My goal has been to setup Vault in HA mode.

Based on the docs, I was under the assumption that if you had a node that is in 'standby' it would forward to the active node, thus not having to unseal (assuming the active node was already unsealed). Right now, non of the nodes forward/redirect - they just serve the Vault UI.

Here's my existing Vault config:

ui = true
api_addr = "https://{{inventory_hostname}}:8200"
cluster_addr = "https://{{inventory_hostname}}:8201"

storage "etcd" {
  address  = "https://etcdhost:2379"
  etcd_api = "v3"
  ha_enabled = "true"
  tls_ca_file = "{{tls_path}}rootCA.crt"
  tls_cert_file = "{{tls_path}}etcd.crt"
  tls_key_file = "{{tls_path}}etcd.key"
  path = "{{etcd_path}}"

listener "tcp" {
  address     = ""
  • I see you are using ansible. I am on that path as well. Now how do you make sure the unseal keys are not stored together. from this link learn.hashicorp.com/vault/getting-started/… : "For the purpose of this getting started guide, save all of these keys somewhere, and continue. In a real deployment scenario, you would never save these keys together. Instead, you would likely use Vault's PGP and Keybase.io support to encrypt each of these keys with the users' PGP keys. ...." Feb 21, 2020 at 14:04

1 Answer 1


According to this documentation, each vault has to be unsealed in a HA setup.

Now you need to initializing and unsealing each Vault instance.

# Initialize vault_s1
$ vault operator init

# Unseal the vault_s1
$ vault operator unseal <unseal_key_1>

$ vault operator unseal <unseal_key_2>

$ vault operator unseal <unseal_key_3>
  • Thanks, yea I also got a reply back from someone at HashiCorp, whom verified that as well.
    – xil3
    Aug 2, 2019 at 14:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.