<p>I have created a hashicorp vault deployment and configured kubernetes auth. The vault container calls kubernetes api internally from the pod to do k8s authentication, and that call is failing with 500 error code (connection refused). I am using docker for windows kubernetes.</p>

<p>I added the below config to vault for kubernetes auth mechanism.</p>

<p><strong>payload.json</strong></p>

<pre><code>{
    "kubernetes_host": "http://kubernetes",
    "kubernetes_ca_cert": &lt;k8s service account token&gt;
}
</code></pre>

<pre><code>curl --header "X-Vault-Token: &lt;vault root token&gt;" --request POST --data @payload.json http://127.0.0.1:8200/v1/auth/kubernetes/config
</code></pre>

<p>I got 204 response as expected.</p>

<p>And I created a role for kubernetes auth using which I am trying to login to vault:</p>

<p><strong>payload2.json</strong></p>

<pre><code>{
    "role": "tanmoy-role",
    "jwt": "&lt;k8s service account token&gt;"
}
</code></pre>

<pre><code>curl --request POST --data @payload2.json http://127.0.0.1:8200/v1/auth/kubernetes/login
</code></pre>

<p>The above curl is giving below response:</p>

<blockquote>
  <p>{"errors":["Post <a href="http://kubernetes/apis/authentication.k8s.io/v1/tokenreviews" rel="nofollow noreferrer">http://kubernetes/apis/authentication.k8s.io/v1/tokenreviews</a>: dial tcp 10.96.0.1:80: connect: connection refused"]}</p>
</blockquote>

<p>Below is my kubernetes service up and running properly and I can also access kubernetes dashboard by using proxy.</p>

<pre><code>NAME            TYPE           CLUSTER-IP      EXTERNAL-IP              PORT(S)                         AGE
kubernetes      ClusterIP      10.96.0.1       &lt;none&gt;                   443/TCP                         13d
</code></pre>

<p>I am not able to figure out why 'kubernetes' service is not accessible from inside the container. Any help would be greatly appreciated.</p>

<p><strong>Edit 1.</strong> My vault pod and service are working fine:</p>

<p><strong>service</strong></p>

<pre><code>NAME            TYPE           CLUSTER-IP      EXTERNAL-IP              PORT(S)                         AGE
vault-elb-int   LoadBalancer   10.104.197.76   localhost,192.168.0.10   8200:31650/TCP,8201:31206/TCP   26h
</code></pre>

<p><strong>Pod</strong></p>

<pre><code>NAME                     READY   STATUS    RESTARTS   AGE
vault-84c65db6c9-pj6zw   1/1     Running   0          21h
</code></pre>

<p><strong>Edit 2.</strong>
As John suggested, I changed the 'kubernetes_host' in payload.json to '<a href="https://kubernetes" rel="nofollow noreferrer">https://kubernetes</a>'. But now I am getting this error:</p>

<pre><code>{"errors":["Post https://kubernetes/apis/authentication.k8s.io/v1/tokenreviews: x509: certificate signed by unknown authority"]}
</code></pre>

<p>Your login request is being sent to the <code>tokenreview</code> endpoint on port 80.  I think this is because your <code>kubernetes_host</code> specifies a <code>http</code> URL.  The 500 response is because it's not listening on port 80, but on 443 instead (as you can see in your service list output).</p>

<p>Try changing to <code>https</code> when configuring the auth, i.e. </p>

<pre><code>payload.json

{
    "kubernetes_host": "https://kubernetes",
    "kubernetes_ca_cert": &lt;k8s service account token&gt;
}
</code></pre>
