Which certificates/secrets are used to connect Consul from Vault?

[tirelibirefe]

Hello @ishustava @ishustava1
Reagarding the discussion here, which certificate is the correct certificate to connect Consul from Vault?

That one;
kubectl create secret generic consul-client-ca --from-literal=ca="$(kubectl exec consul-server-0 -- curl -sk https://localhost:8501/v1/connect/ca/roots | jq -r .Roots[0].RootCert)"

or that one?
consul-consul-ca-cert/tls.crt

Also please check following dialogs:

Consul verified TLS from Pods in Kubernetes cluster

Great, thanks @lkysow. I have proven the below workflow. Perhaps it might help in official documenting of this use case or, at the very least, help others who might stumble upon this post! Create a Kubernetes secret named consul with a key named CONSUL_GOSSIP_ENCRYPTION_KEY and an appropriate encryption key value. Generate value using consul keygen Install the hashicorp/consul Helm chart with an values-override.yaml, such as below: global: datacenter: sandbox gossipEncryption: se…

Vault not able to communicate to Consul over TLS

I am having the same issue. How were you able to solve your issue?

Vault cannot connect to tls enabled Consul

Consul backend tls connection problem

@aram I think the solution is here. it’s a really big adventure. I don’t know people reluctant to accomplish so complex venture. if there is no any other reasonable solution/way for about 19 months; against to the documentation, we may say… "Vault cannot connect to tls enabled Consul securely? Reagrds

Could you please advise how to connect tls enabled Consul from Vault securely by a reasonable way?

Thanks & Regards