HashiCorp Vault
-
-
@mario this would be useful and I was looking at this a week ago. Vault uses MLOCK to stop the data from being sent to disk, like using swap memory, in order to get MEMLOCK you need to tell docker to provide that privilege to the container. Which from what I can see is a limitation on Cloudron (for good reasons). I have the package done and I can share it out once I have cleaned the code up a little but in order to get Vault to run, MLOCK capabilities needs to be disabled in the config file.
You could argue that the docker container in Cloudron is self-contained but something like this would be better hosted internally behind a firewall than something you would put up onto DO for example.
Happy to take differing options and/or opinions.
-
Actually, I went and RTFM: https://cloudron.io/documentation/storage/ I might be able to add custom properties but that would mean all the containers would have the priv.
@girish can you shed any light on the --cap-add=IPC_LOCK being passed to docker?
thanks
-
@ultraviolet take a look at https://cloudron.io/documentation/custom-apps/manifest/#capabilities
This mechanism is already used for some apps (at least OpenVPN, which also needs a capability for networking stuff). The MLOCK capability is currenlty not one of the possibilties, but it would be trivial to add to a future version of cloudron
-
If anyone is interested the repo is here https://github.com/euanmcgregor/vault-cloudron
It is working, I am just looking at LDAP integration just now.
-
@ultraviolet you're a star, thank you so much.
Thanks for the additional clarifications on the manifest capabilities @mehdi
If @girish and @nebulon can add the capability for MLOCK and you can get the LDAP working, that would be beyond awesome.
-
@ultraviolet Thanks! I have added mlock capability for 5.4 in https://git.cloudron.io/cloudron/box/-/commit/84f41e08cfbd3eb4dd5ac2d0e949b6a6d724f1c7
For now (until 5.4) is out, I guess you can disable mlock using
disable_mlock? (Atleast as per https://github.com/hashicorp/docker-vault/issues/24) -
@ultraviolet It seems we need to make another 5.3 release because of some issues. So, maybe I can put this in 5.3 as well. Let me see.
-
@girish awesome. I can see that the change is in 5.3 and I have just upgraded. Made a small change but it is still throwing the error, my manifest file shows this now:
{ "id": "com.vault.cloudron", "version": "0.1.0", "minBoxVersion": "5.3.0", "healthCheckPath": "/", "httpPort": 8200, "addons": { "localstorage": {}, "ldap": {} }, "capabilities": [ "mlock" ], "manifestVersion": 2 }Not sure if I am missing something here?
-
pretty much yeah, the services won't start and the logs will show an error message
-
@ultraviolet I think I got a littler closer to a working state. Currently restarting since my Cloudron wanted a reboot after the last update.
https://github.com/euanmcgregor/vault-cloudron/pull/1
edit: hmm, no. this is what is logged:
Jun 29 20:54:05 2020-06-29 18:54:05,044 INFO spawned: 'vault' with pid 12 Jun 29 20:54:05 Error initializing core: Failed to lock memory: cannot allocate memory Jun 29 20:54:05 Jun 29 20:54:05 This usually means that the mlock syscall is not available. Jun 29 20:54:05 Vault uses mlock to prevent memory from being swapped to Jun 29 20:54:05 disk. This requires root privileges as well as a machine Jun 29 20:54:05 that supports mlock. Please enable mlock on your system or Jun 29 20:54:05 disable Vault from using it. To disable Vault from using it, Jun 29 20:54:05 set the `disable_mlock` configuration option in your configuration Jun 29 20:54:05 file. Jun 29 20:54:05 2020-06-29 18:54:05,115 INFO exited: vault (exit status 1; not expected) Jun 29 20:54:06 2020-06-29 18:54:06,118 INFO spawned: 'vault' with pid 23 -
-
@ultraviolet yes, that is the workaround I am using at the moment as well.
-
-
@ultraviolet do you have ldap working already?
You had the ldap script missing (not added with
git add) so I tried my own, but even after config has completed I cannot login and only getAuthentication failed: ldap operation failed: unable to retrieve user bind DN -
@fbartels I did try to get ldap going, the issue doing it automatically during install is you need to unseal and login to the vault before you can enable the LDAP. Which is hard when the login info is in a text file I am sure it is possible but my knowledge is a bit limited on that, plus it might not be idempotent.
When I tried it manually it gave me that exact error I am still checking to see what the issue might be but I have kind of drawn a blank at the moment. Will take a fresh look later this week when I get a bit of time.
