hashicorp / hashicorp/vault-helm

Setting ClusterIP in Values Prevents Deployment

Open
#575 0 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
Shell
Stars
1.3k
Forks
898
Avg merge
3d 1h
Merged PRs (30d)
1

Description

**Describe the bug**
When HA is enabled and ClusterIP is set, the templates try to set all services to the same ClusterIP which results in a failure because services have to have unique IP addresses.

You can see the same values refs here:
-`vault` service: https://github.com/hashicorp/vault-helm/blob/43656864c6802998d4dbbd0ebd804bcd88c4cdee/templates/server-service.yaml#L21-L23
-`vault-active` service: https://github.com/hashicorp/vault-helm/blob/43656864c6802998d4dbbd0ebd804bcd88c4cdee/templates/server-ha-active-service.yaml#L21-L23
-`vault-standby` service: https://github.com/hashicorp/vault-helm/blob/43656864c6802998d4dbbd0ebd804bcd88c4cdee/templates/server-ha-standby-service.yaml#L21-L23

**To Reproduce**
Steps to reproduce the behavior:
1. Install chart with `.Values.server.service.clusterIP` set and `.Values.server.ha.enabled == true`
2. Helm fails to deploy vault due to service IP conflict between `vault`, `vault-active`, and `vault-standby` services

**Expected behavior**
Ideally, we only want the clusterIP to be set on the `vault` service, not the HA enabled services.

**Environment**
* Kubernetes version:
* Distribution or cloud vendor (OpenShift, EKS, GKE, AKS, etc.): OpenShift 4.6
* Other configuration options or runtime services (istio, etc.): OpenShift Service Mesh v2 (Istio)
* vault-helm version: v0.11

Chart values:

```yaml
...
server:
ha:
enabled: true
service:
clusterIP: x.x.x.x # Will fail with any IP
...
```

**Additional context**
We specify static ClusterIP's for vault because we exclude that address from our istio sidecar init to allow the vault agent injector to work as an init container.

Contributor guide

Open the contributing guide

Research direction

Start with templates/server-service.yaml, templates/server-ha-active-service.yaml, and templates/server-ha-standby-service.yaml, focusing on how server.service.clusterIP is applied when HA is enabled. Reproduce the issue with the provided values using Helm, then verify that deployment succeeds and only the vault service receives the configured ClusterIP while the HA services remain uniquely addressable.

Written by the indexing model from the issue text.

Assessment

Tech stack
helm, kubernetes
Domain
infrastructure
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
52/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.