April 6 & 7
Learn about Vault, Consul, & more at HashiDays Sydney in Australia Register Now


[Enterprise] Performance Standby Nodes

In Vault High Availability guide, it was explained that only one Vault server will be active in a cluster and handles all requests (reads and writes). The rest of the servers become the standby nodes and simply forward requests to the active node.

HA Architecture

If you are running Vault Enterprise 0.11 or later, those standby nodes can handle most read-only requests. For example, performance standbys can handle encryption/decryption of data using transit keys, GET requests of key/value secrets and other requests that do not change underlying storage. This can provide considerable improvements in throughput for traffic of this type, resulting in aggregate performance increase linearly correlated to the number of performance standby nodes deployed in a cluster.

Server Configuration

Performance standbys are enabled by default when the Vault Enterprise license includes this feature. If you wish to disable the performance standbys, you can do so by setting the disable_performance_standby flag to true.

Since any of the nodes in a cluster can get elected as active, it is recommended to keep this setting consistent across all nodes in the cluster.

Enterprise Cluster

A highly available Vault Enterprise cluster consists of multiple servers, and there will be only one active node. The rest can serve as performance standby nodes handling read-only requests locally.

Cluster Architecture

The number of performance standby nodes within a cluster depends on your Vault Enterprise license.

Consider the following scenario:

  • A cluster contains five Vault servers
  • Your Vault Enterprise license allows two performance standby nodes

Cluster Architecture

In this scenario, the performance standby nodes running on VM 8 and VM 9 can process read-only requests. However, the standby nodes running on VM 6 and VM 10 simply forward all requests to the active node running on VM 7.

Help and Reference