{"action":"created","issue":{"url":"https://api.github.com/repos/Boostport/kubernetes-vault/issues/126","repository_url":"https://api.github.com/repos/Boostport/kubernetes-vault","labels_url":"https://api.github.com/repos/Boostport/kubernetes-vault/issues/126/labels{/name}","comments_url":"https://api.github.com/repos/Boostport/kubernetes-vault/issues/126/comments","events_url":"https://api.github.com/repos/Boostport/kubernetes-vault/issues/126/events","html_url":"https://github.com/Boostport/kubernetes-vault/issues/126","id":336933966,"node_id":"MDU6SXNzdWUzMzY5MzM5NjY=","number":126,"title":"Could not create the vault client: validate certificate doesn't contain any IP SANs","user":{"login":"Mar4eli","id":7045770,"node_id":"MDQ6VXNlcjcwNDU3NzA=","avatar_url":"https://avatars2.githubusercontent.com/u/7045770?v=4","gravatar_id":"","url":"https://api.github.com/users/Mar4eli","html_url":"https://github.com/Mar4eli","followers_url":"https://api.github.com/users/Mar4eli/followers","following_url":"https://api.github.com/users/Mar4eli/following{/other_user}","gists_url":"https://api.github.com/users/Mar4eli/gists{/gist_id}","starred_url":"https://api.github.com/users/Mar4eli/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Mar4eli/subscriptions","organizations_url":"https://api.github.com/users/Mar4eli/orgs","repos_url":"https://api.github.com/users/Mar4eli/repos","events_url":"https://api.github.com/users/Mar4eli/events{/privacy}","received_events_url":"https://api.github.com/users/Mar4eli/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":10,"created_at":"2018-06-29T09:45:08Z","updated_at":"2018-06-30T02:49:30Z","closed_at":null,"author_association":"NONE","body":"Good day!\r\n\r\nFirst of all, thank you for project. We have tested it via quick start guide and in love with its potential.\r\n\r\nI'm trying to befriend your project with our vault cluster and experince error, that can't fix.\r\n\r\nWe have vault cluster with 3 nodes joined by consul. They have additional vault_cluster_ip to communicate with current cluster leader. Vault cluster using https.\r\n\r\nI have reproduced steps from guick start guide on our vault cluster and generated certificates. All certificates i leave on vault nodes.\r\n\r\nFrom kubernetes host node i can get token via curl\r\n```\r\ncurl -k -H \"X-Vault-Token:  a2c939a0-875c-da10-8d2b-92aa22e45f64\"  https://10.10.254.236:8200/v1/auth/token/lookup-self\r\n```\r\n\r\nI deploy kubernetes-vault pods and they are crashing. with message:\r\n```\r\ntime=\"2018-06-29T09:39:26Z\" level=debug msg=\"Discovered 0 nodes: []\"\r\ntime=\"2018-06-29T09:39:27Z\" level=fatal msg=\"Could not create the vault client: error parsing supplied token: failed to lookup Vault periodic token: Get https://10.10.254.249:8200/v1/auth/token/lookup-self: x509: cannot validate certificate for 10.10.254.249 because it doesn't contain any IP SANs\r\n```\r\n\r\nI'm using yor kubernetes-vault.yaml file, but change configmap for kubernetes-vault. Right now it looks like this:\r\n```\r\n---\r\napiVersion: v1\r\nkind: ConfigMap\r\nmetadata:\r\n  name: kubernetes-vault\r\ndata:\r\n  kubernetes-vault.yml: |-\r\n    vault:\r\n      addr: https://vault_cluster_ip:8200\r\n      token: a2c939a0-875c-da10-8d2b-92aa22e45f64\r\n      tls:\r\n        vaultCABackends:    \r\n          - root-ca\r\n    kubernetes:\r\n      watchNamespace: ${KUBERNETES_NAMESPACE}\r\n      serviceNamespace: ${KUBERNETES_NAMESPACE}\r\n      service: kubernetes-vault\r\n    prometheus:\r\n      tls:\r\n        vaultCertBackend: intermediate-ca\r\n        vaultCertRole: kubernetes-vault\r\n        vaultCABackends:\r\n          - root-ca\r\n```\r\ni have tried several configurations for vaultCABackends, nothing seems to work.\r\n\r\nI'm noob with certificates, but it seems strange for me that curl working and kubernetes-vault not. can you please tell me, what am i doing wrong?"},"comment":{"url":"https://api.github.com/repos/Boostport/kubernetes-vault/issues/comments/401512315","html_url":"https://github.com/Boostport/kubernetes-vault/issues/126#issuecomment-401512315","issue_url":"https://api.github.com/repos/Boostport/kubernetes-vault/issues/126","id":401512315,"node_id":"MDEyOklzc3VlQ29tbWVudDQwMTUxMjMxNQ==","user":{"login":"F21","id":2263040,"node_id":"MDQ6VXNlcjIyNjMwNDA=","avatar_url":"https://avatars0.githubusercontent.com/u/2263040?v=4","gravatar_id":"","url":"https://api.github.com/users/F21","html_url":"https://github.com/F21","followers_url":"https://api.github.com/users/F21/followers","following_url":"https://api.github.com/users/F21/following{/other_user}","gists_url":"https://api.github.com/users/F21/gists{/gist_id}","starred_url":"https://api.github.com/users/F21/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/F21/subscriptions","organizations_url":"https://api.github.com/users/F21/orgs","repos_url":"https://api.github.com/users/F21/repos","events_url":"https://api.github.com/users/F21/events{/privacy}","received_events_url":"https://api.github.com/users/F21/received_events","type":"User","site_admin":false},"created_at":"2018-06-30T02:49:30Z","updated_at":"2018-06-30T02:49:30Z","author_association":"MEMBER","body":"I think the problem is that you're setting the IP SANs on the immediate CA.\r\n\r\nTo issue certificates for your Vault instance, you should ask the intermediate-ca to issue them via this endpoint: https://10.10.254.249:8200/v1/intermediate-ca/issue/$name_of_role\r\n\r\nWhen issuing a certificate using that endpoint, ensure you include the `ip_sans`. Once the certificates are issued, make sure you restart your Vault instances, so that the new certificates are applied."}}
{"actor":{"display_login":"F21"}}