<p>According to <a href="https://learn.hashicorp.com/vault/operations/ops-vault-ha-consul" rel="nofollow noreferrer">this documentation</a>, each vault has to be unsealed in a HA setup.</p>

<blockquote>
  <p>Now you need to initializing and unsealing each Vault instance.</p>

<pre><code># Initialize vault_s1
$ vault operator init

# Unseal the vault_s1
$ vault operator unseal &lt;unseal_key_1&gt;

$ vault operator unseal &lt;unseal_key_2&gt;

$ vault operator unseal &lt;unseal_key_3&gt;
</code></pre>
</blockquote>

CC BY-SA 4.0
2019-08-02T14:36:27.023Z
Thanks, yea I also got a reply back from someone at HashiCorp, whom verified that as well.
xil3
CC BY-SA 4.0
2019-07-27T09:30:51.730Z
2019-07-27T09:35:58.870Z
2019-07-27T09:35:58.870Z
030
<p>My goal has been to setup Vault in HA mode.</p>

<p>Based on the docs, I was under the assumption that if you had a node that is in 'standby' it would forward to the active node, thus not having to unseal (assuming the active node was already unsealed). Right now, non of the nodes forward/redirect - they just serve the Vault UI.</p>

<p>Here's my existing Vault config:</p>

<pre><code>ui = true
api_addr = "https://{{inventory_hostname}}:8200"
cluster_addr = "https://{{inventory_hostname}}:8201"

storage "etcd" {
  address  = "https://etcdhost:2379"
  etcd_api = "v3"
  ha_enabled = "true"
  tls_ca_file = "{{tls_path}}rootCA.crt"
  tls_cert_file = "{{tls_path}}etcd.crt"
  tls_key_file = "{{tls_path}}etcd.key"
  path = "{{etcd_path}}"
}

listener "tcp" {
  address     = "0.0.0.0:8200"
  tls_cert_file="{{tls_path}}etcd.crt"
  tls_key_file="{{tls_path}}etcd.key"
}
</code></pre>

CC BY-SA 4.0
2020-02-21T14:04:06.827Z
I see you are using ansible. I am on that path as well. Now how do you make sure the unseal keys are not stored together. from this link https://learn.hashicorp.com/vault/getting-started/deploy#initializing-the-vault : "For the purpose of this getting started guide, save all of these keys somewhere, and continue. In a real deployment scenario, you would never save these keys together. Instead, you would likely use Vault's PGP and Keybase.io support to encrypt each of these keys with the users' PGP keys. ...."
black sensei
<hashicorp-vault><high-availability>
When setting up HashiCorp Vault in HA mode, is it normal that you have to unseal each Vault node?
xil3
# When setting up HashiCorp Vault in HA mode, is it normal that you have to unseal each Vault node?

(Asked by: username_0 on 2019-07-26)

My goal has been to setup Vault in HA mode.
Based on the docs, I was under the assumption that if you had a node that is in 'standby' it would forward to the active node, thus not having to unseal (assuming the active node was already unsealed). Right now, non of the nodes forward/redirect - they just serve the Vault UI.
Here's my existing Vault config:
ui = true
api_addr = "https://{{inventory_hostname}}:8200"
cluster_addr = "https://{{inventory_hostname}}:8201"

storage "etcd" {
  address  = "https://etcdhost:2379"
  etcd_api = "v3"
  ha_enabled = "true"
  tls_ca_file = "{{tls_path}}rootCA.crt"
  tls_cert_file = "{{tls_path}}etcd.crt"
  tls_key_file = "{{tls_path}}etcd.key"
  path = "{{etcd_path}}"
}

listener "tcp" {
  address     = "0.0.0.0:8200"
  tls_cert_file="{{tls_path}}etcd.crt"
  tls_key_file="{{tls_path}}etcd.key"
}

**Tags:** hashicorp-vault, high-availability

> **Comments:**
> **username_1**: I see you are using ansible. I am on that path as well. Now how do you make sure the unseal keys are not stored together. from this link https://learn.hashicorp.com/vault/getting-started/deploy#initializing-the-vault : "For the purpose of this getting started guide, save all of these keys somewhere, and continue. In a real deployment scenario, you would never save these keys together. Instead, you would likely use Vault's PGP and Keybase.io support to encrypt each of these keys with the users' PGP keys. ...."  

---

## 1 answers

### Answer by username_2 on 2019-07-27. Score: 1 | Accepted answer

According to this documentation, each vault has to be unsealed in a HA setup.

Now you need to initializing and unsealing each Vault instance.
# Initialize vault_s1
$ vault operator init

# Unseal the vault_s1
$ vault operator unseal 

$ vault operator unseal 

$ vault operator unseal

> **Comments:**
> **username_0**: Thanks, yea I also got a reply back from someone at HashiCorp, whom verified that as well.  

---

