mirror of
https://github.com/hashicorp/vault.git
synced 2025-08-31 19:41:12 +02:00
0660ea6fac
* Update README Let contributors know that docs will now be located in UDR * Add comments to each mdx doc Comment has been added to all mdx docs that are not partials * chore: added changelog changelog check failure * wip: removed changelog * Fix content errors * Doc spacing * Update website/content/docs/deploy/kubernetes/vso/helm.mdx Co-authored-by: Tu Nguyen <im2nguyen@users.noreply.github.com> --------- Co-authored-by: jonathanfrappier <92055993+jonathanfrappier@users.noreply.github.com> Co-authored-by: Tu Nguyen <im2nguyen@users.noreply.github.com>
70 lines
2.9 KiB
Plaintext
70 lines
2.9 KiB
Plaintext
---
|
|
layout: docs
|
|
page_title: Upgrade integrated storage to use Raft WAL
|
|
description: >-
|
|
Upgrade your Vault storage to use write-ahead with Raft logs
|
|
---
|
|
|
|
> [!IMPORTANT]
|
|
> **Documentation Update:** Product documentation, which were located in this repository under `/website`, are now located in [`hashicorp/web-unified-docs`](https://github.com/hashicorp/web-unified-docs), colocated with all other product documentation. Contributions to this content should be done in the `web-unified-docs` repo, and not this one. Changes made to `/website` content in this repo will not be reflected on the developer.hashicorp.com website.
|
|
|
|
# Upgrade integrated storage to use Raft WAL
|
|
|
|
@include 'alerts/experimental.mdx'
|
|
|
|
## Before you start
|
|
|
|
- **You must be using Vault 1.16+**.
|
|
- **You must be using Raft integrated storage**.
|
|
|
|
## Step 1: Migrate a single node
|
|
|
|
1. Take a snapshot of the current node state. Snapshots are completely separate
|
|
from log storage, so the subsequent steps will not affect the snapshot.
|
|
1. Gracefully shut down the Vault process.
|
|
1. Rename the existing Vault storage directory. For example, if your current
|
|
storage path is `/opt/vault/data`, rename it to `/opt/vault/data.boltdb`.
|
|
1. Update the `storage` stanza in your Vault config file:
|
|
- Set `raft_wal = "true"`.
|
|
- Set `raft_log_verifier_enabled = "true"`.
|
|
- Set `raft_log_verification_interval = "<TIME>"` if the default (`1m`) is
|
|
not optimal. The verification interval must be `10s` or more.
|
|
1. Restart the Vault process.
|
|
1. Monitor the node until it syncs with the cluster leader.
|
|
|
|
## Step 2: Verify and repeat
|
|
|
|
1. Observe and monitor your logging metrics and the verification log output on
|
|
the upgraded nodes for 3 – 7 days, depending on how much traffic the
|
|
node normally receives.
|
|
1. Continue updating follower nodes one-by-one.
|
|
1. Only migrate the cluster leader once the other nodes have upgraded
|
|
successfully.
|
|
|
|
## Troubleshooting
|
|
|
|
**If you encounter any issues or errors, immediately roll back the upgraded nodes
|
|
using the snapshot taken before migration**.
|
|
|
|
If you need to revert fully from `raft-wal` to `raft-boltdb` on a node:
|
|
|
|
1. Gracefully shut down the Vault process.
|
|
1. Rename the upgraded Vault storage directory. For example, if your upgraded
|
|
storage path is `/opt/vault/data`, rename it to `/opt/vault/data.raftwal`.
|
|
1. Update the `storage` stanza in your Vault config file:
|
|
- Remove `raft_wal = "true"`.
|
|
- Remove `raft_log_verifier_enabled = "true"`, if desired.
|
|
- Remove `raft_log_verification_interval = "<TIME>"` if desired.
|
|
1. Restart the Vault process.
|
|
1. Monitor the node until it syncs with the cluster leader.
|
|
|
|
Continue reverting nodes one-by-one. Only revert the cluster leader once the
|
|
other nodes are reverted successfully.
|
|
|
|
<Note title="">
|
|
|
|
As of Vault 1.16, you can use `raft_log_verifier_enabled` and
|
|
`raft_log_verification_interval` even if you choose to use BoltDB instead of
|
|
Raft WAL.
|
|
|
|
</Note> |