org.springframework.boot.SpringApplication.applyInitializers(SpringApplication.java:635) [spring-boot-1.4.2.RELEASE.jar:1.4.2.RELEASE]
    at org.springframework.boot.SpringApplication.prepareContext(SpringApplication.java:349) [spring-boot-1.4.2.RELEASE.jar:1.4.2.RELEASE]
    at org.springframework.boot.SpringApplication.run(SpringApplication.java:313) [spring-boot-1.4.2.RELEASE.jar:1.4.2.RELEASE]
    at org.springframework.boot.SpringApplication.run(SpringApplication.java:1186) [spring-boot-1.4.2.RELEASE.jar:1.4.2.RELEASE]
    at org.springframework.boot.SpringApplication.run(SpringApplication.java:1175) [spring-boot-1.4.2.RELEASE.jar:1.4.2.RELEASE]
    at test.configserver.Application.main(Application.java:13) [classes/:na]
Caused by: java.lang.UnsupportedOperationException: No decryption for FailsafeTextEncryptor. Did you configure the keystore correctly?
    at org.springframework.cloud.bootstrap.encrypt.EncryptionBootstrapConfiguration$FailsafeTextEncryptor.decrypt(EncryptionBootstrapConfiguration.java:152) ~[spring-cloud-context-1.1.5.RELEASE.jar:1.1.5.RELEASE]
    at org.springframework.cloud.bootstrap.encrypt.EnvironmentDecryptApplicationInitializer.decrypt(EnvironmentDecryptApplicationInitializer.java:193) ~[spring-cloud-context-1.1.5.RELEASE.jar:1.1.5.RELEASE]
    ... 8 common frames omitted

The keystore config should be correct, since the encrypted value was created using the /encrypt endpoint of the server.

Also, when I start the embedded server without an encrypted value in its configuration and then change the configuration adding an encrypted value, the server detects the config changes and calls to /<name>/<profile> show the correctly decrypted values.

My test application looks like this:

Application.java

@SpringBootApplication
@EnableConfigServer
public class Application {
    public static void main(final String[] args) {
        SpringApplication.run(Application.class, args);
    }
}

bootstrap.yml

server:
    port: 8888
spring:
    application:
        name: config-server
    cloud:
        config:
            server:
                bootstrap: true
                git:
                    uri: file:///config_server/repo

application.yml

encrypt:
    keyStore:
        location: classpath:/configserver.jks
        alias: configserver

(encrypt.keyStore.password is set via -D option)

Sample config that works

config-server:
    test:
        prop: testvalue

Sample config that makes the server fail

config-server:
    test:
        prop: '{cipher}AQBsAuCDKbDgmFMkxcNPbbDMiLq4SZbBgrHX73KSBJAgisTC2O3iTxXyHhY1MWxXhuzYX4EMy2v9enV3iY3IQz4O2GprO/GjQSggW+jHE1TV7MOcvH01nvg6SUKDkAmWHQqWiqQI0G9NPp2KzOHNcMeKm+q8wbvwFSBhA4A8y8F+++mgC8XK1Kc942jepppI17dCSV25/+iUrDDVdBv6rAqu2D9eyuTZmLl6Q2/SLOGBc+Il8B8L3ylyDHrBdQD92C0aAdh6HcY5Jze1wQSNSxTIzT3nKi22DTF69ilwq9SPz5re4Hm+Y1S+be10wHh34L+fdexrdcpFz9ApqsSKDv2TzXiTCNJIKo3xsOWb6QVIL1DjyKexPri/FZWtBu4EX0dWY2OxiMDmkFf+xVIkE4kw'

I'm using Spring-Framework 4.3.4, Spring-Boot 1.4.2 and Spring-Cloud Camden.SR2 on Java 8.

Edit

For setting up a sample project to reproduce the problem, just use the above code snippets of Application.java, bootstrap.yml and application.yml.

Here is the pom.xml for the project:

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <groupId>test</groupId>
    <artifactId>config-server</artifactId>
    <version>1.0.0-SNAPSHOT</version>
    <packaging>jar</packaging>

    <name>config-server</name>

    <properties>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
        <java.version>1.8</java.version>
        <compiler-plugin.version>3.5.1</compiler-plugin.version>
        <spring-framework.version>4.3.4.RELEASE</spring-framework.version>
        <spring-boot.version>1.4.2.RELEASE</spring-boot.version>
        <spring-cloud.version>Camden.SR2</spring-cloud.version>
    </properties>

    <build>
        <plugins>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-compiler-plugin</artifactId>
                <version>${compiler-plugin.version}</version>
                <configuration>
                    <source>${java.version}</source>
                    <target>${java.version}</target>
                </configuration>
            </plugin>
        </plugins>
    </build>

    <dependencyManagement>
        <dependencies>
            <dependency>
                <groupId>org.springframework</groupId>
                <artifactId>spring-framework-bom</artifactId>
                <version>${spring-framework.version}</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>
            <dependency>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-dependencies</artifactId>
                <version>${spring-boot.version}</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>
            <dependency>
                <groupId>org.springframework.cloud</groupId>
                <artifactId>spring-cloud-dependencies</artifactId>
                <version>${spring-cloud.version}</version>
                <type>pom</type>
                <scope>import</scope>
            </dependency>
        </dependencies>
    </dependencyManagement>

    <dependencies>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.cloud</groupId>
            <artifactId>spring-cloud-starter-config</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.cloud</groupId>
            <artifactId>spring-cloud-config-server</artifactId>
        </dependency>
    </dependencies>
</project>

For the git repo just create a folder, call git init inside it and add a file named config-server.yml with the described sample config that works as content.

The keystore can be generated with keytool as described in the Spring-Cloud-Config docs (for my test I didn't set a -secret).

You should then be able to start the project from your IDE and access the config server on localhost:8888.

Steps to reproduce the problem

1. Start the config server

2. curl localhost:8888/config-server/default - should output the configuration that was added to the git repo

3. Encrypt a value: curl localhost:8888/encrypt -d test

4. Add the encrypted value to config-server.yml (prefixed with {cipher} and enclosed in single quotes)

5. curl localhost:8888/config-server/default - should output the decrypted value

6. Restart the config server - fails with error

Answer 1

Put the keystore encryption configuration in bootstrap.yml.