Vault operator init - fails with permission issue

Vault
1

Hello,

I am trying to init the vault. I am using the apt install vault package and the version is Vault v1.8.4.

Here is the error:

Error initializing: Error making API request.
URL: PUT http://127.0.0.1:8200/v1/sys/init
Code: 400. Errors:
* failed to initialize barrier: failed to persist keyring: mkdir /etc/vault.d/data/core: read-only file system

Here is my config

ui = true
storage "file" {
  path = "/etc/vault.d/data"
}
listener "tcp" {
  address       = "0.0.0.0:8200"
  tls_disable    = "true"
}
api_addr = "http://127.0.0.1:8200"
cluster_addr = "https://127.0.0.1:8201"

Here is the systemd file:

[Unit]
Description="HashiCorp Vault - A tool for managing secrets"
Documentation=https://www.vaultproject.io/docs/
Requires=network-online.target
After=network-online.target
ConditionFileNotEmpty=/etc/vault.d/vault.hcl
StartLimitIntervalSec=60
StartLimitBurst=3

[Service]
EnvironmentFile=/etc/vault.d/vault.env
User=vault
Group=vault
ProtectSystem=full
ProtectHome=read-only
PrivateTmp=yes
PrivateDevices=yes
SecureBits=keep-caps
AmbientCapabilities=CAP_IPC_LOCK
CapabilityBoundingSet=CAP_SYSLOG CAP_IPC_LOCK
NoNewPrivileges=yes
ExecStart=/usr/bin/vault server -config=/etc/vault.d/vault.hcl
ExecReload=/bin/kill --signal HUP $MAINPID
KillMode=process
KillSignal=SIGINT
Restart=on-failure
RestartSec=5
TimeoutStopSec=30
LimitNOFILE=65536
LimitMEMLOCK=infinity

[Install]
WantedBy=multi-user.target

Things that I have tried or versions:

  • chmod 777 -R data/ to give it wide open perms.
  • edit systemd file, run it as user root/root and comment out the ProtectHome=read-only
  • tried manually adding the core dir, but the error just moved to the next file system access.
  • /etc/vault.d has ownership of vault.vault all the way through.
  • ubuntu server 20.04.3

Please any help or insight would be greatly appreciated.
Brad

2

This is crazy, but rebooting the machine fixed the issue… :frowning:

Brad

3

Probably the service definition file wasn’t reloaded.
Can get around that with something like
sudo systemctl reload-or-restart vault

1 Like