Unable to put Vault UI in https

Question

I try to run Vault with a CRC OpenShift 4.7 and helm3 but I've some problems when I try to enable the UI in https.

Add hashicorp repo :

helm repo add hashicorp https://helm.releases.hashicorp.com

Install the latest version of vault :


[[tim@localhost config]]$ helm install vault hashicorp/vault \
> --namespace vault-project \
> --set "global.openshift=true" \
> --set "server.dev.enabled=true"

Then I run oc get pods

[tim@localhost config]$ oc get pods
NAME                                            READY   STATUS    RESTARTS   AGE
vault-project-0                                 0/1     Running   0          48m
vault-project-agent-injector-8568dbf75d-4gjnw   1/1     Running   0          6h9m

I run an interactive shell session with the vault-0 pod :

oc rsh vault-project-0

Then I initialize Vault :

/ $ vault operator init --tls-skip-verify -key-shares=1 -key-threshold=1
Unseal Key 1: iE1iU5bnEsRPSkx0Jd5LWx2NMy2YH6C8bG9+Zo6/VOs=

Initial Root Token: s.xVb0DvIMQRYam7oS2C0ZsHBC

Vault initialized with 1 key shares and a key threshold of 1. Please securely
distribute the key shares printed above. When the Vault is re-sealed,
restarted, or stopped, you must supply at least 1 of these keys to unseal it
before it can start servicing requests.

Vault does not store the generated master key. Without at least 1 key to
reconstruct the master key, Vault will remain permanently sealed!
It is possible to generate new unseal keys, provided you have a quorum of
existing unseal keys shares. See "vault operator rekey" for more information.

Export the token :

export VAULT_TOKEN=s.xVb0DvIMQRYam7oS2C0ZsHBC

Unseal Vault :

/ $ vault operator unseal --tls-skip-verify iE1iU5bnEsRPSkx0Jd5LWx2NMy2YH6C8bG9+Zo6/VOs=

Key             Value
---             -----

Seal Type       shamir
Initialized     true
Sealed          false
Total Shares    1
Threshold       1
Version         1.6.2
Storage Type    file
Cluster Name    vault-cluster-21448fb0
Cluster ID      e4d4649f-2187-4682-fbcb-4fc175d20a6b
HA Enabled      false

I check the pods :

[tim@localhost config]$ oc get pods
NAME                                    READY   STATUS    RESTARTS   AGE
vault-project-0                                  1/1     Running   0          35m
vault-project-agent-injector-8568dbf75d-4gjnw    1/1     Running   0          35m

I'm able to get the UI without https :

In the OpenShift console, I switch to the Administrator mode and this is what I've done :

Networking part - Routes > Create routes
Name : vault-route
Hostname : 192.168.130.11
Path :
Service : vault
Target Port : 8200 -> 8200 (TCP)

Now, if I check the URL : http://192.168.130.11/ui :

The UI is available.

In order to enable the https, I've followed the step here :

https://www.vaultproject.io/docs/platform/k8s/helm/examples/standalone-tls

But I've change the K8S commands for the OpenShift commands

# SERVICE is the name of the Vault service in Kubernetes.
# It does not have to match the actual running service, though it may help for consistency.
SERVICE=vault-server-tls

# NAMESPACE where the Vault service is running.
NAMESPACE=vault-project

# SECRET_NAME to create in the Kubernetes secrets store.
SECRET_NAME=vault-server-tls

# TMPDIR is a temporary working directory.
TMPDIR=/**tmp**

Then :

openssl genrsa -out ${TMPDIR}/vault.key 2048

Then create the csr.conf file :

[tim@localhost tmp]$ cat csr.conf 
[req]
default_bits = 4096
default_md = sha256
distinguished_name = req_distinguished_name
x509_extensions = v3_req
prompt = no

[req_distinguished_name]

[v3_req]
keyUsage = keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names

[alt_names]
DNS.1 = vault-project
DNS.2 = vault-project.vault-project
DNS.3 = *apps-crc.testing
DNS.4 = *api.crc.testing
IP.1 = 127.0.0.1

Create the CSR :

openssl req -new -key': openssl req -new -key ${TMPDIR}/vault.key -subj "/CN=${SERVICE}.${NAMESPACE}.apps-crc.testing" -out ${TMPDIR}/server.csr -config ${TMPDIR}/csr.conf

Create the file ** csr.yaml :

$ export CSR_NAME=vault-csr
$ cat <<EOF >${TMPDIR}/csr.yaml
apiVersion: certificates.k8s.io/v1beta1
kind: CertificateSigningRequest
metadata:
  name: ${CSR_NAME}
spec:
  groups:
  - system:authenticated
  request: $(cat ${TMPDIR}/server.csr | base64 | tr -d '\n')
  usages:
  - digital signature
  - key encipherment
  - server auth
EOF

Send the CSR to OpenShfit :

oc create -f ${TMPDIR}/csr.yaml

Approve CSR :

oc adm certificate approve ${CSR_NAME}

Retrieve the certificate :

serverCert=$(oc get csr ${CSR_NAME} -o jsonpath='{.status.certificate}')

Write the certificate out to a file :

echo "${serverCert}" | openssl base64 -d -A -out ${TMPDIR}/vault.crt

Retrieve Openshift CA :

oc config view --raw --minify --flatten -o jsonpath='{.clusters[].cluster.certificate-authority-data}' | base64 -d > ${TMPDIR}/vault.ca

Store the key, cert, and OpenShift CA into Kubernetes secrets :

oc create secret generic ${SECRET_NAME} \
        --namespace ${NAMESPACE} \
        --from-file=vault.key=/home/vault/certs/vault.key \
        --from-file=vault.crt=/home/vault/certs//vault.crt \
        --from-file=vault.ca=/home/vault/certs/vault.ca

The command oc get secret | grep vault :

NAME                                           TYPE                                  DATA   AGE
vault-server-tls                               Opaque                                3      4h15m

Edit my vault-config with the oc edit cm vault-config command:

# Please edit the object below. Lines beginning with a '#' will be ignored,
# and an empty file will abort the edit. If an error occurs while saving this file will be
# reopened with the relevant failures.
#
apiVersion: v1
data:
  extraconfig-from-values.hcl: |-
    disable_mlock = true
    ui = true

    listener "tcp" {
      tls_cert_file = "/vault/certs/vault.crt"
      tls_key_file = "/vault/certs/vault.key"
      tls_client_ca_file = "/vault/certs/vault.ca"
      address = "[::]:8200"
      cluster_address = "[::]:8201"
    }
    storage "file" {
      path = "/vault/data"
    }
kind: ConfigMap
metadata:
  creationTimestamp: "2021-03-15T13:47:24Z"
  name: vault-config
  namespace: vault-project
  resourceVersion: "396958"
  selfLink: /api/v1/namespaces/vault-project/configmaps/vault-config
  uid: 844603a1-b529-4e33-9d58-20525ea7bff

Edit the VolumeMounst, volumes and ADDR parts my statefulset :

volumeMounts:
        - mountPath: /home/vault
          name: home
        - mountPath: /vault/certs
          name: certs

volumes:
      - configMap:
          defaultMode: 420
          name: vault-config
        name: config
      - emptyDir: {}
        name: home
      - name: certs
        secret:
          defaultMode: 420
          secretName: vault-server-tls

name: VAULT_ADDR
          value: https://127.0.0.1:8200

I delete my pods in order to take into account all my changes

oc delete pods vault-project-0

And...

tim@localhost config]$ oc get pods
NAME                                            READY   STATUS    RESTARTS   AGE
vault-project-0                                 0/1     Running   0          48m
vault-project-agent-injector-8568dbf75d-4gjnw   1/1     Running   0          6h9m

vault-project-0 is on 0/1 but running. If I describe the pods :

Events:
  Type     Reason          Age               From               Message
  ----     ------          ----              ----               -------
  Warning  Unhealthy       1s (x6 over 26s)  kubelet            Readiness probe failed: Error checking seal status: Get "https://127.0.0.1:8200/v1/sys/seal-status": http: server gave HTTP response to HTTPS client

If think that I've missed something but I don't know what...

Someone to tell me how to enable https for the vault UI with openshift ?

Unable to put Vault UI in https

0 Answers0