如何通过Helm图表将Vault与Kubernetes上的领事代理连接(领事服务器在Azure管理应用程序上)

Question

寻求帮助:如何通过Helm图表将Vault与Kubernetes上的领事代理连接(领事服务器在Azure管理应用程序上)

我正试着为Vault和领事建造一个POC，我有一些问题。

使用- https://learn.hashicorp.com/tutorials/consul/hashicorp-consul-service-deploy部署Azure托管应用程序的

https://github.com/hashicorp/consul-helm

1. 在AKS上安装了领事代理，其步骤在https://learn.hashicorp.com/tutorials/consul/hashicorp-consul-service-aks?in=consul/hcs-azure领事舵机图表中：

https://github.com/hashicorp/vault-helm

1. 通过头盔图表安装保险库

为领事提供服务和吊舱。

~$kubectl get svc -n consul                                            
NAME                          TYPE        CLUSTER-IP    EXTERNAL-IP   PORT(S)   AGE
consul-connect-injector-svc   ClusterIP   10.0.252.97   <none>        443/TCP   2d13h
consul-controller-webhook     ClusterIP   10.0.169.80   <none>        443/TCP   2d13h

~$kubectl get pods -n consul
NAME                                                         READY   STATUS    RESTARTS   AGE
consul-27j4j                                                 1/1     Running   0          2d13h
consul-connect-injector-webhook-deployment-9454b8d68-778rd   1/1     Running   0          2d13h
consul-controller-7857456f99-mhzpw                           1/1     Running   1          2d13h
consul-lkhpl                                                 1/1     Running   0          2d13h
consul-webhook-cert-manager-cfbb689f7-fgtlw                  1/1     Running   0          2d13h
consul-zf989                                                 1/1     Running   0          2d13h

保险库配置如下：

ui:
  enabled: true
  serviceType: LoadBalancer
server:
  ingress:
    enabled: true
    extraPaths:
      - path: /
        backend:
          serviceName: vault-ui
          servicePort: 8200
    hosts:
      - host: vault.something_masked.com
  ha:
    enabled: true
    config: |
      ui = true

      listener "tcp" {
        tls_disable = 1
        address = "[::]:8200"
        cluster_address = "[::]:8201"
      }

      storage "consul" {
        path = "vault/"
        scheme = "https"
        address = "HOST_IP:8500"
      }

拱顶吊舱

kubectl get pods -n vault                             
NAME                                   READY   STATUS    RESTARTS   AGE
vault-0                                0/1     Running   0          7m14s
vault-1                                0/1     Running   0          7m11s
vault-2                                0/1     Running   0          7m11s
vault-agent-injector-cbbb6f4df-rmbd7   1/1     Running   0          7m22s

错误:金库无法与领事代理沟通。

拱顶原木-0吊舱

kubectl logs vault-0 -n vault

WARNING! Unable to read storage migration status.
2021-06-27T08:37:17.801Z [INFO]  proxy environment: http_proxy="" https_proxy="" no_proxy=""
2021-06-27T08:37:18.824Z [WARN]  storage migration check error: error="Get "https://10.54.0.206:8500/v1/kv/vault/core/migration": dial tcp 10.54.0.206:8500: connect: connection refused"

保险库用原木.喷射器吊舱

 kubectl logs vault-agent-injector-cbbb6f4df-rmbd7 -n vault    
2021-06-27T08:37:09.189Z [INFO]  handler: Starting handler..
Listening on ":8080"...
2021-06-27T08:37:09.218Z [INFO]  handler.auto-tls: Generated CA
2021-06-27T08:37:09.219Z [INFO]  handler.certwatcher: Updated certificate bundle received. Updating certs...
2021-06-27T08:37:18.252Z [INFO]  handler: Request received: Method=POST URL=/mutate?timeout=10s
2021-06-27T08:37:18.452Z [INFO]  handler: Request received: Method=POST URL=/mutate?timeout=10s

如果我错过了什么，在保险库配置中有什么建议或建议吗?？

提前谢谢你。

问候Pooja

Answer 1

有很多地方需要调试这个问题，而且问题可能出现在任何地方。

我现在看到的主要问题是您的保险库正在运行，但没有处于就绪状态。

您必须从海豹突击队状态开始，解除保险库的封印。

阅读更多关于解封：https://learn.hashicorp.com/tutorials/vault/ha-with-consul#step-5-start-vault-and-verify-its-state的信息

还有你的领事是怎么处理金库的？使用LB，侵入，服务名称？

Answer 2

我使用的是领事蓝管理的应用服务器，我已经安装了领事代理在阿克斯。

kubectl get svc -n consul
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
consul-connect-injector-svc ClusterIP 10.0.252.97 <none> 443/TCP 3d13h
consul-controller-webhook ClusterIP 10.0.169.80 <none> 443/TCP 3d13h

由于我使用的是领事代理，所以没有看到领事服务器正在运行。

领事的舵图配置

global:
  enabled: false
  name: consul
  datacenter: dc1
  acls:
    manageSystemACLs: true
    bootstrapToken:
      secretName: XXX-sandbox-managed-app-bootstrap-token
      secretKey: token
  gossipEncryption:
    secretName: XXX-sandbox-managed-app-hcs
    secretKey: gossipEncryptionKey
  tls:
    enabled: true
    enableAutoEncrypt: true
    caCert:
      secretName: XXX-sandbox-managed-app-hcs
      secretKey: caCert
externalServers:
  enabled: true
  hosts:
    ['XXX.az.hashicorp.cloud']
  httpsPort: 443
  useSystemRoots: true
  k8sAuthMethodHost: https://XXX.uksouth.azmk8s.io:443
client:
  enabled: true
  # If you are using Kubenet in your AKS cluster (the default network),
  # uncomment the line below.
  # exposeGossipPorts: true
  join:
    ['XXX.az.hashicorp.cloud']
connectInject:
  enabled: true
controller:
  enabled: true

保险库的舵图配置

ui:
  enabled: true
  serviceType: LoadBalancer

server:
  ingress:
    enabled: true
    extraPaths:
      - path: /
        backend:
          serviceName: vault-ui
          servicePort: 8200
    hosts:
      - host: something.com
  ha:
    enabled: true
    config: |
      ui = true

      listener "tcp" {
        tls_disable = 1
        address = "[::]:8200"
        cluster_address = "[::]:8201"
      }

      storage "consul" {
        path = "vault/"
        scheme = "https"
        address = "HOST_IP:8500"
      }

无法连接到领事代理的保险库错误。

库贝克尔原木拱顶-0 -n金库

WARNING! Unable to read storage migration status.
2021-06-28T08:13:13.041Z [INFO]  proxy environment: http_proxy="" https_proxy="" no_proxy=""
2021-06-28T08:13:13.042Z [WARN]  storage migration check error: error="Get "https://127.0.0.1:8500/v1/kv/vault/core/migration": dial tcp 127.0.0.1:8500: connect: connection refused"

我不确定领事舵图中是否遗漏了某些配置，因为我没有看到在领事命名空间中端口8500上运行的任何服务。

任何建议都将不胜感激。

谢谢，pooja