I’ve successfully migrated Vault from standalone with storage type file to Vault HA with storage type raft. I’ve set the replica amount at 1. When I’m trying to spin up multiple replica’s it returns some TLS errors. I’ve checked that the Vault leader is unsealed.
The vault-0 container (this is the leader) returns the following logs:
2022-12-16T12:02:25.848+0100 [WARN] core.cluster-listener: no TLS config found for ALPN: ALPN=["h2", "http/1.1"]
2022-12-16T12:02:25.848+0100 [DEBUG] core.cluster-listener: error handshaking cluster connection: error="unsupported protocol"
2022-12-16T12:02:27.878+0100 [WARN] core.cluster-listener: no TLS config found for ALPN: ALPN=["h2", "http/1.1"]
2022-12-16T12:02:27.878+0100 [DEBUG] core.cluster-listener: error handshaking cluster connection: error="unsupported protocol"
2022-12-16T12:02:29.924+0100 [WARN] core.cluster-listener: no TLS config found for ALPN: ALPN=["h2", "http/1.1"]
2022-12-16T12:02:29.924+0100 [DEBUG] core.cluster-listener: error handshaking cluster connection: error="unsupported protocol"
The vault-1 container that needs to join returns the following logs:
2022-12-16T12:05:17.424+0100 [INFO] core: security barrier not initialized
2022-12-16T12:05:17.424+0100 [INFO] core: seal configuration missing, not initialized
2022-12-16T12:05:17.978+0100 [INFO] core: security barrier not initialized
2022-12-16T12:05:17.993+0100 [INFO] core: attempting to join possible raft leader node: leader_addr=https://vault-0.vault-internal:8201
2022-12-16T12:05:18.000+0100 [ERROR] core: failed to get raft challenge: leader_addr=https://vault-0.vault-internal:8201 error="error during raft bootstrap init call: Put \"https://vault-0.vault-internal:8201/v1/sys/storage/raft/bootstrap/challenge\": remote error: tls: internal error"
2022-12-16T12:05:18.000+0100 [ERROR] core: failed to retry join raft cluster: retry=2s err="failed to get raft challenge"
The config file looks like this:
config: |
disable_mlock = true
ui = true
listener "tcp" {
tls_disable = true
address = "[::]:8200"
cluster_address = "[::]:8201"
# Enable unauthenticated metrics access (necessary for Prometheus Operator)
telemetry {
unauthenticated_metrics_access = "true"
}
}
storage "raft" {
path = "/vault/raft/"
retry_join {
leader_api_addr = "https://vault-0.vault-internal:8201"
}
}
# Example configuration for using auto-unseal, using Google Cloud KMS. The
# GKMS keys must already exist, and the cluster must have a service account
# that is authorized to access GCP KMS.
#seal "gcpckms" {
# project = "vault-helm-dev"
# region = "global"
# key_ring = "vault-helm-unseal-kr"
# crypto_key = "vault-helm-unseal-key"
#}
# Example configuration for enabling Prometheus metrics in your config.
telemetry {
prometheus_retention_time = "30s",
disable_hostname = true
}
service_registration "kubernetes" {}
Is there any explanation anywhere how to configure the TLS config or is it possible to ignore the TLS verify check? Tried multiple ways to ignore it…
