hashicorp / hashicorp/vault-helm

Allow intercommunication between Vault pods in Network Policy

Open
#481 0 comments 1 reaction 0 assignees View on GitHub
bug
Dominant language
Shell
Stars
1.3k
Forks
898
Avg merge
3d 1h
Merged PRs (30d)
1

Description

**Describe the bug**
When setting up Vault with High-availability enabled, NetworkPolicy enabled, and egress rules, the generated NetworkPolicy does not allow communication between the Vault Pods, due to missing egress configuration.

**To Reproduce**
Steps to reproduce the behavior:
1. Install chart with `server.ha.enabled = true` and `server.networkPolicy.enabled = true`, and some egress rule in `server.networkPolicy.egress`
2. Init/unseal
3. The vault pods are not able to communicate with each other, because the NetworkPolicy for the server does not allow communication between the Vault pods.

**Expected behavior**
The vault pods should be able to communicate.

**Environment**
* Kubernetes version: 1.18
* Distribution or cloud vendor (OpenShift, EKS, GKE, AKS, etc.): don't know exactly
* vault-helm version: 0.9.1

Chart values:

```yaml
server:
ha:
enabled: true
networkPolicy:
enabled: true
egress:
- to: # for example
- ipBlock:
cidr: 8.8.8.8/32 # DNS
ports:
- port: 53
protocol: UDP
```

**Additional context**
I could easily fix this for myself by adding a `podSelector` rule to the egress myself (ports: 8200, 8201), similar to the ingress rule defined in the [the network policy](https://github.com/hashicorp/vault-helm/blob/master/templates/server-network-policy.yaml#L15). However, I think it makes sense to have this added automatically in the Helm chart.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.