vault-on-google-kubernetes-engine

Hi Folks, My Vault cluster was working properly yesterday to give the master authorized access i had to deploy it again with terraform code but not is giving storage access issue , Vault is using GCS as backend Getting below error in stack driver, [WARN] storage migration check error: error="failed to read value for "core/migration": googleapi: got HTTP response code 403 with body: AccessDeniedAccess denied.Primary: /namespaces/service account with additional claims does not have storage.objects.get access to the Google Cloud Storage object." The status of Vault pod, containers with unready status: [vault] Anyone faced this issue?

While trying to reproduce tutorial i've faced an obsolete config line (i guess) and finally i stuck on the error which is the name of the topic. Changes i made to the vault.yaml: lines were changed to After the modification of the config vault-init builds up and starts succesfully, however second image (vault itself) cannot start due to "certificate signed by unknown authority" issue, i've seen a thread with same issue (https://github.com/hashicorp/vault/issues/7400), but in current version of config (vault.yaml) no similar definitions present. I'm newbie into writing kubernetes configs so i kinda stuck, would be much appreciated for the tip where to make a correction. As a test i've run check of the certificate: openssl verify -verbose -CAfile ca.pem vault.pem vault-combined.pem which return OK. Logs from the kubectl describe pod: Logs from the kubectl logs vault-0 -c vault-init

Thanks for putting this together man I love your work! I'm hoping you can help me resolve the issue I'm having. I've gone through the instructions several times and I keep running into the same "storage: object doesn't exists" error when init container is trying to unseal the vault. The missing storage object is unseal-keys.json.enc. For some reason the init container is not able to authenticate to the vault API and unable to generate unseal-keys.json.enc? The only changes I made to the instructions were to use the us-central region and I had to remove cluster-version because 1.11.2-gk3.9 is no longer supported.