hashicorp / hashicorp/vault-helm

Can't access Vault UI on an ingress host when HA is enabled

Open
#786 1 comment 0 reactions 0 assignees View on GitHub
bug
Dominant language
Shell
Stars
1.3k
Forks
898
Avg merge
3d 1h
Merged PRs (30d)
1

Description

**Describe the bug**
If I am using an ingress for vault UI and also have `HA` enabled in vaules.yaml (Because I need to point to an existing `consul` cluster as my vault backend storage), then I can't access vault UI when I visit the `ingress host` - I get `502: Bad gateway error` from my nginx ingress controller.
I was asked to open bug here when earlier I opened the bug here: https://github.com/hashicorp/vault/issues/17002

NOTE: If `ha` is disabled, then the ingress works perfectly fine and I can access vault UI on my ingress host - but it doesn't work when `ha` is enabled.
The reason here is: When `ha` is disabled, only `vault` service is created and no `vault-active` nor `vault-ui` services created with this type of setup. So, it's very simple and straightforward. But, when `ha` is enabled, you see `vault-active` as well as `vault-ui` services created and for some reason neither of them help to point to ingress UI successfully.

**To Reproduce**
Steps to reproduce the behavior:
1. Use following values.yaml and install it with helm command:
```
server:
ha:
enabled: true
replicas: 3
config: |
ui = true
storage "consul" {
path = "vault"
address = "my-consul.mywebsite.com:8500"
}
ingress:
enabled: true
hosts:
- backend:
port:
name: 80
service:
name: vault-ui
host: my-vault.mywebsite.com
pathType: ImplementationSpecific
paths:
- /
ingressClassName: nginx
ui:
enabled: true
```
2. Run `helm install vault hashicorp/vault --set global.name=vault --create-namespace --namespace vault -f values.yaml`
3. You will see that even though my ingress setup from my vaules.yaml points to `vault-ui` service, final nginx ingress rule created after helm installation points to `vault-active` service and not to `vault-ui`.
I understand that it's an expected behavior from the documentation. Here's sentence from their documentation: https://www.vaultproject.io/docs/platform/k8s/helm/configuration#hosts

`If ha is enabled the Ingress will point to the active vault server via the active Service.`

But, how do I achieve what I want to achieve above?
With my ingress pointing to `vault-active` service, I can't access vault UI via ingress.

4. Now, even if I create following ingress object (post above helm installation), I still get` 502: Bad Gateway error` when I visit [my-vault.mywebsite.com](http://myvault.mywebsite.com/):

```
apiVersion: extensions/v1beta1
kind: Ingress
metadata:
name: vault-ingress
namespace: vault
spec:
ingressClassName: nginx
rules:
- host: my-vault.mywebsite.com
http:
paths:
- path: /
backend:
serviceName: vault-ui
servicePort: 80
```

**Expected behavior**
I should be able to see Vault UI when I visit my-vault.mywebsite.com

**Environment:**
* Vault chart version: vault-0.21.0
* Vault App version: 1.11.2
* Kubectl version:
- Client: Major:“1”, Minor:“21”, GitVersion:“v1.21.10”
- Server: Major:“1”, Minor:“21”, GitVersion:“v1.21.10”

Can someone please help with this?
I am sure many other people also might be having the same issue.

Contributor guide

Open the contributing guide

Research direction

Start with the supplied values.yaml and the Helm-generated Ingress, vault-active, and vault-ui services; compare the rendered routing with the documented HA behavior. Reproduce the installation using the stated Helm command and verify that the ingress host reaches the Vault UI with HA enabled and the existing Consul backend.

Written by the indexing model from the issue text.

Assessment

Tech stack
helm, kubernetes, nginx
Domain
devops, infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.