nebtex / vault-migrator

migrate vault data between different physical backends
Apache License 2.0
53 stars 11 forks source link

Migrating from Consul - Consul #7

Closed gmoore-pay closed 5 years ago

gmoore-pay commented 6 years ago

Values seem to properly migrate from consul to another consul end point (attempting to create a DR by leveraging copying from a consul cluster to another consul node - and starting a vault instance against that node).

When bringing up a vault node against the copy, the vault can be unsealed but a leader can't be established. Have tried vault 0.7.0 and 0.10.x

The exporting functionality does seem to work as expected however a new vault instance can't be used against the replicated set.

Do certain values have to be removed from consul to address this? I have attempted to delete the leader data and lock from /vault/core.

When those vaults are removed the following errors are constantly thrown when the vault is unsealed.

[ERROR] core: failed to read auth table: error="decryption failed: cipher: message authentication failed" [INFO ] core: pre-seal teardown starting [INFO ] core: pre-seal teardown complete [ERROR] core: post-unseal setup failed: error="failed to setup auth table" [INFO ] core: acquired lock, enabling active operation [INFO ] core: post-unseal setup starting [INFO ] core: loaded wrapping token key [INFO ] core: successfully setup plugin catalog: plugin-directory= [INFO ] core: successfully mounted backend: type=kv path=secret/ [INFO ] core: successfully mounted backend: type=system path=sys/ [INFO ] core: successfully mounted backend: type=identity path=identity/ [INFO ] core: successfully mounted backend: type=cubbyhole path=cubbyhole/ [ERROR] core: failed to read auth table: error="decryption failed: cipher: message authentication failed"