Answers: <p>According to <a href="https://learn.hashicorp.com/vault/operations/ops-vault-ha-consul" rel="nofollow noreferrer">this documentation</a>, each vault has to be unsealed in a HA setup.</p>
  
  <blockquote>
    <p>Now you need to initializing and unsealing each Vault instance.</p>
  
  <pre><code># Initialize vault_s1
  $ vault operator init
  
  # Unseal the vault_s1
  $ vault operator unseal &lt;unseal_key_1&gt;
  
  $ vault operator unseal &lt;unseal_key_2&gt;
  
  $ vault operator unseal &lt;unseal_key_3&gt;
  </code></pre>
  </blockquote>
  
Answers: CC BY-SA 4.0
Answers: 2019-08-02T14:36:27.023Z
Answers: Thanks, yea I also got a reply back from someone at HashiCorp, whom verified that as well.
Answers: xil3
Answers: CC BY-SA 4.0
Answers: 2019-07-27T09:30:51.730Z
Answers: 2019-07-27T09:35:58.870Z
Answers: 2019-07-27T09:35:58.870Z
Answers: 030
Body: <p>My goal has been to setup Vault in HA mode.</p>
  
  <p>Based on the docs, I was under the assumption that if you had a node that is in 'standby' it would forward to the active node, thus not having to unseal (assuming the active node was already unsealed). Right now, non of the nodes forward/redirect - they just serve the Vault UI.</p>
  
  <p>Here's my existing Vault config:</p>
  
  <pre><code>ui = true
  api_addr = "https://{{inventory_hostname}}:8200"
  cluster_addr = "https://{{inventory_hostname}}:8201"
  
  storage "etcd" {
    address  = "https://etcdhost:2379"
    etcd_api = "v3"
    ha_enabled = "true"
    tls_ca_file = "{{tls_path}}rootCA.crt"
    tls_cert_file = "{{tls_path}}etcd.crt"
    tls_key_file = "{{tls_path}}etcd.key"
    path = "{{etcd_path}}"
  }
  
  listener "tcp" {
    address     = "0.0.0.0:8200"
    tls_cert_file="{{tls_path}}etcd.crt"
    tls_key_file="{{tls_path}}etcd.key"
  }
  </code></pre>
  
Comments: CC BY-SA 4.0
Comments: 2020-02-21T14:04:06.827Z
Comments: I see you are using ansible. I am on that path as well. Now how do you make sure the unseal keys are not stored together. from this link https://learn.hashicorp.com/vault/getting-started/deploy#initializing-the-vault : "For the purpose of this getting started guide, save all of these keys somewhere, and continue. In a real deployment scenario, you would never save these keys together. Instead, you would likely use Vault's PGP and Keybase.io support to encrypt each of these keys with the users' PGP keys. ...."
Comments: black sensei
Tags: <hashicorp-vault><high-availability>
Title: When setting up HashiCorp Vault in HA mode, is it normal that you have to unseal each Vault node?
UserDisplayName: xil3
ThreadText: # When setting up HashiCorp Vault in HA mode, is it normal that you have to unseal each Vault node?
  
  (Asked by: username_0 on 2019-07-26)
  
  My goal has been to setup Vault in HA mode.
  
  Based on the docs, I was under the assumption that if you had a node that is in 'standby' it would forward to the active node, thus not having to unseal (assuming the active node was already unsealed). Right now, non of the nodes forward/redirect - they just serve the Vault UI.
  
  Here's my existing Vault config:
  
  ```
  ui = true
  api_addr = "https://{{inventory_hostname}}:8200"
  cluster_addr = "https://{{inventory_hostname}}:8201"
  
  storage "etcd" {
    address  = "https://etcdhost:2379"
    etcd_api = "v3"
    ha_enabled = "true"
    tls_ca_file = "{{tls_path}}rootCA.crt"
    tls_cert_file = "{{tls_path}}etcd.crt"
    tls_key_file = "{{tls_path}}etcd.key"
    path = "{{etcd_path}}"
  }
  
  listener "tcp" {
    address     = "0.0.0.0:8200"
    tls_cert_file="{{tls_path}}etcd.crt"
    tls_key_file="{{tls_path}}etcd.key"
  }
  
  ```
  
  **Tags:** hashicorp-vault, high-availability
  
  > **Comments:**
  > **username_1**: I see you are using ansible. I am on that path as well. Now how do you make sure the unseal keys are not stored together. from this link https://learn.hashicorp.com/vault/getting-started/deploy#initializing-the-vault : "For the purpose of this getting started guide, save all of these keys somewhere, and continue. In a real deployment scenario, you would never save these keys together. Instead, you would likely use Vault's PGP and Keybase.io support to encrypt each of these keys with the users' PGP keys. ...."  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_2 on 2019-07-27. Score: 1 | Accepted answer
  
  According to [this documentation](https://learn.hashicorp.com/vault/operations/ops-vault-ha-consul), each vault has to be unsealed in a HA setup.
  
  > Now you need to initializing and unsealing each Vault instance.
  >
  > ```
  > # Initialize vault_s1
  > $ vault operator init
  >
  > # Unseal the vault_s1
  > $ vault operator unseal <unseal_key_1>
  >
  > $ vault operator unseal <unseal_key_2>
  >
  > $ vault operator unseal <unseal_key_3>
  >
  > ```
  
  > **Comments:**
  > **username_0**: Thanks, yea I also got a reply back from someone at HashiCorp, whom verified that as well.  
  
  ---
  
  