从s3到dynamodb的保险库后端存储迁移

Question

我正在尝试将保险库存储从s3桶迁移到dynamodb。新的拱顶哈群位于库伯奈特斯。

金库-2 1/1运行0 10s保险库-1 1 1运行0 15 s保险库-0 1/1运行0 15 s保险库

我使用了下面的命令来迁移保险库存储后端

vault operator migrate -config ~/Desktop/migrate.hcl

MacBook-Pro vaultconfig % cat ~/Desktop/migrate.hcl
storage_source “s3” {
bucket = “db-vault-cluster”
}
storage_destination “dynamodb” {
region = “us-east-1”
access_key = “***"
secret_key = "”
table = “demandbase-vault”
}

迁移成功完成，但无法查看秘密。当我重新启动吊舱时，保险库就不会再出现了。得到下面的错误。

2022-02-05T11:46:56.787Z [INFO] core: loaded wrapping token key
2022-02-05T11:46:56.803Z [INFO] core: successfully setup plugin catalog: plugin-directory=""""
2022-02-05T11:46:56.821Z [INFO] core: successfully mounted backend: type=system path=sys/
2022-02-05T11:46:56.822Z [INFO] core: successfully mounted backend: type=identity path=identity/
2022-02-05T11:46:56.822Z [INFO] core: successfully mounted backend: type=cubbyhole path=cubbyhole/
2022-02-05T11:46:58.753Z [INFO] core: pre-seal teardown starting
2022-02-05T11:46:58.753Z [INFO] core: pre-seal teardown complete
2022-02-05T11:46:58.753Z [ERROR] core: post-unseal setup failed: error=“error fetching default policy from store: failed to read policy: decryption failed: cipher: message authentication failed”

有人能帮我迁移存储后端吗？

Answer 1

您是否在配置中使用相同的seal节？看上去Vault找到了储藏室，但无法解密。

将原始(S3)配置的S3部分复制到新(DynamoDB)配置中。