hashicorp / hashicorp/vault-helm
vault-agent-init is failing with auth.handler: error authenticating Error
- Dominant language
- Shell
- Stars
- 1.3k
- Forks
- 898
- Avg merge
- 3d 1h
- Merged PRs (30d)
- 1
Description
**Describe the bug**
A clear and concise description of what the bug is.
```
2021-08-13T06:15:25.628Z [INFO] sink.server: starting sink server
2021-08-13T06:15:30.659Z [ERROR] auth.handler: error authenticating: error="read tcp 172.31.36.104:38624->44.224.148.38:8200: read: connection reset by peer" backoff=1s
2021-08-13T06:15:31.659Z [INFO] auth.handler: authenticating
2021-08-13T06:15:31.668Z [ERROR] auth.handler: error authenticating: error="read tcp 172.31.36.104:38630->44.224.148.38:8200: read: connection reset by peer" backoff=1.89s
2021-08-13T06:15:33.566Z [INFO] auth.handler: authenticating
2021-08-13T06:15:33.576Z [ERROR] auth.handler: error authenticating: error="read tcp 172.31.36.104:38636->44.224.148.38:8200: read: connection reset by peer" backoff=3.19s
2021-08-13T06:15:36.766Z [INFO] auth.handler: authenticating
```
**To Reproduce**
Steps to reproduce the behavior:
1. Install chart
2. Run vault command
3. See error (vault logs, etc.)
`i have followed steps as mentioned in https://www.hashicorp.com/blog/injecting-vault-secrets-into-kubernetes-pods-via-a-sidecar.`
values.yaml
```
injector:
enabled: true
externalVaultAddr: "http://my.vault.com:8200"
```
```
narasimhamurthi.kota@narasim-ltmir7x nessus % kubectl get pods
NAME READY STATUS RESTARTS AGE
vault-agent-injector-6cfbff54df-8nf89 1/1 Running 0 36h
```
Other useful info to include: vault pod logs, `kubectl describe statefulset vault` and `kubectl get statefulset vault -o yaml` output
```
narasimhamurthi.kota@narasim-ltmir7x ~ % kubectl logs nessus-scanner-849c4c7cbf-cbcb7 -n nessus-scanner -c vault-agent-init
==> Vault agent started! Log data will stream in below:
2021-08-13T06:15:25.626Z [INFO] sink.file: creating file sink
2021-08-13T06:15:25.627Z [INFO] sink.file: file sink configured: path=/home/vault/.vault-token mode=-rw-r-----
==> Vault agent configuration:
Cgo: disabled
Log Level: info
Version: Vault v1.7.0
Version Sha: 4e222b85c40a810b74400ee3c54449479e32bb9f
2021-08-13T06:15:25.627Z [INFO] template.server: starting template server
2021-08-13T06:15:25.627Z [INFO] auth.handler: starting auth handler
2021-08-13T06:15:25.627Z [INFO] auth.handler: authenticating
[INFO] (runner) creating new runner (dry: false, once: false)
[INFO] (runner) creating watcher
2021-08-13T06:15:25.628Z [INFO] sink.server: starting sink server
2021-08-13T06:15:30.659Z [ERROR] auth.handler: error authenticating: error="read tcp 172.31.36.104:38624->44.224.148.38:8200: read: connection reset by peer" backoff=1s
2021-08-13T06:15:31.659Z [INFO] auth.handler: authenticating
2021-08-13T06:15:31.668Z [ERROR] auth.handler: error authenticating: error="read tcp 172.31.36.104:38630->44.224.148.38:8200: read: connection reset by peer" backoff=1.89s
2021-08-13T06:15:33.566Z [INFO] auth.handler: authenticating
```
**Expected behavior**
A clear and concise description of what you expected to happen.
**Environment**
* Kubernetes version: 1.20
* Distribution or cloud vendor (OpenShift, EKS, GKE, AKS, etc.):EKS
* Other configuration options or runtime services (istio, etc.):NA
* vault-helm version:0.10.0
Chart values:
```yaml
# Paste your user-supplied values here (`helm get values `).
# Be sure to scrub any sensitive values!
```
PLese find the attached logs.
[Uploading vault-logs.txt…]()
**Additional context**
Add any other context about the problem here.
Contributor guide
Research direction
Start with the vault-agent-init logs and the injector settings in values.yaml, then compare the reported vault-helm 0.10.0 setup with the Kubernetes 1.20/EKS environment described. Reproduce the chart installation and inspect the auth.handler connection-reset behavior; done means the init container authenticates successfully and the documented sidecar flow works.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- helm, kubernetes
- Domain
- cloud, infrastructure
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100