Describe the bug
After upgrading Vault from version 1.19.5 to 1.20.0, using a GCS bucket as the storage backend with the ha_enabled=true option enabled, the following error appears in the pod:
core: failed to acquire lock: error="lock: attempt lock: write lock: failed to read attrs for \"core/lock\": storage: object doesn't exist: googleapi: Error 404: No such object: <gcs_bucket_name>/core/lock, notFound"
The core/lock file does not appear in the bucket itself:
> gsutil ls gs://<gcs_bucket_name>/core
gs://<gcs_bucket_name>/core/audit
gs://<gcs_bucket_name>/core/auth
gs://<gcs_bucket_name>/core/canary-keyring
gs://<gcs_bucket_name>/core/index-header-hmac-key
gs://<gcs_bucket_name>/core/keyring
gs://<gcs_bucket_name>/core/local-audit
gs://<gcs_bucket_name>/core/local-auth
gs://<gcs_bucket_name>/core/local-mounts
gs://<gcs_bucket_name>/core/master
gs://<gcs_bucket_name>/core/mounts
gs://<gcs_bucket_name>/core/recovery-config
gs://<gcs_bucket_name>/core/recovery-key
gs://<gcs_bucket_name>/core/recovery-keys-backup
gs://<gcs_bucket_name>/core/seal-config
gs://<gcs_bucket_name>/core/seal-gen-info
gs://<gcs_bucket_name>/core/shamir-kek
gs://<gcs_bucket_name>/core/cluster/
gs://<gcs_bucket_name>/core/hsm/
gs://<gcs_bucket_name>/core/plugin-catalog/
gs://<gcs_bucket_name>/core/versions/
gs://<gcs_bucket_name>/core/wrapping/
To Reproduce
- Install Vault version 1.19.5 in the Kubernetes cluster using the official Helm chart
- Use a GCS bucket as the storage backend
- Update the Vault Docker image version to 1.20.0
- Check the events in the Vault pod
- Check for the existence of the
core/lock file in the GCS bucket
Expected behavior
Upgrading to version 1.20.0 without changing the storage configuration should not result in an error creating the lock file or prevent the Vault cluster from starting.
Environment:
- Vault Server Version (retrieve with
vault status): 1.20.0
- Vault CLI Version (retrieve with
vault version): v1.20.0 (6fdd6b5), built 2025-06-23T10:21:30Z
- Server Operating System/Architecture: GKE Kubernetes cluster v1.30.5-gke.1014003
Vault server configuration file(s):
ui = true
listener "tcp" {
tls_cert_file = "/vault/userconfig/vault-tls/tls.crt"
tls_key_file = "/vault/userconfig/vault-tls/tls.key"
address = "[::]:8200"
cluster_address = "[::]:8201"
}
plugin_directory = "/usr/local/libexec/vault"
storage "gcs" {
bucket = "<gcs_bucket_name>"
ha_enabled = "true"
chunk_size = "512"
}
service_registration "kubernetes" {}
seal "awskms" {
region = "<region>"
kms_key_id = "<kms_key_id>"
}
disable_mlock = true
Additional context
Describe the bug
After upgrading Vault from version 1.19.5 to 1.20.0, using a GCS bucket as the storage backend with the
ha_enabled=trueoption enabled, the following error appears in the pod:The
core/lockfile does not appear in the bucket itself:To Reproduce
core/lockfile in the GCS bucketExpected behavior
Upgrading to version 1.20.0 without changing the storage configuration should not result in an error creating the lock file or prevent the Vault cluster from starting.
Environment:
vault status): 1.20.0vault version): v1.20.0 (6fdd6b5), built 2025-06-23T10:21:30ZVault server configuration file(s):
Additional context