diff --git a/command/server.go b/command/server.go index ab894901b3e8..9389570a0d98 100644 --- a/command/server.go +++ b/command/server.go @@ -937,12 +937,31 @@ CLUSTER_SYNTHESIS_COMPLETE: return 1 } - if err := core.UnsealWithStoredKeys(context.Background()); err != nil { - if vault.IsFatalError(err) { - c.UI.Error(fmt.Sprintf("Error initializing core: %s", err)) - return 1 + // Attempt unsealing in a background goroutine. This is needed for when a + // Vault cluster with multiple servers is configured with auto-unseal but is + // uninitialized. Once one server initializes the storage backend, this + // goroutine will pick up the unseal keys and unseal this instance. + go func() { + for { + err := core.UnsealWithStoredKeys(context.Background()) + if err == nil { + return + } + + if vault.IsFatalError(err) { + c.logger.Error(fmt.Sprintf("Error unsealing core", "error", err)) + return + } else { + c.logger.Warn(fmt.Sprintf("Failed to unseal core", "error" err)) + } + + select { + case <-c.ShutdownCh: + return + case <-time.After(5 * time.Second): + } } - } + }() // Perform service discovery registrations and initialization of // HTTP server after the verifyOnly check. diff --git a/vault/init.go b/vault/init.go index 89883c448c18..c4ad07ecf028 100644 --- a/vault/init.go +++ b/vault/init.go @@ -281,7 +281,7 @@ func (c *Core) UnsealWithStoredKeys(ctx context.Context) error { defer c.unsealWithStoredKeysLock.Unlock() if !c.seal.StoredKeysSupported() { - return errors.New("stored keys are not supported") + return nil } // Disallow auto-unsealing when migrating