title: How to connect Vault with Consul agent on Kubernetes via Helm chart (Consul server is on Azure managed app)
body: <h1>Requesting for some help on : How to connect Vault with Consul agent on Kubernetes via Helm chart (Consul server is on Azure managed app)</h1>
  <p>I'm trying to build a POC, for Vault and consul and got some questions.</p>
  <ol>
  <li><p>Deployed Azure managed app using - <a href="https://learn.hashicorp.com/tutorials/consul/hashicorp-consul-service-deploy" rel="nofollow noreferrer">https://learn.hashicorp.com/tutorials/consul/hashicorp-consul-service-deploy</a></p>
  </li>
  <li><p>Installed consul agent on AKS with the steps in the <a href="https://learn.hashicorp.com/tutorials/consul/hashicorp-consul-service-aks?in=consul/hcs-azure" rel="nofollow noreferrer">https://learn.hashicorp.com/tutorials/consul/hashicorp-consul-service-aks?in=consul/hcs-azure</a>
  Consul helm chart : <a href="https://github.com/hashicorp/consul-helm" rel="nofollow noreferrer">https://github.com/hashicorp/consul-helm</a></p>
  </li>
  <li><p>Installed vault via helm chart: <a href="https://github.com/hashicorp/vault-helm" rel="nofollow noreferrer">https://github.com/hashicorp/vault-helm</a></p>
  </li>
  </ol>
  <p>Kubernetes services and pods for consul.</p>
  <pre><code>~$kubectl get svc -n consul                                            
  NAME                          TYPE        CLUSTER-IP    EXTERNAL-IP   PORT(S)   AGE
  consul-connect-injector-svc   ClusterIP   10.0.252.97   &lt;none&gt;        443/TCP   2d13h
  consul-controller-webhook     ClusterIP   10.0.169.80   &lt;none&gt;        443/TCP   2d13h
  
  ~$kubectl get pods -n consul
  NAME                                                         READY   STATUS    RESTARTS   AGE
  consul-27j4j                                                 1/1     Running   0          2d13h
  consul-connect-injector-webhook-deployment-9454b8d68-778rd   1/1     Running   0          2d13h
  consul-controller-7857456f99-mhzpw                           1/1     Running   1          2d13h
  consul-lkhpl                                                 1/1     Running   0          2d13h
  consul-webhook-cert-manager-cfbb689f7-fgtlw                  1/1     Running   0          2d13h
  consul-zf989                                                 1/1     Running   0          2d13h
  </code></pre>
  <p>vault config as below:</p>
  <pre><code>ui:
    enabled: true
    serviceType: LoadBalancer
  server:
    ingress:
      enabled: true
      extraPaths:
        - path: /
          backend:
            serviceName: vault-ui
            servicePort: 8200
      hosts:
        - host: vault.something_masked.com
    ha:
      enabled: true
      config: |
        ui = true
  
        listener &quot;tcp&quot; {
          tls_disable = 1
          address = &quot;[::]:8200&quot;
          cluster_address = &quot;[::]:8201&quot;
        }
  
        storage &quot;consul&quot; {
          path = &quot;vault/&quot;
          scheme = &quot;https&quot;
          address = &quot;HOST_IP:8500&quot;
        }
  
  </code></pre>
  <p>Vault pods</p>
  <pre><code>kubectl get pods -n vault                             
  NAME                                   READY   STATUS    RESTARTS   AGE
  vault-0                                0/1     Running   0          7m14s
  vault-1                                0/1     Running   0          7m11s
  vault-2                                0/1     Running   0          7m11s
  vault-agent-injector-cbbb6f4df-rmbd7   1/1     Running   0          7m22s
  </code></pre>
  <h2>ERROR : Vault is unable to make communication with consul agent.</h2>
  <p>Logs for vault-0 pod</p>
  <pre><code>kubectl logs vault-0 -n vault
  
  WARNING! Unable to read storage migration status.
  2021-06-27T08:37:17.801Z [INFO]  proxy environment: http_proxy=&quot;&quot; https_proxy=&quot;&quot; no_proxy=&quot;&quot;
  2021-06-27T08:37:18.824Z [WARN]  storage migration check error: error=&quot;Get &quot;https://10.54.0.206:8500/v1/kv/vault/core/migration&quot;: dial tcp 10.54.0.206:8500: connect: connection refused&quot;
  </code></pre>
  <p>Logs for vault-agent-injector pod</p>
  <pre><code> kubectl logs vault-agent-injector-cbbb6f4df-rmbd7 -n vault    
  2021-06-27T08:37:09.189Z [INFO]  handler: Starting handler..
  Listening on &quot;:8080&quot;...
  2021-06-27T08:37:09.218Z [INFO]  handler.auto-tls: Generated CA
  2021-06-27T08:37:09.219Z [INFO]  handler.certwatcher: Updated certificate bundle received. Updating certs...
  2021-06-27T08:37:18.252Z [INFO]  handler: Request received: Method=POST URL=/mutate?timeout=10s
  2021-06-27T08:37:18.452Z [INFO]  handler: Request received: Method=POST URL=/mutate?timeout=10s
  </code></pre>
  <p>Any suggestions or advice in the vault configuration if I have missed something ??</p>
  <p>Thank you in advance.</p>
  <p>Regards
  Pooja</p>