vault-cluster | Ansible vault cluster Deploy

When you have set the Kubernetes auth into the vault you have used the

The way you interact with Vault is via HTTP(s) API. That means you need to expose the vault service running in your Vault-Cluster cluster using one of the usual methods.

As an example you could:

• use a service of type LoadBalancer (this works because you are running kubernetes in a cloud provider that supports this feature);
• install an ingress controller, expose it (again with a load balancer) and define an Ingress resource for your vault service.
• use a node port service

The EXTERNAL_VAULT_ADDR value depends on which strategy you want to use.

The messages are not about client certs or CA certs, a TLS handshake happens whether the client presents a certificate or not.

Instead, it is because a TCP connection is created and established and the Go library now wants to start a TLS handshake. Instead, the other side (the health checker) just hangs up and the TLS handshake never happens. Go then logs this message.

You are correct in saying that it is harmless, this is purely a side effect of port-liveness health checking. It is however spammy and annoying.

You have two basic options to get around this:

1. filter the messages out of the logs when persisting them
2. change to a different type of health check

I would recommend the second option: switch to a different health check. Vault has a /sys/health endpoint that can be used with HTTPS health checks.

In addition to getting rid of the TLS warning messages, the health endpoint also allows to you check for active and unsealed nodes.

That seems to be due to the expected format in yaml file for attribute caBundle. I couldn't find a documented schema for it. But, I found an example https://github.com/kubernetes/kubernetes/issues/61171. The caBundle seems to be taking a single line of string which is base64. I have tested this and it works for me.

It should work if you place entire base64 encoded file in one line and put it against caBundle. Refer to the link posted for an example.