title: How to use Spring Cloud Config with a Git and Vault composite environment repository?
body: <p>I've been tinkering with Spring Cloud Config, but have a use case where config properties are divided into two types:</p>
  
  <ol>
  <li><p>Non-secret values, which developers should be able to view and maintain (e.g. JDBC URL's, etc)</p></li>
  <li><p>Secret values, which should be viewed and maintained only by designated people with special access (e.g. passwords)</p></li>
  </ol>
  
  <p>So I'm very interested in the support for "<a href="http://cloud.spring.io/spring-cloud-config/spring-cloud-config.html" rel="noreferrer">Composite Environment Repositories</a>", currently available in the snapshot versions.  It seems like I would be able to use Git for the developer-managed properties, Vault for the secret properties, and configure it such that Vault would always take precedence over Git in the event of a conflict.</p>
  
  <p>However, I'm finding that not only does Vault always take precedence... it's being used as the <strong>exclusive</strong> backend.  No properties from Git are returned at all.</p>
  
  <p>My <code>application.yml</code> looks like this:</p>
  
  <pre><code>spring:
    profiles:
      active: git, vault
    cloud:
      config:
        server:
          vault:
            order: 1
          git:
            uri: https://github.com/spring-cloud-samples/config-repo
            basedir: target/config
            order: 2
  </code></pre>
  
  <p>I have written a property to Vault like this:</p>
  
  <pre><code>vault write secret/foo foo=vault
  </code></pre>
  
  <p>And I am calling my config server like this:</p>
  
  <pre><code>curl -X "GET" "http://127.0.0.1:8888/foo/default" -H "X-Config-Token: a9384085-f048-7c99-ebd7-e607840bc24e"
  </code></pre>
  
  <p>However, the JSON response payload only includes the Vault property.  Nothing from Git:</p>
  
  <pre><code>{
      "name": "foo",
      "profiles": [
          "default"
      ],
      "label": null,
      "version": null,
      "state": null,
      "propertySources": [
          {
              "name": "vault:foo",
              "source": {
                  "foo": "vault"
              }
          }
      ]
  }
  </code></pre>
  
  <p>It doesn't matter if I reverse the <code>order</code> settings in <code>application.yml</code>, to give Git higher priority than Vault.  As long as the Vault profile is active, it acts as the exclusive backend.</p>
  
  <p>However, if I deactivate the vault profile, then the same curl operation does return results from the Git backend:</p>
  
  <pre><code>{
      "name": "foo",
      "profiles": [
          "default"
      ],
      "label": "master",
      "version": "30f5f4a144dba41e23575ebe46369222b7cbc90d",
      "state": null,
      "propertySources": [
          {
              "name": "https://github.com/spring-cloud-samples/config-repo/foo.properties",
              "source": {
                  "democonfigclient.message": "hello spring io",
                  "foo": "from foo props"
              }
          },
          {
              "name": "https://github.com/spring-cloud-samples/config-repo/application.yml",
              "source": {
                  "info.description": "Spring Cloud Samples",
                  "info.url": "https://github.com/spring-cloud-samples",
                  "eureka.client.serviceUrl.defaultZone": "http://localhost:8761/eureka/",
                  "foo": "from-default"
              }
          }
      ]
  }
  </code></pre>
  
  <p>Is there anything I could be missing?  Some reason why the Git properties and Vault properties don't... well, "composite" together?</p>
  
  <p>The only example in the documentation shows Git and Subversion being used together, and there's a note warning you that all repos should contain the same label (e.g. <code>master</code>).  I'm wondering if that's the issue, as the label is always <code>null</code> for Vault.</p>