无法初始化保管库

Question

我正在尝试使用以下命令初始化Vault，使用root使用root来运行该命令，还尝试了与“保险库”用户。 /etc/vault目录的所有者设置为库用户，但库用户也遇到相同的错误。

vault operator init > /etc/vault/config/init.file

但失败并显示以下错误

root@ip-172-31-65-238:~# vault operator init > /etc/vault/config/init.file 
Error initializing: Error making API request.

URL: PUT http://127.0.0.1:8200/v1/sys/init
Code: 400. Errors:

* failed to initialize barrier: failed to persist keyring: mkdir /etc/vault/data/core: read-only file system

我的保管库配置文件如下所示

listener "tcp" {
  address = "0.0.0.0:8200"
  tls_disable = "1"
}
api_addr = "http://127.0.0.1:8200"
storage "file" {
    path = "/etc/vault/data"
}
ui = true

我已如下导出环境变量

export VAULT_ADDR=http://127.0.0.1:8200

我的systemd文件如下所示

[Unit]
Description=vault service
Documentation=https://www.vaultproject.io/docs/
Requires=network-online.target
After=network-online.target
ConditionFileNotEmpty=/etc/vault/config/default.hcl

[Service]
User=vault
Group=vault
ProtectSystem=full
ProtectHome=read-only
PrivateTmp=yes
PrivateDevices=yes
SecureBits=keep-caps
AmbientCapabilities=CAP_IPC_LOCK
Capabilities=CAP_IPC_LOCK+ep
CapabilityBoundingSet=CAP_SYSLOG CAP_IPC_LOCK
NoNewPrivileges=yes
ExecStart=/usr/local/bin/vault server -config=/etc/vault/config/default.hcl -log-level=info
ExecReload=/bin/kill --signal HUP \$MAINPID
KillMode=process
KillSignal=SIGINT
Restart=on-failure
RestartSec=5
TimeoutStopSec=30
StartLimitIntervalSec=60
StartLimitBurst=3
LimitNOFILE=65536

[Install]
WantedBy=multi-user.target

对此非常感谢！

Answer 1

我没有关于您的环境的足够信息，但是您可能在文件权限方面存在一些问题。

某人在Google Cloud服务器中遇到了类似的问题-它与缺少“ read_write”服务帐户范围有关，如您在此处看到的：https://github.com/hashicorp/vault/issues/6085