Summary
This article shows how to obtain the list of peers on the DR secondary cluster.
Architecture
Assuming the architecture consists of two Vault Enterprise clusters: one primary Vault cluster and another secondary Vault cluster with disaster recovery replication enabled as explained here.
Prerequisites
- Two Vault clusters using Integrated Storage (Raft) as storage backend and Disaster Recovery replication enabled
- Vault Enterprise versions 1.7, 1.8, 1.9
Issue
Listing the peers on a DR secondary cluster is failing with the error path disabled in replication DR secondary mode.
$ vault operator raft list-peers
Error reading the raft cluster configuration: Error making API request.
URL: GET https://vault-cluster.dev:8200/v1/sys/storage/raft/configuration
Code: 400. Errors:
* path disabled in replication DR secondary mode
Solution
- Generate a DR operation token on DR secondary cluster
- Start the DR operation token generation process.
$ vault operator generate-root -dr-token -init
A One-Time-Password has been generated for you and is shown in the OTP field.
You will need this value to decode the resulting root token, so keep it safe.
Nonce e68edd85-74f5-3b0b-2466-850cd6dd52cb
Started true
Progress 0/3
Complete false
OTP aZePuBbOxRjjXDLQGaTBT0EW2K
OTP Length 26
- Run the following command for each unseal/recovery key
vault operator generate-root -dr-token \
-nonce=e68edd85-74f5-3b0b-2466-850cd6dd52cb \
X7qnGTzV6cuD+WtaWjcR67chJLiI0i0iZglZ4fun7EGC
Nonce e68edd85-74f5-3b0b-2466-850cd6dd52cb
Started true
Progress 1/3
Complete false
vault operator generate-root -dr-token \
-nonce=e68edd85-74f5-3b0b-2466-850cd6dd52cb \
f9kDBTttibwgPcCPXE/Bu1eM5uL2YJOh8kzDFAp2q/2f
Nonce e68edd85-74f5-3b0b-2466-850cd6dd52cb
Started true
Progress 2/3
Complete false
vault operator generate-root -dr-token \
-nonce=e68edd85-74f5-3b0b-2466-850cd6dd52cb \
isxQajloXimbBqMu7yr6S5tnJ0u+CmLnPCKNLocLqUAq
Nonce e68edd85-74f5-3b0b-2466-850cd6dd52cb
Started true
Progress 3/3
Complete true
Encoded Token EnRUMRx1UTghJ18/Kwd6NAwHFTU7cx0GfAo
The encoded token is provided in the output after all unseal/recovery keys are provided.
- Decode the encoded token
vault operator generate-root -dr-token \
-otp="aZePuBbOxRjjXDLQGaTBT0EW2K" \
-decode=EnRUMRx1UTghJ18/Kwd6NAwHFTU7cx0GfAo
s.1ai73wYu5UsC6eKfAwoCXQNA
- List the peers on the secondary DR cluster using the DR operation token
vault operator raft list-peers -dr-token="s.1ai73wYu5UsC6eKfAwoCXQNA"
Node Address State Voter
---- ------- ----- -----
node1 172.31.1.130:8201 leader true
node2 172.31.16.128:8201 follower true
node3 172.31.32.30:8201 follower true