vault icon indicating copy to clipboard operation
vault copied to clipboard

Docker vault setup gives error that vault cant connect to mongodb

Open mdupreejr opened this issue 2 years ago • 12 comments

Docker vault setup gives error that vault cant connect to mongodb

mdupreejr avatar May 24 '23 03:05 mdupreejr

Same error here

kevinzezel avatar May 26 '23 04:05 kevinzezel

Same error here

juniorbts avatar May 26 '23 04:05 juniorbts

Can you provide some context? Docker compose? Stand-alone docker?

cedricve avatar May 26 '23 06:05 cedricve

Hi, i have the same error.

NikolaBoyko avatar May 28 '23 18:05 NikolaBoyko

@NikolaBoyko can you provide details of your setup?

cedricve avatar May 28 '23 18:05 cedricve

@cedricve yes context: docker-compose (custom but i think that problem identically) i found that this in name resolving in vault binary i wrote a custom entrypoint that resolve mongo container name to ip and setup it in MONGODB_HOST. It resolve the problem

NikolaBoyko avatar May 28 '23 18:05 NikolaBoyko

my entrypoint.sh #!/bin/sh echo $MONGODB_HOST nslookup kerberos-mongo echo $(nslookup $MONGODB_HOST) export MONGODB_HOST=$(nslookup $MONGODB_HOST | awk -F': ' 'NR==8 { print $2 } ') echo $MONGODB_HOST ./main serve

NikolaBoyko avatar May 28 '23 18:05 NikolaBoyko

Hmm I just ran the current docker-compose.yaml it returns this on boot:

kerberos-vault  | Error en mongo: no reachable servers
kerberos-vault exited with code 1

But afterwards it recovers:

kerberos-vault  | time="2023-05-28T18:33:15Z" level=info msg="Running Kerberos Vault on :80"
kerberos-vault  | time="2023-05-28T18:33:15Z" level=info msg="Cleanup: nothing to be removed from erg"

cedricve avatar May 28 '23 18:05 cedricve

Hey all, I believe this error was caused due to some setup time for MongoDB. The Kerberos Vault was connecting to mongodb, before it was properly initialised. Please find the fix here: https://github.com/kerberos-io/vault/commit/cfc02d1579dab683386971ec717d1968d747b7bb. I also disabled Ingress by default, as most users would be willing to use it without DNS names. Now both Vault :80 and Minio :9000 are exposed.

@NikolaBoyko can you verify if this helps for you as well?

cedricve avatar May 28 '23 18:05 cedricve

I try wait mongo with wait.sh it did not help. I try your fix tomorrow, thanks.

NikolaBoyko avatar May 28 '23 19:05 NikolaBoyko

Hi! @cedricve your fix don't help, but problem was resolved in container version kerberos/vault:1.0.882646955. I think fix is identical to kerberos-io/agent#101

NikolaBoyko avatar May 30 '23 16:05 NikolaBoyko

hmm indeed might be the case! Waiting for other people to confirm fix.

cedricve avatar May 30 '23 17:05 cedricve