> ## Documentation Index
> Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Demo Disaster Replication Configuration
> This guide explains how to enable and configure performance replication in Vault Enterprise for active-active read scalability across multiple clusters.
In this guide, you’ll learn how to enable and configure **performance replication** in Vault Enterprise. Performance replication lets you distribute Vault policies, secrets engines, authentication methods, and audit configurations across multiple clusters for active-active read scalability, while routing write operations to a single primary.
## Key Concepts
* **Active-Active Workloads**: Read operations (authentication, secret reads, dynamic secret generation) are served locally on each replica.
* **Centralized Writes**: All write requests (policy changes, configuration updates) are forwarded to the primary cluster.
* **Independent Authentication**: Tokens and leases created on a performance secondary are local and are *not* replicated from the primary. Clients must re-authenticate on each cluster.
## Performance vs. Disaster Recovery (DR) Replication
| Feature | Performance Replication | DR Replication |
| ---------------------- | -------------------------------- | ------------------------------ |
| Policies & Config | ✓ | ✗ |
| Secrets Engines & Auth | ✓ | ✗ |
| Audit Configurations | ✓ | ✗ |
| Tokens & Leases | ✗ | ✓ |
| Use Case | Active-active, low-latency reads | Failover and disaster recovery |
| Write Path | Forwarded to primary | Forwarded to primary |
## Example Architecture: Data Centers & Cloud Regions
### Multi–Data Center Deployment
A primary cluster in **Data Center A** replicates to performance secondaries in **Data Center B** and a **cloud region**. Local applications read and authenticate against their nearest replica, while writes go to the primary.
### Global Cloud Deployment
In a cloud setup, the primary (US-East2) replicates to secondaries in US-East and EU-West. Applications in each region authenticate to their local replica for reads; writes are sent back to the primary and propagated.
## How Performance Replication Works
1. **Active-Active Authentication**\
Each performance replica handles logins locally. Tokens and leases exist only on the cluster where they were issued.
2. **Local Dynamic Secrets**\
Replicas generate dynamic credentials (e.g., database passwords, AWS keys) without contacting the primary:
3. **External Service Interactions**\
Connections to AWS, databases, and other external services occur directly from each replica:
## Setup Process
Follow these four steps to configure performance replication:
1. Enable performance replication on the primary.
2. Generate a secondary token.
3. Enable the secondary using the token.
4. Monitor the replication status.
### CLI Commands
```bash theme={null}
# 1. Enable performance replication on the primary
vault write -f sys/replication/performance/primary/enable
# 2. Generate a secondary token on the primary
vault write sys/replication/performance/primary/secondary-token id="secondary-id"
# 3. Activate the performance secondary with the token
vault write sys/replication/performance/secondary/enable token="secondary-token"
```
Enabling a secondary will **purge its local data** (including unseal and recovery keys) and sync entirely from the primary.
### Monitoring Replication
```bash theme={null}
# View overall replication status
vault read --format=json sys/replication/status
# View performance replication status
vault read --format=json sys/replication/performance/status
# View DR replication status
vault read --format=json sys/replication/dr/status
```
After setup, verify that changes—such as enabling a new auth method—on the primary cluster appear on each performance secondary.
## References
* [Vault Replication Concepts](https://www.vaultproject.io/docs/enterprise/replication)
* [Kubernetes Basics](https://kubernetes.io/docs/concepts/overview/what-is-kubernetes/)
* [AWS Documentation](https://aws.amazon.com/documentation/)
* [Terraform Registry](https://registry.terraform.io/)