HTTP Error 400 when using Kong Ingress

[zavertiaev]

Describe the bug
Vault is deployed in HA mode with ingress enabled. When attempting to access the ingress URL, we receive an HTTP ERROR 400.

Environment

• Kubernetes version: v1.30.4
  • Distribution or cloud vendor (OpenShift, EKS, GKE, AKS, etc.): bare metal
  • Other configuration options or runtime services (istio, etc.): kong (helm chart 2.40.0)
• vault-helm version: 0.28.1

Chart values:

global:
  enabled: true
  tlsDisable: false
injector:
  enabled: false
server:
  resources:
    requests:
      memory: 256Mi
      cpu: 250m
    limits:
      memory: 512Mi
      cpu: 500m
  ingress:
    enabled: true
    annotations:
      konghq.com/protocols: "https"
    ingressClassName: kong
    hosts:
      - host: vault.example.com
    tls:
      - secretName: vault-tls
        hosts:
          - vault.example.com
  readinessProbe:
    enabled: true
    path: "/v1/sys/health?standbyok=true&sealedcode=204&uninitcode=204"
  livenessProbe:
    enabled: true
    path: "/v1/sys/health?standbyok=true"
    initialDelaySeconds: 60
  extraEnvironmentVars:
    VAULT_CACERT: /vault/userconfig/vault-ha-tls/vault.ca
    VAULT_TLSCERT: /vault/userconfig/vault-ha-tls/vault.crt
    VAULT_TLSKEY: /vault/userconfig/vault-ha-tls/vault.key
  volumes:
    - name: userconfig-vault-ha-tls
      secret:
        defaultMode: 420
        secretName: vault-ha-tls
  volumeMounts:
    - mountPath: /vault/userconfig/vault-ha-tls
      name: userconfig-vault-ha-tls
      readOnly: true
  dataStorage:
    enabled: true
  auditStorage:
    enabled: true
  standalone:
    enabled: false
  ha:
    enabled: true
    raft:
      enabled: true
      setNodeId: true
      config: |
        ui = true
        cluster_name = "vault-integrated-storage"
        listener "tcp" {
          tls_disable = 0
          address = "[::]:8200"
          cluster_address = "[::]:8201"
          tls_cert_file = "/vault/userconfig/vault-ha-tls/vault.crt"
          tls_key_file  = "/vault/userconfig/vault-ha-tls/vault.key"
          tls_client_ca_file = "/vault/userconfig/vault-ha-tls/vault.ca"
          tls_disable_client_certs = "true"
        }
        storage "raft" {
          path = "/vault/data"
        }
        service_registration "kubernetes" {}
ui:
  enabled: true
csi:
  enabled: true
  resources:
    requests:
      memory: 128Mi
      cpu: 50m
    limits:
      memory: 128Mi
      cpu: 50m

[zavertiaev]

It was an issue on kong's side