The port used for the auto-healing health check is always the variable vault_port (default 8200), but the firewall rule allowing this autohealing health check will be vault_port only when using internal load balacing, otherwise it will be vault_proxy_port (default 58200) which would result in the MIG being 100% unhealthy perpetually (though in practice the cluster will work with reduced capacity and rolling outages due to the staggered auto-healing behaviour)
Expected behavior
firewall rule created for autohealing and load-balancing health checks matches autohealing health check port
Observed behavior
firewall rule created for autohealing and load-balancing health checks does not match autohealing health check port (when using external load balancing)
Terraform Configuration
autohealing health check port: https://github.com/terraform-google-modules/terraform-google-vault/blob/master/modules/cluster/main.tf#LL290C24-L290C34
firewall rule used for autohealing and load-balancer health checks:
https://github.com/terraform-google-modules/terraform-google-vault/blob/master/network.tf#LL132C62-L132C78
for correct behaviour the firewall rule should always include the port used for autohealing health check
TL;DR
The port used for the auto-healing health check is always the variable vault_port (default 8200), but the firewall rule allowing this autohealing health check will be
vault_port
only when using internal load balacing, otherwise it will bevault_proxy_port
(default 58200) which would result in the MIG being 100% unhealthy perpetually (though in practice the cluster will work with reduced capacity and rolling outages due to the staggered auto-healing behaviour)Expected behavior
firewall rule created for autohealing and load-balancing health checks matches autohealing health check port
Observed behavior
firewall rule created for autohealing and load-balancing health checks does not match autohealing health check port (when using external load balancing)
Terraform Configuration
Terraform Version
Additional information
No response