hashicorp / docker-vault

Official Docker images for Vault
Mozilla Public License 2.0
500 stars 223 forks source link

Cannot list plugins #331

Closed michvllni closed 1 year ago

michvllni commented 1 year ago

I am unable to list plugins with docker exec vault vault plugin list, I always get the error: Error listing available plugins: data from server response is empty

I found this information regarding the issue.

When trying to use one of the workaround commands I get the following:

docker exec vault vault list sys/plugins/catalog/auth
Error listing sys/plugins/catalog/auth: Error making API request.

URL: GET http://0.0.0.0:8200/v1/sys/plugins/catalog/auth?list=true
Code: 403. Errors:

* permission denied

This might also be an issue with my config (I'm using a vault container behind a traefik reverse proxy)

This is my config.hcl:

storage "raft" {
  path    = "/vault/file"
}

listener "tcp" {
  address     = "0.0.0.0:8200"
  tls_disable = 1
  proxy_protocol_behavior = "use_always"
}

cluster_addr = "https://127.0.0.1:8201"
ui = true
disable_mlock = true
plugin_directory = "/opt/vault/plugins"

my docker-compose.yml:

version: '3.6'
networks:
  traefik:
    name: "traefik"
    external: true

services:

  vault:
    image: hashicorp/vault
    container_name: vault
    ports:
      - 8200:8200
    volumes:
      - /services/hashicorp-vault/vault/config:/vault/config
      - /services/hashicorp-vault/vault/policies:/vault/policies
      - /services/hashicorp-vault/vault/file:/vault/file
      - /services/hashicorp-vault/vault/logs:/vault/logs
      - /services/hashicorp-vault/vault/plugins:/opt/vault/plugins
    environment:
      - VAULT_ADDR=http://0.0.0.0:8200
      - VAULT_API_ADDR=http://0.0.0.0:8200
    command: server
    cap_add:
      - IPC_LOCK
    labels:
      - traefik.enable=true
      - traefik.http.routers.vault.entrypoints=websecure
      - traefik.http.routers.vault.rule=Host(`vault.xxx.de`)
      - traefik.http.routers.vault.middlewares=httpsredirect@file
      - traefik.http.routers.vault.tls=true
      - traefik.http.services.vault.loadbalancer.server.port=8200
    networks:
      - traefik
michvllni commented 1 year ago

I was able to resolve the issue...I have to run this from inside the container and login beforehand.