Issue KMS vault transit with boundary enterprise ( seft-managed )

Boundary
1

Dear teams,

I build boundary enterpise ( seft-managed ) demo but have issue kms :" Error parsing KMS configuration: error fetching kms plugin rpc client: fork/exec /tmp/3469086231/boundary-plugin-kms-transit-bhkZe: permission denied"

version : Boundary Enterprise. 15

After confgi Vault transit,
I run command:
journalctl -u boundary

and see issue : boundary[34499]: Error parsing KMS configuration: error fetching kms plugin rpc client: fork/exec /tmp/3469086231/boundary-plugin-kms-transit-bhkZe: permission denied

config file controller.hcl :

kms “transit” {
purpose = “root”
address = “http://x.x.x.x:8200”
token = “hvs.CAESIMn-K-a-jBPJ3zA6t75JVoW-1Svu4SFpBDk77l777hiEKHGh2cy5idm0zWFNUVjlyN3JwUDhmUVdkYnp6UlEQ3Sg”

disable_renewal = “false”

// Key configuration
key_name = “boundary”
mount_path = “transit/”

// TLS Configuration
tls_skip_verify = “true”
}

Please help me recommend follow config fix it, I think misconfiguration.

Many thanks for your teams support.

2

The issue is that it is trying to spin out plugin binaries to execute them but it is unable to. You should specify a custom directory via Plugins - configuration | Boundary | HashiCorp Developer where the files Boundary writes in are able to be executed.

3

Hi Mr. Jeft.

Thank for your support, I config Plugins add to file controller.hcl
"plugins {
execution_dir = “/var/run/boundary/plugin-exec”
}
"

But have error:

Error parsing KMS configuration: error writing out plugin for execution: open /var/run/boundary/plugin-exec/boundary-plugin-kms-transit-kQd45: permission deni>
boundary[52361]: Error parsing KMS configuration: error fetching kms plugin rpc client: fork/exec /tmp/1429644624/boundary-plugin-kms-transit-69osd: permission denied
Error parsing KMS configuration: error writing out plugin for execution: open /var/run/boundary/plugin-exec/boundary-plugin-kms-transit-QU0NA: no such file or>
I think miss configuration "namespace "transit with vault ? Please recommend config fix error: permission denied.

Many thanks,
EP

4

It looks like /var/run may be a symlink to /tmp (which is not uncommon), and you still don’t have permission to execute binaries in that space, which may be due to how tmpfs is mounted. Try using a different directory outside tmpfs and see if that helps.

5

Hi Mr. Jeft,

Thank for your support. Error fix but have new error :slight_smile:

Mar 13 07:58:58 server-boundary boundary[22270]: Error parsing KMS configuration: error setting configuration on the kms plugin: rpc error: code = Unknown desc = Error making API request.
Mar 13 07:58:58 server-boundary boundary[22270]: URL: PUT http://x…x.x.x:8200/v1/transit/encrypt/boundary
Mar 13 07:58:58 server-boundary boundary[22270]: Code: 403. Errors:
Mar 13 07:58:58 server-boundary boundary[22270]: * permission denied

This is error config transit kms “namespace” on server vault ? Please recommend resolved misconfiguration fix it.

Many thanks,

EP