https - 哈希公司金库 : "Error initializing listener of type tcp: error loading TLS cert " Where is my mistake?

Question

我尝试在虚拟机 ubuntu 20.04 ( ip : 192.168.56.9 ) 上使用 docker-compose 运行 Vault。没有 https，已经可以正常工作，但是当我尝试使用来自 openssl 的自签名证书将保险库放入 https 时，它不起作用。

这里是我的配置:

docker-compose.yml :

version: '3.6'

services:

  vault:
    build:
      context: ./vault
      dockerfile: Dockerfile
    ports:
      - 8200:8200
    volumes:
      - ./vault/config:/vault/config
      - ./vault/policies:/vault/policies
      - ./vault/data:/vault/data
      - ./vault/logs:/vault/logs
      - ./vault/volume_test/:/vault/volume_test
    environment:
      - VAULT_ADDR=http://192.168.56.9:8200
    command: server -config=/vault/config/vault-config.conf
    cap_add:
      - IPC_LOCK

Dockerfile:

# base image
FROM alpine:3.7

# set vault version
ENV VAULT_VERSION 0.10.3

# create a new directory
RUN mkdir /vault

# download dependencies
RUN apk --no-cache add \
      bash \
      ca-certificates \
      wget

# download and set up vault
RUN wget --quiet --output-document=/tmp/vault.zip https://releases.hashicorp.com/vault/${VAULT_VERSION}/vault_${VAULT_VERSION}_linux_amd64.zip && \
    unzip /tmp/vault.zip -d /vault && \
    rm -f /tmp/vault.zip && \
    chmod +x /vault

# update PATH
ENV PATH="PATH=$PATH:$PWD/vault"

# add the config file
COPY ./config/vault-config.conf /vault/config/vault-config.conf

# expose port 8200
EXPOSE 8200

# run vault
ENTRYPOINT ["vault"]

我的 vault-config.conf :

backend "file" {
  path = "vault/data"
}

listener "tcp" {
  address = "0.0.0.0:8200"
  tls_disable = false
  tls_cert_file = "/home/xxx/Vault-Docker/domain.crt"
  tls_key_file = "/home/xxx/Vault-Docker/domain.key"
}

#api_addr = "http://192.168.56.9:8200"

disable_mlock = true

ui = true

我如何创建我的 .crt 和我的 .key :

在 /home/xxx/Vault-Docker/ 中创建一个 cert.conf 文件:

[req]
default_bits = 4096
default_md = sha256
distinguished_name = req_distinguished_name
x509_extensions = v3_req
prompt = no

[req_distinguished_name]
C = FR
ST = VA
L = SomeCity
O = MyCompany
OU = MyDivision
CN = 192.168.56.9

[v3_req]
keyUsage = keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names

[alt_names]
IP.1 = 192.168.56.9

然后在/home/xxx/Vault-Docker/中执行:

openssl req -nodes -x509 -days 365 -keyout domain.key -out domain.crt -config cert.conf

但是当我运行时:

docker-compose up -d --build

然后:

docker logs vault-docker_vault_1 

输出是:

Error initializing listener of type tcp: error loading TLS cert: open /home/xxx/Vault-Docker/domain.crt: no such file or directory

有人告诉我我的错误在哪里吗？

非常感谢!

Answer 1

那是因为你的证书配置没有挂载在容器内。为了修复它，您需要:

1. 创建一个新目录./vault/cert
2. 将 domain.crt 和 domain.key 移动到 ./vault/cert
3. 向 docker-compose-yml 添加一个新卷:

   volumes:
...
     - ./vault/cert/:/vault/cert
...

1. 将 vault-config.conf 从 /home/.../domain* 更改为 /vault/cert/domain* tls_cert_* 指令

然后 Vault 将能够找到证书。