# \#k8s **URL:** https://discuss.hashicorp.com/tag/k8s/30.md [Latest](https://discuss.hashicorp.com/latest.md) · [Categories](https://discuss.hashicorp.com/categories.md) · [Tags](https://discuss.hashicorp.com/tags.md) --- ## [Is file watching the right way to handle Vault MongoDB dynamic secret rotation in Node.js?](https://discuss.hashicorp.com/t/is-file-watching-the-right-way-to-handle-vault-mongodb-dynamic-secret-rotation-in-node-js/77720)
**Author:** [@vephito](https://discuss.hashicorp.com/u/vephito)\ **Replies:** 2\ **Last updated:** [September 12, 2026, 5:50pm UTC](https://discuss.hashicorp.com/t/is-file-watching-the-right-way-to-handle-vault-mongodb-dynamic-secret-rotation-in-node-js/77720 "2026-09-12T17:50:54Z")
We use Vault Agent as a sidecar that writes a fresh MongoDB connection string to a file every 12 hours. Our Node/Express app uses a file watcher to monitor that file and, on change, swaps to a new MongoClient and closes … --- ## [Consul API Gateway doesn't seem completely conformant with official Specs](https://discuss.hashicorp.com/t/consul-api-gateway-doesnt-seem-completely-conformant-with-official-specs/76398)
**Author:** [@academian](https://discuss.hashicorp.com/u/academian)\ **Replies:** 1\ **Last updated:** [August 27, 2026, 4:51am UTC](https://discuss.hashicorp.com/t/consul-api-gateway-doesnt-seem-completely-conformant-with-official-specs/76398 "2026-08-27T04:51:43Z")
Hi, I am trying to use Consul API gateway on a EKS cluster but the gateway doesn’t seem to be fully compliant with the official conformance specs. I’m specifically looking at HTTPRoute and RequestRedirect which is a cor… --- ## [HCP Vault Kubernetes Authentication Setup and Troubleshooting Guide (K3s) || Permission Denied Error 403](https://discuss.hashicorp.com/t/hcp-vault-kubernetes-authentication-setup-and-troubleshooting-guide-k3s-permission-denied-error-403/77478)
**Author:** [@jainc6400](https://discuss.hashicorp.com/u/jainc6400)\ **Replies:** 0\ **Last updated:** [June 9, 2026, 6:27am UTC](https://discuss.hashicorp.com/t/hcp-vault-kubernetes-authentication-setup-and-troubleshooting-guide-k3s-permission-denied-error-403/77478 "2026-06-09T06:27:07Z")
HCP Vault Kubernetes Authentication Setup and Troubleshooting Guide Author: Chirag Jain Published Date: June 2026 Disclaimer This document is based on testing and validation performed in a personal lab environment. C… --- ## [Vault helm chart maintenance](https://discuss.hashicorp.com/t/vault-helm-chart-maintenance/77351)
**Author:** [@Kuchaaar](https://discuss.hashicorp.com/u/Kuchaaar)\ **Replies:** 3\ **Last updated:** [May 16, 2026, 10:11am UTC](https://discuss.hashicorp.com/t/vault-helm-chart-maintenance/77351 "2026-05-16T10:11:20Z")
Can anyone answer this issue? --- ## [Add metrics to the Vault Secrets Operator for rollout restart trigger counts](https://discuss.hashicorp.com/t/add-metrics-to-the-vault-secrets-operator-for-rollout-restart-trigger-counts/77406)
**Author:** [@mnacharov](https://discuss.hashicorp.com/u/mnacharov)\ **Replies:** 0\ **Last updated:** [May 6, 2026, 3:11pm UTC](https://discuss.hashicorp.com/t/add-metrics-to-the-vault-secrets-operator-for-rollout-restart-trigger-counts/77406 "2026-05-06T15:11:55Z")
Hi, vault team! I’ve prepared PR to add metrics which could help me to increase observability of one of the cool features of the VSO, please give me some feedback, I’ll be happy to have it in future releases: --- ## [Deploy vault in k8s with integrated storage](https://discuss.hashicorp.com/t/deploy-vault-in-k8s-with-integrated-storage/22425)
**Author:** [@bonyfusolia](https://discuss.hashicorp.com/u/bonyfusolia)\ **Replies:** 1\ **Last updated:** [March 13, 2026, 3:04pm UTC](https://discuss.hashicorp.com/t/deploy-vault-in-k8s-with-integrated-storage/22425 "2026-03-13T15:04:57Z")
I deployed HA vault cluster in local kubernetes (docker desktop). This is without TLS. I have a copied the overide values below, # Vault Helm Chart Value Overrides global: enabled: true tlsDisable: true server… --- ## [Accesslog not captured in OTEL consul integration](https://discuss.hashicorp.com/t/accesslog-not-captured-in-otel-consul-integration/77149)
**Author:** [@deepak7946](https://discuss.hashicorp.com/u/deepak7946)\ **Replies:** 1\ **Last updated:** [February 16, 2026, 5:45am UTC](https://discuss.hashicorp.com/t/accesslog-not-captured-in-otel-consul-integration/77149 "2026-02-16T05:45:44Z")
I have a otel collector service running on the kubernetes cluster. The otel svc is otel-collector-opentelemetry-collector ClusterIP 10.0.xx.xx 6831/UDP,14250/TCP,14268/TCP,4317/TCP,4318/TCP,9411/TCP 4h7m… --- ## [Does Hashicorp Vault provides KMS Provider integration?](https://discuss.hashicorp.com/t/does-hashicorp-vault-provides-kms-provider-integration/3841)
**Author:** [@kongyew](https://discuss.hashicorp.com/u/kongyew)\ **Replies:** 3\ **Last updated:** [February 4, 2026, 3:37pm UTC](https://discuss.hashicorp.com/t/does-hashicorp-vault-provides-kms-provider-integration/3841 "2026-02-04T15:37:30Z")
i want to use Hashicorp vault to store encryption key for Kubernetes ETCD database. Currently, Kubernetes provides KMS provider and i want to know whether Hashicorp Vault provides KMS Provider integration. --- ## [Vault design vm vs. container and secret engine best practices](https://discuss.hashicorp.com/t/vault-design-vm-vs-container-and-secret-engine-best-practices/77035)
**Author:** [@motorbass](https://discuss.hashicorp.com/u/motorbass)\ **Replies:** 2\ **Last updated:** [January 12, 2026, 3:29pm UTC](https://discuss.hashicorp.com/t/vault-design-vm-vs-container-and-secret-engine-best-practices/77035 "2026-01-12T15:29:46Z")
Hi After using Vault on a dedicated VM since 2 years, it’s now time to re-think the architecture due to the evolution of needs and practices, so I got some questions relative to Vault :slight\_smile: Question 1 - For us… --- ## [API gateway is stale](https://discuss.hashicorp.com/t/api-gateway-is-stale/77032)
**Author:** [@Sharofiddin](https://discuss.hashicorp.com/u/Sharofiddin)\ **Replies:** 0\ **Last updated:** [January 8, 2026, 6:35am UTC](https://discuss.hashicorp.com/t/api-gateway-is-stale/77032 "2026-01-08T06:35:31Z")
Consul’s API Gateway for Kubernetes feels stale and significantly behind modern Gateway API–based solutions, yet once you adopt Consul as a service mesh you’re effectively forced to use it for first-class north–south tra… --- ## [404 error from RHEL9 Repo](https://discuss.hashicorp.com/t/404-error-from-rhel9-repo/76896)
**Author:** [@iiaroz](https://discuss.hashicorp.com/u/iiaroz)\ **Replies:** 0\ **Last updated:** [December 6, 2025, 10:01am UTC](https://discuss.hashicorp.com/t/404-error-from-rhel9-repo/76896 "2025-12-06T10:01:19Z")
During a metadata validation check on the HashiCorp RPM repository for RHEL 9, we observed that the repository metadata references the following package: consul-k8s-1.7.7-1.x86\_64.rpm 404, message=‘Not Found’, url=‘htt… --- ## [Move kubernetes resources to a new cluster](https://discuss.hashicorp.com/t/move-kubernetes-resources-to-a-new-cluster/76891)
**Author:** [@markod](https://discuss.hashicorp.com/u/markod)\ **Replies:** 0\ **Last updated:** [December 4, 2025, 2:48pm UTC](https://discuss.hashicorp.com/t/move-kubernetes-resources-to-a-new-cluster/76891 "2025-12-04T14:48:20Z")
Changing an eks cluster for the kubernetes provider doesn’t destroy the resources on the old cluster, even when using alias providers. given the following applied state changing the provider for the namespace resourc… --- ## [Consul - override default timeout of envoys](https://discuss.hashicorp.com/t/consul-override-default-timeout-of-envoys/76845)
**Author:** [@MiladiHedi](https://discuss.hashicorp.com/u/MiladiHedi)\ **Replies:** 0\ **Last updated:** [November 25, 2025, 10:43pm UTC](https://discuss.hashicorp.com/t/consul-override-default-timeout-of-envoys/76845 "2025-11-25T22:43:55Z")
hello, I’m working on Consul 1.20 on a Kubernetes cluster. I have a problem that I can’t solve: all requests are blocked at 5 minutes by a timeout, and I receive a 504 error. My goal is to have requests every hour (I … --- ## [Managing startup of envoy Sidecar in consul (consul on k8s)](https://discuss.hashicorp.com/t/managing-startup-of-envoy-sidecar-in-consul-consul-on-k8s/76770)
**Author:** [@MiladiHedi](https://discuss.hashicorp.com/u/MiladiHedi)\ **Replies:** 2\ **Last updated:** [November 25, 2025, 5:00pm UTC](https://discuss.hashicorp.com/t/managing-startup-of-envoy-sidecar-in-consul-consul-on-k8s/76770 "2025-11-25T17:00:30Z")
Context: Consul 1.20.2 deployed on Kubernetes. Problem: Our application (running in a service mesh proxy) needs to make external calls (outside the mesh) to initialize its data at startup. These calls fail because the E… --- ## [Audiences required for Kubernetes authentication role - Inconsistent documentation](https://discuss.hashicorp.com/t/audiences-required-for-kubernetes-authentication-role-inconsistent-documentation/76769)
**Author:** [@sarah](https://discuss.hashicorp.com/u/sarah)\ **Replies:** 2\ **Last updated:** [November 13, 2025, 8:23pm UTC](https://discuss.hashicorp.com/t/audiences-required-for-kubernetes-authentication-role-inconsistent-documentation/76769 "2025-11-13T20:23:18Z")
I’m looking into upgrading our Vault to 1.21, and reading through the upgrade notes. I notice the “Important changes” page has a section “Audiences required for Kubernetes authentication roles”, which seems to indicate t… --- ## [Multi-tenancy with Vault Namespaces and Kubernetes Auth Method with shared Cluster](https://discuss.hashicorp.com/t/multi-tenancy-with-vault-namespaces-and-kubernetes-auth-method-with-shared-cluster/76736)
**Author:** [@abinet](https://discuss.hashicorp.com/u/abinet)\ **Replies:** 1\ **Last updated:** [November 10, 2025, 7:44pm UTC](https://discuss.hashicorp.com/t/multi-tenancy-with-vault-namespaces-and-kubernetes-auth-method-with-shared-cluster/76736 "2025-11-10T19:44:50Z")
We are evaluating following pretty regular scenario: sharing a Vault Server between multiple development teams and configuring Kubernetes Auth Method for the workloads of those teams running on shared Kubernetes Cluster … --- ## [Create cluster with Shared Network in GKE](https://discuss.hashicorp.com/t/create-cluster-with-shared-network-in-gke/19641)
**Author:** [@xyphanajay](https://discuss.hashicorp.com/u/xyphanajay)\ **Replies:** 2\ **Last updated:** [November 4, 2025, 5:17am UTC](https://discuss.hashicorp.com/t/create-cluster-with-shared-network-in-gke/19641 "2025-11-04T05:17:22Z")
I’m trying to create a cluster in GKE project-1 with shared network of project-2. Roles given to Service account: project-1: Kubernetes Engine Cluster Admin, Compute Network Admin project-2: Kubernetes Engine Service … --- ## [Boundary - Forcing Re-authentication when Switching Between Organizations](https://discuss.hashicorp.com/t/boundary-forcing-re-authentication-when-switching-between-organizations/76661)
**Author:** [@DevOpsWorkInProgress](https://discuss.hashicorp.com/u/DevOpsWorkInProgress)\ **Replies:** 1\ **Last updated:** [October 15, 2025, 4:04pm UTC](https://discuss.hashicorp.com/t/boundary-forcing-re-authentication-when-switching-between-organizations/76661 "2025-10-15T16:04:33Z")
Setup: OIDC Auth Method (Keycloak). A single user has roles in multiple Boundary organizations (e.g., Org A and Org B). Observed Behavior: A single login correctly provides a unified view of resources from bo… --- ## [Boundary OIDC + PKCE: Missing “code\_challenge\_method” - Both Web UI and CLI fail](https://discuss.hashicorp.com/t/boundary-oidc-pkce-missing-code-challenge-method-both-web-ui-and-cli-fail/76602)
**Author:** [@DevOpsWorkInProgress](https://discuss.hashicorp.com/u/DevOpsWorkInProgress)\ **Replies:** 1\ **Last updated:** [October 9, 2025, 7:35pm UTC](https://discuss.hashicorp.com/t/boundary-oidc-pkce-missing-code-challenge-method-both-web-ui-and-cli-fail/76602 "2025-10-09T19:35:23Z")
Hi, I’m running Boundary v0.20.0 Version information: Build Date: 2025-09-18T16:30:15Z Git Revision: dba31589bffa725d43d8f4d7e5ad937f2362c230 Version Number: 0.20.0 using Keycloak as OIDC pr… --- ## [Boundary UI Error 500 with larger host sets (CLI works fine) – v0.19.3 – RKE2/Ubuntu 24.04](https://discuss.hashicorp.com/t/boundary-ui-error-500-with-larger-host-sets-cli-works-fine-v0-19-3-rke2-ubuntu-24-04/76550)
**Author:** [@DevOpsWorkInProgress](https://discuss.hashicorp.com/u/DevOpsWorkInProgress)\ **Replies:** 7\ **Last updated:** [September 29, 2025, 7:36pm UTC](https://discuss.hashicorp.com/t/boundary-ui-error-500-with-larger-host-sets-cli-works-fine-v0-19-3-rke2-ubuntu-24-04/76550 "2025-09-29T19:36:24Z")
Hi all, I’m running Boundary v0.19.3 on RKE2 (Kubernetes) / Ubuntu 24.04 LTS. The Boundary UI works fine when the host set is empty or contains just a few hosts. Once the host set grows (typically around 40–50 hos… --- ## [Vault restart operator for cluster on k8s](https://discuss.hashicorp.com/t/vault-restart-operator-for-cluster-on-k8s/76410)
**Author:** [@jonmosco](https://discuss.hashicorp.com/u/jonmosco)\ **Replies:** 1\ **Last updated:** [September 6, 2025, 1:07pm UTC](https://discuss.hashicorp.com/t/vault-restart-operator-for-cluster-on-k8s/76410 "2025-09-06T13:07:52Z")
I wanted to share a new Kubernetes operator I’ve been developing: the Vault Restart Operator (GitHub repo link ). It’s designed to safely automate rolling restarts of Vault clusters (using the Raft integrated storage ba… --- ## [Setup nodes with libvirt ready for K8s](https://discuss.hashicorp.com/t/setup-nodes-with-libvirt-ready-for-k8s/76417)
**Author:** [@DDavid5](https://discuss.hashicorp.com/u/DDavid5)\ **Replies:** 0\ **Last updated:** [September 3, 2025, 6:00am UTC](https://discuss.hashicorp.com/t/setup-nodes-with-libvirt-ready-for-k8s/76417 "2025-09-03T06:00:29Z")
Hi, I would like to setup cluster with 3 controlplane and 3 worker nodes. I just need to set those nodes to communicate each other and I will do other stuff for k8s manually. I am not able to find any procedure how to do… --- ## [Unable to do Route Table Association in AWS](https://discuss.hashicorp.com/t/unable-to-do-route-table-association-in-aws/76328)
**Author:** [@radicaled](https://discuss.hashicorp.com/u/radicaled)\ **Replies:** 0\ **Last updated:** [August 22, 2025, 2:29pm UTC](https://discuss.hashicorp.com/t/unable-to-do-route-table-association-in-aws/76328 "2025-08-22T14:29:51Z")
I’m working on creating a new EKS, I’m using Cilium as CNI instead of using the AWS vpc-cni. What I’m trying to do is to create a new set of private subnets so I can associate the pod network. My train of thought is as… --- ## [Recovering cluster](https://discuss.hashicorp.com/t/recovering-cluster/76300)
**Author:** [@safderali5](https://discuss.hashicorp.com/u/safderali5)\ **Replies:** 2\ **Last updated:** [August 21, 2025, 7:24pm UTC](https://discuss.hashicorp.com/t/recovering-cluster/76300 "2025-08-21T19:24:50Z")
I had a vault cluster using raft storage with 3 instances. The cluster pods were scaled down to 1 pod without propoerly scaling the raft cluster before. Now the the 2 of the vault pods and their PVCs has been deleted. Th… --- ## [Services are unregistered after restarting the syncCatalog pod](https://discuss.hashicorp.com/t/services-are-unregistered-after-restarting-the-synccatalog-pod/76259)
**Author:** [@lock908](https://discuss.hashicorp.com/u/lock908)\ **Replies:** 0\ **Last updated:** [August 18, 2025, 3:41pm UTC](https://discuss.hashicorp.com/t/services-are-unregistered-after-restarting-the-synccatalog-pod/76259 "2025-08-18T15:41:48Z")
Services are unregistered after restarting the syncCatalog pod. Messages are displayed first: to-consul/sink: invalid service found, scheduling for delete: service-name Next: to-consul/sink: deregistering service: no… --- ## [Clarify changelog entry for v0.10.0: "Add Kubernetes Client QPS and Burst Configuration"](https://discuss.hashicorp.com/t/clarify-changelog-entry-for-v0-10-0-add-kubernetes-client-qps-and-burst-configuration/76010)
**Author:** [@luis.longo](https://discuss.hashicorp.com/u/luis.longo)\ **Replies:** 0\ **Last updated:** [July 31, 2025, 8:18am UTC](https://discuss.hashicorp.com/t/clarify-changelog-entry-for-v0-10-0-add-kubernetes-client-qps-and-burst-configuration/76010 "2025-07-31T08:18:59Z")
Hi, While reviewing the changelog for the new Vault Secrets Operator (VSO) release v0.10.0, one of the entries simply reads: “Add Kubernetes Client QPS and Burst Configuration” After reading PR #1013, it’s clear thi… --- ## [Why is it incredibly difficult to create a ServiceMonitor to send metrics to prometheus/grafana?](https://discuss.hashicorp.com/t/why-is-it-incredibly-difficult-to-create-a-servicemonitor-to-send-metrics-to-prometheus-grafana/61069)
**Author:** [@razahuss02](https://discuss.hashicorp.com/u/razahuss02)\ **Replies:** 4\ **Last updated:** [July 29, 2025, 8:35am UTC](https://discuss.hashicorp.com/t/why-is-it-incredibly-difficult-to-create-a-servicemonitor-to-send-metrics-to-prometheus-grafana/61069 "2025-07-29T08:35:30Z")
Here is my ServiceMonitor apiVersion: monitoring.coreos.com/v1 kind: ServiceMonitor metadata: name: vault labels: release: kube-prometheus-stack # prometheus: kube-prometheus-stack spec: selector: matc… --- ## [I can't see the services of the new dc that is deployed in the gke](https://discuss.hashicorp.com/t/i-cant-see-the-services-of-the-new-dc-that-is-deployed-in-the-gke/75935)
**Author:** [@arturmon82](https://discuss.hashicorp.com/u/arturmon82)\ **Replies:** 0\ **Last updated:** [July 24, 2025, 12:26pm UTC](https://discuss.hashicorp.com/t/i-cant-see-the-services-of-the-new-dc-that-is-deployed-in-the-gke/75935 "2025-07-24T12:26:25Z")
does not see DC services although wan members have Alive. if you look from a remote DC services consul catalog nodes -datacenter=lg-stage-google-k8s-us-central1 Error listing nodes: Unexpected response code: 500 (Remote… --- ## [Solved: How to specify the project for a VPC subnetwork used by a GKE node pool?](https://discuss.hashicorp.com/t/solved-how-to-specify-the-project-for-a-vpc-subnetwork-used-by-a-gke-node-pool/75767)
**Author:** [@davidxia](https://discuss.hashicorp.com/u/davidxia)\ **Replies:** 4\ **Last updated:** [July 10, 2025, 1:53pm UTC](https://discuss.hashicorp.com/t/solved-how-to-specify-the-project-for-a-vpc-subnetwork-used-by-a-gke-node-pool/75767 "2025-07-10T13:53:05Z")
Is there a way to specify the project for a VPC subnetwork used by a GKE node pool? I’m using terraform to create a new node pool that has one NIC attached to subnet A in project 1 and another NIC attached to subnet B in… --- ## [Vault Auto Unseal Issue](https://discuss.hashicorp.com/t/vault-auto-unseal-issue/75664)
**Author:** [@gokul](https://discuss.hashicorp.com/u/gokul)\ **Replies:** 5\ **Last updated:** [July 9, 2025, 11:29am UTC](https://discuss.hashicorp.com/t/vault-auto-unseal-issue/75664 "2025-07-09T11:29:47Z")
I have HashiCorp Vault running as a pod in EKS, configured with PV/PVC backed by EFS for storage. Auto-unseal is set up using AWS KMS, and the storage backend is the file method. This setup has been working fine for a lo… [Next page](https://discuss.hashicorp.com/tag/k8s/30.md?match_all_tags=true&page=1&tags%5B%5D=k8s)