Vault: feature request: vault command to view cluster status

[aerickson]

It would be super nice to be able to say vault members or similar and see the versions, seal status, etc (similar to nomad or consul) for all nodes in a HA cluster.

Please let me know if this would be well received and I'll try to code something up.

Thanks!

[vishalnayak]

@aerickson When Vault is running on Consul backend, all the nodes registers themselves with Consul under the default service name vault. So, consul should list out all the items. I remember that there was an issue with this behavior which has been fixed.

Please test the behavior with latest Vault and check if curl http://localhost:8500/v1/catalog/service/vault | jq . or dig +short @127.0.0.1 -p 8600 vault.service.consul srv shows all the nodes.

[aerickson]

@vishalnayak Thanks. I fixed the issue (now removed from the post) I was seeing with our cluster (it was running old code).

Can you re-open this as I'm still interested in the feature request?

[vishalnayak]

Sure, I'll reopen. I'll mark this as future as it is still not clear as to how this would work and also because this is not on our immediate roadmap.

[aerickson]

Thanks. Yeah, understood. Happy to work on it if we figure out how it should work.

[raoofm]

@vishalnayak shouldn't this be a feature supported in all backends?

[jefferai]

I think one issue is that it's not clear what you'd actually show. Seal status can only be unsealed because if a standby is sealed you won't actually have information passing between the standby and active node. So the only thing that I can think of is version, which isn't super useful.

If there's a real use case for this we can consider it, but closing for now.

[jen20]

It would be immensely useful to be able to see the addresses of the active and all nodes in the standby state via the API - using Consul only works if you are actually _using_ Consul as a physical backend.

[edward2a]

Heeeeyyyy... I find interesting that a clustering system cannot show its cluster status nor members... something like consul's members and 'operator raft list-peers' would be ideal.