# Vault Agent with Kubernetes - getting connection refused error

**URL:** <https://discuss.hashicorp.com/t/vault-agent-with-kubernetes-getting-connection-refused-error/13882>\
**Category:** Vault\
**Tags:** k8s\
**Created:** [September 8, 2020, 6:48am UTC](https://discuss.hashicorp.com/t/vault-agent-with-kubernetes-getting-connection-refused-error/13882 "2020-09-08T06:48:39Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![urmilaB4](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/urmilab4/32/11419_2.png) [@urmilaB4](https://discuss.hashicorp.com/u/urmilaB4)\
**Post date:** [September 8, 2020, 6:48am UTC](https://discuss.hashicorp.com/t/vault-agent-with-kubernetes-getting-connection-refused-error/13882/1 "2020-09-08T06:48:39Z")

</div>

I am trying the sample example Vault Agent Auto-Auth using the kubernetes auth method. I have followed all the steps given in [[Vault Agent with Kubernetes | Vault | HashiCorp Developer](https://learn.hashicorp.com/tutorials/vault/agent-kubernetes)] but while login request getting connection refused.

I have configured K8s using below commands -

> export VAULT\_SA\_NAME=$(sudo kubectl get sa vault-auth-k8s -n namespace1 -o jsonpath=“{.secrets[\*][‘name’]}”)

> export SA\_JWT\_TOKEN=(sudo kubectl get secret -n namespace1$VAULT\_SA\_NAME -o jsonpath=“{.data.token}” | base64 --decode; echo)

> export SA\_CA\_CRT=$(sudo kubectl get secret -n namespace1$VAULT\_SA\_NAME -o jsonpath=“{.data[‘ca.crt’]}” | base64 --decode; echo)

> export K8S\_HOST=“127.0.0.1” ##Using k3s so using kubernetes host address as 127.0.0.1

> curl   
> –header “X-Vault-Token: $VAULT\_TOKEN”   
> –request POST   
> –data ‘{“type”: “kubernetes”}’   
> [http://X.X.X.X:8200/v1/sys/auth/kubernetes](http://X.X.X.X:8200/v1/sys/auth/kubernetes)

> sudo kubectl exec vault-0 -n namespace1 – vault write auth/kubernetes/config   
> token\_reviewer\_jwt=“$SA\_JWT\_TOKEN”   
> kubernetes\_host=“https://$K8S\_HOST:8443”   
> kubernetes\_ca\_cert=“$SA\_CA\_CRT”

> sudo kubectl exec vault-0 -n namespace1 – vault write auth/kubernetes/role/example   
> bound\_service\_account\_names=vault-auth-k8s   
> bound\_service\_account\_namespaces=namespace1   
> policies=myapp-k8svl-ro   
> ttl=240h

> TOKEN=$(sudo kubectl get secrets -n namespace1 -o jsonpath=“{.items[?(@.metadata.annotations[‘kubernetes.io/service-account.name’]==‘vault-auth-k8s’)].data.token}”|base64 --decode)

> curl --request POST --data ‘{“jwt”: "’“$TOKEN”‘", “role”: “example”}’ [http://X.X.X.X:8200/v1/auth/kubernetes/login](http://X.X.X.X:8200/v1/auth/kubernetes/login)

Once we run the above command getting error (error displayed in vault-0) -  
[ERROR] auth.kubernetes.auth\_kubernetes\_e415b64a: login unauthorized due to: Post [[https://127.0.0.1:8443/apis/authentication.k8s.io/v1/tokenreviews:](https://127.0.0.1:8443/apis/authentication.k8s.io/v1/tokenreviews:)] dial tcp 127.0.0.1:8443: connect: connection refused

Please help if any configuration is missing or have done any wrong configurations.  
Using vault port as 8200 and K8s host port as 8443

---

<div class="post-metadata">

**Author:** ![mirkop-mattr](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/mirkop-mattr/32/6655_2.png) [@mirkop-mattr](https://discuss.hashicorp.com/u/mirkop-mattr)\
**Post date:** [September 8, 2020, 8:10pm UTC](https://discuss.hashicorp.com/t/vault-agent-with-kubernetes-getting-connection-refused-error/13882/2 "2020-09-08T20:10:32Z")

</div>

Hi, any chance you can reformat the post? It’s quite hard to read.  
I have not used k3s much, but could it be that when you are in the context of your vault pod, the kubernetes api is not exposed under localhost hence you get a connection refused?

---

<div class="post-metadata">

**Author:** ![urmilaB4](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/urmilab4/32/11419_2.png) [@urmilaB4](https://discuss.hashicorp.com/u/urmilaB4)\
**Post date:** [September 9, 2020, 6:38am UTC](https://discuss.hashicorp.com/t/vault-agent-with-kubernetes-getting-connection-refused-error/13882/3 "2020-09-09T06:38:58Z")

</div>

Hi,  
Thanks for the reply. I have modified my post and hope so it is more readable now. My all pods(including Vault) are in same kubernetes node as I am doing it localy on my machine.  
But if I run the following commands I am able to access K8s apis on same machine.

> TOKEN=$(sudo kubectl get secrets -o jsonpath=“{.items[?(@.metadata.annotations[‘kubernetes.io/service-account.name’]==‘default’)].data.token}”|base64 --decode)

> curl -X GET [https://127.0.0.1:6443/apis](https://127.0.0.1:6443/apis) --header “Authorization: Bearer $TOKEN” --insecure  
> Curl command Output:  
> {  
> “kind”: “APIGroupList”,  
> “apiVersion”: “v1”,  
> “groups”: [  
> {  
> “name”: “[apiregistration.k8s.io](http://apiregistration.k8s.io)”,  
> “versions”: [  
> {  
> “groupVersion”: “[apiregistration.k8s.io/v1](http://apiregistration.k8s.io/v1)”,  
> “version”: “v1”  
> },  
> {  
> “groupVersion”: “[apiregistration.k8s.io/v1beta1](http://apiregistration.k8s.io/v1beta1)”,  
> “version”: “v1beta1”  
> }  
> ], … \*omitted due to long output

When I use the same url through vault then getting connection refused error.