hashicorp / hashicorp/vault-helm
Allow intercommunication between Vault pods in Network Policy
- Dominant language
- Shell
- Stars
- 1.3k
- Forks
- 898
- Avg merge
- 3d 1h
- Merged PRs (30d)
- 1
Description
**Describe the bug**
When setting up Vault with High-availability enabled, NetworkPolicy enabled, and egress rules, the generated NetworkPolicy does not allow communication between the Vault Pods, due to missing egress configuration.
**To Reproduce**
Steps to reproduce the behavior:
1. Install chart with `server.ha.enabled = true` and `server.networkPolicy.enabled = true`, and some egress rule in `server.networkPolicy.egress`
2. Init/unseal
3. The vault pods are not able to communicate with each other, because the NetworkPolicy for the server does not allow communication between the Vault pods.
**Expected behavior**
The vault pods should be able to communicate.
**Environment**
* Kubernetes version: 1.18
* Distribution or cloud vendor (OpenShift, EKS, GKE, AKS, etc.): don't know exactly
* vault-helm version: 0.9.1
Chart values:
```yaml
server:
ha:
enabled: true
networkPolicy:
enabled: true
egress:
- to: # for example
- ipBlock:
cidr: 8.8.8.8/32 # DNS
ports:
- port: 53
protocol: UDP
```
**Additional context**
I could easily fix this for myself by adding a `podSelector` rule to the egress myself (ports: 8200, 8201), similar to the ingress rule defined in the [the network policy](https://github.com/hashicorp/vault-helm/blob/master/templates/server-network-policy.yaml#L15). However, I think it makes sense to have this added automatically in the Helm chart.
Contributor guide
Assessment
This issue has not been assessed yet.