Skip to content

Consider HA connection state for Vault standby health #953

Description

@henkhofs

Spring Cloud Vault's HealthBuilderDelegate currently reports any unsealed standby Vault node as UP. Vault's sys/health response includes ha_connection_healthy for standby nodes; a standby without a healthy HA connection should not be considered healthy by actuator health.

Context:

  • Vault returns 429 for standby sys/health responses by default, with a response body containing standby=true and ha_connection_healthy.
  • Spring Vault PR Handle Vault standby health responses spring-projects/spring-vault#1007 exposes ha_connection_healthy through VaultHealth and aligns reactive sys/health error-body handling with the blocking implementation.
  • Once Spring Cloud Vault consumes a Spring Vault version with that field, HealthBuilderDelegate could treat standby health as UP only when ha_connection_healthy is true, and DOWN otherwise.

Suggested semantics:

  • initialized=false -> DOWN
  • sealed=true -> DOWN
  • standby=true && ha_connection_healthy=true -> UP
  • standby=true && ha_connection_healthy!=true -> DOWN
  • performance_standby=true -> UP
  • active -> UP

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions