在GCE上安装Hashicorp vault

Question

我正在尝试在google实例Redhat 7上安装vault，每次运行脚本时，我都会收到一个用于解封vault的有线错误，有时解封安装有时不起作用，以下是错误：

安装代码是git中的here

当我尝试通过comand vault operator init解封时：

# vault operator init
Error initializing: Error making API request.

URL: PUT http://127.0.0.1:8200/v1/sys/init
Code: 400. Errors:

* Vault is already initialized


   # echo $VAULT_ADDR
http://127.0.0.1:8200

 vault operator  unseal
Unseal Key (will be hidden): 
Error unsealing: Error making API request.

URL: PUT http://127.0.0.1:8200/v1/sys/unseal
Code: 400. Errors:

* 'key' must be specified in request body as JSON, or 'reset' set to true

服务显示为：

 systemctl status vault.service
● vault.service - "HashiCorp Vault - A tool for managing secrets"
   Loaded: loaded (/etc/systemd/system/vault.service; enabled; vendor preset: disabled)
   Active: active (running) since Tue 2019-08-27 20:28:59 UTC; 17min ago
     Docs: https://www.vaultproject.io/docs/
 Main PID: 851 (vault)
   CGroup: /system.slice/vault.service
           └─851 /usr/bin/vault server -config=/etc/vault/config.hcl

Aug 27 20:29:02 instance-5 vault[851]: ==> Vault server configuration:
Aug 27 20:29:02 instance-5 vault[851]: Api Address: http://127.0.0.1:8200
Aug 27 20:29:02 instance-5 vault[851]: Cgo: disabled
Aug 27 20:29:02 instance-5 vault[851]: Cluster Address: https://127.0.0.1:8201
Aug 27 20:29:02 instance-5 vault[851]: Listener 1: tcp (addr: "0.0.0.0:8200", cluster address: "0.0.0.0:820...led")
Aug 27 20:29:02 instance-5 vault[851]: Log Level: info
Aug 27 20:29:02 instance-5 vault[851]: Mlock: supported: true, enabled: false
Aug 27 20:29:02 instance-5 vault[851]: Storage: gcs (HA available)
Aug 27 20:29:02 instance-5 vault[851]: Version: Vault v1.2.2
Aug 27 20:29:03 instance-5 vault[851]: ==> Vault server started! Log data will stream in below:
Hint: Some lines were ellipsized, use -l to show in full

根据代码，我应该自动解封

Answer 1

从问题中指定的命令看，您似乎没有在unseal command中指定密钥。要解封vault，您必须为其提供3个解封密钥，并为这3个密钥分别运行一次命令：

vault operator unseal key1
vault operator unseal key2
vault operator unseal key3

当您第一次使用initialize vault时，控制台上会打印出5个解封密钥，您可以使用这5个密钥中的任意3个密钥来解封保险库。