I am trying to integrate the vault system to manage the env credential. Earlier I was managing the credentials using heml-chart. After vault integration application sometimes throws db refused to connect error.

I am creating .env in Dockerfile and update the .env inside service-entry.sh

Env file is getting generated correctly which I am verifying using cat .env command inside service-entry.sh.

Any suggestion would be helpful in why the application is throwing db refused to connect error in some requests.

Here is my Dockerfile

FROM php:7.3-fpm

# Set working directory
WORKDIR /b2b

# Install dependencies
RUN apt-get update && apt-get install -y apt-utils
RUN apt-get install -y 
   wget 
   build-essential 
   libpng-dev 
   libjpeg62-turbo-dev 
   libfreetype6-dev 
   locales 
   zip 
   libzip-dev 
   jpegoptim optipng pngquant gifsicle 
   vim 
   unzip 
   curl 
   libxml2-dev 
   openssl 
   procps 
   jq

# Clear cache
RUN apt-get clean && rm -rf /var/lib/apt/lists/*

# Install extensions
RUN docker-php-ext-install pdo_mysql mbstring zip exif pcntl soap
RUN docker-php-ext-configure gd --with-gd --with-freetype-dir=/usr/include/ --with-jpeg-dir=/usr/include/ --with-png-dir=/usr/include/
RUN docker-php-ext-install gd
RUN docker-php-ext-install bcmath

# Install composer
RUN curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/local/bin --filename=composer

# Copy existing application directory contents
COPY service-entry.sh .

COPY ./aqualens_b2b_in .

# Create .env file and set permissions
RUN touch .env && chmod 0777 .env

RUN chmod -R 0777 ./storage
RUN chmod -R 0777 ./bootstrap

RUN mkdir -p ./storage/framework/cache
RUN mkdir -p ./storage/framework/sessions
RUN mkdir -p ./storage/framework/views

RUN chmod -R 0777 ./storage

# Set the entry point for the container
CMD ["sh","/b2b/service-entry.sh" ]

RUN composer install
RUN php artisan optimize

Here is service-entry.sh file

#!/bin/sh

# For VAULT

: ${VAULT_ENABLED:="true"}
: ${VAULT_SERVICE_ACCOUNT_TOKEN_FILE:="/var/run/secrets/kubernetes.io/serviceaccount/token"}
: ${VAULT_URI:="http://vault-cluster-url.local:2000"}
: ${VAULT_ROLE:="vault-myapp-config-b2b-auth-role"}
: ${VAULT_BACKEND:="company/myapp/myapp-config"}
: ${VAULT_DEFAULT_CONTEXT:="myapp-b2b"}

# Check and print the current directory and its permissions
echo "Current directory: $(pwd)"
ls -ld .
ls -a
ls -l

if [ "$VAULT_ENABLED" = "true" ]; then
    kubernetesToken=$(cat "${VAULT_SERVICE_ACCOUNT_TOKEN_FILE}")
    if [ $? -ne 0 ]; then
        echo "Error: Unable to read Kubernetes service account token file"
    fi

    vaultEndpoint="${VAULT_URI}/v1/auth/kubernetes/login"
    H1_KUBE="Content-Type: application/json"
    H2_KUBE="Authorization: Bearer ${kubernetesToken}"

    requestData="{"role":"${VAULT_ROLE}","jwt":"${kubernetesToken}"}"
    response=$(curl -s -X POST -H "$H1_KUBE" -H "$H2_KUBE" --data "${requestData}" "${vaultEndpoint}")


    if [ $? -ne 0 ]; then
        echo "Error: Unable to authenticate with Vault"
    fi

    access_token=$(echo "${response}" | jq -r .auth.client_token)
    if [ -z "$access_token" ] || [ "$access_token" = "null" ]; then
        echo "Error: Unable to retrieve access token from Vault response"
    fi

    H1_VAULT="X-Vault-Token: ${access_token}"
    H2_VAULT="Accept: application/json"

    RESPONSE_VAULT=$(curl -s -H "$H1_VAULT" -H "$H2_VAULT" "${VAULT_URI}/v1/${VAULT_BACKEND}/${VAULT_DEFAULT_CONTEXT}")

    if [ $? -ne 0 ]; then
        echo "Error: Unable to fetch vault data"
    fi

    export_statements=$(echo "$RESPONSE_VAULT" | jq -r '.data | to_entries[] | @sh "export (.key)=(.value)"')
    if [ -z "$export_statements" ]; then
        echo "Error: No data retrieved from Vault"
    fi

    echo "Logging Qualens Vault Integration:"
    echo "export_statements"
    echo "$export_statements"

    # Read each export statement and process it
    echo "$export_statements" | while IFS= read -r line; do
        eval "$line"
        key=$(echo "$line" | cut -d'=' -f1 | cut -d' ' -f2)
        value=$(echo "$line" | cut -d'=' -f2- | sed "s/^'//" | sed "s/'$//")
        if grep -q "^${key}=" .env; then
            # Update existing variable
            sed -i "s|^${key}=.*|${key}=${value}|g" .env
        else
            # Add new variable
            echo "${key}=${value}" >> .env
        fi
    done

     # Debug: Print contents of .env file after update
    echo "Contents of .env file after update:"
    cat .env

fi

# For PHP
php-fpm