<p>Currently having a problem where the readiness probe is failing when deploying the Vault Helm chart. Vault is working but whenever I describe the pods get this error. How do I get the probe to use HTTPS instead of HTTP if anyone knows how to solve this I would be great as losing my mind slowly?</p>
<p>Kubectl Describe pod</p>
<pre class="lang-yaml prettyprint-override"><code>Name:         vault-0
Namespace:    default
Priority:     0
Node:         ip-192-168-221-250.eu-west-2.compute.internal/192.168.221.250
Start Time:   Mon, 24 Aug 2020 16:41:59 +0100
Labels:       app.kubernetes.io/instance=vault
              app.kubernetes.io/name=vault
              component=server
              controller-revision-hash=vault-768cd675b9
              helm.sh/chart=vault-0.6.0
              statefulset.kubernetes.io/pod-name=vault-0
Annotations:  kubernetes.io/psp: eks.privileged
Status:       Running
IP:           192.168.221.251
IPs:
  IP:           192.168.221.251
Controlled By:  StatefulSet/vault
Containers:
  vault:
    Container ID:  docker://445d7cdc34cd01ef1d3a46f2d235cb20a94e48279db3fcdd84014d607af2fe1c
    Image:         vault:1.4.2
    Image ID:      docker-pullable://vault@sha256:12587718b79dc5aff542c410d0bcb97e7fa08a6b4a8d142c74464a9df0c76d4f
    Ports:         8200/TCP, 8201/TCP, 8202/TCP
    Host Ports:    0/TCP, 0/TCP, 0/TCP
    Command:
      /bin/sh
      -ec
    Args:
      sed -E &quot;s/HOST_IP/${HOST_IP?}/g&quot; /vault/config/extraconfig-from-values.hcl &gt; /tmp/storageconfig.hcl;
      sed -Ei &quot;s/POD_IP/${POD_IP?}/g&quot; /tmp/storageconfig.hcl;
      /usr/local/bin/docker-entrypoint.sh vault server -config=/tmp/storageconfig.hcl

    State:          Running
      Started:      Mon, 24 Aug 2020 16:42:00 +0100
    Ready:          False
    Restart Count:  0
    Readiness:      exec [/bin/sh -ec vault status -tls-skip-verify] delay=5s timeout=5s period=3s #success=1 #failure=2
    Environment:
      HOST_IP:               (v1:status.hostIP)
      POD_IP:                (v1:status.podIP)
      VAULT_K8S_POD_NAME:   vault-0 (v1:metadata.name)
      VAULT_K8S_NAMESPACE:  default (v1:metadata.namespace)
      VAULT_ADDR:           http://127.0.0.1:8200
      VAULT_API_ADDR:       http://$(POD_IP):8200
      SKIP_CHOWN:           true
      SKIP_SETCAP:          true
      HOSTNAME:             vault-0 (v1:metadata.name)
      VAULT_CLUSTER_ADDR:   https://$(HOSTNAME).vault-internal:8201
      HOME:                 /home/vault
      VAULT_CACERT:         /vault/userconfig/vault-server-tls/vault.ca
    Mounts:
      /home/vault from home (rw)
      /var/run/secrets/kubernetes.io/serviceaccount from vault-token-cv9vx (ro)
      /vault/config from config (rw)
      /vault/userconfig/vault-server-tls from userconfig-vault-server-tls (ro)
Conditions:
  Type              Status
  Initialized       True
  Ready             False
  ContainersReady   False
  PodScheduled      True
Volumes:
  config:
    Type:      ConfigMap (a volume populated by a ConfigMap)
    Name:      vault-config
    Optional:  false
  userconfig-vault-server-tls:
    Type:        Secret (a volume populated by a Secret)
    SecretName:  vault-server-tls
    Optional:    false
  home:
    Type:       EmptyDir (a temporary directory that shares a pod's lifetime)
    Medium:
    SizeLimit:  &lt;unset&gt;
  vault-token-cv9vx:
    Type:        Secret (a volume populated by a Secret)
    SecretName:  vault-token-cv9vx
    Optional:    false
QoS Class:       BestEffort
Node-Selectors:  &lt;none&gt;
Tolerations:     node.kubernetes.io/not-ready:NoExecute for 300s
                 node.kubernetes.io/unreachable:NoExecute for 300s
Events:
  Type     Reason     Age   From                                                    Message
  ----     ------     ----  ----                                                    -------
  Normal   Scheduled  7s    default-scheduler                                       Successfully assigned default/vault-0 to ip-192-168-221-250.eu-west-2.compute.internal
  Normal   Pulled     6s    kubelet, ip-192-168-221-250.eu-west-2.compute.internal  Container image &quot;vault:1.4.2&quot; already present on machine
  Normal   Created    6s    kubelet, ip-192-168-221-250.eu-west-2.compute.internal  Created container vault
  Normal   Started    6s    kubelet, ip-192-168-221-250.eu-west-2.compute.internal  Started container vault
  Warning  Unhealthy  0s    kubelet, ip-192-168-221-250.eu-west-2.compute.internal  Readiness probe failed: Error checking seal status: Error making API request.

URL: GET http://127.0.0.1:8200/v1/sys/seal-status
Code: 400. Raw Message:

Client sent an HTTP request to an HTTPS server.
</code></pre>
<p>Vault Config File</p>
<pre class="lang-yaml prettyprint-override"><code># global:
#   tlsDisable: false

injector:
  enabled: false

server:
  extraEnvironmentVars:
    VAULT_CACERT: /vault/userconfig/vault-server-tls/vault.ca

  extraVolumes:
  - type: secret
    name: vault-server-tls # Matches the ${SECRET_NAME} from above
  affinity: &quot;&quot;
  readinessProbe:
    enabled: true
    path: /v1/sys/health
  # # livelinessProbe:
  # #   enabled: true
  # #   path: /v1/sys/health?standbyok=true
  # #   initialDelaySeconds: 60
  ha:
    enabled: true

    config: |
      ui = true

      api_addr = &quot;https://127.0.0.1:8200&quot; # Unsure if this is correct

      storage &quot;dynamodb&quot; {
        ha_enabled = &quot;true&quot;
        region     = &quot;eu-west-2&quot;
        table      = &quot;global-vault-data&quot;
        access_key = &quot;KEY&quot;
        secret_key = &quot;SECRET&quot;
      }

      # listener &quot;tcp&quot; {
      #     address = &quot;0.0.0.0:8200&quot;
      #     tls_disable = &quot;true&quot;
      # }

      listener &quot;tcp&quot; {
        address = &quot;0.0.0.0:8200&quot;
        cluster_address = &quot;0.0.0.0:8201&quot;
        tls_cert_file = &quot;/vault/userconfig/vault-server-tls/vault.crt&quot;
        tls_key_file  = &quot;/vault/userconfig/vault-server-tls/vault.key&quot;
        tls_client_ca_file = &quot;/vault/userconfig/vault-server-tls/vault.ca&quot;
      }

      seal &quot;awskms&quot; {
        region     = &quot;eu-west-2&quot;
        access_key = &quot;KEY&quot;
        secret_key = &quot;SECRET&quot;
        kms_key_id = &quot;ID&quot;
      }
ui:
  enabled: true
  serviceType: LoadBalancer
</code></pre>

<p>In your environment variable definitions you have:</p>
<pre class="lang-yaml prettyprint-override"><code>VAULT_ADDR:           http://127.0.0.1:8200
</code></pre>
<p>And non TLS is diable on your Vault configs (TLS enabled):</p>
<pre><code>      listener &quot;tcp&quot; {
        address = &quot;0.0.0.0:8200&quot;
        cluster_address = &quot;0.0.0.0:8201&quot;
        tls_cert_file = &quot;/vault/userconfig/vault-server-tls/vault.crt&quot;
        tls_key_file  = &quot;/vault/userconfig/vault-server-tls/vault.key&quot;
        tls_client_ca_file = &quot;/vault/userconfig/vault-server-tls/vault.ca&quot;
      }
</code></pre>
<p>And your Readiness probe is executing in the pod:</p>
<pre class="lang-sh prettyprint-override"><code>vault status -tls-skip-verify
</code></pre>
<p>So that's trying to connect to <code>http://127.0.0.1:8200</code>, you can try changing the environment variable to use HTTPS: <em><code>VAULT_ADDR=https://127.0.0.1:8200</code></em></p>
<p>You may have another (different) issue with your configs and env variable not matching:</p>
<p>K8s manifest:</p>
<pre><code>VAULT_API_ADDR:       http://$(POD_IP):8200
</code></pre>
<p>Vault configs:</p>
<pre><code>api_addr = &quot;https://127.0.0.1:8200&quot;
</code></pre>
<p>✌️</p>
