{"action":"created","comment":{"url":"https://api.github.com/repos/hashicorp/vault/pulls/comments/176844410","pull_request_review_id":106624557,"id":176844410,"diff_hunk":"@@ -0,0 +1,621 @@\n+---\n+layout: \"guides\"\n+page_title: \"Vault HA with Consul - Guides\"\n+sidebar_current: \"guides-operations-vault-ha\"\n+description: |-\n+  This guide This guide will walk you through a simple Vault Highly Available\n+  (HA) cluster implementation. While this is not an exhaustive or prescriptive\n+  guide that can be used as a drop-in production example, it covers the basics\n+  enough to inform your own production setup.\n+---\n+\n+# Vault Haigh Availability (HA)\n+\n+Vault can run in a high availability (HA) mode to protest against  outages by\n+running multiple Vault servers. Vault is typically bound by the IO limits of the\n+storage backend rather than the compute requirements. Certain storage backends,\n+such as Consul, provide additional coordination functions that enable Vault to\n+run in an HA configuration while others provide a more robust backup and\n+restoration process.\n+\n+This guide will walk you through a simple Vault Highly Available (HA) cluster\n+implementation. While this is not an exhaustive or prescriptive guide that can\n+be used as a drop-in production example, it covers the basics enough to inform\n+your own production setup.\n+\n+\n+## Reference Materials\n+\n+- [High Availability Mode](/docs/concepts/ha.html)\n+- [Consul Storage Backend](/docs/configuration/storage/consul.html)\n+- [High Availability Parameters](/docs/configuration/index.html#high-availability-parameters)\n+- [Consul Agent Configuration](https://www.consul.io/docs/agent/options.html)\n+\n+## Estimated Time to Complete\n+\n+10 minutes\n+\n+## Prerequisites\n+\n+- Vault\n+- Consul\n+\n+## Steps\n+\n+Our goal in following this guide is to arrive at a Vault HA setup\n+consisting of the following:\n+\n+- 2 Vault servers: 1 active and 1 standby\n+- Cluster of 3 Consul servers\n+\n+### Reference Diagram\n+\n+This diagram lays out the simple architecture details for reference:\n+\n+![Reference Architecture](/assets/images/vault-ha-consul.png)\n+\n+We’ll use the open source software editions of Vault and Consul in this guide,\n+but the setup is the same for Enterprise editions.\n+\n+### Consul Server Cluster\n+\n+Our Consul servers in this guide will be defined by IP address only, but also\n+referenced by a label:\n+\n+- **`consul_s1: 10.1.42.101`**\n+- **`consul_s2: 10.1.42.102`**\n+- **`consul_s3: 10.1.42.103`**\n+\n+The consul binary is presumed to be located in /usr/local/bin/consul, but if\n+your case differs, you can adjust the path references accordingly.\n+\n+With that in mind, here is a basic Consul server configuration starting point:\n+\n+#### Consul Server Configuration\n+\n+```plaintext\n+{\n+  \"server\": true,\n+  \"node_id\": \"$NODE_ID\",\n+  \"datacenter\": \"dc1\",\n+  \"data_dir\": \"$CONSUL_DATA_PATH\",\n+  \"bind_addr\": \"0.0.0.0\",\n+  \"client_addr\": \"0.0.0.0\",\n+  \"advertise_addr\": \"$ADVERTISE_ADDR\",\n+  \"bootstrap_expect\": 3,\n+  \"retry_join\": [\"$JOIN1\", \"$JOIN2\", \"$JOIN3\"],\n+  \"ui\": true,\n+  \"log_level\": \"DEBUG\",\n+  \"enable_syslog\": true,\n+  \"acl_enforce_version_8\": false\n+}\n+```\n+\n+Note that some values contain variable placeholders while the rest have\n+reasonable defaults. You should change the following in your own Consul server\n+configuration based on the example:\n+\n+- `$CONSUL_DATA_PATH`: absolute path to Consul data directory; ensure that\n+this directory is writable by the Consul process user.\n+- `$ADVERTISE_ADDR`: this should be set to address that you prefer the Consul\n+servers advertise to the other servers in the cluster and should not be set to\n+`0.0.0.0`; for this guide, it should be set to the Consul server’s IP address in\n+each instance of the configuration file, or `10.1.42.101`,` 10.1.42.102`, and\n+`10.1.42.103` respectively.\n+- `JOIN1**`, `**JOIN2`, `$JOIN3`: This example uses the `retry_join`\n+method of joining the server agents to form a cluster; as such, the values for\n+this guide would be `10.1.42.101`, `10.1.42.102`, and `10.1.42.103` respectively.\n+- `$NODE_ID` this is a unique label for the node; in our case, this will be\n+`consul_s1`, `consul_s2`, and `consul_s3` respectively.\n+\n+You’ll note also that the web user interface is enabled, and Consul will be\n+logging at DEBBUG level to the system log. The last configuration of note, is\n+**`acl_enforce_version_8`** which helps to completely disable the Consul ACL\n+enforcement so that we do not need to be concerned with ACLs in this guide; in a\n+production instance you’d of course want to enable ACLs, and follow the Consul\n+ACL Guide for enabling them.\n+\n+Create one instance of this configuration per Consul server with valid values as\n+in these examples, named `server_agent.json` on each of the Consul server agents\n+named for example, `/usr/local/etc/consul/server_agent.json`:\n+\n+#### `consul1` Example\n+\n+    {\n+      \"server\": true,\n+      \"node_id\": \"consul_s1\",\n+      \"datacenter\": \"dc1\",\n+      \"data_dir\": \"/var/consul/data\",\n+      \"bind_addr\": \"0.0.0.0\",\n+      \"client_addr\": \"0.0.0.0\",\n+      \"advertise_addr\": \"10.1.42.101\",\n+      \"bootstrap_expect\": 3,\n+      \"retry_join\": [\"10.1.42.101\", \"10.1.42.102\", \"10.1.42.103\"],\n+      \"ui\": true,\n+      \"log_level\": \"DEBUG\",\n+      \"enable_syslog\": true,\n+      \"acl_enforce_version_8\": false\n+    }\n+\n+#### `consul2` Example\n+\n+    {\n+      \"server\": true,\n+      \"node_id\": \"consul_s2\",\n+      \"datacenter\": \"dc1\",\n+      \"data_dir\": \"/var/consul/data\",\n+      \"bind_addr\": \"0.0.0.0\",\n+      \"client_addr\": \"0.0.0.0\",\n+      \"advertise_addr\": \"10.1.42.102\",\n+      \"bootstrap_expect\": 3,\n+      \"retry_join\": [\"10.1.42.101\", \"10.1.42.102\", \"10.1.42.103\"],\n+      \"ui\": true,\n+      \"log_level\": \"DEBUG\",\n+      \"enable_syslog\": true,\n+      \"acl_enforce_version_8\": false\n+    }\n+\n+#### consul3 Example\n+\n+    {\n+      \"server\": true,\n+      \"node_id\": \"consul_s3\",","path":"website/source/guides/operations/vault-ha-consul.html.md","position":162,"original_position":162,"commit_id":"b9fb17fe518d247ab084f042b8cd72b0836ca79c","original_commit_id":"b9fb17fe518d247ab084f042b8cd72b0836ca79c","user":{"login":"brianshumate","id":77563,"avatar_url":"https://avatars0.githubusercontent.com/u/77563?v=4","gravatar_id":"","url":"https://api.github.com/users/brianshumate","html_url":"https://github.com/brianshumate","followers_url":"https://api.github.com/users/brianshumate/followers","following_url":"https://api.github.com/users/brianshumate/following{/other_user}","gists_url":"https://api.github.com/users/brianshumate/gists{/gist_id}","starred_url":"https://api.github.com/users/brianshumate/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/brianshumate/subscriptions","organizations_url":"https://api.github.com/users/brianshumate/orgs","repos_url":"https://api.github.com/users/brianshumate/repos","events_url":"https://api.github.com/users/brianshumate/events{/privacy}","received_events_url":"https://api.github.com/users/brianshumate/received_events","type":"User","site_admin":false},"body":"```\r\n\"node_name\": \"consul_s3\",\r\n```\r\n\r\ninstead here, please.\r\n","created_at":"2018-03-23T19:38:13Z","updated_at":"2018-03-23T19:38:39Z","html_url":"https://github.com/hashicorp/vault/pull/4187#discussion_r176844410","pull_request_url":"https://api.github.com/repos/hashicorp/vault/pulls/4187","author_association":"MEMBER","_links":{"self":{"href":"https://api.github.com/repos/hashicorp/vault/pulls/comments/176844410"},"html":{"href":"https://github.com/hashicorp/vault/pull/4187#discussion_r176844410"},"pull_request":{"href":"https://api.github.com/repos/hashicorp/vault/pulls/4187"}}},"pull_request":{"url":"https://api.github.com/repos/hashicorp/vault/pulls/4187","id":176941737,"html_url":"https://github.com/hashicorp/vault/pull/4187","diff_url":"https://github.com/hashicorp/vault/pull/4187.diff","patch_url":"https://github.com/hashicorp/vault/pull/4187.patch","issue_url":"https://api.github.com/repos/hashicorp/vault/issues/4187","number":4187,"state":"open","locked":false,"title":"[WIP] Vault HA guide draft","user":{"login":"yhyakuna","id":7660718,"avatar_url":"https://avatars3.githubusercontent.com/u/7660718?v=4","gravatar_id":"","url":"https://api.github.com/users/yhyakuna","html_url":"https://github.com/yhyakuna","followers_url":"https://api.github.com/users/yhyakuna/followers","following_url":"https://api.github.com/users/yhyakuna/following{/other_user}","gists_url":"https://api.github.com/users/yhyakuna/gists{/gist_id}","starred_url":"https://api.github.com/users/yhyakuna/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/yhyakuna/subscriptions","organizations_url":"https://api.github.com/users/yhyakuna/orgs","repos_url":"https://api.github.com/users/yhyakuna/repos","events_url":"https://api.github.com/users/yhyakuna/events{/privacy}","received_events_url":"https://api.github.com/users/yhyakuna/received_events","type":"User","site_admin":false},"body":"Based on Brian Shumate's doc --> https://support.hashicorp.com/hc/en-us/articles/360002183854","created_at":"2018-03-23T00:02:58Z","updated_at":"2018-03-23T19:38:39Z","closed_at":null,"merged_at":null,"merge_commit_sha":"5d4d96070aaa33c3c8c50c295c39d90ecf3c5e4c","assignee":null,"assignees":[],"requested_reviewers":[],"requested_teams":[],"labels":[],"milestone":null,"commits_url":"https://api.github.com/repos/hashicorp/vault/pulls/4187/commits","review_comments_url":"https://api.github.com/repos/hashicorp/vault/pulls/4187/comments","review_comment_url":"https://api.github.com/repos/hashicorp/vault/pulls/comments{/number}","comments_url":"https://api.github.com/repos/hashicorp/vault/issues/4187/comments","statuses_url":"https://api.github.com/repos/hashicorp/vault/statuses/b9fb17fe518d247ab084f042b8cd72b0836ca79c","head":{"label":"hashicorp:vault-ha-consul","ref":"vault-ha-consul","sha":"b9fb17fe518d247ab084f042b8cd72b0836ca79c","user":{"login":"hashicorp","id":761456,"avatar_url":"https://avatars2.githubusercontent.com/u/761456?v=4","gravatar_id":"","url":"https://api.github.com/users/hashicorp","html_url":"https://github.com/hashicorp","followers_url":"https://api.github.com/users/hashicorp/followers","following_url":"https://api.github.com/users/hashicorp/following{/other_user}","gists_url":"https://api.github.com/users/hashicorp/gists{/gist_id}","starred_url":"https://api.github.com/users/hashicorp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hashicorp/subscriptions","organizations_url":"https://api.github.com/users/hashicorp/orgs","repos_url":"https://api.github.com/users/hashicorp/repos","events_url":"https://api.github.com/users/hashicorp/events{/privacy}","received_events_url":"https://api.github.com/users/hashicorp/received_events","type":"Organization","site_admin":false},"repo":{"id":31288958,"name":"vault","full_name":"hashicorp/vault","owner":{"login":"hashicorp","id":761456,"avatar_url":"https://avatars2.githubusercontent.com/u/761456?v=4","gravatar_id":"","url":"https://api.github.com/users/hashicorp","html_url":"https://github.com/hashicorp","followers_url":"https://api.github.com/users/hashicorp/followers","following_url":"https://api.github.com/users/hashicorp/following{/other_user}","gists_url":"https://api.github.com/users/hashicorp/gists{/gist_id}","starred_url":"https://api.github.com/users/hashicorp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hashicorp/subscriptions","organizations_url":"https://api.github.com/users/hashicorp/orgs","repos_url":"https://api.github.com/users/hashicorp/repos","events_url":"https://api.github.com/users/hashicorp/events{/privacy}","received_events_url":"https://api.github.com/users/hashicorp/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/hashicorp/vault","description":"A tool for secrets management, encryption as a service, and privileged access management","fork":false,"url":"https://api.github.com/repos/hashicorp/vault","forks_url":"https://api.github.com/repos/hashicorp/vault/forks","keys_url":"https://api.github.com/repos/hashicorp/vault/keys{/key_id}","collaborators_url":"https://api.github.com/repos/hashicorp/vault/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/hashicorp/vault/teams","hooks_url":"https://api.github.com/repos/hashicorp/vault/hooks","issue_events_url":"https://api.github.com/repos/hashicorp/vault/issues/events{/number}","events_url":"https://api.github.com/repos/hashicorp/vault/events","assignees_url":"https://api.github.com/repos/hashicorp/vault/assignees{/user}","branches_url":"https://api.github.com/repos/hashicorp/vault/branches{/branch}","tags_url":"https://api.github.com/repos/hashicorp/vault/tags","blobs_url":"https://api.github.com/repos/hashicorp/vault/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/hashicorp/vault/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/hashicorp/vault/git/refs{/sha}","trees_url":"https://api.github.com/repos/hashicorp/vault/git/trees{/sha}","statuses_url":"https://api.github.com/repos/hashicorp/vault/statuses/{sha}","languages_url":"https://api.github.com/repos/hashicorp/vault/languages","stargazers_url":"https://api.github.com/repos/hashicorp/vault/stargazers","contributors_url":"https://api.github.com/repos/hashicorp/vault/contributors","subscribers_url":"https://api.github.com/repos/hashicorp/vault/subscribers","subscription_url":"https://api.github.com/repos/hashicorp/vault/subscription","commits_url":"https://api.github.com/repos/hashicorp/vault/commits{/sha}","git_commits_url":"https://api.github.com/repos/hashicorp/vault/git/commits{/sha}","comments_url":"https://api.github.com/repos/hashicorp/vault/comments{/number}","issue_comment_url":"https://api.github.com/repos/hashicorp/vault/issues/comments{/number}","contents_url":"https://api.github.com/repos/hashicorp/vault/contents/{+path}","compare_url":"https://api.github.com/repos/hashicorp/vault/compare/{base}...{head}","merges_url":"https://api.github.com/repos/hashicorp/vault/merges","archive_url":"https://api.github.com/repos/hashicorp/vault/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/hashicorp/vault/downloads","issues_url":"https://api.github.com/repos/hashicorp/vault/issues{/number}","pulls_url":"https://api.github.com/repos/hashicorp/vault/pulls{/number}","milestones_url":"https://api.github.com/repos/hashicorp/vault/milestones{/number}","notifications_url":"https://api.github.com/repos/hashicorp/vault/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/hashicorp/vault/labels{/name}","releases_url":"https://api.github.com/repos/hashicorp/vault/releases{/id}","deployments_url":"https://api.github.com/repos/hashicorp/vault/deployments","created_at":"2015-02-25T00:15:59Z","updated_at":"2018-03-23T18:22:00Z","pushed_at":"2018-03-23T19:16:17Z","git_url":"git://github.com/hashicorp/vault.git","ssh_url":"git@github.com:hashicorp/vault.git","clone_url":"https://github.com/hashicorp/vault.git","svn_url":"https://github.com/hashicorp/vault","homepage":"https://www.vaultproject.io/","size":44819,"stargazers_count":8773,"watchers_count":8773,"language":"Go","has_issues":true,"has_projects":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":1277,"mirror_url":null,"archived":false,"open_issues_count":223,"license":{"key":"mpl-2.0","name":"Mozilla Public License 2.0","spdx_id":"MPL-2.0","url":"https://api.github.com/licenses/mpl-2.0"},"forks":1277,"open_issues":223,"watchers":8773,"default_branch":"master"}},"base":{"label":"hashicorp:master","ref":"master","sha":"6c0b238459756032c35d1dc95707eb419142e6c2","user":{"login":"hashicorp","id":761456,"avatar_url":"https://avatars2.githubusercontent.com/u/761456?v=4","gravatar_id":"","url":"https://api.github.com/users/hashicorp","html_url":"https://github.com/hashicorp","followers_url":"https://api.github.com/users/hashicorp/followers","following_url":"https://api.github.com/users/hashicorp/following{/other_user}","gists_url":"https://api.github.com/users/hashicorp/gists{/gist_id}","starred_url":"https://api.github.com/users/hashicorp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hashicorp/subscriptions","organizations_url":"https://api.github.com/users/hashicorp/orgs","repos_url":"https://api.github.com/users/hashicorp/repos","events_url":"https://api.github.com/users/hashicorp/events{/privacy}","received_events_url":"https://api.github.com/users/hashicorp/received_events","type":"Organization","site_admin":false},"repo":{"id":31288958,"name":"vault","full_name":"hashicorp/vault","owner":{"login":"hashicorp","id":761456,"avatar_url":"https://avatars2.githubusercontent.com/u/761456?v=4","gravatar_id":"","url":"https://api.github.com/users/hashicorp","html_url":"https://github.com/hashicorp","followers_url":"https://api.github.com/users/hashicorp/followers","following_url":"https://api.github.com/users/hashicorp/following{/other_user}","gists_url":"https://api.github.com/users/hashicorp/gists{/gist_id}","starred_url":"https://api.github.com/users/hashicorp/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hashicorp/subscriptions","organizations_url":"https://api.github.com/users/hashicorp/orgs","repos_url":"https://api.github.com/users/hashicorp/repos","events_url":"https://api.github.com/users/hashicorp/events{/privacy}","received_events_url":"https://api.github.com/users/hashicorp/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/hashicorp/vault","description":"A tool for secrets management, encryption as a service, and privileged access management","fork":false,"url":"https://api.github.com/repos/hashicorp/vault","forks_url":"https://api.github.com/repos/hashicorp/vault/forks","keys_url":"https://api.github.com/repos/hashicorp/vault/keys{/key_id}","collaborators_url":"https://api.github.com/repos/hashicorp/vault/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/hashicorp/vault/teams","hooks_url":"https://api.github.com/repos/hashicorp/vault/hooks","issue_events_url":"https://api.github.com/repos/hashicorp/vault/issues/events{/number}","events_url":"https://api.github.com/repos/hashicorp/vault/events","assignees_url":"https://api.github.com/repos/hashicorp/vault/assignees{/user}","branches_url":"https://api.github.com/repos/hashicorp/vault/branches{/branch}","tags_url":"https://api.github.com/repos/hashicorp/vault/tags","blobs_url":"https://api.github.com/repos/hashicorp/vault/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/hashicorp/vault/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/hashicorp/vault/git/refs{/sha}","trees_url":"https://api.github.com/repos/hashicorp/vault/git/trees{/sha}","statuses_url":"https://api.github.com/repos/hashicorp/vault/statuses/{sha}","languages_url":"https://api.github.com/repos/hashicorp/vault/languages","stargazers_url":"https://api.github.com/repos/hashicorp/vault/stargazers","contributors_url":"https://api.github.com/repos/hashicorp/vault/contributors","subscribers_url":"https://api.github.com/repos/hashicorp/vault/subscribers","subscription_url":"https://api.github.com/repos/hashicorp/vault/subscription","commits_url":"https://api.github.com/repos/hashicorp/vault/commits{/sha}","git_commits_url":"https://api.github.com/repos/hashicorp/vault/git/commits{/sha}","comments_url":"https://api.github.com/repos/hashicorp/vault/comments{/number}","issue_comment_url":"https://api.github.com/repos/hashicorp/vault/issues/comments{/number}","contents_url":"https://api.github.com/repos/hashicorp/vault/contents/{+path}","compare_url":"https://api.github.com/repos/hashicorp/vault/compare/{base}...{head}","merges_url":"https://api.github.com/repos/hashicorp/vault/merges","archive_url":"https://api.github.com/repos/hashicorp/vault/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/hashicorp/vault/downloads","issues_url":"https://api.github.com/repos/hashicorp/vault/issues{/number}","pulls_url":"https://api.github.com/repos/hashicorp/vault/pulls{/number}","milestones_url":"https://api.github.com/repos/hashicorp/vault/milestones{/number}","notifications_url":"https://api.github.com/repos/hashicorp/vault/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/hashicorp/vault/labels{/name}","releases_url":"https://api.github.com/repos/hashicorp/vault/releases{/id}","deployments_url":"https://api.github.com/repos/hashicorp/vault/deployments","created_at":"2015-02-25T00:15:59Z","updated_at":"2018-03-23T18:22:00Z","pushed_at":"2018-03-23T19:16:17Z","git_url":"git://github.com/hashicorp/vault.git","ssh_url":"git@github.com:hashicorp/vault.git","clone_url":"https://github.com/hashicorp/vault.git","svn_url":"https://github.com/hashicorp/vault","homepage":"https://www.vaultproject.io/","size":44819,"stargazers_count":8773,"watchers_count":8773,"language":"Go","has_issues":true,"has_projects":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":1277,"mirror_url":null,"archived":false,"open_issues_count":223,"license":{"key":"mpl-2.0","name":"Mozilla Public License 2.0","spdx_id":"MPL-2.0","url":"https://api.github.com/licenses/mpl-2.0"},"forks":1277,"open_issues":223,"watchers":8773,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/hashicorp/vault/pulls/4187"},"html":{"href":"https://github.com/hashicorp/vault/pull/4187"},"issue":{"href":"https://api.github.com/repos/hashicorp/vault/issues/4187"},"comments":{"href":"https://api.github.com/repos/hashicorp/vault/issues/4187/comments"},"review_comments":{"href":"https://api.github.com/repos/hashicorp/vault/pulls/4187/comments"},"review_comment":{"href":"https://api.github.com/repos/hashicorp/vault/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/hashicorp/vault/pulls/4187/commits"},"statuses":{"href":"https://api.github.com/repos/hashicorp/vault/statuses/b9fb17fe518d247ab084f042b8cd72b0836ca79c"}},"author_association":"CONTRIBUTOR"}}
{"actor":{"display_login":"brianshumate"}}