Kubernetes部署PostgreSQL时HashiCorp Vault连接拒绝问题求助

环境与配置背景 #

我在Kubernetes部署HashiCorp Vault用于存储JWT、数据库密码等敏感信息，已完成基础配置。相关资源配置如下：

ServiceAccount与SecretProviderClass配置 #

kind: ServiceAccount
apiVersion: v1
metadata:
  name: application-sa
  namespace: application-dev
---
apiVersion: secrets-store.csi.x-k8s.io/v1
kind: SecretProviderClass
metadata:
  name: application-vault-database
  namespace: application-dev
spec:
  provider: vault
  secretObjects:
    - data:
        - key: password
          objectName: db-password
      secretName: dbpass
      type: Opaque
  parameters:
    vaultAddress: "https://127.0.0.1:8200"
    roleName: "database"
    objects: |
      - objectName: "db-password"
        secretPath: "secret/data/db-pass"
        secretKey: "password"

PostgreSQL部署配置 #

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: application-postgresql-pvc
  namespace: application-dev
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 2Gi
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: application-postgresql
  namespace: application-dev
spec:
  replicas: 1
  selector:
    matchLabels:
      app: application-postgresql
  template:
    metadata:
      labels:
        app: application-postgresql
    spec:
      serviceAccountName: application-sa
      volumes:
        - name: data
          persistentVolumeClaim:
            claimName: application-postgresql-pvc
        - name: secrets-store-inline
          csi:
            driver: secrets-store.csi.k8s.io
            readOnly: true
            volumeAttributes:
              secretProviderClass: "application-vault-database"
      containers:
        - name: postgres
          image: postgres:14.5
          env:
            - name: POSTGRES_USER
              value: application
            - name: POSTGRES_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: dbpass
                  key: password
          ports:
            - containerPort: 5432
          volumeMounts:
            - name: secrets-store-inline
              mountPath: "/mnt/secrets-store"
              readOnly: true
            - name: data
              mountPath: /var/lib/postgresql/data
              subPath: postgres
          resources:
            requests:
              memory: '512Mi'
              cpu: '500m'
            limits:
              memory: '1Gi'
              cpu: '1'
---
apiVersion: v1
kind: Service
metadata:
  name: application-postgresql
  namespace: application-dev
spec:
  selector:
    app: application-postgresql
  ports:
    - port: 5432

错误现象 #

启动数据库Pod时出现CSI卷挂载失败，报错信息如下：

MountVolume.SetUp failed for volume "secrets-store-inline" : rpc error: code = Unknown desc = failed to mount secrets store objects for pod application-dev/application-postgresql-7db74cf6b-8b2q4, err: rpc error: code = Unknown desc = error making mount request: couldn't read secret "db-password": failed to login: Post "https://127.0.0.1:8200/v1/auth/kubernetes/login": dial tcp 127.0.0.1:8200: connect: connection refused

已尝试的操作 #

• 修改Vault的Kubernetes认证配置，将kubernetes_host替换为集群外部API地址：

  vault write auth/kubernetes/config \
      kubernetes_host="https://xxx.api.k8s.fr-par.scw.cloud:6443"
  

  原配置使用的是$KUBERNETES_PORT_443_TCP_ADDR（值为10.32.0.1）。
• 将SecretProviderClass中的vaultAddress改为http://vault.default:8200，但出现域名解析错误：

  Post "http://vault.default:8200/v1/auth/kubernetes/login": dial tcp: lookup vault.default on 10.32.0.10:53: no such host
  

请求帮助 #

我猜测原配置中https://127.0.0.1:8200地址正确，但Kubernetes认证存在问题，求排查思路。

内容的提问来源于stack exchange，提问作者Benjamin Barbé