Can't add new vault nodes to existing raft cluster

Vault
1

I am trying to add two nodes to existing 3 node cluster. The join command works but new nodes still not initialized and sealed. I have the 5 nodes in “retry_join”.

vault operator raft  join -address=https://cluster-leader-fqdn:8200 -tls-skip-verify
Key       Value
---       -----
Joined    true

vault status -tls-skip-verify
Key                      Value
---                      -----
Recovery Seal Type       xxxxxxxxx
Initialized              false
Sealed                   true
Total Recovery Shares    0
Threshold                0
Unseal Progress          0/0
Unseal Nonce             n/a
Version                  1.8.1
Storage Type             raft
HA Enabled               true

errors on logs 


[WARN]  core: join attempt failed: error="failed to send answer to raft leader node: error bootstrapping cluster: cluster already has state
[INFO]  core: security barrier not initialized
[INFO]  core: attempting to join possible raft leader node: leader_addr=https://cluster-leader-fqdn:8200
[WARN]  core: join attempt failed: error="failed to send answer to raft leader node: error bootstrapping cluster: cluster already has state
[ERROR] core: failed to retry join raft cluster: retry=2s
2

Where did you get this syntax? Never seen that used before.

3

This is one option in the help file. I tried other combinations without luck.

vault operator raft join "https://cluster-leader-fqdn:8200" -leader-ca-cert=@ca_root.pem  -leader-client-cert=@client_cert.pem -leader-client-key=@client_cert.key

Too many arguments (expected 0-1, got 4)

vault operator raft join

Error joining the node to the Raft cluster: Post "https://127.0.0.1:8200/v1/sys/storage/raft/join": x509: certificate signed by unknown authority

vault operator raft join -tls-skip-verify

Error joining the node to the Raft cluster: Error making API request.

URL: POST https://127.0.0.1:8200/v1/sys/storage/raft/join
Code: 500. Errors:

* failed to join raft cluster: failed to join any raft leader node
4

I’d fix the syntax…cause that should work.
You want the leader URL at the end, after the options.
Format is
vault operator raft join [options] [args]
where options are the things with dashes, and the argument (only takes 1) is the URL.

5

if you do vault operator raft join -h, the example they provide is:

$ vault operator raft join "http://127.0.0.2:8200" \
  -leader-ca-cert=@leader_ca.crt \
  -leader-client-cert=@leader_client.crt \
  -leader-client-key=@leader.key

which does give you the error of Too many arguments (expected 0-1, got 4). Perhaps syntax was updated but not the help at some point