Hi! I’m usually not the one that begs for help in these forums, but I just have to admit that I am stuck and need assistance!
I am trying to setup Vault in HA mode with Raft storage and TLS using certs from my own CA (pfSense) and I created a certificate for Vault with the following info:
Subject Alternative Names: vault, vault.vault, vault.vault.svc, vault.vault.svc.cluster.local, vault-0.vault-internal, vault-1.vault-internal, vault-2.vault-internal, IP Address:127.0.0.1
I have verified that the vault.ca, vault.crt and vault.key files have been mounted inside the pods, and that the SAN names are present in those files.
My problem is that I can’t join a pod to raft:
❯ kubectl -n vault exec -ti vault-1 -- vault operator raft join http://vault-0.vault-internal:8200
Error joining the node to the Raft cluster: Error making API request.
URL: POST https://127.0.0.1:8200/v1/sys/storage/raft/join
Code: 500. Errors:
* failed to join raft cluster: timed out on raft join: %!w(<nil>)
I have tried tons of different IP addresses etc. in the VAULT_ADDR, address=, cluster_addr= and so on.
Can someone explain exactly which IPs or FQDNS should be used? I’m getting blind at the moment and have no idea anymore.
This is my listener:
ha:
enabled: true
replicas: 2
apiAddr: "https://127.0.0.1:8200"
raft:
enabled: true
setNodeId: true
config: |
ui = true
listener "tcp" {
tls_disable = 0
address = "[::]:8200"
cluster_address = "[::]:8201"
tls_cert_file = "/vault/userconfig/vault-server-tls/vault.crt"
tls_key_file = "/vault/userconfig/vault-server-tls/vault.key"
tls_client_ca_file = "/vault/userconfig/vault-server-tls/vault.ca"
}
disable_mlock = true
storage "raft" {
path = "/vault/data"
}
service_registration "kubernetes" {}
and these are my extra env. vars:
extraEnvironmentVars:
VAULT_CACERT: "/vault/userconfig/vault-server-tls/vault.ca"
VAULT_ADDR: "https://127.0.0.1:8200"
This is output of my Vault Server configuration values:
==> Vault server configuration:
Api Address: https://127.0.0.1:8200
Cgo: disabled
Cluster Address: https://vault-0.vault-internal:8201
Go Version: go1.17.7
Listener 1: tcp (addr: "[::]:8200", cluster address: "[::]:8201", max_request_duration: "1m30s", max_request_size: "33554432", tls: "enabled")
Log Level: trace
Mlock: supported: true, enabled: false
Recovery Mode: false
Storage: raft (HA available)
Version: Vault v1.10.0
Version Sha: 7738ec5d0d6f5bf94a809ee0f6ff0142cfa525a6
Any ideas what could be wrong??! I hope someone can specify exactly which IPs I should use.
Thank you for helping me out! Appreciate it