HashiCorp Vault — Performance Replication

Performance Replication (Enterprise feature) creates read replicas in multiple datacenters, reducing latency and scaling read operations.

---

How It Works

┌────────────────────────┐         ┌────────────────────────┐
│   Primary Cluster      │         │  Performance Secondary  │
│   (US-East)            │────────▶│  (EU-West)             │
│                        │ replicate│                        │
│  Reads ✅  Writes ✅   │         │  Reads ✅  Writes ❌   │
│                        │         │  (forwards writes)      │
└────────────────────────┘         └────────────────────────┘
                                            │
                                    ┌───────▼───────────────┐
                                    │  Performance Secondary │
                                    │  (AP-Southeast)        │
                                    │  Reads ✅  Writes ❌  │
                                    └────────────────────────┘

---

What’s Replicated

Replicated	NOT Replicated
Secrets engines and data	Tokens (generated locally)
Auth methods and config	Leases (managed locally)
Policies	Audit device config
Identity entities	Local mounts
PKI CAs and certs

---

Enable Performance Replication

Primary Cluster

# Enable replication on primary
vault write -f sys/replication/performance/primary/enable

# Generate a secondary activation token
vault write sys/replication/performance/primary/secondary-token \
    id="eu-west-secondary"
# Returns: eyJhb...  (activation token)

Secondary Cluster

# Activate the secondary with the token from primary
vault write sys/replication/performance/secondary/enable \
    token="eyJhb..."

# The secondary will:
# 1. Connect to primary
# 2. Download all data
# 3. Start serving read requests

---

Check Replication Status

# Primary
vault read sys/replication/performance/status

# Secondary
vault read sys/replication/performance/status

---

Write Forwarding

When a client sends a write to a secondary:

Client → Secondary → Forwards write to Primary → Primary commits
                                                 → Replicates back
                                                 → Secondary updated

This is transparent to the client.

---

Filtered Replication

Replicate only specific paths to a secondary:

# Create a filter — only replicate specific mounts
vault write sys/replication/performance/primary/secondary-token \
    id="eu-west-filtered" \
    paths_filter_type="allow" \
    paths_filter="secret/,pki_int/"

This is useful when:

• Certain data must stay in specific regions (compliance)
• Secondaries only need a subset of secrets

---

Use Cases

Scenario	How
Multi-region reads	Secondary per region, clients read locally
Read scaling	Multiple secondaries handle read load
Data locality	Filter replication by mount path
Reduced latency	Local reads instead of cross-region

---

Quick Reference

Command	Description
vault write -f sys/replication/performance/primary/enable	Enable primary
vault write sys/replication/performance/primary/secondary-token id=NAME	Generate activation token
vault write sys/replication/performance/secondary/enable token=TOKEN	Activate secondary
vault read sys/replication/performance/status	Check replication status

Note: Performance Replication is a Vault Enterprise feature.

---

Next: Disaster Recovery