I have a vault k8s cluster installed with helm chart and i want to set auto unseal in it so when pod reschedules/restarted it unsealed auto in startup. After i enable i am just getting below logs on vault pods
—> error parsing Seal configuration: context deadline exceeded
Here is my config with raft storage and mounted inside pod —>
/vault/config $ cat extraconfig-from-values.hcl
ui = true
listener “tcp” {
tls_disable = 0
address = “0.0.0.0:8200”
address = “[::]:8200”
cluster_address = “0.0.0.0:8201”
cluster_address = “[::]:8201”
#added by Rakesh
tls_cert_file = “/vault/userconfig/tls/tls.crt”
tls_key_file = “/vault/userconfig/tls/tls.key”
#tls_ca_file = “/vault/userconfig/tls/ca.crt”
tls_client_ca_file = “/vault/userconfig/tls/ca.crt”
tls_disable_client_certs = “true”
Enable unauthenticated metrics access (necessary for Prometheus Operator)
telemetry {
unauthenticated_metrics_access = “false”
}
}
telemetry {
prometheus_retention_time = “30m”,
disable_hostname = true
}
storage “raft” {
path = “/vault/data”
retry_join {
leader_api_addr = “https://vault-0.vault-internal.secretvault.svc.cluster.local:8200”
leader_ca_cert_file = “/vault/userconfig/tls/ca.crt”
leader_client_cert_file = “/vault/userconfig/tls/tls.crt”
leader_client_key_file = “/vault/userconfig/tls/tls.key”
}
retry_join {
leader_api_addr = “https://vault-1.vault-internal.secretvault.svc.cluster.local:8200”
leader_ca_cert_file = “/vault/userconfig/tls/ca.crt”
leader_client_cert_file = “/vault/userconfig/tls/tls.crt”
leader_client_key_file = “/vault/userconfig/tls/tls.key”
}
retry_join {
leader_api_addr = “https://vault-2.vault-internal.secretvault.svc.cluster.local:8200”
leader_ca_cert_file = “/vault/userconfig/tls/ca.crt”
leader_client_cert_file = “/vault/userconfig/tls/tls.crt”
leader_client_key_file = “/vault/userconfig/tls/tls.key”
}
}
service_registration “kubernetes” {}
seal “transit” {
address = “https://one-secrets.example.com” # this is address of vault B which holds unseal keys for this A cluster
token = “hvs.CAESIK-ugADrlofbdfbdjbfbjsdjfsdjfdgfsjgdfjfgjxcjbkkskdjhgksjdhfksdhjf”
disable_renewal = “false”
key_name = “vault-k8s-unseal-key”
mount_path = “transit/”
}
disable_mlock = true
###########################
… in my case i can;t use AWS or GCP KMS , i have my other vault cluster B where i can store unseal keys for vault Cluster A , with transit method i am unable to get where the issue is exactly . Any help or alternative is much appreciated