Vault cannot authorize approle
Hey Team, I'm working with charmed openstack and it looks like I let my certs expire stupidly... and now I'm seeing this from vault: Vault cannot authorize approle Further info from the logs indicate this: unit-vault-0: 08:42:04 WARNING unit.vault/0.juju-log InternalServerError: Unable to authorize approle. This may indicate failure to communicate with the database unit-vault-0: 08:42:04 ERROR unit.vault/0.juju-log Traceback (most recent call last): File "/var/lib/juju/agents/unit-vault- 0/charm/reactive/vault_handlers.py", line 896, in client_approle_authorized vault.get_local_client() File "/var/lib/juju/agents/unit-vault-0/.venv/lib/python3.10/site- packages/tenacity/__init__.py", line 339, in wrapped_f return self(f, *args, **kw) File "/var/lib/juju/agents/unit-vault-0/.venv/lib/python3.10/site- packages/tenacity/__init__.py", line 430, in __call__ do = self.iter(retry_state=retry_state) File "/var/lib/juju/agents/unit-vault-0/.venv/lib/python3.10/site- packages/tenacity/__init__.py", line 378, in iter raise retry_exc.reraise() File "/var/lib/juju/agents/unit-vault-0/.venv/lib/python3.10/site- packages/tenacity/__init__.py", line 206, in reraise raise self.last_attempt.result() File "/usr/lib/python3.10/concurrent/futures/_base.py", line 451, in result return self.__get_result() File "/usr/lib/python3.10/concurrent/futures/_base.py", line 403, in __get_result raise self._exception File "/var/lib/juju/agents/unit-vault-0/.venv/lib/python3.10/site- packages/tenacity/__init__.py", line 433, in __call__ result = fn(*args, **kwargs) File "/var/lib/juju/agents/unit-vault-0/charm/lib/charm/vault.py", line 258, in get_local_client client.auth_approle(app_role_id) File "/var/lib/juju/agents/unit-vault-0/.venv/lib/python3.10/site- packages/hvac/v1/__init__.py", line 2072, in auth_approle return self.auth('/v1/auth/{0}/login'.format(mount_point), json=params, use_token=use_token) File "/var/lib/juju/agents/unit-vault-0/.venv/lib/python3.10/site- packages/hvac/v1/__init__.py", line 1726, in auth return self._adapter.auth( File "/var/lib/juju/agents/unit-vault-0/.venv/lib/python3.10/site- packages/hvac/adapters.py", line 159, in auth response = self.post(url, **kwargs).json() File "/var/lib/juju/agents/unit-vault-0/.venv/lib/python3.10/site- packages/hvac/adapters.py", line 103, in post return self.request('post', url, **kwargs) File "/var/lib/juju/agents/unit-vault-0/.venv/lib/python3.10/site- packages/hvac/adapters.py", line 233, in request utils.raise_for_error(response.status_code, text, errors=errors) File "/var/lib/juju/agents/unit-vault-0/.venv/lib/python3.10/site- packages/hvac/utils.py", line 39, in raise_for_error raise exceptions.InternalServerError(message, errors=errors) hvac.exceptions.InternalServerError: internal error The database seems to be up and accessible... so, I gotta believe it's a cert issue... so, I feel like this might be a chicken-egg issue where it can't connect to the DB due to certs... but then can't issue certs because it can't connect to the DB. Any thoughts? ----- Andy Speagle
Well... the plot thickens here... my vault is fully sealed now and with the certs expired, I can seem to find a way to unseal it in order to get the certs replaced. Is there anything to be done here? -- Andy Speagle
Hi Andy, Can’t you unseal your vault using the official procedure from the Vault page [1]? The full concept is described here [2]. /Jan Wasilewski [1] https://developer.hashicorp.com/vault/tutorials/getting-started/getting-star... [2] https://developer.hashicorp.com/vault/docs/concepts/seal pt., 13 gru 2024 o 23:51 Andy Speagle <aspeagle@toyon.com> napisał(a):
Well... the plot thickens here... my vault is fully sealed now and with the certs expired, I can seem to find a way to unseal it in order to get the certs replaced.
Is there anything to be done here?
-- Andy Speagle
On Mon, 2024-12-16 at 09:49 +0100, Jan Wasilewski wrote:
Hi Andy,
Can’t you unseal your vault using the official procedure from the Vault page [1]? The full concept is described here [2].
/Jan Wasilewski
[1] https://developer.hashicorp.com/vault/tutorials/getting-started/getti ng-started-deploy#seal-unseal [2] https://developer.hashicorp.com/vault/docs/concepts/seal
Actually, no... this is part of my charmed openstack environment. I stupidly let the certs expire... and now I get this: Error unsealing: Error making API request. URL: PUT http://127.0.0.1:8200/v1/sys/unseal Code: 500. Errors: * failed to check seal configuration: x509: certificate has expired or is not yet valid: current time 2024-12-16T19:51:48Z is after 2024-12- 04T20:22:24Z I'm really not sure what cert it's complaining about... locally, the vault cli client doesn't connect via TLS... so, it must be taking about a cert for the mysql backend that vault's using... but, I can't seem to figure out how to get vault to ignore ANY and ALL certs to move forward on this.
pt., 13 gru 2024 o 23:51 Andy Speagle <aspeagle@toyon.com> napisał(a):
Well... the plot thickens here... my vault is fully sealed now and with the certs expired, I can seem to find a way to unseal it in order to get the certs replaced.
Is there anything to be done here?
-- Andy Speagle Sr. Site Reliability Engineer Toyon Research Corporation 316.617.2431
Hi Andy, have you tried to replace your expired certificates [1]? This way you should solve your issue. /Jan Wasilewski [1] https://support.hashicorp.com/hc/en-us/articles/4417759906835-Replacing-the-... pon., 16 gru 2024 o 20:57 Andy Speagle <aspeagle@toyon.com> napisał(a):
On Mon, 2024-12-16 at 09:49 +0100, Jan Wasilewski wrote:
Hi Andy,
Can’t you unseal your vault using the official procedure from the Vault page [1]? The full concept is described here [2].
/Jan Wasilewski
[1] https://developer.hashicorp.com/vault/tutorials/getting-started/getti ng-started-deploy#seal-unseal [2] https://developer.hashicorp.com/vault/docs/concepts/seal
Actually, no... this is part of my charmed openstack environment. I stupidly let the certs expire... and now I get this:
Error unsealing: Error making API request.
URL: PUT http://127.0.0.1:8200/v1/sys/unseal Code: 500. Errors:
* failed to check seal configuration: x509: certificate has expired or is not yet valid: current time 2024-12-16T19:51:48Z is after 2024-12- 04T20:22:24Z
I'm really not sure what cert it's complaining about... locally, the vault cli client doesn't connect via TLS... so, it must be taking about a cert for the mysql backend that vault's using... but, I can't seem to figure out how to get vault to ignore ANY and ALL certs to move forward on this.
pt., 13 gru 2024 o 23:51 Andy Speagle <aspeagle@toyon.com> napisał(a):
Well... the plot thickens here... my vault is fully sealed now and with the certs expired, I can seem to find a way to unseal it in order to get the certs replaced.
Is there anything to be done here?
-- Andy Speagle Sr. Site Reliability Engineer Toyon Research Corporation 316.617.2431
participants (2)
-
Andy Speagle
-
Jan Wasilewski