2

我尝试在虚拟机 ubuntu 20.04（ip：192.168.56.9）上使用 docker-compose 运行 Vault。没有 https，已经可以正常工作了，但是当我尝试使用来自 openssl 的自签名证书将保管库放入 https 时，它不起作用。

这是我的配置：

码头工人-compose.yml：

version: '3.6'

services:

  vault:
    build:
      context: ./vault
      dockerfile: Dockerfile
    ports:
      - 8200:8200
    volumes:
      - ./vault/config:/vault/config
      - ./vault/policies:/vault/policies
      - ./vault/data:/vault/data
      - ./vault/logs:/vault/logs
      - ./vault/volume_test/:/vault/volume_test
    environment:
      - VAULT_ADDR=http://192.168.56.9:8200
    command: server -config=/vault/config/vault-config.conf
    cap_add:
      - IPC_LOCK

Dockerfile：

# base image
FROM alpine:3.7

# set vault version
ENV VAULT_VERSION 0.10.3

# create a new directory
RUN mkdir /vault

# download dependencies
RUN apk --no-cache add \
      bash \
      ca-certificates \
      wget

# download and set up vault
RUN wget --quiet --output-document=/tmp/vault.zip https://releases.hashicorp.com/vault/${VAULT_VERSION}/vault_${VAULT_VERSION}_linux_amd64.zip && \
    unzip /tmp/vault.zip -d /vault && \
    rm -f /tmp/vault.zip && \
    chmod +x /vault

# update PATH
ENV PATH="PATH=$PATH:$PWD/vault"

# add the config file
COPY ./config/vault-config.conf /vault/config/vault-config.conf

# expose port 8200
EXPOSE 8200

# run vault
ENTRYPOINT ["vault"]

我的Vault-config.conf：

backend "file" {
  path = "vault/data"
}

listener "tcp" {
  address = "0.0.0.0:8200"
  tls_disable = false
  tls_cert_file = "/home/xxx/Vault-Docker/domain.crt"
  tls_key_file = "/home/xxx/Vault-Docker/domain.key"
}

#api_addr = "http://192.168.56.9:8200"

disable_mlock = true

ui = true

我如何创建.crt和.key：

在/home/xxx/Vault-Docker/中创建一个 cert.conf 文件：

[req]
default_bits = 4096
default_md = sha256
distinguished_name = req_distinguished_name
x509_extensions = v3_req
prompt = no

[req_distinguished_name]
C = FR
ST = VA
L = SomeCity
O = MyCompany
OU = MyDivision
CN = 192.168.56.9

[v3_req]
keyUsage = keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names

[alt_names]
IP.1 = 192.168.56.9

并在 /home/xxx/Vault-Docker/ 中执行：

openssl req -nodes -x509 -days 365 -keyout domain.key -out domain.crt -config cert.conf

但是当我运行时：

docker-compose up -d --build

然后 ：

docker logs vault-docker_vault_1

输出是：

Error initializing listener of type tcp: error loading TLS cert: open /home/xxx/Vault-Docker/domain.crt: no such file or directory

有人告诉我我的错误在哪里？

非常感谢 ！

4

1 回答 1

0

那是因为您的证书配置未安装在容器内。为了修复它，您需要：

  1. 创建一个新目录./vault/cert
  2. 移动domain.crt和domain.key到./vault/cert
  3. 添加到docker-compose-yml新卷：
   volumes:
...
     - ./vault/cert/:/vault/cert
...
  1. 在两个指令上vault-config.conf从/home/.../domain*to更改/vault/cert/domain*tls_cert_*



然后 Vault 将能够找到证书。

于 2020-12-03T17:27:03.947 回答