# HashiCorp Vault Cluster Unseal

These steps are for a new vault cluster that has been configured and started up, but is in an unsealed state.

For an existing cluster with unsealed nodes, see this page: [Handling Vault Node Restart](https://wiki.galaxydump.com/link/458)

### Leader Initialization

The following will initialize a new vault cluster and return a set of unseal keys and a root token.

<p class="callout info">NOTE: The ca.crt file is privileged, You will need to run these commands as the root user.  
Run the following to switch to the root user:</p>

```bash
sudo -i
```

Go to the first node, and do these (as root):

```bash
# From an admin shell that can reach the VLAN:
export VAULT_ADDR="https://vault0204.ogsofttech.lan:8200"
export VAULT_CACERT="/opt/vault/tls/ca.crt"   # path on your admin box

# Initialize the cluster (choose your own shares/threshold)
vault operator init -key-shares=5 -key-threshold=3
```

<p class="callout info">NOTE: Use the fully-qualified hostname above, as it appears in the node's cert.</p>

Once executed, the vault node will reply with 5 unseal keys and an initial root token.

<p class="callout warning">Distribute each of these unseal keys to trusted admins, to store in offline password storage.</p>

<p class="callout info">NOTE: Three (3) unseal keys are required to unseal the vault.</p>

<p class="callout info">Use the initial root token to setup policies and auth.  
Then, retire it.</p>

### Unseal the Leader

With the unseal keys from the initialized node (received above), we need to unseal its vault.

<p class="callout info">NOTE: We do this, while still as root, and on the same host that we got the keys from.</p>

Now, unseal each node, by calling this command once each, for three of the five unseal keys:

<p class="callout info">NOTE: It will prompt you for the unseal key, each time you run it.</p>

```bash
vault operator unseal
```

### Initial Root Login

With the vault unsealed, we need to perform an initial login as root:

```bash
# Log in with the root token for initial setup tasks
vault login <root_token>
```

Once logged in, you can check the vault status with this:

```bash
vault status
```

If successful, you should see `Initialized: true`, `Sealed: false`, `HA Enabled: true`, and this node as leader.

The first node is online, and the cluster is up... sort of.

Each cluster member has auto-discovered a leader and established a RAFT quorum.

But, the other nodes are still not unsealed (since we did not configured auto-unseal).

### Unseal Other Nodes

Similar to what you did, to unseal the first node, we will do the same to each member, below.

Switch to root on each node with:

```bash
sudo -i
```

Set exports for each node:

<p class="callout info">NOTE: Make sure that the vault\_addr variable is pointing to the local node being unsealed, here.</p>

```bash
export VAULT_ADDR="https://vault0205.ogsofttech.lan:8200";
export VAULT_CACERT="/opt/vault/tls/ca.crt"
```

<p class="callout info">NOTE: Use the fully-qualified hostname above, as it appears in the node's cert.</p>

Now, unseal each node, by calling this command once each, for three of the five unseal keys:

<p class="callout info">NOTE: It will prompt you for the unseal key, each time you run it.</p>

```bash
vault operator unseal
```

### Check Status

Once you have initialized the leader node, and unsealed all nodes, we need to confirm that the cluster is good.

Run this:

<p class="callout info">NOTE: The vault\_addr should be pointing to the leader, here.</p>

```bash
# Set this if you are coming back to this page, and the environment value is not set...
export VAULT_ADDR="https://vault0204.ogsofttech.lan:8200";
# Run this to check status...
vault status
```

Confirm RAFT peers with this:

```bash
vault operator raft list-peers
```

<p class="callout warning">NOTE: The above may only work on the current leader, because https.  
We need to work through why this is, and solve it, so it can be run on any node.</p>

When run, you will see something like this:

[![image.png](https://wiki.galaxydump.com/uploads/images/gallery/2025-09/scaled-1680-/HCX5VSa7OOY5gn5s-image.png)](https://wiki.galaxydump.com/uploads/images/gallery/2025-09/HCX5VSa7OOY5gn5s-image.png)

If healthy, you will see one node as leader, and the others as voting followers.

<p class="callout info">NOTE: Make sure each node you configured, is present.</p>

There is a health check that can be performed, by calling this:

```bash
curl -s -H "X-Vault-Token: $VAULT_TOKEN" "$VAULT_ADDR/v1/sys/ha-status" | jq .
```

<p class="callout info">NOTE: Be sure that the VAULT\_TOKEN and VAULT\_ADDR environment variables are set.  
Or, you can hardcode them with a minimal privilege user account.</p>

When run, you will get a JSON list of nodes and their status.