Skip to content

Consider HA connection state for Vault standby health #953

Description

@henkhofs

Spring Cloud Vault's HealthBuilderDelegate currently reports any unsealed standby Vault node as UP. Vault's sys/health response includes ha_connection_healthy for standby nodes; a standby without a healthy HA connection should not be considered healthy by actuator health.

Context:

  • Vault returns 429 for standby sys/health responses by default, with a response body containing standby=true and ha_connection_healthy.
  • Spring Vault PR Handle Vault standby health responses spring-projects/spring-vault#1007 exposes ha_connection_healthy through VaultHealth and aligns reactive sys/health error-body handling with the blocking implementation.
  • Once Spring Cloud Vault consumes a Spring Vault version with that field, HealthBuilderDelegate could treat standby health as UP only when ha_connection_healthy is true, and DOWN otherwise.

Suggested semantics:

  • initialized=false -> DOWN
  • sealed=true -> DOWN
  • standby=true && ha_connection_healthy=true -> UP
  • standby=true && ha_connection_healthy!=true -> DOWN
  • performance_standby=true -> UP
  • active -> UP

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Fields

    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions