After upgrade from 1.7/stable to 1.8/stable: failed to look up namespace from the token: no namespace

[Diko Parvanov]

After charm upgrade from 1.7/stable to 1.8/stable with vault snap refresh from 1.7/stable to 1.8/stable as well services can't communicate to vault with:

unit-nova-compute-kvm-sriov-0: 07:11:32 WARNING unit.nova-compute-kvm-sriov/0.post-series-upgrade hvac.exceptions.InternalServerError: error performing token check: failed to look up namespace from the token: no namespace, on post http://vault.pc1.canonical.com:8200/v1/sys/wrapping/unwrap

trying manually to create a token fails as well:

vault token create -ttl=10m
Error creating token: Error making API request.

URL: POST http://127.0.0.1:8200/v1/auth/token/create
Code: 500. Errors:

* error performing token check: failed to look up namespace from the token: no namespace

[Alex Kavanagh (ajkavanagh)]

I've noticed an issue with config for the snap set to the default and it failing during the upgrade-charm hook as well.

[Liam Young (gnuoy)]

When you say "with vault snap refresh from 1.7/stable to 1.8/stable as well" do you mean you manually issued the snap refresh to the 1.8 channel?

Do you have the steps you went through to do the upgrade?

Can you provide juju logs and vault logs from the vault units please ?

NOTE: From what I can tell namespaces are an enterprise feature which is strange.

[Diko Parvanov (dparv)]

The vault snap was refreshed by the charm, nothing manual. Unfortunately this was partner cloud and it was re-deployed couple of times since, so no logs.

It is a single step: juju upgrade-charm vault --channel 1.8/stable