Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

storage migration check error #79

Open
SrikantPatil88 opened this issue May 29, 2020 · 5 comments
Open

storage migration check error #79

SrikantPatil88 opened this issue May 29, 2020 · 5 comments

Comments

@SrikantPatil88
Copy link

My Vault cluster was working properly yesterday, after upgrade it stopped working

Getting below error in stack driver,

[WARN] storage migration check error: error="failed to read value for "core/migration": googleapi: got HTTP response code 403 with body: AccessDeniedAccess denied.

Primary: /namespaces/service account with additional claims does not have storage.objects.get access to the Google Cloud Storage object.
"

The status of Vault pod,
containers with unready status: [vault]

@SrikantPatil88
Copy link
Author

Hi,

Does anyone seen this error in gcp stack driver after upgrade?

@stale
Copy link

stale bot commented Jun 16, 2020

Hi there! This has been automatically marked as stale because it has not had activity in the past 14 days. It will be closed in 14 days if no further activity takes place.

@stale stale bot added the waiting-reply label Jun 16, 2020
@bluemalkin
Copy link

@SrikantPatil88 did you manage to fix this ? I have the same issue despite that storage object admin permission is granted

@SrikantPatil88
Copy link
Author

@bluemalkin, Yes, We manage to solve the issue.

The issue was the default k8’s service account required binding to the Google service account within the workload Identity.

Workload Identities were added in Kubernetes 1.14 + and are required when the master nodes were upgraded.
https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity

@bluemalkin
Copy link

@bluemalkin, Yes, We manage to solve the issue.

The issue was the default k8’s service account required binding to the Google service account within the workload Identity.

Workload Identities were added in Kubernetes 1.14 + and are required when the master nodes were upgraded.
https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity

Thanks - I fixed my issue, I used the wrong annotation for the service account. I'm using workload identity too and it works well.

You may want to close this ticket.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants