Not able to unseal the vault in transit mode

Vault
,
1

Hi Team,
I am not able to unseal the vault in transit mode if vault1 is down(vault1 has been removed due to some architecture design issue).
Is there any solution to recover all of the data back without vault 1?

Here’s the link I am following

Thanks,
Freud

2

You’ll need to restore the transit unseal server (Vault1 it sounds like) to unseal a cluster that relies on it for unsealing. If you don’t have a backup of the vault1 cluster, anything relying on that cluster to unseal is going to be lost.

1 Like
3

Thanks, Mike! This seems to be the only way we can choose.

4

@luoyan35714 if you want to go down that route I would advise that you set up a vault cluster instead of one vault server to be used as unseal.

Think about the overhead it all causes. I was planning to implement it that way too, but in the end after discussing with the operations team we decided to do manual unseal.

Note that your vault1 still needs to be manually unsealed.

So your other choices are:

  • manual unseal
  • use a HSM for unsealing
  • auto unseal through AWS/Azure KMS