title: Continuous TLS handshake error logs in vault nodes due to LB health check
body: <p>I am getting continuous TLS handshake errors every 5 sec due to my load balancer pinging vault nodes in every 5 seconds. Kube load balancer is pinging my vault nodes using</p>
  <p><code>nc -vz podip podPort</code> every 5 sec</p>
  <p>I have already disabled client cert verification in my config.hcl but still see below logs in my kubectl logs for vault</p>
  <pre><code>kubectl logs pod-0 -n mynamespace 
  [INFO]  http: TLS handshake error from 10.x.x.x:60056: EOF 2020-09-02T01:13:32.957Z 
  [INFO]  http: TLS handshake error from 10.x.x.x:23995: EOF 2020-09-02T01:13:37.957Z 
  [INFO]  http: TLS handshake error from 10.x.x.x:54165: EOF 2020-09-02T01:13:42.957Z 
  </code></pre>
  <p>Below is my config.hcl which I am loading via kube config map</p>
  <pre><code>
  
  apiVersion: v1
  kind: ConfigMap
  metadata:
    name: raft-config
    labels:
      name: raft-config
  data:
    config.hcl: |
      storage &quot;raft&quot; {
        path  = &quot;/vault-data&quot;
        tls_skip_verify = &quot;true&quot;
        retry_join {
          leader_api_addr = &quot;https://vault-cluster-0:8200&quot;
          leader_ca_cert_file = &quot;/opt/ca/vault.crt&quot;
          leader_client_cert_file = &quot;/opt/ca/vault.crt&quot;
          leader_client_key_file = &quot;/opt/ca/vault.key&quot;
        }
        retry_join {
          leader_api_addr = &quot;https://vault-cluster-1:8200&quot;
          leader_ca_cert_file = &quot;/opt/ca/vault.crt&quot;
          leader_client_cert_file = &quot;/opt/ca/vault.crt&quot;
          leader_client_key_file = &quot;/opt/ca/vault.key&quot;
        }
        retry_join {
          leader_api_addr = &quot;https://vault-cluster-2:8200&quot;
          leader_ca_cert_file = &quot;/opt/ca/vault.crt&quot;
          leader_client_cert_file = &quot;/opt/ca/vault.crt&quot;
          leader_client_key_file = &quot;/opt/ca/vault.key&quot;
        }
      }
      seal &quot;transit&quot; {
       address = &quot;https://vaulttransit:8200&quot;
       disable_renewal = &quot;false&quot;
       key_name = &quot;autounseal&quot;
       mount_path = &quot;transit/&quot;
       tls_skip_verify = &quot;true&quot;
      }
      listener &quot;tcp&quot; {
       address = &quot;0.0.0.0:8200&quot;
       tls_cert_file = &quot;/opt/ca/vault.crt&quot;
       tls_key_file = &quot;/opt/ca/vault.key&quot;
       tls_skip_verify = &quot;true&quot;
       tls_disable_client_certs = &quot;true&quot;
      }
      ui=true
      disable_mlock = true
  </code></pre>
  <p>As I am using external open source vault image and my load balancer is an internal LB (which has internal CA cert). I am suspecting my vault pod is not able to recognize the CA cert provided by my load balancer when it tries to ping port 8200(TCP listener is started by vault on this port)</p>
  <p>These logs are harmless and not causing any issue but they are unnecessary noise which I want to avoid. My vault nodes are working on https and there seems to be no issue in their functionality.</p>
  <p>Can someone please help understand why vault TCP listener is trying to do TLS handshake even though I have explicitly specified <code>tls_disable_client_certs = &quot;true&quot;</code></p>
  <p>Again these logs are flooding my pods every 5 sec when my LB tries to do a health check on my pods using <code>nc -vz podip podPort</code></p>
  <p>My vault version is 1.5.3</p>