My goal has been to setup Vault in HA mode.

Based on the docs, I was under the assumption that if you had a node that is in 'standby' it would forward to the active node, thus not having to unseal (assuming the active node was already unsealed). Right now, non of the nodes forward/redirect - they just serve the Vault UI.

Here's my existing Vault config:

ui = true
api_addr = "https://{{inventory_hostname}}:8200"
cluster_addr = "https://{{inventory_hostname}}:8201"

storage "etcd" {
  address  = "https://etcdhost:2379"
  etcd_api = "v3"
  ha_enabled = "true"
  tls_ca_file = "{{tls_path}}rootCA.crt"
  tls_cert_file = "{{tls_path}}etcd.crt"
  tls_key_file = "{{tls_path}}etcd.key"
  path = "{{etcd_path}}"

listener "tcp" {
  address     = ""

According to this documentation, each vault has to be unsealed in a HA setup.

Now you need to initializing and unsealing each Vault instance.

# Initialize vault_s1
$ vault operator init

# Unseal the vault_s1
$ vault operator unseal <unseal_key_1>

$ vault operator unseal <unseal_key_2>

$ vault operator unseal <unseal_key_3>
  • Thanks, yea I also got a reply back from someone at HashiCorp, whom verified that as well. – xil3 Aug 2 at 14:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.