Vault deployment work should be treated as security infrastructure, not just another stateful service.

The runbooks need to cover normal operation and the uncomfortable moments: initialization, sealing, unsealing, leader changes, backup, and recovery.

Deployment Baseline

Document:

  • storage backend.
  • HA topology.
  • TLS certificates.
  • seal mechanism.
  • audit devices.
  • auth methods.
  • backup and restore path.
  • monitoring and alerting expectations.

Vault should not run in production without audit logging and a tested recovery path.

Initialization And Unseal

Initialization creates the root token and unseal or recovery material. That ceremony needs named participants, secure storage, and evidence that the root token was revoked or locked away according to policy.

Unseal runbooks should include:

  • who can participate.
  • where recovery material is stored.
  • how quorum is reached.
  • how the active node is identified.
  • how success is verified.

Operational Checks

Useful checks:

vault status
vault operator raft list-peers
vault audit list
vault auth list
vault secrets list

Acceptance Criteria

  • HA is documented and tested.
  • audit logging is enabled.
  • unseal or recovery process has named owners.
  • root token handling is documented.
  • backups are encrypted and restore-tested.

References

  • Vault documentation: Seal/Unseal.
  • Vault documentation: High Availability.
  • Vault documentation: Production Hardening.