hashicorp / hashicorp/vault-helm

vault-agent-init is failing with auth.handler: error authenticating Error

Open
#592 0 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
Shell
Stars
1.3k
Forks
898
Avg merge
3d 1h
Merged PRs (30d)
1

Description

**Describe the bug**
A clear and concise description of what the bug is.

```
2021-08-13T06:15:25.628Z [INFO] sink.server: starting sink server
2021-08-13T06:15:30.659Z [ERROR] auth.handler: error authenticating: error="read tcp 172.31.36.104:38624->44.224.148.38:8200: read: connection reset by peer" backoff=1s
2021-08-13T06:15:31.659Z [INFO] auth.handler: authenticating
2021-08-13T06:15:31.668Z [ERROR] auth.handler: error authenticating: error="read tcp 172.31.36.104:38630->44.224.148.38:8200: read: connection reset by peer" backoff=1.89s
2021-08-13T06:15:33.566Z [INFO] auth.handler: authenticating
2021-08-13T06:15:33.576Z [ERROR] auth.handler: error authenticating: error="read tcp 172.31.36.104:38636->44.224.148.38:8200: read: connection reset by peer" backoff=3.19s
2021-08-13T06:15:36.766Z [INFO] auth.handler: authenticating
```

**To Reproduce**
Steps to reproduce the behavior:
1. Install chart
2. Run vault command
3. See error (vault logs, etc.)
`i have followed steps as mentioned in https://www.hashicorp.com/blog/injecting-vault-secrets-into-kubernetes-pods-via-a-sidecar.`
values.yaml
```
injector:
enabled: true
externalVaultAddr: "http://my.vault.com:8200"
```
```
narasimhamurthi.kota@narasim-ltmir7x nessus % kubectl get pods
NAME READY STATUS RESTARTS AGE
vault-agent-injector-6cfbff54df-8nf89 1/1 Running 0 36h

```

Other useful info to include: vault pod logs, `kubectl describe statefulset vault` and `kubectl get statefulset vault -o yaml` output
```
narasimhamurthi.kota@narasim-ltmir7x ~ % kubectl logs nessus-scanner-849c4c7cbf-cbcb7 -n nessus-scanner -c vault-agent-init
==> Vault agent started! Log data will stream in below:

2021-08-13T06:15:25.626Z [INFO] sink.file: creating file sink
2021-08-13T06:15:25.627Z [INFO] sink.file: file sink configured: path=/home/vault/.vault-token mode=-rw-r-----
==> Vault agent configuration:

Cgo: disabled
Log Level: info
Version: Vault v1.7.0
Version Sha: 4e222b85c40a810b74400ee3c54449479e32bb9f

2021-08-13T06:15:25.627Z [INFO] template.server: starting template server
2021-08-13T06:15:25.627Z [INFO] auth.handler: starting auth handler
2021-08-13T06:15:25.627Z [INFO] auth.handler: authenticating
[INFO] (runner) creating new runner (dry: false, once: false)
[INFO] (runner) creating watcher
2021-08-13T06:15:25.628Z [INFO] sink.server: starting sink server
2021-08-13T06:15:30.659Z [ERROR] auth.handler: error authenticating: error="read tcp 172.31.36.104:38624->44.224.148.38:8200: read: connection reset by peer" backoff=1s
2021-08-13T06:15:31.659Z [INFO] auth.handler: authenticating
2021-08-13T06:15:31.668Z [ERROR] auth.handler: error authenticating: error="read tcp 172.31.36.104:38630->44.224.148.38:8200: read: connection reset by peer" backoff=1.89s
2021-08-13T06:15:33.566Z [INFO] auth.handler: authenticating
```

**Expected behavior**
A clear and concise description of what you expected to happen.

**Environment**
* Kubernetes version: 1.20
* Distribution or cloud vendor (OpenShift, EKS, GKE, AKS, etc.):EKS
* Other configuration options or runtime services (istio, etc.):NA
* vault-helm version:0.10.0

Chart values:

```yaml
# Paste your user-supplied values here (`helm get values `).
# Be sure to scrub any sensitive values!
```
PLese find the attached logs.
[Uploading vault-logs.txt…]()

**Additional context**
Add any other context about the problem here.

Contributor guide

Open the contributing guide

Research direction

Start with the vault-agent-init logs and the injector settings in values.yaml, then compare the reported vault-helm 0.10.0 setup with the Kubernetes 1.20/EKS environment described. Reproduce the chart installation and inspect the auth.handler connection-reset behavior; done means the init container authenticates successfully and the documented sidecar flow works.

Written by the indexing model from the issue text.

Assessment

Tech stack
helm, kubernetes
Domain
cloud, infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.