hashicorp / hashicorp/vault-helm

Missing NetworkPolicy for Init Container

Open
#944 0 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
Shell
Stars
1.3k
Forks
898
Avg merge
3d 1h
Merged PRs (30d)
1

Description

**Describe the bug**
The init container of the injector can't connect to $releasename.vault.svc:8200

An additional NetworkPolicy is required.

**To Reproduce**
Steps to reproduce the behavior:
1. Install chart
2. Use the agent injector
3. See error

```
testdeployment-79c87f598b-n5gts vault-agent-init 2023-08-17T09:48:30.272Z [ERROR] agent.auth.handler: error authenticating: error="Put \"[http://vault-deployment.vault.svc:8200/v1/auth/kubernetes/login\](http://vault-deployment.vault.svc:8200/v1/auth/kubernetes/login%5C)": dial tcp [172.17.32.81:8200](http://172.17.32.81:8200/): i/o timeout" backoff=1s
```

**Expected behavior**
I expected that the helm chart would create the required NetworkPolicy which allows other Namespaces to connect.

**Environment**
OpenShift 4.10.61
Chart version 0.25.0

**Additional context**
With this NetworkPolicy it worked:

```yaml
---
kind: NetworkPolicy
apiVersion: networking.k8s.io/v1
metadata:
name: agent-injector-access
namespace: vault
spec:
podSelector:
matchLabels:
app.kubernetes.io/instance: vault-deployment
app.kubernetes.io/name: vault
ingress:
- ports:
- protocol: TCP
port: 8200
from:
- namespaceSelector: {}
policyTypes:
- Ingress
```

Contributor guide

Open the contributing guide

Research direction

Start by inspecting the vault-helm chart's NetworkPolicy templates and render the chart with the agent injector enabled. Compare the rendered resources with the supplied policy; done means the chart creates a policy allowing the init container to reach Vault on TCP port 8200 from other namespaces.

Written by the indexing model from the issue text.

Assessment

Tech stack
helm, kubernetes
Domain
devops, infrastructure
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.