Skip to content

The core/lock file is not created in the GCS bucket after upgrading to version 1.20.0 #31125

@verdel

Description

@verdel

Describe the bug
After upgrading Vault from version 1.19.5 to 1.20.0, using a GCS bucket as the storage backend with the ha_enabled=true option enabled, the following error appears in the pod:

core: failed to acquire lock: error="lock: attempt lock: write lock: failed to read attrs for \"core/lock\": storage: object doesn't exist: googleapi: Error 404: No such object: <gcs_bucket_name>/core/lock, notFound"

The core/lock file does not appear in the bucket itself:

> gsutil ls gs://<gcs_bucket_name>/core

gs://<gcs_bucket_name>/core/audit
gs://<gcs_bucket_name>/core/auth
gs://<gcs_bucket_name>/core/canary-keyring
gs://<gcs_bucket_name>/core/index-header-hmac-key
gs://<gcs_bucket_name>/core/keyring
gs://<gcs_bucket_name>/core/local-audit
gs://<gcs_bucket_name>/core/local-auth
gs://<gcs_bucket_name>/core/local-mounts
gs://<gcs_bucket_name>/core/master
gs://<gcs_bucket_name>/core/mounts
gs://<gcs_bucket_name>/core/recovery-config
gs://<gcs_bucket_name>/core/recovery-key
gs://<gcs_bucket_name>/core/recovery-keys-backup
gs://<gcs_bucket_name>/core/seal-config
gs://<gcs_bucket_name>/core/seal-gen-info
gs://<gcs_bucket_name>/core/shamir-kek
gs://<gcs_bucket_name>/core/cluster/
gs://<gcs_bucket_name>/core/hsm/
gs://<gcs_bucket_name>/core/plugin-catalog/
gs://<gcs_bucket_name>/core/versions/
gs://<gcs_bucket_name>/core/wrapping/

To Reproduce

  1. Install Vault version 1.19.5 in the Kubernetes cluster using the official Helm chart
  2. Use a GCS bucket as the storage backend
  3. Update the Vault Docker image version to 1.20.0
  4. Check the events in the Vault pod
  5. Check for the existence of the core/lock file in the GCS bucket

Expected behavior
Upgrading to version 1.20.0 without changing the storage configuration should not result in an error creating the lock file or prevent the Vault cluster from starting.

Environment:

  • Vault Server Version (retrieve with vault status): 1.20.0
  • Vault CLI Version (retrieve with vault version): v1.20.0 (6fdd6b5), built 2025-06-23T10:21:30Z
  • Server Operating System/Architecture: GKE Kubernetes cluster v1.30.5-gke.1014003

Vault server configuration file(s):

ui = true

listener "tcp" {
  tls_cert_file = "/vault/userconfig/vault-tls/tls.crt"
  tls_key_file = "/vault/userconfig/vault-tls/tls.key"
  address = "[::]:8200"
  cluster_address = "[::]:8201"
}

plugin_directory = "/usr/local/libexec/vault"

storage "gcs" {
  bucket = "<gcs_bucket_name>"
  ha_enabled = "true"
  chunk_size = "512"
}

service_registration "kubernetes" {}

seal "awskms" {
  region     = "<region>"
  kms_key_id = "<kms_key_id>"
}
disable_mlock = true

Additional context

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugUsed to indicate a potential bugstorage/gcs

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions