[VAULT] Add run Vault on zCX page

[yhyakuna]

🔍 Deploy preview

This PR adds "Deploy Vault on zCX" page based on #1464.
Make the editorial updates to the original.

[github-actions]

Vercel Previews Deployed

Name	Status	Preview	Updated (UTC)
Dev Portal	✅ Ready (Inspect)	Visit Preview	Tue Dec 9 18:55:26 UTC 2025
Unified Docs API	✅ Ready (Inspect)	Visit Preview	Tue Dec 9 18:48:06 UTC 2025

[github-actions]

Broken Link Checker

No broken links found! 🎉

[schavis]

Suggested change

	This guide walks through deploying a fully secured 3-node HashiCorp Vault Enterprise cluster
	on IBM z/OS Container Extensions (zCX). The setup uses three independent zCX instances,
	each running Vault with its own unique IP address. A Layer-4 HAProxy load balancer sits
	in front to distribute traffic, and end-to-end TLS encryption is applied across all Vault nodes
	and the load balancer to ensure secure communication throughout the cluster.
	Deploy a fully secured 3-node HashiCorp Vault Enterprise cluster on IBM z/OS
	Container Extensions (zCX) with:
	- Three independent zCX instances running Vault on unique IP addressed.
	- A Layer-4 HAProxy load balancer to distribute traffic.
	- End-to-end TLS encryption to ensure secure communication throughout the cluster.

Style correction: describe the outcome of following the how-to guide, not the contents of the guide

[schavis]

Suggested change

	## Step 1: Container image deployment
	## Step 1: Get the Vault Enterprise image from Docker

Style correction: use verbs for headings and describe the outcome of the step

[schavis]

Suggested change

	1. Pull the official Vault Enterprise container image on all three zCX nodes.
	1. Use the Docker CLI to pull official Vault Enterprise container images on all three zCX nodes:

[schavis]

Suggested change

	## Step 2: Persistent volume creation
	## Step 2: Create a persistent volume on each node

[schavis]

Suggested change

	1. Create volume for Vault data storage (Raft backend, audit logs).
	1. Create volume for Vault data storage including an internal storage backend and space for audit logs:

Style correction: prefer "internal storage" over "Raft" when not discussing the mechanics of the storage, avoid parenthesis when possible

[schavis]

Can we also set the VAULT_PROXY_ADDR to the load balancer URL and port for easier API calls later?

For example;

Suggested change

	1. Set and export the `VAULT_PROXY_ADDR` environment variable in your local
	terminal to the load balancer URL and port:
	```shell-session
	$ export VAULT_PROXY_ADDR="https://<load_balancer_id>:<port>"
	```

[schavis]

Suggested change

	```shell-session
	$ curl \
	--cacert <CA_CERT_FILE> \
	--header "X-Vault-Token: <VAULT_TOKEN>" \
	https://<LOAD_BALANCER_IP>:<PORT>/v1/sys/storage/raft/configuration \
	| jq .
	```
	<Tabs>
	<Tab heading="CLI" group="cli">
	```shell-session
	$ vault read \
	-ca-cert "/path/to/vault.pem" \
	-format json \
	/sys/storage/raft/configuration \
	| jq
	```
	</Tab>
	<Tab heading="API" group="api">
	```shell-session
	$ curl \
	--request POST \
	--header "X-Vault-Token: ${VAULT_TOKEN}" \
	--namespace "X-Vault-Namespace: ${VAULT_NAMESPACE}" \
	--cacert <CA_CERT_FILE> \
	${VAULT_PROXY_ADDR}/v1/sys/storage/raft/configuration \
	| jq .
	```
	</Tab>
	</Tabs>

We generally want new content to provide examples using both the CLI and the API so folks have example code regardless of which method they prefer

[schavis]

Suggested change

- [Seal/unseal](/vault/docs/concepts/seal)

Folded into "Before you start"

[schavis]

Suggested change

	- [CLI command - operator init](/vault/docs/commands/operator/init)
	- [CLI command - `operator init`](/vault/docs/commands/operator/init)

[schavis]

Suggested change

	- [CLI command - operator unseal](/vault/docs/commands/operator/unseal)
	- [CLI command - `operator unseal`](/vault/docs/commands/operator/unseal)

[schavis]

Let me know if you have any questions