Docker部署HashiCorp Vault时执行appRole列表命令遇403权限拒绝

我是HashiCorp Vault新手，为学习搭建了docker-compose环境及相关配置，目的是在其他机器上运行时无需手动创建secrets和appRole。折腾两天未找到问题：运行docker-compose后进入容器执行/bin/sh docker-compose-configs/vault-config/init-vault.sh无异常，但执行vault list auth/approle/role时出现403错误：

/ # vault list auth/approle/role
Error listing auth/approle/role: Error making API request.

URL: GET http://127.0.0.1:8200/v1/auth/approle/role?list=true
Code: 403. Errors:

* permission denied

相关配置文件 #

Docker-compose配置 #

version: '3'

services:
  vault:
    image: vault:latest
    container_name: ticketflow-vault
    ports:
      - "8200:8200"
    environment:
      VAULT_DEV_ROOT_TOKEN_ID: ticketflow-token
      VAULT_DEV_LISTEN_ADDRESS: "0.0.0.0:8200"
      VAULT_ADDR: "http://127.0.0.1:8200"
    cap_add:
      - IPC_LOCK
    restart: always
    volumes:
      - vault-data:/vault/file
      - vault-logs:/vault/logs
      - ./vault-config:/docker-compose-configs/vault-config
volumes:
  vault-data:
  vault-logs:

config.hcl配置 #

storage "file" {
  path = "/vault/file"
}

listener "tcp" {
  address     = "0.0.0.0:8200"
  tls_disable = 1
}

ui = true
api_addr = "http://127.0.0.1:8200"

init-vault.sh脚本 #

#!/bin/sh

chmod +x /docker-compose-configs/vault-config/*.sh
/docker-compose-configs/vault-config/import-approle.sh
/docker-compose-configs/vault-config/import-secrets.sh

import-secrets.sh脚本 #

#!/bin/sh

export VAULT_ADDR='http://127.0.0.1:8200'
export VAULT_TOKEN='ticketflow-token'

while true; do
  vault_status=$(vault status -format=json)
  if echo "$vault_status" | grep -q '"sealed": false'; then
    break
  fi
  sleep 5
done

echo "Importing secrets..."
while read line; do
  key=$(echo $line | cut -d '=' -f 1)
  value=$(echo $line | cut -d '=' -f 2)
  echo "Importing secret: authentication.$key"
  vault kv put secret/ticketflow/development/authentication.$key value=$value
done < /docker-compose-configs/vault-config/secrets.txt

echo "Secrets imported successfully."

import-approle.sh脚本 #

#!/bin/sh

export VAULT_ADDR='http://127.0.0.1:8200'
export VAULT_TOKEN='ticketflow-token'

vault auth enable approle

vault policy write ticketflow -<<EOT
path "secret/ticketflow/development/*" {
  capabilities = ["read", "list"]
}
path "auth/approle/role/*" {
  capabilities = ["read", "list", "create", "update"]
}
path "sys/policies/acl/*" {
  capabilities = ["read"]
}
EOT

vault write auth/approle/role/ticketflow \
    token_policies="ticketflow" \
    token_ttl=1h \
    token_max_ttl=24h \
    secret_id_num_uses=0 \
    secret_id_ttl=0 \
    token_num_uses=0 \
    token_period=0

vault write auth/approle/role/ticketflow \
    token_policies="ticketflow" \
    token_ttl=1h \
    token_max_ttl=24h

vault read auth/approle/role/ticketflow/role-id
vault write -f auth/approle/role/ticketflow/secret-id

secrets.txt内容 #

client_secret=45edaa89-16cb-41e2-aee5-970ab971ee9c
client_id=Authentication-client
REALM=TicketFlow

问题排查与解决方案 #

1. 确认当前使用的Vault Token #

执行echo $VAULT_TOKEN，如果输出不是ticketflow-token，说明环境变量未正确设置。可手动导出：

export VAULT_TOKEN=ticketflow-token

或执行命令时直接指定token：

vault list auth/approle/role -token=ticketflow-token

2. 解决Dev模式与配置文件冲突 #

docker-compose中设置VAULT_DEV_ROOT_TOKEN_ID会让Vault以Dev模式启动，该模式会忽略大部分config.hcl配置（包括storage持久化），数据仅存于内存，容器重启后丢失。Dev模式下root token为ticketflow-token，但需确保执行命令时token正确加载。

3. 让容器自动执行初始化脚本 #

手动执行脚本可能遇到Vault未完全就绪的问题，修改docker-compose的command字段，让容器启动后自动完成初始化：

services:
  vault:
    # 其他配置不变
    command: sh -c "vault server -config=/docker-compose-configs/vault-config/config.hcl & sleep 10 && /docker-compose-configs/vault-config/init-vault.sh && tail -f /dev/null"

4. 修正config.hcl的api_addr #

容器内的api_addr应设置为0.0.0.0:8200，避免内部API调用异常：

api_addr = "http://0.0.0.0:8200"

5. 验证权限 #

执行以下命令确认当前token权限：

# 用root token查询role列表
vault list auth/approle/role -token=ticketflow-token
# 查看当前token详情
vault token lookup

如果vault token lookup返回的不是root token，说明需切换到root token后再执行操作。

内容的提问来源于stack exchange，提问作者paulo