Add Option.PROFILE_SPECIFIC to profile specific PropertySources from Vault

Fixes gh-1997

pom.xml

@@ -30,7 +30,7 @@
 		<spring-cloud-commons.version>3.1.1-SNAPSHOT</spring-cloud-commons.version>
 		<aws-java-sdk.version>1.11.911</aws-java-sdk.version>
 		<google-api-services-iam.version>v1-rev20201112-1.30.10</google-api-services-iam.version>
-		<testcontainers.version>1.15.1</testcontainers.version>
+		<testcontainers.version>1.16.2</testcontainers.version>
 		<wiremock.version>2.31.0</wiremock.version>
 		<maven-checkstyle-plugin.failsOnError>true</maven-checkstyle-plugin.failsOnError>
 		<maven-checkstyle-plugin.failsOnViolation>true

spring-cloud-config-client/src/main/java/org/springframework/cloud/config/client/ConfigServerConfigDataLoader.java

@@ -161,8 +161,11 @@ public class ConfigServerConfigDataLoader implements ConfigDataLoader<ConfigServ
 							// https://github.com/spring-cloud/spring-cloud-config/issues/1874
 							for (String profile : resource.getAcceptedProfiles()) {
 								// TODO: switch to match
-								if (propertySourceName.contains("-" + profile + ".")) {
-									// TODO: switch to Options.with() when implemented
+								// , is used as a profile-separator for property sources
+								// from vault
+								// - is the default profile-separator for property sources
+								if (propertySourceName.matches(".*[-,]" + profile + ".*")) {
+									// // TODO: switch to Options.with() when implemented
 									options.add(Option.PROFILE_SPECIFIC);
 								}
 							}

spring-cloud-config-sample/pom.xml

@@ -52,6 +52,21 @@
 			<artifactId>junit-vintage-engine</artifactId>
 			<scope>test</scope>
 		</dependency>
+		<dependency>
+			<groupId>org.testcontainers</groupId>
+			<artifactId>junit-jupiter</artifactId>
+			<scope>test</scope>
+		</dependency>
+		<dependency>
+			<groupId>org.testcontainers</groupId>
+			<artifactId>vault</artifactId>
+			<scope>test</scope>
+		</dependency>
+		<dependency>
+			<groupId>org.testcontainers</groupId>
+			<artifactId>testcontainers</artifactId>
+			<scope>test</scope>
+		</dependency>
 		<dependency>
 			<groupId>org.springframework.retry</groupId>
 			<artifactId>spring-retry</artifactId>

spring-cloud-config-sample/src/test/java/sample/ConfigDataOrderingVaultIntegrationTests.java

@@ -0,0 +1,101 @@
+/*
+ * Copyright 2018-2019 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package sample;
+
+import java.io.IOException;
+
+import org.json.JSONException;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
+import org.testcontainers.containers.BindMode;
+import org.testcontainers.junit.jupiter.Container;
+import org.testcontainers.junit.jupiter.Testcontainers;
+import org.testcontainers.utility.DockerImageName;
+import org.testcontainers.vault.VaultContainer;
+
+import org.springframework.boot.SpringApplication;
+import org.springframework.cloud.config.server.ConfigServerApplication;
+import org.springframework.context.ConfigurableApplicationContext;
+import org.springframework.util.SocketUtils;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+/**
+ * Integration test for https://github.com/spring-cloud/spring-cloud-config/issues/1997
+ * The error only occurs if a profile specific config imports is used, otherwise
+ * reordering does not take place. A profile specific config import is defined in
+ * vaultordering/client-dev.yml
+ */
+@Testcontainers
+public class ConfigDataOrderingVaultIntegrationTests {
+
+	private static final int configServerPort = SocketUtils.findAvailableTcpPort();
+
+	private static final int configClientPort = SocketUtils.findAvailableTcpPort();
+
+	private static ConfigurableApplicationContext client;
+
+	private static ConfigurableApplicationContext server;
+
+	@Container
+	public static VaultContainer vaultContainer = new VaultContainer<>(DockerImageName.parse("vault"))
+			.withVaultToken("my-root-token").withClasspathResourceMapping("vaultordering/vault_test_policy.txt",
+					"/tmp/vault_test_policy.txt", BindMode.READ_ONLY);
+
+	@BeforeAll
+	public static void startConfigServer() throws IOException, InterruptedException, JSONException {
+		server = SpringApplication.run(org.springframework.cloud.config.server.ConfigServerApplication.class,
+				"--spring.config.location=classpath:/vaultordering/", "--spring.config.name=server",
+				"--server.port=" + configServerPort,
+				"--spring.cloud.config.server.vault.port=" + vaultContainer.getFirstMappedPort());
+
+		execInVault("vault", "kv", "put", "secret/client-app,dev", "my.prop=vaultdev");
+		execInVault("vault", "kv", "put", "secret/client-app", "my.prop=vault");
+
+	}
+
+	@AfterAll
+	public static void close() {
+		if (server != null) {
+			server.close();
+		}
+		if (server != null) {
+			client.close();
+		}
+	}
+
+	@Test
+	void propertyFromVaultIsUsed() {
+		client = SpringApplication.run(ConfigServerApplication.class, "--server.port=" + configClientPort,
+				"--spring.config.location=classpath:/vaultordering/", "--spring.config.name=client",
+				"--spring.profiles.active=dev", "--spring.application.name=client-app",
+				"--spring.cloud.config.enabled=true", "--spring.cloud.config.server.enabled=false",
+				"--config.server.port=" + configServerPort);
+
+		assertThat(client.getEnvironment().getProperty("my.prop")).isEqualTo("vaultdev");
+
+	}
+
+	private static String execInVault(String... command) throws IOException, InterruptedException {
+		org.testcontainers.containers.Container.ExecResult execResult = vaultContainer.execInContainer(command);
+		assertThat(execResult.getExitCode()).isZero();
+		assertThat(execResult.getStderr()).isEmpty();
+		return execResult.getStdout();
+	}
+
+}

spring-cloud-config-sample/src/test/resources/logback-test.xml

@@ -0,0 +1,20 @@
+<?xml version="1.0" encoding="UTF-8" ?>
+<configuration>
+
+	<contextListener class="ch.qos.logback.classic.jul.LevelChangePropagator">
+		<resetJUL>true</resetJUL>
+	</contextListener>
+
+	<appender name="STDOUT" class="ch.qos.logback.core.ConsoleAppender">
+		<encoder>
+			<pattern>%d{HH:mm:ss.SSS} [%thread] %-5level %logger{36} - %msg%n</pattern>
+		</encoder>
+	</appender>
+
+	<root level="info">
+		<appender-ref ref="STDOUT"/>
+	</root>
+
+	<logger name="org.testcontainers" level="INFO"/>
+	<logger name="com.github.dockerjava" level="WARN"/>
+</configuration>

spring-cloud-config-sample/src/test/resources/orderingtest-dev.yml

@@ -1 +0,0 @@
-my.prop: my value from local dev profile

spring-cloud-config-sample/src/test/resources/vaultordering/client-dev.yml

@@ -0,0 +1,3 @@
+spring:
+  config:
+    import: configserver:http://localhost:${config.server.port}

spring-cloud-config-sample/src/test/resources/vaultordering/server.yml

@@ -0,0 +1,13 @@
+spring:
+  profiles:
+    active: native, vault
+  cloud:
+    config:
+      server:
+        vault:
+          order: 10
+          token: my-root-token
+          kv-version: 2
+        native:
+          order: 20
+          searchLocations: classpath:/vault-test-repo

spring-cloud-config-sample/src/test/resources/vaultordering/vault-test-repo/client-app-dev.yml

@@ -0,0 +1 @@
+my.prop: nativedev

spring-cloud-config-sample/src/test/resources/vaultordering/vault-test-repo/client-app.yml

@@ -0,0 +1 @@
+my.prop: native

spring-cloud-config-sample/src/test/resources/vaultordering/vault_test_policy.txt

@@ -0,0 +1,16 @@
+path "secret/metadata/" {
+capabilities = ["list"]
+}
+path "secret/data/client-app,*" {
+capabilities = ["read", "list"]
+}
+path "secret/data/client-app" {
+capabilities = ["read", "list"]
+}
+path "secret/data/application,*" {
+capabilities = ["read", "list"]
+}
+path "secret/data/application*" {
+capabilities = ["read", "list"]
+}
+