hashicorp / hashicorp/vault-helm
Setting ClusterIP in Values Prevents Deployment
- Dominant language
- Shell
- Stars
- 1.3k
- Forks
- 898
- Avg merge
- 3d 1h
- Merged PRs (30d)
- 1
Description
**Describe the bug**
When HA is enabled and ClusterIP is set, the templates try to set all services to the same ClusterIP which results in a failure because services have to have unique IP addresses.
You can see the same values refs here:
-`vault` service: https://github.com/hashicorp/vault-helm/blob/43656864c6802998d4dbbd0ebd804bcd88c4cdee/templates/server-service.yaml#L21-L23
-`vault-active` service: https://github.com/hashicorp/vault-helm/blob/43656864c6802998d4dbbd0ebd804bcd88c4cdee/templates/server-ha-active-service.yaml#L21-L23
-`vault-standby` service: https://github.com/hashicorp/vault-helm/blob/43656864c6802998d4dbbd0ebd804bcd88c4cdee/templates/server-ha-standby-service.yaml#L21-L23
**To Reproduce**
Steps to reproduce the behavior:
1. Install chart with `.Values.server.service.clusterIP` set and `.Values.server.ha.enabled == true`
2. Helm fails to deploy vault due to service IP conflict between `vault`, `vault-active`, and `vault-standby` services
**Expected behavior**
Ideally, we only want the clusterIP to be set on the `vault` service, not the HA enabled services.
**Environment**
* Kubernetes version:
* Distribution or cloud vendor (OpenShift, EKS, GKE, AKS, etc.): OpenShift 4.6
* Other configuration options or runtime services (istio, etc.): OpenShift Service Mesh v2 (Istio)
* vault-helm version: v0.11
Chart values:
```yaml
...
server:
ha:
enabled: true
service:
clusterIP: x.x.x.x # Will fail with any IP
...
```
**Additional context**
We specify static ClusterIP's for vault because we exclude that address from our istio sidecar init to allow the vault agent injector to work as an init container.
Contributor guide
Research direction
Start with templates/server-service.yaml, templates/server-ha-active-service.yaml, and templates/server-ha-standby-service.yaml, focusing on how server.service.clusterIP is applied when HA is enabled. Reproduce the issue with the provided values using Helm, then verify that deployment succeeds and only the vault service receives the configured ClusterIP while the HA services remain uniquely addressable.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- helm, kubernetes
- Domain
- infrastructure
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 52/100