Hello,

I tried to walk through demo on my on-premise k8s cluster. Everything went fine until checking secrets in patched static-secrets directory:

kubectl exec -ti $( kubectl get pods -n app --field-selector=status.phase==Running -o jsonpath='{.items[0].metadata.name}' ) -n app -c app -- ls /vault/secrets

ls: /vault/secrets: No such file or directory
command terminated with exit code 1

There is no container on the pod besides the jodonnellhashi/static-secrets-app:1.0.0:

kubectl get pods -n app -o jsonpath="{.items[*].spec.containers[*].image}"
jodonnellhashi/static-secrets-app:1.0.0

How to debug this issue?

Thanks for this demo repo!

I am facing some issues when automating the post-start tasks via k8s.

When I execute the following manually after pod creation, everything works

OUTPUT=/tmp/output.txt
export VAULT_ADDR=https://127.0.0.1:8200
export VAULT_SKIP_VERIFY=true

vault operator init >>${OUTPUT?}

unseal=$(cat ${OUTPUT?} | grep "Recovery Key 1:" | sed -e "s/Recovery Key 1: //g")
root=$(cat ${OUTPUT?} | grep "Initial Root Token:" | sed -e "s/Initial Root Token: //g")

[...]

However, when using postStart:, pods error right from the start (in the vault operator init call it seems):

 Warning  FailedPostStartHook  17m                kubelet            Exec lifecycle hook ([/bin/sh -c sleep 5 && cp /vault/userconfig/demo-vault/bootstrap.sh /tmp/bootstrap.sh && chmod +x /tmp/bootstrap.sh && /tmp/bootstrap.sh]) for Container "vault" in Pod "vault-0_vault(a37cdea2-9b4c-4b78-81e6-dd61db6e0e72)" failed - error: command '/bin/sh -c sleep 5 && cp /vault/userconfig/demo-vault/bootstrap.sh /tmp/bootstrap.sh && chmod +x /tmp/bootstrap.sh && /tmp/bootstrap.sh' exited with 2: Error initializing: Put "https://127.0.0.1:8200/v1/sys/init": dial tcp 127.0.0.1:8200: connect: connection refused

PS: I needed to change "Unseal" to "Recovery", I guess the naming has changed in the recent vault releases (using 1.8.3 atm).
I already added a sleep delay of 30s (instead of 5s) without success.

Thanks for this example repo!

When deploying in HA mode, multiple pods start at the same time and try to execute the bootstrap script.
One pod will be the fastest and the others will error and state "Vault has already been initialized" and will enter a reboot loop.
How does it work for this repo, for which HA mode seems off but still three replicas are being used judging from the default helm chart values.

Hi Jason,
I could deploy the solution to a minikube one-node cluster
$ kubectl -n vault get pods
NAME READY STATUS RESTARTS AGE
vault-0 1/1 Running 0 48m
vault-agent-injector-7dcf474d9b-hwpl5 1/1 Running 0 49m

However, I experienced the "x509: certificate signed by unknown authority" error

$ kubectl -n vault exec -it vault-0 -- vault status
Error checking seal status: Get https://127.0.0.1:8200/v1/sys/seal-status: x509: certificate signed by unknown authority
command terminated with exit code 1

I have been across this error before?

Thank you,
Philip