如何解决“Couldn't start vault with IPC_LOCK. Disabling IPC_LOCK”和“Cluster address must be set when using raft storage”错误？

Question

我使用以下堆栈文件以 docker swarm 模式部署 vault 服务。

堆栈文件：

version: '3.8'
services:

  faume-vault:
    image: vault:1.6.0
    environment:
      TZ: UTC
      VAULT_ADDR: 'http://0.0.0.0:8200'
      VAULT_LOCAL_CONFIG: |-
        {
          "disable_cache": true,
          "disable_mlock": true,
          "ui": true,
          "backend": {
            "raft": {
              "node_id": "vault",
              "path": "/vault"
            }
          },
          "default_lease_ttl": "168h",
          "max_lease_ttl": "720h",
          "seal": {
            "awskms": {
              "access_key": "xxxxxxxxxxxxxxxxxxxxxxx"
              "secret_key": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
              "kms_key_id": "xxxxxxxxxxxxxxxxxxxxxxx"
            }
          },
          "listener": {
            "tcp": {
              "address": "0.0.0.0:8200",
              "cluster_address": "0.0.0.0:8201",
              "tls_disable": true
            }
          },
          "cluster_addr": "http://vault.faume.local:8201",
          "api_addr": "http://vault.faume.local:8200"
        }
    command: server
    volumes:
      - 'faume-vault:/vault'
    ports:
      - '8200:8200'
    networks:
      faume:
        aliases:
          - vault.faume.local
    deploy:
      mode: replicated
      replicas: 1
      restart_policy:
        condition: on-failure
      placement:
        constraints:
          - node.role==manager


volumes:
  faume-vault:

networks:
  faume:

部署堆栈文件时，服务创建没有错误，但服务没有运行。

服务日志如下：

faume-vault_faume-vault.1.xztddsvjaa2c@DevOps-Dhanushka    | Couldn't start vault with IPC_LOCK. Disabling IPC_LOCK, please use --privileged or --cap-add IPC_LOCK
faume-vault_faume-vault.1.xkh8abjlzyel@DevOps-Dhanushka    | Couldn't start vault with IPC_LOCK. Disabling IPC_LOCK, please use --privileged or --cap-add IPC_LOCK
faume-vault_faume-vault.1.xkh8abjlzyel@DevOps-Dhanushka    | 2021-07-26T08:20:15.705Z [INFO]  proxy environment: http_proxy= https_proxy= no_proxy=
faume-vault_faume-vault.1.xztddsvjaa2c@DevOps-Dhanushka    | 2021-07-26T08:20:31.553Z [INFO]  proxy environment: http_proxy= https_proxy= no_proxy=
faume-vault_faume-vault.1.xkh8abjlzyel@DevOps-Dhanushka    | Cluster address must be set when using raft storage
faume-vault_faume-vault.1.xztddsvjaa2c@DevOps-Dhanushka    | Cluster address must be set when using raft storage
faume-vault_faume-vault.1.5g7wzqm7fn0f@DevOps-Dhanushka    | Couldn't start vault with IPC_LOCK. Disabling IPC_LOCK, please use --privileged or --cap-add IPC_LOCK
faume-vault_faume-vault.1.5g7wzqm7fn0f@DevOps-Dhanushka    | 2021-07-26T08:20:23.070Z [INFO]  proxy environment: http_proxy= https_proxy= no_proxy=
faume-vault_faume-vault.1.5g7wzqm7fn0f@DevOps-Dhanushka    | Cluster address must be set when using raft storage
faume-vault_faume-vault.1.kf0k9eoou749@DevOps-Dhanushka    | Couldn't start vault with IPC_LOCK. Disabling IPC_LOCK, please use --privileged or --cap-add IPC_LOCK
faume-vault_faume-vault.1.kf0k9eoou749@DevOps-Dhanushka    | Cluster address must be set when using raft storage
faume-vault_faume-vault.1.kf0k9eoou749@DevOps-Dhanushka    | 2021-07-26T08:20:39.894Z [INFO]  proxy environment: http_proxy= https_proxy= no_proxy=

似乎错误是“mlock”。但我已经成功配置了“mlock”变量。可以请你提些建议吗？

Answer 1

您需要以特权模式运行您的faume-vault 容器。

只需添加privileged: true 选项。

docker swarm 仅在最新版本中支持此功能（请参阅 privileged mode in docker compose in a swarm），请确保您运行的是足够新的版本。

请确保您了解运行特权 pod 所涉及的 security concerns。