Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

vault_disable_mlock should be available for all storage types #287

Open
nununo opened this issue Apr 15, 2022 · 1 comment
Open

vault_disable_mlock should be available for all storage types #287

nununo opened this issue Apr 15, 2022 · 1 comment

Comments

@nununo
Copy link

nununo commented Apr 15, 2022

Hello,

I'm trying to use this role to install Vault in a Proxmox LXC in a home lab context. Everything runs smoothly. Even the mlock capability check. But then the service fails to start with this error:

Apr 15 19:48:14 vault sh[2727]: Error initializing core: Failed to lock memory: cannot allocate memo>
Apr 15 19:48:14 vault sh[2727]: This usually means that the mlock syscall is not available.
Apr 15 19:48:14 vault sh[2727]: Vault uses mlock to prevent memory from being swapped to
Apr 15 19:48:14 vault sh[2727]: disk. This requires root privileges as well as a machine
Apr 15 19:48:14 vault sh[2727]: that supports mlock. Please enable mlock on your system or
Apr 15 19:48:14 vault sh[2727]: disable Vault from using it. To disable Vault from using it,
Apr 15 19:48:14 vault sh[2727]: set the `disable_mlock` configuration option in your configuration
Apr 15 19:48:14 vault sh[2727]: file.

This being a home lab I planned on disabling swap and mlock. But, while vault_disable_mlock is not mentioned in the documentation/defaults, is is being used in template vault_backend_raft.j2. Unfortunately, this is the only storage type accepting it.

Would it be possible to introduce vault_disable_mlock as a global configuration parameter available for all kinds of storages?

Thanks in advance.

@nununo
Copy link
Author

nununo commented Apr 16, 2022

I just found a workaround which allows me to disable mlock using this role: using vault_main_configuration_template to replace the main template.

While I no longer need it, I still think it is a nice improvement so I'll leave the issue and the PR #288 open.

Regards.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant