How to list peers on the secondary DR cluster

Summary

This article shows how to obtain the list of peers on the DR secondary cluster.

Architecture

Assuming the architecture consists of two Vault Enterprise clusters: one primary Vault cluster and another secondary Vault cluster with disaster recovery replication enabled as explained here.

Prerequisites

• Two Vault clusters using Integrated Storage (Raft) as storage backend and Disaster Recovery replication enabled
• Vault Enterprise versions 1.7, 1.8, 1.9

Issue

 Listing the peers on a DR secondary cluster is failing with the error path disabled in replication DR secondary mode.

$ vault operator raft list-peers
Error reading the raft cluster configuration: Error making API request.

URL: GET https://vault-cluster.dev:8200/v1/sys/storage/raft/configuration
Code: 400. Errors:

* path disabled in replication DR secondary mode

Solution

- Generate a DR operation token on DR secondary cluster

• Start the DR operation token generation process.

$ vault operator generate-root -dr-token -init
A One-Time-Password has been generated for you and is shown in the OTP field.
You will need this value to decode the resulting root token, so keep it safe.

Nonce         e68edd85-74f5-3b0b-2466-850cd6dd52cb
Started       true
Progress      0/3
Complete      false
OTP           aZePuBbOxRjjXDLQGaTBT0EW2K
OTP Length    26

• Run the following command for each unseal/recovery key

vault operator generate-root -dr-token \
 -nonce=e68edd85-74f5-3b0b-2466-850cd6dd52cb \
X7qnGTzV6cuD+WtaWjcR67chJLiI0i0iZglZ4fun7EGC

Nonce       e68edd85-74f5-3b0b-2466-850cd6dd52cb
Started     true
Progress    1/3
Complete    false

vault operator generate-root -dr-token \
-nonce=e68edd85-74f5-3b0b-2466-850cd6dd52cb \
f9kDBTttibwgPcCPXE/Bu1eM5uL2YJOh8kzDFAp2q/2f
Nonce       e68edd85-74f5-3b0b-2466-850cd6dd52cb
Started     true
Progress    2/3
Complete    false

vault operator generate-root -dr-token \
-nonce=e68edd85-74f5-3b0b-2466-850cd6dd52cb \
isxQajloXimbBqMu7yr6S5tnJ0u+CmLnPCKNLocLqUAq
Nonce            e68edd85-74f5-3b0b-2466-850cd6dd52cb
Started          true
Progress         3/3
Complete         true
Encoded Token    EnRUMRx1UTghJ18/Kwd6NAwHFTU7cx0GfAo

The encoded token is provided in the output after all unseal/recovery keys are provided.

•  Decode the encoded token

vault operator generate-root -dr-token \
-otp="aZePuBbOxRjjXDLQGaTBT0EW2K" \
-decode=EnRUMRx1UTghJ18/Kwd6NAwHFTU7cx0GfAo

s.1ai73wYu5UsC6eKfAwoCXQNA

- List the peers on the secondary DR cluster using the DR operation token

vault operator raft list-peers -dr-token="s.1ai73wYu5UsC6eKfAwoCXQNA"

Node     Address               State       Voter
----     -------               -----       -----
node1    172.31.1.130:8201     leader      true
node2    172.31.16.128:8201    follower    true
node3    172.31.32.30:8201     follower    true