{"action":"created","issue":{"url":"https://api.github.com/repos/hashicorp/vault/issues/634","labels_url":"https://api.github.com/repos/hashicorp/vault/issues/634/labels{/name}","comments_url":"https://api.github.com/repos/hashicorp/vault/issues/634/comments","events_url":"https://api.github.com/repos/hashicorp/vault/issues/634/events","html_url":"https://github.com/hashicorp/vault/issues/634","id":107564233,"number":634,"title":"Vault servers are stateful regarding seal/unseal","user":{"login":"bkeroackdsc","id":9576999,"avatar_url":"https://avatars.githubusercontent.com/u/9576999?v=3","gravatar_id":"","url":"https://api.github.com/users/bkeroackdsc","html_url":"https://github.com/bkeroackdsc","followers_url":"https://api.github.com/users/bkeroackdsc/followers","following_url":"https://api.github.com/users/bkeroackdsc/following{/other_user}","gists_url":"https://api.github.com/users/bkeroackdsc/gists{/gist_id}","starred_url":"https://api.github.com/users/bkeroackdsc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bkeroackdsc/subscriptions","organizations_url":"https://api.github.com/users/bkeroackdsc/orgs","repos_url":"https://api.github.com/users/bkeroackdsc/repos","events_url":"https://api.github.com/users/bkeroackdsc/events{/privacy}","received_events_url":"https://api.github.com/users/bkeroackdsc/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-09-21T17:50:10Z","updated_at":"2015-09-21T20:57:35Z","closed_at":"2015-09-21T20:27:34Z","body":"Using the S3 backend with three vault servers behind a load balancer for HA, the servers appear to have independent state during the unsealing process.\r\n\r\nFor example, if the master key is split into three shards and the unseal PUT requests happen to hit different servers, you can end up with some servers returning ``sealed: true`` and some ``sealed: false``.\r\n\r\nVault should store all state in some persistent backend so load balancing works as expected.\r\n"},"comment":{"url":"https://api.github.com/repos/hashicorp/vault/issues/comments/142106233","html_url":"https://github.com/hashicorp/vault/issues/634#issuecomment-142106233","issue_url":"https://api.github.com/repos/hashicorp/vault/issues/634","id":142106233,"user":{"login":"bkeroackdsc","id":9576999,"avatar_url":"https://avatars.githubusercontent.com/u/9576999?v=3","gravatar_id":"","url":"https://api.github.com/users/bkeroackdsc","html_url":"https://github.com/bkeroackdsc","followers_url":"https://api.github.com/users/bkeroackdsc/followers","following_url":"https://api.github.com/users/bkeroackdsc/following{/other_user}","gists_url":"https://api.github.com/users/bkeroackdsc/gists{/gist_id}","starred_url":"https://api.github.com/users/bkeroackdsc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bkeroackdsc/subscriptions","organizations_url":"https://api.github.com/users/bkeroackdsc/orgs","repos_url":"https://api.github.com/users/bkeroackdsc/repos","events_url":"https://api.github.com/users/bkeroackdsc/events{/privacy}","received_events_url":"https://api.github.com/users/bkeroackdsc/received_events","type":"User","site_admin":false},"created_at":"2015-09-21T20:57:35Z","updated_at":"2015-09-21T20:57:35Z","body":"@jefferai And yet they all can share the S3 backend fine, which begs the question why they can't also have the same configuration/auth backend. IOW, why can't S3 work for HA? Or perhaps put another way, why can't the configuration/auth datastore be independent from the secrets datastore? (to allow stateless servers)"}}