Vault "Vault is sealed" (503) in CI

By Daniel Zoghalchali·Latchkey

Vault returned 503 because the server is sealed. A sealed Vault cannot decrypt storage or serve secrets, so every request fails until an operator (or auto-unseal) unseals it.

What this error means

Requests fail with "Error making API request ... Code: 503 ... * Vault is sealed", often right after a Vault restart or upgrade.

Error making API request.

URL: GET https://vault.example.com/v1/secret/data/ci/app
Code: 503. Errors:

* Vault is sealed

Common causes

Vault restarted and is not yet unsealed

After a restart, upgrade, or crash, Vault comes up sealed until unseal keys (or auto-unseal via KMS) are applied.

CI hit the server during a maintenance window

A deploy or failover left Vault sealed briefly, and the job happened to run during that window.

How to fix it

Unseal Vault (operator action)

1. Check seal status with vault status.
2. Apply unseal key shares, or rely on configured auto-unseal.
3. Re-run CI once Sealed reads false.

vault status
vault operator unseal <key-share-1>
vault operator unseal <key-share-2>
vault operator unseal <key-share-3>

Wait and retry transient seals

If auto-unseal is configured, the seal is brief; retry the read after a short backoff instead of failing immediately.

until vault status >/dev/null 2>&1; do sleep 5; done

How to prevent it

• Configure auto-unseal (KMS/HSM) so restarts do not leave Vault sealed.
• Run a vault status readiness check before secret reads.
• Schedule Vault maintenance outside heavy CI windows.

Frequently asked questions

Related guides

References

• GitHub Actions documentation