桥公司 保险库 ： " Error initializing listener of type tcp: error loading TLS cert " 我的错误在哪里？

Question

我尝试在虚拟机ubuntu 20.04(ip:192.168.56.9(上使用docker compose运行Vault。如果没有https，它已经很好了，但当我试图用openssl的自签名证书将保险库放入https时，它就不起作用了。

这里是我的配置：

docker compose.yml：

version: '3.6'
services:
vault:
build:
context: ./vault
dockerfile: Dockerfile
ports:
- 8200:8200
volumes:
- ./vault/config:/vault/config
- ./vault/policies:/vault/policies
- ./vault/data:/vault/data
- ./vault/logs:/vault/logs
- ./vault/volume_test/:/vault/volume_test
environment:
- VAULT_ADDR=http://192.168.56.9:8200
command: server -config=/vault/config/vault-config.conf
cap_add:
- IPC_LOCK

Dockerfile：

# base image
FROM alpine:3.7
# set vault version
ENV VAULT_VERSION 0.10.3
# create a new directory
RUN mkdir /vault
# download dependencies
RUN apk --no-cache add 
bash 
ca-certificates 
wget
# download and set up vault
RUN wget --quiet --output-document=/tmp/vault.zip https://releases.hashicorp.com/vault/${VAULT_VERSION}/vault_${VAULT_VERSION}_linux_amd64.zip && 
unzip /tmp/vault.zip -d /vault && 
rm -f /tmp/vault.zip && 
chmod +x /vault
# update PATH
ENV PATH="PATH=$PATH:$PWD/vault"
# add the config file
COPY ./config/vault-config.conf /vault/config/vault-config.conf
# expose port 8200
EXPOSE 8200
# run vault
ENTRYPOINT ["vault"]

我的保险库配置文件：

backend "file" {
path = "vault/data"
}
listener "tcp" {
address = "0.0.0.0:8200"
tls_disable = false
tls_cert_file = "/home/xxx/Vault-Docker/domain.crt"
tls_key_file = "/home/xxx/Vault-Docker/domain.key"
}
#api_addr = "http://192.168.56.9:8200"
disable_mlock = true
ui = true

如何创建.crt和.key:

在/home/xxx/Vault Docker/:中创建cert.conf文件

[req]
default_bits = 4096
default_md = sha256
distinguished_name = req_distinguished_name
x509_extensions = v3_req
prompt = no
[req_distinguished_name]
C = FR
ST = VA
L = SomeCity
O = MyCompany
OU = MyDivision
CN = 192.168.56.9
[v3_req]
keyUsage = keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names
[alt_names]
IP.1 = 192.168.56.9

并在/home/xxx/Vault Docker/：中执行

openssl req -nodes -x509 -days 365 -keyout domain.key -out domain.crt -config cert.conf

但当我跑步时：

docker-compose up -d --build

然后：

docker logs vault-docker_vault_1 

输出为：

Error initializing listener of type tcp: error loading TLS cert: open /home/xxx/Vault-Docker/domain.crt: no such file or directory

有人告诉我我的错误在哪里？

非常感谢！

Answer 1

这是因为您的证书配置没有安装在容器中。为了修复它，你需要：

1. 创建一个新目录./vault/cert
2. 将domain.crt和domain.key都移动到./vault/cert
3. 向docker-compose-yml添加新卷：

volumes:
...
- ./vault/cert/:/vault/cert
...

4. 在两个tls_cert_*指令上将vault-config.conf从/home/.../domain*更改为/vault/cert/domain*

然后Vault将能够找到证书。

Answer 2

您给出的证书路径将是容器路径，并且您已将证书保存在主机中。