search

hashicorp / vault

A tool for secrets management, encryption as a service, and privileged access management
https://www.vaultproject.io/
Other
31.31k stars 4.23k forks source link

Request going only through leader when using consul clustering #1092

Closed ruchi15 closed 8 years ago

ruchi15 commented 8 years ago

Hi, I am using 3 vault instances and 3 consul instances. Consul instances are in a cluster. data is consistent and replicated fine through all the consul instances. Now, my concern is when I am writing something on a standby mode vault instance, It is passing through the leader vault instance(which is correct). But when I am reading something through standby vault instance, it is also passing the request to the leader vault instance(as consul is using raft algorithm of consensus protocol). So my overall load is coming on the leader vault instance. And if i want to use a load balancer (it distributes the requests through all instances) in front of vault instances, still my overall load is upto leader vault instance(again raft algorithm). I didn't get the use of this architecture.

Can someone tell me the actual reason? any suggestion will be appreciated.

jefferai commented 8 years ago

Hi @ruchi15,

Vault does not use Raft. There is no leader election and no leader, there is only the active node and standby nodes, which forward requests to the active node.

Vault does take advantage of the Raft algorithm in Consul to ensure atomicity of its lock, but that's purely a property of using a Consul lock.

Consul itself does not service reads from follower nodes by default; you can look at description of the available consistency nodes at https://www.consul.io/docs/internals/consensus.html. This is to reduce the possibility of stale reads. There is a "stale" consistency mode that allows followers to service reads, but this is not the default.

lagging commented 8 years ago

so , can we say our entire traffic(read and write) will pass through active node. Will it be able to handle large request successfully. (can you give (estimate) max traffic handled if possible).

jefferai commented 8 years ago

@lagging that depends on a large number of factors -- your hardware, your available system resources, your physical backend, your bandwidth to your physical backend, what secret backends you are using, what data you are using them with...

The best advice I can give you is to do a proof of concept to benchmark your expected load and verify that it is sufficient.