hashicorp / hashicorp/vault-helm
Missing NetworkPolicy for Init Container
- Dominant language
- Shell
- Stars
- 1.3k
- Forks
- 898
- Avg merge
- 3d 1h
- Merged PRs (30d)
- 1
Description
**Describe the bug**
The init container of the injector can't connect to $releasename.vault.svc:8200
An additional NetworkPolicy is required.
**To Reproduce**
Steps to reproduce the behavior:
1. Install chart
2. Use the agent injector
3. See error
```
testdeployment-79c87f598b-n5gts vault-agent-init 2023-08-17T09:48:30.272Z [ERROR] agent.auth.handler: error authenticating: error="Put \"[http://vault-deployment.vault.svc:8200/v1/auth/kubernetes/login\](http://vault-deployment.vault.svc:8200/v1/auth/kubernetes/login%5C)": dial tcp [172.17.32.81:8200](http://172.17.32.81:8200/): i/o timeout" backoff=1s
```
**Expected behavior**
I expected that the helm chart would create the required NetworkPolicy which allows other Namespaces to connect.
**Environment**
OpenShift 4.10.61
Chart version 0.25.0
**Additional context**
With this NetworkPolicy it worked:
```yaml
---
kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
name: agent-injector-access
namespace: vault
spec:
podSelector:
matchLabels:
app.kubernetes.io/instance: vault-deployment
app.kubernetes.io/name: vault
ingress:
- ports:
- protocol: TCP
port: 8200
from:
- namespaceSelector: {}
policyTypes:
- Ingress
```
Contributor guide
Research direction
Start by inspecting the vault-helm chart's NetworkPolicy templates and render the chart with the agent injector enabled. Compare the rendered resources with the supplied policy; done means the chart creates a policy allowing the init container to reach Vault on TCP port 8200 from other namespaces.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- helm, kubernetes
- Domain
- devops, infrastructure
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100