Comment 1 for bug 1987677

Revision history for this message
Nobuto Murata (nobuto) wrote :

I can confirm this behavior. From what I saw, it looks like some moments are necessary to settle down the HA status of the vault cluster after unsealing it even with a single node cluster.

Here is an output from the unseal command and as we can see "n/a" is recorded for HA Cluster status and there is no cluster address either.

+ vault operator unseal Lp0QKU6ts/9Eydb/A3s3DUs5qcyzmxfpDI5M4jfmhY8=
Key Value
--- -----
Seal Type shamir
Initialized true
Sealed false
Total Shares 1
Threshold 1
Version 1.8.8
Storage Type raft
Cluster Name vault-cluster-777ad2a5
Cluster ID 0afa6371-5941-493f-d258-d76389cdbecc
HA Enabled true
HA Cluster n/a
HA Mode standby
Active Node Address <none>
Raft Committed Index 24
Raft Applied Index 24

With the status above, `token create` can fail by missing active cluster node.

++ vault token create -ttl=10m -format json
Error creating token: Error making API request.

URL: POST http://192.168.151.108:8200/v1/auth/token/create
Code: 500. Errors:

* local node not active but active cluster node not found

Here is the expected status after some time for the record.

$ vault status
Key Value
--- -----
Seal Type shamir
Initialized true
Sealed false
Total Shares 1
Threshold 1
Version 1.8.8
Storage Type raft
Cluster Name vault-cluster-777ad2a5
Cluster ID 0afa6371-5941-493f-d258-d76389cdbecc
HA Enabled true
HA Cluster https://192.168.151.108:8201
HA Mode active
Active Since 2023-10-18T15:22:40.840977987Z
Raft Committed Index 1478
Raft Applied Index 1478