This is the article I refer to. https://developer.hashicorp.com/vault/docs/platform/k8s/helm/examples/ha-with-raft
root@Will-T-PC:~# helm version
version.BuildInfo{Version:"v3.11.1", GitCommit:"293b50c65d4d56187cd4e2f390f0ada46b4c4737", GitTreeState:"clean", GoVersion:"go1.18.10"}
After I refer to this to implement, I get an error.
$ kubectl describe pod vault-0 -n vault
Error: Readiness probe failed: Error checking seal status: Get "http://127.0.0.1:8200/v1/sys/seal-status": dial tcp 127.0.0.1:8200: connect: connection refused
root@Will-T-PC:~/.kube# helm install vault hashicorp/vault \
--names> --namespace vault \
--set "> --set "server.ha.enabled=true" \
--set "> --set "server.ha.replicas=3"
NAME: vault
LAST DEPLOYED: Thu Apr 27 21:45:46 2023
NAMESPACE: vault
STATUS: deployed
REVISION: 1
NOTES:
Thank you for installing HashiCorp Vault!
Now that you have deployed Vault, you should look over the docs on using
Vault with Kubernetes available here:
https://www.vaultproject.io/docs/
Your release is named vault. To learn more about the release, try:
$ helm status vault
$ helm get manifest vault
root@Will-T-PC:~/.kube#
root@Will-T-PC:~/.kube# kubectl get all -n vault
NAME READY STATUS RESTARTS AGE
pod/vault-0 0/1 Running 0 2m43s
pod/vault-1 0/1 Running 0 2m43s
pod/vault-2 0/1 Pending 0 2m43s
pod/vault-agent-injector-84bb6bcd84-swbmr 1/1 Running 0 2m44s
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
service/vault ClusterIP 10.100.58.87 <none> 8200/TCP,8201/TCP 2m45s
service/vault-active ClusterIP 10.100.166.159 <none> 8200/TCP,8201/TCP 2m45s
service/vault-agent-injector-svc ClusterIP 10.100.169.60 <none> 443/TCP 2m45s
service/vault-internal ClusterIP None <none> 8200/TCP,8201/TCP 2m45s
service/vault-standby ClusterIP 10.100.185.43 <none> 8200/TCP,8201/TCP 2m45s
NAME READY UP-TO-DATE AVAILABLE AGE
deployment.apps/vault-agent-injector 1/1 1 1 2m46s
NAME DESIRED CURRENT READY AGE
replicaset.apps/vault-agent-injector-84bb6bcd84 1 1 1 2m47s
NAME READY AGE
statefulset.apps/vault 0/3 2m46s
root@Will-T-PC:~/.kube# kubectl exec -ti vault-0 -- vault operator init
Error from server (NotFound): pods "vault-0" not found
root@Will-T-PC:~# kubectl describe pod vault-0 -n vault
Name: vault-0
Namespace: vault
Priority: 0
Service Account: vault
Node: ip-172-16-2-86.us-west-1.compute.internal/172.16.2.86
Start Time: Thu, 27 Apr 2023 21:46:04 +0800
Labels: app.kubernetes.io/instance=vault
app.kubernetes.io/name=vault
component=server
controller-revision-hash=vault-767b9b789b
helm.sh/chart=vault-0.24.0
statefulset.kubernetes.io/pod-name=vault-0
Annotations: kubernetes.io/psp: eks.privileged
Status: Running
IP: 172.16.11.137
IPs:
IP: 172.16.11.137
Controlled By: StatefulSet/vault
Containers:
vault:
Container ID: docker://4b04532f40a5465b803e8ef780c163f6836e5ee808907140e3af428eb4ec35fb
Image: hashicorp/vault:1.13.1
Image ID: docker-pullable://hashicorp/vault@sha256:b888abc3fc0529550d4a6c87884419e86b8cb736fe556e3e717a6bc50888b3b8
Ports: 8200/TCP, 8201/TCP, 8202/TCP
Host Ports: 0/TCP, 0/TCP, 0/TCP
Command:
/bin/sh
-ec
Args:
cp /vault/config/extraconfig-from-values.hcl /tmp/storageconfig.hcl;
[ -n "${HOST_IP}" ] && sed -Ei "s|HOST_IP|${HOST_IP?}|g" /tmp/storageconfig.hcl;
[ -n "${POD_IP}" ] && sed -Ei "s|POD_IP|${POD_IP?}|g" /tmp/storageconfig.hcl;
[ -n "${HOSTNAME}" ] && sed -Ei "s|HOSTNAME|${HOSTNAME?}|g" /tmp/storageconfig.hcl;
[ -n "${API_ADDR}" ] && sed -Ei "s|API_ADDR|${API_ADDR?}|g" /tmp/storageconfig.hcl;
[ -n "${TRANSIT_ADDR}" ] && sed -Ei "s|TRANSIT_ADDR|${TRANSIT_ADDR?}|g" /tmp/storageconfig.hcl;
[ -n "${RAFT_ADDR}" ] && sed -Ei "s|RAFT_ADDR|${RAFT_ADDR?}|g" /tmp/storageconfig.hcl;
/usr/local/bin/docker-entrypoint.sh vault server -config=/tmp/storageconfig.hcl
State: Running
Started: Thu, 27 Apr 2023 21:46:10 +0800
Ready: False
Restart Count: 0
Readiness: exec [/bin/sh -ec vault status -tls-skip-verify] delay=5s timeout=3s period=5s #success=1 #failure=2 Environment:
HOST_IP: (v1:status.hostIP)
POD_IP: (v1:status.podIP)
VAULT_K8S_POD_NAME: vault-0 (v1:metadata.name)
VAULT_K8S_NAMESPACE: vault (v1:metadata.namespace)
VAULT_ADDR: http://127.0.0.1:8200
VAULT_API_ADDR: http://$(POD_IP):8200
SKIP_CHOWN: true
SKIP_SETCAP: true
HOSTNAME: vault-0 (v1:metadata.name)
VAULT_CLUSTER_ADDR: https://$(HOSTNAME).vault-internal:8201
HOME: /home/vault
Mounts:
/home/vault from home (rw)
/var/run/secrets/kubernetes.io/serviceaccount from kube-api-access-92p4n (ro)
/vault/config from config (rw)
Conditions:
Type Status
Initialized True
Ready False
ContainersReady False
PodScheduled True
Volumes:
config:
Type: ConfigMap (a volume populated by a ConfigMap)
Name: vault-config
Optional: false
home:
Type: EmptyDir (a temporary directory that shares a pod's lifetime)
Medium:
SizeLimit: <unset>
kube-api-access-92p4n:
Type: Projected (a volume that contains injected data from multiple sources)
TokenExpirationSeconds: 3607
ConfigMapName: kube-root-ca.crt
ConfigMapOptional: <nil>
DownwardAPI: true
QoS Class: BestEffort
Node-Selectors: <none>
Tolerations: node.kubernetes.io/not-ready:NoExecute op=Exists for 300s
node.kubernetes.io/unreachable:NoExecute op=Exists for 300s
Events:
Type Reason Age From Message
---- ------ ---- ---- -------
Normal Scheduled 4m44s default-scheduler Successfully assigned vault/vault-0 to ip-172-16-2-86.us-west-1.compute.internal
Warning FailedMount 4m43s kubelet MountVolume.SetUp failed for volume "config" : failed to sync configmap cache: timed out waiting for the condition
Normal Pulling 4m42s kubelet Pulling image "hashicorp/vault:1.13.1"
Normal Pulled 4m39s kubelet Successfully pulled image "hashicorp/vault:1.13.1" in 3.351737534s (3.351743554s including waiting)
Normal Created 4m38s kubelet Created container vault
Normal Started 4m38s kubelet Started container vault
**Warning Unhealthy 3m2s (x20 over 4m32s) kubelet Readiness probe failed: Error checking seal status: Get "http://127.0.0.1:8200/v1/sys/seal-status": dial tcp 127.0.0.1:8200: connect: connection refused**
root@Will-T-PC:~#
root@Will-T-PC:~# kubectl exec -it vault-0 -n vault
error: you must specify at least one command for the container
root@Will-T-PC:~#
root@Will-T-PC:~# kubectl exec -it vault-0 -n vault -- vault status
Error checking seal status: Get "http://127.0.0.1:8200/v1/sys/seal-status": dial tcp 127.0.0.1:8200: connect: connection refused
command terminated with exit code 1
root@Will-T-PC:~# kubectl exec -it vault-0 -n vault -- vault operator init
Get "http://127.0.0.1:8200/v1/sys/seal-status": dial tcp 127.0.0.1:8200: connect: connection refused
command terminated with exit code 2
It looks like the container didn't start successfully and I don't know what steps I'm missing.
Thanks!
