Reusing Vault Setup Script to Prevent Sealing and Unhealthy Container States

[AbhilashKD]

Hello everyone,

I'm working with the [Sunbird-RC DevOps repository](https://github.com/Sunbird-RC/devops.git) on the main branch to set up registry and credentialing services on my server. The setup uses make for installation, and here are the steps I’ve followed:

1. Prepare Vault:

   chmod +x setup_vault.sh
   cp .env.example .env
   make

2. After running the make command, the services are installed, and the Vault unseal keys and tokens are stored in the keys.txt file.

Everything works fine initially, but when I:

• Restart the services, or
• Rerun the make command,

The Vault gets sealed again, and I encounter issues such as services showing an unhealthy state. Here's the state of my containers:

CONTAINER ID   IMAGE                                                             STATUS                      PORTS
3d3cda5e3cda   ghcr.io/sunbird-rc/sunbird-rc-credentials-service:v2.0.0          Up 44 hours (unhealthy)    0.0.0.0:3000->3000/tcp
86062d4616ce   ghcr.io/sunbird-rc/sunbird-rc-credential-schema:v2.0.0            Up 44 hours (unhealthy)    0.0.0.0:3333->3333/tcp
ee5a35905c46   ghcr.io/sunbird-rc/sunbird-rc-identity-service:v2.0.0             Up 44 hours (unhealthy)    0.0.0.0:3332->3332/tcp
5f376f6a7b17   postgres:12.1-alpine                                              Up 44 hours (healthy)      0.0.0.0:5432->5432/tcp
906ec22c58cb   vault:1.13.3                                                      Up 44 hours (unhealthy)    0.0.0.0:8200->8200/tcp

Challenges:

1. Vault seals after a restart, causing the dependent services to go unhealthy.
2. I need a way to make the setup reusable without manual intervention to unseal Vault.

Questions:

• How can I modify the setup_vault.sh script or the deployment process to automatically unseal Vault using the keys in keys.txt?
• Is there a better approach to ensure the services remain healthy after restarts?

Any guidance or examples of similar setups would be highly appreciated. Thanks!
@coolbung @snehal0904 @aimansharief @pallakartheekreddy @vinod303

[AbhilashKD]

Any Updates on this ? or solutions how can i solve this ?
@coolbung @snehal0904 @pallakartheekreddy @vinod303 @tejash-jl

[pallakartheekreddy]

@AbhilashKD in Devops repo which one you are using deploy-as-code or infra-as-code

Please refer below document for more details
https://rc.sunbird.org/use/developers-guide/credentialling-services/working-with-the-vault#initialising-the-vault

[AbhilashKD]

hi @pallakartheekreddy
i am using deploy-as-code
How can do the changes in the vault so whenever i am restarting the docker container it will unseal itself or automate this process by updating the code ?
can you provide more insights on this ??

[pallakartheekreddy]

@AbhilashKD Can we get into a call to check this issue? I am available today 2:30PM