[Guide] Performance Standby Nodes (#5272)

* Performance Standby Nodes guide

* Added a link in the Vault HA guide

* Added links

* Clarified the node selection info

* Incorporated feedback

* Added 'when the Enterprise license includes this feature'

* Fixed the label: server 8 -> VM8

* Incorporated the feedback

website/source/guides/operations/index.html.md

@@ -63,8 +63,11 @@ guide demonstrates how to selectively filter out secret engines from being
 replicated across clusters. This feature can help organizations to comply with
 ***General Data Protection Regulation (GDPR)***.
 
-- [Multi-Tenant Pattern with Namespaces](/guides/operations/multi-tenant.html) guide discuss a pattern to
+- [Performance Standby Nodes](/guides/operations/performance-nodes.html) guide
-isolate secrets using ACL Namespaces.
+describes how Vault HA works with performance standby nodes.
+
+- [Multi-Tenant Pattern with Namespaces](/guides/operations/multi-tenant.html)
+guide discuss a pattern to isolate secrets using ACL Namespaces.
 
 - [Vault Auto-unseal using AWS Key Management Service (KMS)](/guides/operations/autounseal-aws-kms.html) guide demonstrates an example of
 how to use Terraform to provision an instance that utilizes an encryption key

website/source/guides/operations/performance-nodes.html.md

@@ -0,0 +1,88 @@
+---
+layout: "guides"
+page_title: "Performance Standby Nodes - Guides"
+sidebar_current: "guides-operations-performance-nodes"
+description: |-
+  This guide will walk you through a simple Vault Highly Available (HA) cluster
+  implementation. While this is not an exhaustive or prescriptive guide that
+  can be used as a drop-in production example, it covers the basics enough to
+  inform your own production setup.
+---
+
+# Performance Standby Nodes
+
+~> **Enterprise Only:** Performance Standby Nodes feature is a part of _Vault Enterprise_.
+
+In [Vault High Availability](/guides/operations/vault-ha-consul.html) guide, it
+was explained that only one Vault server will be _active_ in a cluster and
+handles **all** requests (reads and writes).  The rest of the servers become the
+_standby_ nodes and simply forward requests to the _active_ node.  
+
+![HA Architecture](/assets/images/vault-ha-consul-3.png)
+
+If you are running **_Vault Enterprise_ 0.11** or later, those standby nodes can
+handle most read-only requests. For example, performance standbys can handle
+encryption/decryption of data using [transit](/docs/secrets/transit/index.html)
+keys, GET requests of key/value secrets and other requests that do not change
+underlying storage. This can provide considerable improvements in throughput for
+traffic of this type, resulting in aggregate performance increase linearly
+correlated to the number of performance standby nodes deployed in a cluster.
+
+
+## Reference Materials
+
+- [Performance Standby Nodes](/docs/enterprise/performance-standby/index.html)
+- [High Availability Mode](/docs/concepts/ha.html)
+- [Consul Storage Backend](/docs/configuration/storage/consul.html)
+- [Vault Reference Architecture](/guides/operations/reference-architecture.html)
+
+
+## Server Configuration
+
+Performance standbys are enabled by default when the Vault Enterprise license
+includes this feature. If you wish to disable the performance standbys, you can
+do so by setting the
+[`disable_performance_standby`](/docs/configuration/index.html#vault-enterprise-parameters)
+flag to `true`.  
+
+Since any of the nodes in a cluster can get elected as active, it is recommended
+to keep this setting consistent across all nodes in the cluster.
+
+!> Consider a scenario where a node with performance standby _disabled_
+becomes the active node. The performance standby feature is
+disabled for the whole cluster although it is enabled on other nodes.
+
+
+## Enterprise Cluster
+
+A highly available Vault Enterprise cluster consists of multiple servers, and
+there will be only one active node. The rest can serve as performance standby
+nodes handling read-only requests locally.
+
+![Cluster Architecture](/assets/images/vault-perf-standby-1.png)
+
+The number of performance standby nodes within a cluster depends on your Vault
+Enterprise license.
+
+Consider the following scenario:
+
+- A cluster contains **five** Vault servers
+- Your Vault Enterprise license allows **two** performance standby nodes
+
+![Cluster Architecture](/assets/images/vault-perf-standby.png)
+
+In this scenario, the performance standby nodes running on VM 8 and VM 9 can
+process read-only requests. However, the _standby_ nodes running on VM 6 and VM
+10 simply forward all requests to the active node running on VM 7.
+
+
+> **NOTE:** The selection of performance standby node is determined by the
+active node. When a node is selected, it gets  promoted to become a performance
+standby. This is a race condition that there is no configuration
+parameter to specify which nodes to become performance standbys.
+
+
+## Next steps
+
+Read [Production Hardening](/guides/operations/production.html) to learn best
+practices for a production hardening deployment of Vault.

website/source/guides/operations/reference-architecture.html.md

@@ -207,15 +207,17 @@ adhere to security best practices.
 
 ### High Availability
 
-A Vault cluster is the highly-available unit of deployment within one datacenter.
+A Vault cluster is the highly-available unit of deployment within one
-A recommended approach is three Vault servers with a Consul storage backend.
+datacenter. A recommended approach is three Vault servers with a Consul storage
-With this configuration, during a Vault server outage, failover is handled
+backend. With this configuration, during a Vault server outage, failover is
-immediately without human intervention. To learn more about setting up your
+handled immediately without human intervention.
-Vault servers in HA mode, read [_Vault HA with
-Consul_](/guides/operations/vault-ha-consul.html) guide.
 
-High-availability and data-locality across datacenters requires
+To learn more about setting up your Vault servers in HA mode, read [_Vault HA
-Vault Enterprise.
+with Consul_](/guides/operations/vault-ha-consul.html) guide.
+
+> High-availability with [Performance Standby
+Nodes](/guides/operations/performance-nodes.html) and data-locality across
+datacenters requires Vault Enterprise.
 
 
 ## <a name="multi-dc"></a>Deployment Topology for Multiple Datacenters

website/source/guides/operations/vault-ha-consul.html.md

@@ -31,8 +31,7 @@ Nodes** feature is included in _Vault Enterprise Premium_, and also available
 for _Vault Enterprise Pro_ with additional fee. This is particularly useful for
 processing high volume Encryption as a Service ([Transit secrets
 engine](/docs/secrets/transit/index.html)) requests. Read [Performance Standby
-Nodes](/docs/enterprise/performance-standby/index.html) documentation for more
+Nodes](/docs/enterprise/performance-standby/index.html) documentation and a [guide](/guides/operations/performance-nodes.html) for more details.
-details.
 
 
 ~> This guide will walk you through a simple Vault Highly Available (HA) cluster

website/source/layouts/guides.erb

@@ -41,6 +41,9 @@
           <li<%= sidebar_current("guides-operations-mount-filter") %>>
             <a href="/guides/operations/mount-filter.html">Mount Filter</a>
           </li>
+          <li<%= sidebar_current("guides-operations-performance-nodes") %>>
+            <a href="/guides/operations/performance-nodes.html">Performance Standby Nodes</a>
+          </li>
           <li<%= sidebar_current("guides-operations-multi-tenant") %>>
             <a href="/guides/operations/multi-tenant.html">Multi-Tenant: Namespaces</a>
           </li>