Repository: quarkusio/quarkus
Issue: Upgrading from 1.11.x to 1.13.x breaks kubernetes authentication for quarkus-vault extension

## Describe the bug

I use quarkus-vault extension to access secrets dynamically.

I use client-token authentication for local development and kubernetes authentication for production (see below for configuration).

I upgraded from version 1.11.x to 1.13.x and everything works fine for local development. But when I tried to deploy into kubernetes, I get the following exception during kubernetes authentication : 

```
ERROR: Failed to start application (with profile prod)
io.smallrye.mutiny.TimeoutException
	at io.smallrye.mutiny.operators.uni.UniBlockingAwait.await(UniBlockingAwait.java:58)
	at io.smallrye.mutiny.groups.UniAwait.atMost(UniAwait.java:61)
	at io.quarkus.vault.runtime.client.VertxVaultClient.exec(VertxVaultClient.java:161)
	at io.quarkus.vault.runtime.client.VertxVaultClient.exec(VertxVaultClient.java:154)
	at io.quarkus.vault.runtime.client.VertxVaultClient.post(VertxVaultClient.java:107)
	at io.quarkus.vault.runtime.client.VertxVaultClient.post(VertxVaultClient.java:101)
	at io.quarkus.vault.runtime.client.authmethod.VaultInternalKubernetesAuthMethod.login(VaultInternalKubernetesAuthMethod.java:28)
	at io.quarkus.vault.runtime.VaultAuthManager.loginKubernetes(VaultAuthManager.java:256)
	at io.quarkus.vault.runtime.VaultAuthManager.login(VaultAuthManager.java:155)
	at io.quarkus.vault.runtime.VaultAuthManager.vaultLogin(VaultAuthManager.java:145)
	at io.quarkus.vault.runtime.VaultAuthManager.login(VaultAuthManager.java:116)
	at io.quarkus.vault.runtime.VaultAuthManager.login(VaultAuthManager.java:95)
	at io.quarkus.vault.runtime.VaultAuthManager.getClientToken(VaultAuthManager.java:79)
	at io.quarkus.vault.runtime.VaultKvManager.readSecret(VaultKvManager.java:36)
	at io.quarkus.vault.runtime.VaultKvManager_ClientProxy.readSecret(VaultKvManager_ClientProxy.zig:222)
	at io.quarkus.vault.runtime.config.VaultConfigSource.fetchSecrets(VaultConfigSource.java:92)
	at io.quarkus.vault.runtime.config.VaultConfigSource.lambda$fetchSecrets$2(VaultConfigSource.java:88)
	at java.base/java.util.ArrayList.forEach(ArrayList.java:1511)
	at io.quarkus.vault.runtime.config.VaultConfigSource.fetchSecrets(VaultConfigSource.java:88)
	at io.quarkus.vault.runtime.config.VaultConfigSource.lambda$getSecretConfig$0(VaultConfigSource.java:72)
	at java.base/java.util.Optional.ifPresent(Optional.java:176)
	at io.quarkus.vault.runtime.config.VaultConfigSource.getSecretConfig(VaultConfigSource.java:72)
	at io.quarkus.vault.runtime.config.VaultConfigSource.getValue(VaultConfigSource.java:53)
	at io.smallrye.config.ConfigValueConfigSourceWrapper.getConfigValue(ConfigValueConfigSourceWrapper.java:20)
	at io.smallrye.config.SmallRyeConfigSourceInterceptor.getValue(SmallRyeConfigSourceInterceptor.java:26)
	at io.smallrye.config.SmallRyeConfigSourceInterceptorContext.proceed(SmallRyeConfigSourceInterceptorContext.java:20)
	at io.smallrye.config.SmallRyeConfigSourceInterceptor.getValue(SmallRyeConfigSourceInterceptor.java:27)
	at io.smallrye.config.SmallRyeConfigSourceInterceptorContext.proceed(SmallRyeConfigSourceInterceptorContext.java:20)
	at io.smallrye.config.SmallRyeConfigSourceInterceptor.getValue(SmallRyeConfigSourceInterceptor.java:27)
	at io.smallrye.config.SmallRyeConfigSourceInterceptorContext.proceed(SmallRyeConfigSourceInterceptorContext.java:20)
	at io.smallrye.config.SecretKeysConfigSourceInterceptor.getValue(SecretKeysConfigSourceInterceptor.java:22)
	at io.smallrye.config.SmallRyeConfigSourceInterceptorContext.proceed(SmallRyeConfigSourceInterceptorContext.java:20)
	at io.smallrye.config.RelocateConfigSourceInterceptor.getValue(RelocateConfigSourceInterceptor.java:26)
	at io.smallrye.config.SmallRyeConfigSourceInterceptorContext.proceed(SmallRyeConfigSourceInterceptorContext.java:20)
	at io.smallrye.config.ProfileConfigSourceInterceptor.convertProfile(ProfileConfigSourceInterceptor.java:125)
	at io.smallrye.config.ProfileConfigSourceInterceptor.<init>(ProfileConfigSourceInterceptor.java:49)
	at io.smallrye.config.SmallRyeConfigBuilder$1.getInterceptor(SmallRyeConfigBuilder.java:165)
	at io.smallrye.config.SmallRyeConfigBuilder$InterceptorWithPriority.getInterceptor(SmallRyeConfigBuilder.java:413)
	at io.smallrye.config.SmallRyeConfig$ConfigSourceInterceptorWithPriority.getInterceptor(SmallRyeConfig.java:608)
	at io.smallrye.config.SmallRyeConfig$ConfigSources.<init>(SmallRyeConfig.java:424)
	at io.smallrye.config.SmallRyeConfig.<init>(SmallRyeConfig.java:66)
	at io.smallrye.config.SmallRyeConfigBuilder.build(SmallRyeConfigBuilder.java:358)
	at io.quarkus.runtime.generated.Config.readConfig(Config.zig:2071)
	at io.quarkus.deployment.steps.RuntimeConfigSetup.deploy(RuntimeConfigSetup.zig:60)
	at io.quarkus.runner.ApplicationImpl.doStart(ApplicationImpl.zig:552)
	at io.quarkus.runtime.Application.start(Application.java:90)
	at io.quarkus.runtime.ApplicationLifecycleManager.run(ApplicationLifecycleManager.java:100)
	at io.quarkus.runtime.Quarkus.run(Quarkus.java:66)
	at io.quarkus.runtime.Quarkus.run(Quarkus.java:42)
	at io.quarkus.runtime.Quarkus.run(Quarkus.java:119)
	at io.quarkus.runner.GeneratedMain.main(GeneratedMain.zig:29)
```

### Configuration
```properties
# vault
"%dev":
  quarkus:
    vault:
      url: ${VAULT_URL}
      authentication:
        client-token: 00000000-0000-0000-0000-000000000000
      secret-config-kv-path: ${VAULT_PATH}

"%prod":
  quarkus:
    vault:
      url: ${VAULT_URL}
      authentication:
        kubernetes:
          role: ${VAULT_K8S_ROLE}
          auth-mount-path: ${K8S_AUTH_MOUNT_PATH}
      secret-config-kv-path: ${VAULT_PATH}
```


## Environment (please complete the following information):

### Docker image
openjdk:14

### Output of `java -version`
Java 14

### Build tool (ie. output of `mvnw --version` or `gradlew --version`)
Maven 3.6

## Additional context

I tried one month ago to upgrade from 1.11.x to 1.12.x and had the same error.

I didn't change anything else except the following property after upgrade : 

```properties
quarkus:
  ...
  package:
    type: legacy-jar
```

Changed files:
test-framework/vault/src/main/java/io/quarkus/vault/test/VaultTestExtension.java
extensions/vault/runtime/src/test/java/io/quarkus/vault/runtime/VaultDbManagerTest.java
extensions/vault/runtime/src/test/java/io/quarkus/vault/runtime/VaultAuthManagerTest.java
extensions/vault/runtime/src/main/java/io/quarkus/vault/runtime/config/VaultBootstrapConfig.java
extensions/vault/runtime/src/main/java/io/quarkus/vault/runtime/client/MutinyVertxClientFactory.java

diff --git a/extensions/vault/runtime/src/main/java/io/quarkus/vault/runtime/client/MutinyVertxClientFactory.java b/extensions/vault/runtime/src/main/java/io/quarkus/vault/runtime/client/MutinyVertxClientFactory.java
index b4ebe50c3fa..35ad4f4ba25 100644
--- a/extensions/vault/runtime/src/main/java/io/quarkus/vault/runtime/client/MutinyVertxClientFactory.java
+++ b/extensions/vault/runtime/src/main/java/io/quarkus/vault/runtime/client/MutinyVertxClientFactory.java
@@ -22,6 +22,10 @@ public static WebClient createHttpClient(Vertx vertx, VaultBootstrapConfig vault
                 .setConnectTimeout((int) vaultBootstrapConfig.connectTimeout.toMillis())
                 .setIdleTimeout((int) vaultBootstrapConfig.readTimeout.getSeconds());
 
+        if (vaultBootstrapConfig.nonProxyHosts.isPresent()) {
+            options.setNonProxyHosts(vaultBootstrapConfig.nonProxyHosts.get());
+        }
+
         boolean trustAll = vaultBootstrapConfig.tls.skipVerify.orElseGet(() -> tlsConfig.trustAll);
         if (trustAll) {
             skipVerify(options);
diff --git a/extensions/vault/runtime/src/main/java/io/quarkus/vault/runtime/config/VaultBootstrapConfig.java b/extensions/vault/runtime/src/main/java/io/quarkus/vault/runtime/config/VaultBootstrapConfig.java
index 5f82842529c..561d38880d9 100644
--- a/extensions/vault/runtime/src/main/java/io/quarkus/vault/runtime/config/VaultBootstrapConfig.java
+++ b/extensions/vault/runtime/src/main/java/io/quarkus/vault/runtime/config/VaultBootstrapConfig.java
@@ -210,6 +210,17 @@ public class VaultBootstrapConfig {
     @ConfigItem(defaultValue = DEFAULT_READ_TIMEOUT)
     public Duration readTimeout;
 
+    /**
+     * List of remote hosts that are not proxied when the client is configured to use a proxy. This
+     * list serves the same purpose as the JVM {@code nonProxyHosts} configuration.
+     *
+     * <p>
+     * Entries can use the <i>*</i> wildcard character for pattern matching, e.g <i>*.example.com</i> matches
+     * <i>www.example.com</i>.
+     */
+    @ConfigItem
+    public Optional<List<String>> nonProxyHosts;
+
     /**
      * List of named credentials providers, such as: `quarkus.vault.credentials-provider.foo.kv-path=mypath`
      * <p>
diff --git a/extensions/vault/runtime/src/test/java/io/quarkus/vault/runtime/VaultAuthManagerTest.java b/extensions/vault/runtime/src/test/java/io/quarkus/vault/runtime/VaultAuthManagerTest.java
index 24e9dd84173..fd9302df836 100644
--- a/extensions/vault/runtime/src/test/java/io/quarkus/vault/runtime/VaultAuthManagerTest.java
+++ b/extensions/vault/runtime/src/test/java/io/quarkus/vault/runtime/VaultAuthManagerTest.java
@@ -125,6 +125,7 @@ private VaultBootstrapConfig createConfig() {
             config.authentication.userpass.passwordWrappingToken = Optional.empty();
             config.connectTimeout = Duration.ofSeconds(1);
             config.readTimeout = Duration.ofSeconds(1);
+            config.nonProxyHosts = Optional.empty();
             config.tls.skipVerify = Optional.of(true);
             config.logConfidentialityLevel = LogConfidentialityLevel.LOW;
             config.renewGracePeriod = Duration.ofSeconds(3);
diff --git a/extensions/vault/runtime/src/test/java/io/quarkus/vault/runtime/VaultDbManagerTest.java b/extensions/vault/runtime/src/test/java/io/quarkus/vault/runtime/VaultDbManagerTest.java
index 3437587327e..76fde7c66d1 100644
--- a/extensions/vault/runtime/src/test/java/io/quarkus/vault/runtime/VaultDbManagerTest.java
+++ b/extensions/vault/runtime/src/test/java/io/quarkus/vault/runtime/VaultDbManagerTest.java
@@ -135,6 +135,7 @@ private VaultBootstrapConfig createConfig() {
             config.authentication.userpass.passwordWrappingToken = Optional.empty();
             config.connectTimeout = Duration.ofSeconds(1);
             config.readTimeout = Duration.ofSeconds(1);
+            config.nonProxyHosts = Optional.empty();
             config.tls.skipVerify = Optional.of(true);
             config.logConfidentialityLevel = LogConfidentialityLevel.LOW;
             config.renewGracePeriod = Duration.ofSeconds(3);
diff --git a/test-framework/vault/src/main/java/io/quarkus/vault/test/VaultTestExtension.java b/test-framework/vault/src/main/java/io/quarkus/vault/test/VaultTestExtension.java
index 33b33f608ef..3d496359b76 100644
--- a/test-framework/vault/src/main/java/io/quarkus/vault/test/VaultTestExtension.java
+++ b/test-framework/vault/src/main/java/io/quarkus/vault/test/VaultTestExtension.java
@@ -178,6 +178,7 @@ private TestVaultClient createVaultClient() {
         vaultBootstrapConfig.tls.caCert = Optional.empty();
         vaultBootstrapConfig.connectTimeout = Duration.ofSeconds(5);
         vaultBootstrapConfig.readTimeout = Duration.ofSeconds(1);
+        vaultBootstrapConfig.nonProxyHosts = Optional.empty();
         vaultBootstrapConfig.authentication = new VaultAuthenticationConfig();
         vaultBootstrapConfig.authentication.kubernetes = new VaultKubernetesAuthenticationConfig();
         return new TestVaultClient(new VaultConfigHolder().setVaultBootstrapConfig(vaultBootstrapConfig));