title: HashiCorp Vault sealing questions
body: <p>I've started playing with Hashicorp's Vault to manage secrets and had some questions about the day-to-day of Vault sealing.  My workflow has two auth backends; specific users access Vault with write access to add new secrets, servers have readonly access for the secrets they need.</p>
  
  <p>1) Under normal circumstances, does the Vault stay in an unsealed state?  I believe it would as a dynamically provisioned server should not have to coordinate an unseal.</p>
  
  <p>2) Is the purpose of sealing to off-board staff to rotate keys and in case of an intrusion?</p>
  
  <p>3) What's the best practice for ensuring the vault process is always running, since if it dies the Vault will seal?  Also, in a highly available configuration, if one Vault node's process dies, does it seal the Vault for everyone?</p>