Vault传输引擎启动时自动解封未通过VAULT_TOKEN？

Question

VAULT-1解封提供程序：

cat /etc/vault.d/vault.json  

"listener": [{
  "tcp": {
        "address": "0.0.0.0:8200",
        "tls_disable" : 1
        }
        }],
"storage" :{
        "file" : {
        "path" : "/opt/vault/data"
        }
        },
"max_lease_ttl": "1h",
"default_lease_ttl": "1h"
}

VAULT-2解封客户端，这是尝试自动解封的vault：

cat /etc/vault.d/vault.hcl  

disable_mlock = true
ui=true

storage "file" {
  path = "/vault-2/data"
}

listener "tcp" {
  address     = "0.0.0.0:8200"
  tls_disable = "true"
}

seal "transit" {
  address = "http://192.168.100.100:8200"
  disable_renewal = "false"
  key_name = "autounseal"
  mount_path = "transit/"
  tls_skip_verify = "true"
}

令牌在VAULT-1上似乎有效：

vault token lookup s.XazV
Key                 Value
---                 -----
accessor            eCH1R3G
creation_time       1637091280
creation_ttl        10h
display_name        token
entity_id           n/a
expire_time         2021-11-17T00:34:40.837284665-05:00
explicit_max_ttl    0s
id                  s.XazV
issue_time          2021-11-16T14:34:40.837289691-05:00
meta                <nil>
num_uses            0

在VAULT-2上，我设置了一个env var：

export VAULT_TOKEN="s.XazV"

我在VAULT-1上相应地启用了该策略。但是，在VAULT-2上启动服务时：

vault2 vault[758]: URL: PUT http://192.168.100.100:8200/v1/transit/encrypt/autounseal
vault2 vault[758]: Code: 400. Errors:
vault2 vault[758]: * missing client token

谢谢。

Answer 1

如果使用systemctl启动Vault服务，则可能需要将服务文件配置为将令牌包含在环境配置中，而不是通过导出。

https://askubuntu.com/questions/940679/pass-environment-variables-to-services-started-with-systemctl#940797