When setting up HashiCorp Vault in HA mode, is it normal that you have to unseal each Vault node?

Question

My goal has been to setup Vault in HA mode.

Based on the docs, I was under the assumption that if you had a node that is in 'standby' it would forward to the active node, thus not having to unseal (assuming the active node was already unsealed). Right now, non of the nodes forward/redirect - they just serve the Vault UI.

Here's my existing Vault config:

ui = true
api_addr = "https://{{inventory_hostname}}:8200"
cluster_addr = "https://{{inventory_hostname}}:8201"

storage "etcd" {
  address  = "https://etcdhost:2379"
  etcd_api = "v3"
  ha_enabled = "true"
  tls_ca_file = "{{tls_path}}rootCA.crt"
  tls_cert_file = "{{tls_path}}etcd.crt"
  tls_key_file = "{{tls_path}}etcd.key"
  path = "{{etcd_path}}"
}

listener "tcp" {
  address     = "0.0.0.0:8200"
  tls_cert_file="{{tls_path}}etcd.crt"
  tls_key_file="{{tls_path}}etcd.key"
}

Answer 1

According to this documentation, each vault has to be unsealed in a HA setup.

Now you need to initializing and unsealing each Vault instance.

# Initialize vault_s1
$ vault operator init

# Unseal the vault_s1
$ vault operator unseal <unseal_key_1>

$ vault operator unseal <unseal_key_2>

$ vault operator unseal <unseal_key_3>