I’m working on moving the authentication credentials from my application config to HashiCorp vault. I was able to connect to vault with Vault configs in the application.yml or bootstrap.yml. But when I move the vault token configs to PCF Config Server and deploy my code to PCF I’m getting an error.

Here’s my Config Server Json: vault-config

{
  "git": {
    "uri": "https://uri.com",
    "username": "user",
    "password": "pass"
  },
  "vault": {
    "host": "hostname",
    "port": 443,
    "kvVersion": "2",
    "scheme": "https",
    "backend": "kv",
    "profile-separator": ",",
    "skipSslValidation": true,
    "namespace": "vault/my-app-namespace",
    "order": "1",
    "token": "token",
    "authentication": "token"
  }
}

Here’s my application.yml in git:

my-app-username: ${my-app-username}
my-app-password: ${my-app-password}

spring:
  cloud:
    config:
      allow-override: true
      overrideSystemProperties: false
      overrideNone: true
    vault:
      kv:
        application-name: my-app

This is my bootstrap.yml in the app:

spring:
  config:
    import: optional:vault://
  cloud:
    config:
      allowOverride: true
      overrideSystemProperties: false
      overrideNone: true
    vault:
      enabled: true

Error during deployment:

[APP/PROC/WEB/0] [OUT] 12:08:35.806 [main] ERROR org.springframework.boot.SpringApplication -- Application run failed
[APP/PROC/WEB/0] [OUT] java.lang.IllegalStateException: Cannot create authentication mechanism for TOKEN. This method requires either a Token (spring.cloud.vault.token) or a token file at ~/.vault-token.
[APP/PROC/WEB/0] [OUT] at org.springframework.cloud.vault.config.ClientAuthenticationFactory.tokenAuthentication(ClientAuthenticationFactory.java:429)
[APP/PROC/WEB/0] [OUT] at org.springframework.cloud.vault.config.ClientAuthenticationFactory.createClientAuthentication(ClientAuthenticationFactory.java:149)
[APP/PROC/WEB/0] [OUT] at org.springframework.cloud.vault.config.VaultConfigDataLoader$ImperativeInfrastructure.lambda$registerClientAuthentication$4(VaultConfigDataLoader.java:512)
[APP/PROC/WEB/0] [OUT] at org.springframework.boot.DefaultBootstrapContext.getInstance(DefaultBootstrapContext.java:119)
[APP/PROC/WEB/0] [OUT] at org.springframework.boot.DefaultBootstrapContext.getOrElseThrow(DefaultBootstrapContext.java:111)
[APP/PROC/WEB/0] [OUT] at org.springframework.boot.DefaultBootstrapContext.get(DefaultBootstrapContext.java:88)

Any insight how to integrate with vault via config server and not maintain the vault related config inside the application.yml or in bootstrap.yml so it can be shared with other apps deployed to same space in PCF?