0

I have setup hashicorp vault server in kubernetes. Vault server works fine when accessed through CLI or UI. I created another pod which runs my application. But I cannot access Vault Server from my application which is running on different pod.

I have tried using Cluster-IP:Port, IP:Port but always see error Connection Refused.

service.yaml

apiVersion: v1
kind: Service
metadata:
  name: vault
  labels:
    run: vault
spec:
  type: ClusterIP
  ports:
    - port: 8080
      targetPort: 8200
      protocol: TCP
      name: vault
  selector:
    run: vault

deployment.yaml

apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: vault
  labels:
    run: vault
spec:
  replicas: 1
  template:
    metadata:
      labels:
        run: vault
    spec:
      containers:
      - name: vault
        command: ["vault", "server", "-config", "/vault/config/vault.hcl"]
        image: "vault"
        imagePullPolicy: IfNotPresent
        securityContext:
          capabilities:
            add:
              - IPC_LOCK
        volumeMounts:
          - name: configurations
            mountPath: /vault/config/vault.hcl
            subPath: vault.hcl  
      volumes:
        - name: configurations
          configMap:
            name: vault

I need to access vault server from an application running in different pod within same cluster.
Mazhar Hassan
  • 1
  • 1

1 Answers1

0

Please describe, how do you try to access Vault from different pods?

Otherwise, if you don't see any error on your pods, you need to be able to access Vault from other pods within the same namespace via service name or ClusterIP address as you mentioned.

For troubleshooting purposes, I would advise you to run sample Vault pod for testing purposes, like below

kubectl run vault-test --image=vault -l "app=vault-test"

Then, run exec to new pod's shell via:

kubectl exec -it $(kubectl get pods --namespace default -l "app=vault-test" -o jsonpath="{.items[0].metadata.name}") sh

Then, run below commands to see test:

export VAULT_ADDR=http://vault:8080 # "vault" is your service name

OR

export VAULT_ADDR=http://<ClusterIP of vault service>:8080

Then

vault status

you need to see output like below

Key Value --- ----- Seal Type shamir Initialized true Sealed false Total Shares 1 Threshold 1 Version 1.0.1 Cluster Name vault-cluster-f3e6e68d Cluster ID 0280993f-5aee-4f97-b8e5-53f652fdc5ad HA Enabled false

Please let me know about the status of this troubleshooting.

Black_Bacardi
  • 324
  • 4
  • 10
clxoid
  • 2,577
  • 12
  • 21
  • I followed the steps you mentioned. I can see this error when I run _vault status_ `Error checking seal status: Get http://vault:8080/v1/sys/seal-status: dial tcp 10.103.28.202:8080: connect: connection refused.` However the output is fine when I run vault with -dev mode. – Mazhar Hassan Jan 30 '19 at 22:08
  • 1
    Please check if your vault server is listening on `0.0.0.0:8200` interface – clxoid Jan 31 '19 at 12:09
  • you can configure multiple listeners in the config. https://www.vaultproject.io/docs/configuration/listener/tcp – NicoKowe May 20 '20 at 12:45