diff --git a/website/source/assets/images/vault-perf-standby-1.png b/website/source/assets/images/vault-perf-standby-1.png new file mode 100644 index 0000000000..ea74d79404 Binary files /dev/null and b/website/source/assets/images/vault-perf-standby-1.png differ diff --git a/website/source/assets/images/vault-perf-standby.png b/website/source/assets/images/vault-perf-standby.png new file mode 100644 index 0000000000..07d4cf6d01 Binary files /dev/null and b/website/source/assets/images/vault-perf-standby.png differ diff --git a/website/source/guides/operations/index.html.md b/website/source/guides/operations/index.html.md index 819c7ae563..960ea3cb9a 100644 --- a/website/source/guides/operations/index.html.md +++ b/website/source/guides/operations/index.html.md @@ -63,8 +63,11 @@ guide demonstrates how to selectively filter out secret engines from being replicated across clusters. This feature can help organizations to comply with ***General Data Protection Regulation (GDPR)***. -- [Multi-Tenant Pattern with Namespaces](/guides/operations/multi-tenant.html) guide discuss a pattern to -isolate secrets using ACL Namespaces. +- [Performance Standby Nodes](/guides/operations/performance-nodes.html) guide +describes how Vault HA works with performance standby nodes. + +- [Multi-Tenant Pattern with Namespaces](/guides/operations/multi-tenant.html) +guide discuss a pattern to isolate secrets using ACL Namespaces. - [Vault Auto-unseal using AWS Key Management Service (KMS)](/guides/operations/autounseal-aws-kms.html) guide demonstrates an example of how to use Terraform to provision an instance that utilizes an encryption key diff --git a/website/source/guides/operations/performance-nodes.html.md b/website/source/guides/operations/performance-nodes.html.md new file mode 100644 index 0000000000..4fe6c82fb3 --- /dev/null +++ b/website/source/guides/operations/performance-nodes.html.md @@ -0,0 +1,88 @@ +--- +layout: "guides" +page_title: "Performance Standby Nodes - Guides" +sidebar_current: "guides-operations-performance-nodes" +description: |- + This guide will walk you through a simple Vault Highly Available (HA) cluster + implementation. While this is not an exhaustive or prescriptive guide that + can be used as a drop-in production example, it covers the basics enough to + inform your own production setup. +--- + +# Performance Standby Nodes + +~> **Enterprise Only:** Performance Standby Nodes feature is a part of _Vault Enterprise_. + +In [Vault High Availability](/guides/operations/vault-ha-consul.html) guide, it +was explained that only one Vault server will be _active_ in a cluster and +handles **all** requests (reads and writes). The rest of the servers become the +_standby_ nodes and simply forward requests to the _active_ node. + +![HA Architecture](/assets/images/vault-ha-consul-3.png) + +If you are running **_Vault Enterprise_ 0.11** or later, those standby nodes can +handle most read-only requests. For example, performance standbys can handle +encryption/decryption of data using [transit](/docs/secrets/transit/index.html) +keys, GET requests of key/value secrets and other requests that do not change +underlying storage. This can provide considerable improvements in throughput for +traffic of this type, resulting in aggregate performance increase linearly +correlated to the number of performance standby nodes deployed in a cluster. + + +## Reference Materials + +- [Performance Standby Nodes](/docs/enterprise/performance-standby/index.html) +- [High Availability Mode](/docs/concepts/ha.html) +- [Consul Storage Backend](/docs/configuration/storage/consul.html) +- [Vault Reference Architecture](/guides/operations/reference-architecture.html) + + +## Server Configuration + +Performance standbys are enabled by default when the Vault Enterprise license +includes this feature. If you wish to disable the performance standbys, you can +do so by setting the +[`disable_performance_standby`](/docs/configuration/index.html#vault-enterprise-parameters) +flag to `true`. + +Since any of the nodes in a cluster can get elected as active, it is recommended +to keep this setting consistent across all nodes in the cluster. + +!> Consider a scenario where a node with performance standby _disabled_ +becomes the active node. The performance standby feature is +disabled for the whole cluster although it is enabled on other nodes. + + +## Enterprise Cluster + +A highly available Vault Enterprise cluster consists of multiple servers, and +there will be only one active node. The rest can serve as performance standby +nodes handling read-only requests locally. + +![Cluster Architecture](/assets/images/vault-perf-standby-1.png) + +The number of performance standby nodes within a cluster depends on your Vault +Enterprise license. + +Consider the following scenario: + +- A cluster contains **five** Vault servers +- Your Vault Enterprise license allows **two** performance standby nodes + +![Cluster Architecture](/assets/images/vault-perf-standby.png) + +In this scenario, the performance standby nodes running on VM 8 and VM 9 can +process read-only requests. However, the _standby_ nodes running on VM 6 and VM +10 simply forward all requests to the active node running on VM 7. + + +> **NOTE:** The selection of performance standby node is determined by the +active node. When a node is selected, it gets promoted to become a performance +standby. This is a race condition that there is no configuration +parameter to specify which nodes to become performance standbys. + + +## Next steps + +Read [Production Hardening](/guides/operations/production.html) to learn best +practices for a production hardening deployment of Vault. diff --git a/website/source/guides/operations/reference-architecture.html.md b/website/source/guides/operations/reference-architecture.html.md index 95600a51c1..3cba618e7b 100644 --- a/website/source/guides/operations/reference-architecture.html.md +++ b/website/source/guides/operations/reference-architecture.html.md @@ -207,15 +207,17 @@ adhere to security best practices. ### High Availability -A Vault cluster is the highly-available unit of deployment within one datacenter. -A recommended approach is three Vault servers with a Consul storage backend. -With this configuration, during a Vault server outage, failover is handled -immediately without human intervention. To learn more about setting up your -Vault servers in HA mode, read [_Vault HA with -Consul_](/guides/operations/vault-ha-consul.html) guide. +A Vault cluster is the highly-available unit of deployment within one +datacenter. A recommended approach is three Vault servers with a Consul storage +backend. With this configuration, during a Vault server outage, failover is +handled immediately without human intervention. -High-availability and data-locality across datacenters requires -Vault Enterprise. +To learn more about setting up your Vault servers in HA mode, read [_Vault HA +with Consul_](/guides/operations/vault-ha-consul.html) guide. + +> High-availability with [Performance Standby +Nodes](/guides/operations/performance-nodes.html) and data-locality across +datacenters requires Vault Enterprise. ## Deployment Topology for Multiple Datacenters diff --git a/website/source/guides/operations/vault-ha-consul.html.md b/website/source/guides/operations/vault-ha-consul.html.md index 0a581bafa0..0e51d4929e 100644 --- a/website/source/guides/operations/vault-ha-consul.html.md +++ b/website/source/guides/operations/vault-ha-consul.html.md @@ -31,8 +31,7 @@ Nodes** feature is included in _Vault Enterprise Premium_, and also available for _Vault Enterprise Pro_ with additional fee. This is particularly useful for processing high volume Encryption as a Service ([Transit secrets engine](/docs/secrets/transit/index.html)) requests. Read [Performance Standby -Nodes](/docs/enterprise/performance-standby/index.html) documentation for more -details. +Nodes](/docs/enterprise/performance-standby/index.html) documentation and a [guide](/guides/operations/performance-nodes.html) for more details. ~> This guide will walk you through a simple Vault Highly Available (HA) cluster diff --git a/website/source/layouts/guides.erb b/website/source/layouts/guides.erb index ca712432e9..f62193815e 100644 --- a/website/source/layouts/guides.erb +++ b/website/source/layouts/guides.erb @@ -41,6 +41,9 @@ > Mount Filter + > + Performance Standby Nodes + > Multi-Tenant: Namespaces