[feature] Request for Auto-Unseal Feature Implementation
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
vault-charm |
Triaged
|
Wishlist
|
Unassigned |
Bug Description
I need to unseal the vault using an external vault.
I'm trying to auto-unsealed with another Vault using the method described here https:/
However, I'm encountering an issue where it's not possible to modify the default configuration of the vault at the location "/var/snap/
My steps:
On the external vault:
vault secrets enable transit
vault write -f transit/
tee autounseal.hcl <<EOF
path "transit/
capabilities = [ "update" ]
}
path "transit/
capabilities = [ "update" ]
}
EOF
vault policy write autounseal autounseal.hcl
vault token create -orphan -policy=
On the charm vault:
VAULT_TOKEN=
then I should add in /var/snap/
seal "transit" {
address = "http://<external-
disable_renewal = "false"
key_name = "autounseal"
mount_path = "transit/"
tls_skip_verify = "true"
}
At the moment I can't find another way to use an external vault to unseal the key in the internal vault.
Changed in vault-charm: | |
status: | New → Triaged |
importance: | Undecided → Wishlist |