When attempting to set up OCI KMS Seal as documented, vault will fail to start.
The following are examples of errors that may be encountered:
Error parsing Seal configuration: 'key_id' not found for OCI KMS seal configuration
Error parsing Seal configuration: error initializing OCI KMS client:
failed creating NewKmsCryptoClientWithConfigurationProvider:
can not create client, bad configuration:
did not find a proper configuration for tenancy
These errors can be caused by either of the following:
1. Known issue parsing out the OCI seal key_id from the vault config file.
2. Missing OCI API configuration file or insufficient permissions.
'key_id' not found for OCI KMS seal configuration is encountered, this may be a result of an existing issue.
To work around this issue, set the
VAULT_OCIKMS_SEAL_KEY_ID environment variable.
2. If setting up seal with the API
auth_type_api_key is set to true, you may receive an
error initializing OCI KMS client error if the OCI API configuration is not properly created on the OCI instance. Review the OCI documentation on how to set up an API key.
Note: Please ensure that vault user has permissions to the
~/.oci directory where the api signing key and configuration file is located.
Example api config file.
cat /home/vault/.oci/config [DEFAULT] user=ocid1.user.oc1..XXXXXXXXX fingerprint=a1:82:53:e1:fd:bd:e7:55:1b:7b:e8:XX:XX:XX:XX:XX tenancy=ocid1.tenancy.oc1..XXXXXXXX region=us-ashburn-1 key_file=/home/vault/.oci/oci_api_private_key.pem
An alternative is to set
auth_type_api_key to false and use Dynamic Groups.