hashicorp / hashicorp/vault-helm

Raft cluster_addr env variable is hardcoded to use https

Open
#629 3 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

enhancement
Dominant language
Shell
Stars
1.3k
Forks
897
Avg merge
3d 1h
Merged PRs (30d)
1

Description

Is your feature request related to a problem? Please describe.
Feature. I've been trying to setup raft storage. After deleting one of the peers manually because of some debugging, I'm unable to re-add the node to the cluster. I've noticed that the environment variable VAULT_CLUSTER_ADDR is hardcoded to use https as seen in the server-statefulset.yaml template.

Describe the solution you'd like
Even though I've specified the cluster address and the leader API's address within the retry_join blocks, the pods still use a semi-hardcoded environment variable to try and reach the other nodes. I believe this may lead to not being able to re-join the cluster once a peer has been removed. If not using https, which is my case, we should be able to specify.

Describe alternatives you've considered
Tried hardcoding the environment variable a couple times but the way it is configured within the template does not allow for any changes when it comes to the https protocol.

Additional context
My high availability configuration looks like this, currently:

  ha:
    enabled: true
    replicas: 2
    raft:
      enabled: true
      setNodeId: true
      config: |
        ui = true
        api_addr = "http://POD_IP:8200"
        cluster_addr = "http://POD_IP:8201"
        disable_mlock = true
        
        listener "tcp" {
          tls_disable = 1
          address = "0.0.0.0:8200"
          cluster_address = "0.0.0.0:8201"
        }

        storage "raft" {
          path = "/vault/data"
          node_id = "vault-0"
          retry_join {
            leader_api_addr = "http://vault-0.vault-internal:8200"
          }

          retry_join {
            leader_api_addr = "http://vault-1.vault-internal:8200"
          }

          autopilot {
            cleanup_dead_servers = "true"
            last_contact_threshold = "200ms"
            last_contact_failure_threshold = "10m"
            max_trailing_logs = 250000
            min_quorum = 2
            server_stabilization_time = "10s"
          }
        }
        
        service_registration "kubernetes" {}

        seal "gcpckms" {
          project = "REDACTED"
          region = "global"
          key_ring = "REDACTED"
          crypto_key = "REDACTED"
        }

The api_addr variable is picked up and used to configure the pods' VAULT_API_ADDR variable, contrary to cluster_addr which is ignored.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the server-statefulset.yaml template and compare how the shown api_addr and cluster_addr settings become VAULT_API_ADDR and VAULT_CLUSTER_ADDR. Trace the HA/Raft configuration path and verify that the rendered StatefulSet allows the cluster address protocol to follow the configured value instead of forcing https, without changing existing api_addr behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
helm, kubernetes
Domain
devops, infrastructure
Issue type
Feature
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.