---
title: Charmhub | Deploy Vault using Charmhub - The Open Operator Collection
description: Deploy the latest version of Vault as a Kubernetes Operator on any cloud.
url: https://charmhub.io/vault-k8s/docs/h-unseal
---

# Vault

[Canonical Telco](https://charmhub.io/publisher/telco-charmers "View all packages from Canonical Telco")

* [Canonical Telco](https://charmhub.io/publisher/telco-charmers "View all packages from Canonical Telco")

Platform:

2.0/stable 565

```
juju deploy vault-k8s --channel 2.0/stable
```

[Learn to deploy on juju >](https://juju.is/docs/juju/manage-applications)

---

#### Relevant links

* [Homepage](https://charmhub.io/vault-k8s)

---

#### Contacts

##### Maintainers

+ [Matrix Channel](https://matrix.to/#/!yAkGlrYcBFYzYRvOlQ:ubuntu.com?via=ubuntu.com&via=matrix.org&via=mozilla.org)

* [Submit a bug](https://github.com/canonical/vault-k8s-operator/issues)

---

Share your thoughts on this charm with the community on discourse.

[Join the discussion](https://discourse.charmhub.io/)

# Unseal a sealed unit

In the circumstance that a Vault unit restarts, you will have to manually unseal it. This guide walks you through the necessary steps:

Starting from a cluster where one unit is sealed:

```
$ juju status
Model  Controller          Cloud/Region        Version  SLA          Timestamp
demo   microk8s-localhost  microk8s/localhost  3.4.0    unsupported  13:02:12-04:00

App    Version  Status   Scale  Charm      Channel    Rev  Address         Exposed  Message
vault           waiting      3  vault-k8s  1.15/beta  198  10.152.183.208  no       installing agent

Unit      Workload  Agent  Address      Ports  Message
vault/0*  active    idle   10.1.182.38
vault/1   active    idle   10.1.182.51
vault/2   blocked   idle   10.1.182.15         Please unseal Vault
```

Set the `VAULT_ADDR` variable to the sealed unit:

```
export VAULT_ADDR=https://$(juju status vault/2 --format=yaml |  yq '.applications.vault.units.vault/2.address'):8200; echo $VAULT_ADDR
```

Unseal the the unit using the same unseal keys as received during the initialization of the Vault leader:

```
vault operator unseal -tls-skip-verify EJoB62t286mjUpSQYZg3mOla3lz/bbElVL5OLnj+rpE=
```

The units will go back to the active/idle state:

```
$ juju status
Model  Controller          Cloud/Region        Version  SLA          Timestamp
demo   microk8s-localhost  microk8s/localhost  3.4.0    unsupported  13:03:26-04:00

App    Version  Status  Scale  Charm      Channel    Rev  Address         Exposed  Message
vault           active      3  vault-k8s  1.15/beta  198  10.152.183.208  no

Unit      Workload  Agent  Address      Ports  Message
vault/0*  active    idle   10.1.182.38
vault/1   active    idle   10.1.182.51
vault/2   active    idle   10.1.182.15
```

---