在K8s集群部署带TLS的Vault时出现HTTPS客户端收HTTP响应错误

问题描述 #

按HashiCorp官方文档部署启用TLS的Standalone Vault到K8s集群后，vault-0 Pod无法就绪，状态如下：

kubectl get po -n vault
NAME                                   READY   STATUS    RESTARTS   AGE
vault-0                                0/1     Running   0          6m33s
vault-agent-injector-ffb558b4b-rhmvc   1/1     Running   0          6m41s

Pod事件日志显示：

Normal   Created         7m25s                   kubelet            Created container vault
Normal   Started         7m25s                   kubelet            Started container vault
Warning  Unhealthy       2m25s (x60 over 7m20s)  kubelet            Readiness probe failed: Error checking seal status: Get "https://127.0.0.1:8200/v1/sys/seal-status": http: server gave HTTP response to HTTPS client

使用的Vault Helm配置：

standalone:
    enabled: true
    config: |
      ui = true

      listener "tcp" {
        tls_disable = 0
        address = "[::]:8200"
        cluster_address = "[::]:8201"
        tls_cert_file = "/vault/userconfig/vault-server-tls/vault.crt"
        tls_key_file  = "/vault/userconfig/vault-server-tls/vault.key"
        tls_client_ca_file = "/vault/userconfig/vault-server-tls/vault.ca"
      }
      storage "file" {
        path = "/vault/data"
      }
  enabled: true

解决方案 #

核心问题 #

Vault Helm Chart的默认Readiness/Liveness探针使用HTTP协议访问，但你的Vault配置已启用TLS（监听HTTPS），导致探针请求HTTP到HTTPS端口，出现"HTTP response to HTTPS client"错误。

修改探针配置 #

在Helm values中覆盖默认探针，指定使用HTTPS协议，并根据证书情况配置证书验证：

standalone:
  enabled: true
  config: |
    ui = true

    listener "tcp" {
      tls_disable = 0
      address = "[::]:8200"
      cluster_address = "[::]:8201"
      tls_cert_file = "/vault/userconfig/vault-server-tls/vault.crt"
      tls_key_file  = "/vault/userconfig/vault-server-tls/vault.key"
      tls_client_ca_file = "/vault/userconfig/vault-server-tls/vault.ca"
    }
    storage "file" {
      path = "/vault/data"
    }
  # 覆盖Readiness探针
  readinessProbe:
    httpGet:
      path: "/v1/sys/seal-status"
      port: 8200
      scheme: HTTPS
      tlsConfig:
        insecureSkipVerify: true # 自签证书需开启，若使用可信CA可移除并配置caFile
    initialDelaySeconds: 5
    periodSeconds: 5
    failureThreshold: 2
  # 覆盖Liveness探针
  livenessProbe:
    httpGet:
      path: "/v1/sys/seal-status"
      port: 8200
      scheme: HTTPS
      tlsConfig:
        insecureSkipVerify: true
    initialDelaySeconds: 5
    periodSeconds: 5
enabled: true

额外检查点 #

1. 验证证书挂载：确认证书Secret已正确挂载到/vault/userconfig/vault-server-tls/路径，可通过kubectl exec vault-0 -n vault -- ls /vault/userconfig/vault-server-tls检查文件是否存在。
2. 查看Vault启动日志：执行kubectl logs vault-0 -n vault，确认Vault启动时是否有证书加载失败的错误（如文件不存在、权限问题）。

内容的提问来源于stack exchange，提问作者Ajay Gupta