配置基于Raft与Transit自动解封的Vault HA集群遇TLS问题求助

问题描述 #

我参考文档搭建基于Raft后端的Vault集群，无TLS时可正常运行，但启用TLS后出现节点加入失败的问题。Transit引擎与第一个Raft节点配置正常，添加集群第二个节点（即第三个节点）时出现以下错误：

2022-07-21T11:08:41.407Z [INFO]  core: stored unseal keys supported, attempting fetch
2022-07-21T11:08:41.407Z [WARN]  failed to unseal core: error="stored unseal keys are supported, but none were found"
2022-07-21T11:08:41.407Z [INFO]  core: security barrier not initialized
2022-07-21T11:08:41.408Z [INFO]  core: attempting to join possible raft leader node: leader_addr=https://10.20.30.42:8200
2022-07-21T11:08:41.462Z [WARN]  core: join attempt failed: error="error during raft bootstrap init call: Put \"https://10.20.30.42:8200/v1/sys/storage/raft/bootstrap/challenge\": x509: certificate signed by unknown authority"
2022-07-21T11:08:41.462Z [INFO]  core: security barrier not initialized
2022-07-21T11:08:41.462Z [INFO]  core: attempting to join possible raft leader node: leader_addr=https://10.20.30.43:8200
2022-07-21T11:08:41.477Z [WARN]  core: join attempt failed: error="error during raft bootstrap init call: Put \"https://10.20.30.43:8200/v1/sys/storage/raft/bootstrap/challenge\": x509: certificate signed by unknown authority"
2022-07-21T11:08:41.477Z [ERROR] core: failed to retry join raft cluster: retry=2s
2022-07-21T11:08:41.477Z [INFO]  http: TLS handshake error from 172.17.0.1:56062: remote error: tls: bad certificate
2022-07-21T11:08:43.477Z [INFO]  core: security barrier not initialized

原本以为设置VAULT_CACERT环境变量指定正确证书路径即可解决x509证书未知颁发机构错误，该方法在初始节点配置时有效，但在加入集群时失效，请问还缺少哪些配置步骤？

解决步骤 #

1. 在节点配置文件中明确Raft通信的CA证书路径 #

仅依赖VAULT_CACERT环境变量无法覆盖Raft节点间内部通信的证书验证，必须在Vault配置文件（如vault.hcl）的storage "raft"块中指定CA证书：

listener "tcp" {
  address = "0.0.0.0:8200"
  tls_cert_file = "/path/to/your-node-cert.pem"
  tls_key_file = "/path/to/your-node-key.pem"
  tls_client_ca_file = "/path/to/ca-cert.pem" # 用于验证客户端及其他节点的证书
}

storage "raft" {
  path = "/path/to/raft/data"
  retry_join {
    leader_api_addr = "https://10.20.30.42:8200"
    tls_ca_cert_file = "/path/to/ca-cert.pem" # 关键：指定验证Leader证书的CA文件
  }
  retry_join {
    leader_api_addr = "https://10.20.30.43:8200"
    tls_ca_cert_file = "/path/to/ca-cert.pem"
  }
}

每个retry_join块中的tls_ca_cert_file是Raft节点间信任证书的核心配置，环境变量不会自动填充此处参数。

2. 确保所有节点证书包含正确的SAN字段 #

错误日志中的tls: bad certificate提示证书的Subject Alternative Name（SAN）未包含节点的IP或域名。生成证书时，必须为每个节点添加对应的IP和域名到SAN中，示例OpenSSL配置片段：

[v3_req]
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
subjectAltName = @alt_names

[alt_names]
IP.1 = 10.20.30.42
IP.2 = 10.20.30.43
IP.3 = 新节点的IP地址
DNS.1 = vault-node1.example.com
DNS.2 = vault-node2.example.com
DNS.3 = vault-node3.example.com

重新生成所有节点的证书，确保SAN覆盖节点的所有标识。

3. 启动节点时确保环境变量与配置文件一致 #

启动新节点前，确认环境变量正确设置，且与配置文件路径匹配：

export VAULT_ADDR="https://新节点IP:8200"
export VAULT_CACERT="/path/to/ca-cert.pem"
vault server -config=vault.hcl

4. 验证证书信任链 #

在新节点上先测试与Leader节点的证书信任，确保通信正常：

curl --cacert /path/to/ca-cert.pem https://10.20.30.42:8200/v1/sys/health

若返回正常的健康状态，再执行集群加入操作。

内容的提问来源于stack exchange，提问作者charlietaylor