Vault "in standby mode" / "node not active" in CI

By Daniel Zoghalchali·Latchkey

The request reached a standby Vault node in an HA cluster. Standby nodes normally forward to the active node, but if forwarding is disabled or the node is mid-failover, the request is refused.

What this error means

A call fails with "Code: 503 ... * Vault is in standby mode" or "node not active but active cluster node not found", usually behind a load balancer that reached a standby.

Error making API request.

URL: GET https://vault.example.com/v1/secret/data/ci/app
Code: 503. Errors:

* Vault is in standby mode

Common causes

The LB routed to a standby without forwarding

A standby node with request forwarding disabled cannot serve the read and returns 503.

A failover is in progress

During leader election there may be no active node momentarily, so standby nodes reject requests.

How to fix it

Route to the active node

1. Point VAULT_ADDR at the cluster address that always resolves to the active node (or the HA LB with health checks).
2. Ensure request forwarding is enabled so standbys proxy to active.
3. Re-run after failover settles.

# check which node is active
vault status | grep -i 'HA Mode'

Retry across a brief failover

Failovers are short; retry the read with backoff rather than failing on the first 503.

for i in 1 2 3 4 5; do
  vault kv get secret/ci/app && break
  sleep 5
done

How to prevent it

• Use the HA load balancer address with active-node health checks.
• Enable request forwarding so standby nodes proxy transparently.
• Add short retries to absorb brief failovers.

Frequently asked questions

Related guides

References

• Node.js documentation
• npm CLI documentation
• GitHub Actions documentation