The Production Hardening document indicates how to harden Vault for production purposes, but what if Vault is run on for example Digital Ocean and the platform is unavailable or the disk gets corrupted?
Add a comment
|
2 Answers
Well, the first step is to use a backend which supports HA. Consul, for example, supports HA. If you are not an enterprise customer, you may have to run a shell script via cron to upload consul snapshots to s3 or where ever you want to store them. Later, you can restore all your secrets. And obviously, the snapshots are encrypted.
According to this documentation two vault servers have to be run. One of them has to be active and the other passive. In order to run such a setup both vault servers need to be unsealed.