Don't load a required mount if in secondary mode, let sync invalidate…

… do that

vault/logical_system.go

@@ -820,7 +820,7 @@ func (b *SystemBackend) handleTidyLeases(req *logical.Request, d *framework.Fiel
 
 func (b *SystemBackend) invalidate(key string) {
 	if b.Core.logger.IsTrace() {
-		b.Core.logger.Trace("sys: invaliding key", "key", key)
+		b.Core.logger.Trace("sys: invalidating key", "key", key)
 	}
 	switch {
 	case strings.HasPrefix(key, policySubPath):

vault/mount.go

@@ -513,7 +513,13 @@ func (c *Core) loadMounts() error {
 					break
 				}
 			}
-			if !foundRequired {
+			// In a replication scenario we will let sync invalidation take
+			// care of creating a new required mount that doesn't exist yet.
+			// This should only happen in the upgrade case where a new one is
+			// introduced on the primary; otherwise initial bootstrapping will
+			// ensure this comes over. If we upgrade first, we simply don't
+			// create the mount, so we won't conflict when we sync.
+			if !foundRequired && c.replicationState != consts.ReplicationSecondary {
 				c.mounts.Entries = append(c.mounts.Entries, requiredMount)
 				needPersist = true
 			}