When Vault supplies ConfigData, its first request can happen before an ordinary proxy-customizer bean exists. Install the request factory through the bootstrap registry instead.

For a Spring Framework 6.1-or-later stack:

import java.net.InetSocketAddress;
import java.net.ProxySelector;
import java.net.http.HttpClient;
import org.springframework.http.client.JdkClientHttpRequestFactory;
import org.springframework.vault.config.AbstractVaultConfiguration
    .ClientFactoryWrapper;

var http = HttpClient.newBuilder()
    .proxy(ProxySelector.of(
        new InetSocketAddress("proxy.example.net", 8080)))
    .build();

application.addBootstrapRegistryInitializer(registry ->
    registry.register(ClientFactoryWrapper.class, context ->
        new ClientFactoryWrapper(
            new JdkClientHttpRequestFactory(http))));

application is the existing SpringApplication. Add this initializer before calling run, retaining the Vault URI and authentication settings.

ClientFactoryWrapper exposes this factory to Vault's bootstrap infrastructure; it does not install an application-wide default for unrelated HTTP clients.

Use the project's compatible Cloud Vault/Boot dependency set. Apache 4 examples cannot be copied into Spring Framework 6's Apache 5 request factory.

Make the proxy address available before bootstrap too. For a publicly reachable Vault server on a route that permits public proxies, choose an HTTP candidate from the HTTP proxy list before application startup. If it is stored only in Vault, the application cannot discover the route needed for that first Vault request.

འབྲེལ་བའི་རྩོམ་ཡིག