<p>I would like to use auto unseal vault mechanism using the GCP KMS.</p>
<p>I have been following this <a href="https://learn.hashicorp.com/tutorials/vault/kubernetes-raft-deployment-guide#configure-vault-helm-chart" rel="nofollow noreferrer">tutorial</a> (section: 'Google KMS Auto Unseal') and applying the official <a href="https://artifacthub.io/packages/helm/hashicorp/vault" rel="nofollow noreferrer">hashicorp helm chart</a> with the following values:</p>
<pre><code>global:
  enabled: true

server:
  logLevel: &quot;debug&quot;
  injector:
    logLevel: &quot;debug&quot;
  extraEnvironmentVars:
    GOOGLE_REGION: global
    GOOGLE_PROJECT: ESGI-projects
    GOOGLE_APPLICATION_CREDENTIALS: /vault/userconfig/kms-creds/credentials.json

  extraVolumes:
    - type: 'secret'
      name: 'kms-creds'

  ha:
    enabled: true
    replicas: 3
    raft:
      enabled: true
    config: |
      ui = true

      listener &quot;tcp&quot; {
        tls_disable = 1
        address = &quot;[::]:8200&quot;
        cluster_address = &quot;[::]:8201&quot;
      }

      seal &quot;gcpckms&quot; {
        project     = &quot;ESGI-projects&quot;
        region      = &quot;global&quot;
        key_ring    = &quot;gitter&quot;
        crypto_key  = &quot;vault-helm-unseal-key&quot;
      }

      storage &quot;raft&quot; {
        path = &quot;/vault/data&quot;
      }
</code></pre>
<p>I have created a <code>kms-creds</code> with the json credentials for a service account (I have tried with Cloud KMS Service Agent and owner role but none of them work.</p>
<p>Here are the keys in my key ring :</p>
<p><a href="https://i.stack.imgur.com/7Hdxt.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/7Hdxt.png" alt="enter image description here" /></a></p>
<p>My cluster is just a local cluster created with kind.</p>
<p>On the first replica of the vault server all seems ok (but not running though):</p>
<p><a href="https://i.stack.imgur.com/qyg2z.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/qyg2z.png" alt="enter image description here" /></a></p>
<p>And on the two others got the normal message claiming that the vault is sealed:</p>
<p><a href="https://i.stack.imgur.com/k7nrN.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/k7nrN.png" alt="enter image description here" /></a></p>
<p>Any idea what could be wrong? Should I create one key for each replica?</p>

Paul Barrié
<p>OK well, I have succeeded in setting in place the Vault with auto unseal !
What I did:</p>
<ul>
<li><p>Change the project (the id was required, not the name)</p>
</li>
<li><p>I disabled the raft (<code>raft.enabled: false</code>)</p>
</li>
<li><p>I moved the backend to google cloud storage adding to the config:</p>
</li>
</ul>
<pre><code>storage &quot;gcs&quot; {
        bucket = &quot;gitter-secrets&quot;
        ha_enabled    = &quot;true&quot;
}
</code></pre>
<p><code>ha_enabled=true</code> was compulsory (with regional bucket)</p>
<p>My final helm values is:</p>
<pre><code>global:
  enabled: true

server:
  logLevel: &quot;debug&quot;
  injector:
    logLevel: &quot;debug&quot;
  extraEnvironmentVars:
    GOOGLE_REGION: global
    GOOGLE_PROJECT: esgi-projects-354109
    GOOGLE_APPLICATION_CREDENTIALS: /vault/userconfig/kms-creds/credentials.json
  extraVolumes:
    - type: 'secret'
      name: 'kms-creds'

  ha:
    enabled: true
    replicas: 3
    raft:
      enabled: false
    config: |
      ui = true

      listener &quot;tcp&quot; {
        tls_disable = 1
        address = &quot;[::]:8200&quot;
        cluster_address = &quot;[::]:8201&quot;
      }

      seal &quot;gcpckms&quot; {
        project     = &quot;esgi-projects-354109&quot;
        region      = &quot;global&quot;
        key_ring    = &quot;gitter&quot;
        crypto_key  = &quot;vault-helm-unseal-key&quot;
      }

      storage &quot;gcs&quot; {
        bucket = &quot;gitter-secrets&quot;
        ha_enabled    = &quot;true&quot;
      }
</code></pre>
<p>Using a service account with permissions:</p>
<ul>
<li>Cloud KMS CryptoKey Encrypter/Decrypter</li>
<li>Storage Object Admin Permission on gitter-secrets only</li>
</ul>
<p>I had an issue at first, the vault-0 needed to run a <code>vault operator init</code>. After trying several things (post install hooks among others) and comming back to the initial state the pod were unsealing normally without running anything.</p>
