Looks like the error you shared is from Ansible? Have you reviewed the logs on the Vault side when this happens to see what is happening there?
Some other things I would be looking for to figure this out:
- Get logs from Vault, the error there may be more helpful as to what is going on (maybe auth lockout from some bad connection.
- Is there any consistency to this, for example its always Monday at 1am but never Tuesday at 1am?
- What is your Vault configuration (# of nodes, how are nodes managed, what version, what auth method is Ansible using)?
- Have you tried connecting directly to Vault and bypassing the load balancer when this happens?