<p>I'm running Vault cluster in my Kubernetes cluster (AWS EKS). It seems to be working. I've initialized and unsealed it. When I'm trying to use UI via <code>kubectl port-forward service/vault 8200:8200</code> and enter it through <code>https://localhost:8200</code> it says that <code>Client sent an HTTP request to an HTTPS server.</code> When inspecting vault pods logs I'm getting: <code>http: TLS handshake error from 127.0.0.1:38678: remote error: tls: unknown certificate</code>. Could you help me with that one?</p>
<p>My Vault config:</p>
<pre><code>resource &quot;helm_release&quot; &quot;vault&quot; {
  name       = &quot;vault&quot;
  namespace  = kubernetes_namespace.vault.id
  chart      = &quot;vault&quot;
  repository = &quot;https://helm.releases.hashicorp.com&quot;
  version    = &quot;0.22.0&quot;

  values = [
    &lt;&lt;EOF
global:
  tlsDisable: false
ui:
  enabled: true
server:
  extraEnvironmentVars:
    VAULT_CACERT: /vault/userconfig/vault-server-tls/vault.ca
  extraVolumes:
    - type: secret
      name: vault-server-tls
  nodeSelector: |
    eks.amazonaws.com/nodegroup: &quot;vault-${var.environment}&quot;
  tolerations:
    - key: &quot;nodegroup&quot;
      operator: &quot;Equal&quot;
      value: &quot;vault&quot;
      effect: &quot;NoSchedule&quot;
  logLevel: &quot;debug&quot;
  ha:
    enabled: true
    nodes: 3
    raft:
      enabled: true
      setNodeId: true
      config: |
        ui = true

        listener &quot;tcp&quot; {
          tls_disable = 0
          tls_cert_file = &quot;/vault/userconfig/vault-server-tls/vault.crt&quot;
          tls_key_file  = &quot;/vault/userconfig/vault-server-tls/vault.key&quot;
          tls_client_ca_file = &quot;/vault/userconfig/vault-server-tls/vault.ca&quot;
          address = &quot;[::]:8200&quot;
          cluster_address = &quot;[::]:8201&quot;
        }

        storage &quot;raft&quot; {
          path    = &quot;/vault/data&quot;
        }

        service_registration &quot;kubernetes&quot; {}

        seal &quot;awskms&quot; {
          region     = &quot;${var.aws_region}&quot;
          kms_key_id = &quot;${aws_kms_key.vault.key_id}&quot;
        }
EOF
    ,
  ]
}
</code></pre>
<p>The script I'm generating certs with:</p>
<pre><code>#!/bin/bash -e

SERVICE=vault
SECRET_NAME=vault-server-tls
TMPDIR=/tmp
SLEEP_TIME=15
KUBECTL_INSTALLATION_URL=https://storage.googleapis.com/kubernetes-release/release/v1.23.6/bin/linux/amd64/kubectl

# Name of the CSR
echo &quot;Name the CSR: vault-csr&quot;
export CSR_NAME=vault-csr

# Install OpenSSL
echo &quot;Install openssl&quot;
yum install -y openssl 2&gt;&amp;1

# Install Kubernetes cli
echo &quot;Install Kubernetes cli&quot;
curl -o kubectl ${KUBECTL_INSTALLATION_URL}
chmod +x ./kubectl
mkdir -p $HOME/bin &amp;&amp; cp ./kubectl $HOME/bin/kubectl &amp;&amp; export PATH=$PATH:$HOME/bin
kubectl version --short --client

# Create a private key
echo &quot;Generate certificate Private key&quot;
openssl genrsa -out ${TMPDIR}/vault.key 2048

# Create CSR
echo &quot;Create CSR file&quot;
cat &lt;&lt;EOF &gt;${TMPDIR}/csr.conf
[req]
req_extensions = v3_req
distinguished_name = req_distinguished_name
[req_distinguished_name]
[ v3_req ]
basicConstraints = CA:FALSE
keyUsage = nonRepudiation, digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names
[alt_names]
DNS.1 = ${SERVICE}
DNS.2 = ${SERVICE}.${NAMESPACE}
DNS.3 = ${SERVICE}.${NAMESPACE}.svc
DNS.4 = ${SERVICE}.${NAMESPACE}.svc.cluster.local
DNS.5 = vault-0.vault-internal
DNS.6 = vault-1.vault-internal
DNS.7 = vault-2.vault-internal
IP.1 = 127.0.0.1
EOF

# Sign the CSR
echo &quot;Sign the CSR&quot;
openssl req -new -key ${TMPDIR}/vault.key -subj &quot;/CN=${SERVICE}.${NAMESPACE}.svc&quot; -out ${TMPDIR}/server.csr -config ${TMPDIR}/csr.conf

echo &quot;Create a CSR Manifest file&quot;
cat &lt;&lt;EOF &gt;${TMPDIR}/csr.yaml
apiVersion: certificates.k8s.io/v1
kind: CertificateSigningRequest
metadata:
  name: ${CSR_NAME}
spec:
  groups:
  - system:authenticated
  request: $(cat ${TMPDIR}/server.csr | base64 | tr -d '\n')
  signerName: beta.eks.amazonaws.com/app-serving
  usages:
  - digital signature
  - key encipherment
  - server auth
EOF

echo &quot;Create CSR from manifest file&quot;
kubectl create -f ${TMPDIR}/csr.yaml

sleep ${SLEEP_TIME}
echo &quot;Fetch the CSR from kubernetes&quot;
kubectl get csr ${CSR_NAME}

# Approve Cert
echo &quot;Approve the Certificate&quot;
kubectl certificate approve ${CSR_NAME}

serverCert=$(kubectl get csr ${CSR_NAME} -n kubecf -o jsonpath='{.status.certificate}')
echo &quot;${serverCert}&quot; | openssl base64 -d -A -out ${TMPDIR}/vault.crt

echo &quot;Fetch Kubernetes CA Certificate&quot;
kubectl get secret -o jsonpath=&quot;{.items[?(@.type==\&quot;kubernetes.io/service-account-token\&quot;)].data['ca\.crt']}&quot; | base64 --decode &gt; ${TMPDIR}/vault.ca 2&gt;/dev/null || true

echo &quot;Create secret containing the TLS Certificates and key&quot;
echo kubectl create secret generic ${SECRET_NAME} \
--namespace &quot;${NAMESPACE}&quot; \
--from-file=vault.key=${TMPDIR}/vault.key \
--from-file=vault.crt=${TMPDIR}/vault.crt \
--from-file=vault.ca=${TMPDIR}/vault.ca

kubectl create secret generic ${SECRET_NAME} \
--namespace &quot;${NAMESPACE}&quot; \
--from-file=vault.key=${TMPDIR}/vault.key \
--from-file=vault.crt=${TMPDIR}/vault.crt \
--from-file=vault.ca=${TMPDIR}/vault.ca
</code></pre>

Murakami
<p>you do not really need to access with <code>https</code> while using port-word. As the certificate is not valid for <code>localhost</code>.</p>
<p>so you can simply access it via <a href="http://localhost:8200/ui/" rel="nofollow noreferrer">http://localhost:8200/ui/</a></p>
<p>Or you might need to add <code>DNS.8 = localhost</code> as well in the certs.</p>
