--- title: Charmhub | Deploy Vault using Charmhub - The Open Operator Collection description: Deploy the latest version of Vault as a Kubernetes Operator on any cloud. url: https://charmhub.io/vault-k8s/libraries/vault_autounseal --- # Vault [Canonical Telco](https://charmhub.io/publisher/telco-charmers "View all packages from Canonical Telco") * [Canonical Telco](https://charmhub.io/publisher/telco-charmers "View all packages from Canonical Telco") Platform: 2.0/stable 590 ``` juju deploy vault-k8s --channel 2.0/stable ``` [Learn to deploy on juju >](https://juju.is/docs/juju/manage-applications) [Toggle side navigation](https://charmhub.io/vault-k8s/libraries/vault_autounseal#drawer) ## charms.vault\_k8s.v0.vault\_autounseal * [*Docstrings*Docstrings](https://charmhub.io/vault-k8s/libraries/vault_autounseal) [*Code*Source code](https://charmhub.io/vault-k8s/libraries/vault_autounseal/source-code) * + Download Fetch library ``` charmcraft fetch-lib charms.vault_k8s.v0.vault_autounseal ``` [Download vault\_autounseal.py](https://charmhub.io/vault-k8s/libraries/vault_autounseal/download) + *Last updated* 06 Dec 2024 + *Revision* Library version 0.6 Library for the vault-autounseal relation. This library contains the Requires and Provides classes for handling the vault-autounseal interface. The provider side of the interface is responsible for enabling the vault transit engine and creating the necessary keys and policies for an external vault to be able to autounseal itself. The requirer side of the interface is responsible for retrieving the necessary details to autounseal the vault instance, and configuring the vault instance to use them. ##### Getting Started From a charm directory, fetch the library using `charmcraft`: ``` charmcraft fetch-lib charms.vault_k8s.v0.vault_autounseal ``` ###### Provider charm The provider charm is the charm that provides a Vault instance that can be used to autounseal other Vault instances via the Vault transit backend. Add the following to `metadata.yaml`: ``` provides: vault-autounseal-provides: interface: vault-autounseal ``` ###### Requirer charm The requirer charm is the charm that wishes to autounseal a Vault instance via the Vault transit backend. Add the following to `metadata.yaml`: ``` requires: vault-autounseal-requires: interface: vault-autounseal limit: 1 ``` ###### Integration You can integrate both charms by running: ``` juju integrate :vault-autounseal-provides :vault-autounseal-requires ``` where `vault a` is the Vault app which will provide the autounseal service, and `vault b` is the Vault app which will be configured for autounseal via `vault a`. --- Index * [class LogAdapter](https://charmhub.io/vault-k8s/libraries/vault_autounseal#logadapter) * + [def process( self, msg, kwargs)](https://charmhub.io/vault-k8s/libraries/vault_autounseal#logadapter-process) * [class VaultAutounsealProviderSchema](https://charmhub.io/vault-k8s/libraries/vault_autounseal#vaultautounsealproviderschema) * [class ProviderSchema](https://charmhub.io/vault-k8s/libraries/vault_autounseal#providerschema) * [class VaultAutounsealDetailsReadyEvent](https://charmhub.io/vault-k8s/libraries/vault_autounseal#vaultautounsealdetailsreadyevent) * + [def \_\_init\_\_( self, handle, address, mount\_path, key\_name, role\_id, secret\_id, ca\_certificate)](https://charmhub.io/vault-k8s/libraries/vault_autounseal#vaultautounsealdetailsreadyevent-__init__) * + [def snapshot( self)](https://charmhub.io/vault-k8s/libraries/vault_autounseal#vaultautounsealdetailsreadyevent-snapshot) * + [def restore( self, snapshot)](https://charmhub.io/vault-k8s/libraries/vault_autounseal#vaultautounsealdetailsreadyevent-restore) * [class VaultAutounsealProviderRemoved](https://charmhub.io/vault-k8s/libraries/vault_autounseal#vaultautounsealproviderremoved) * [class VaultAutounsealRequirerRelationCreated](https://charmhub.io/vault-k8s/libraries/vault_autounseal#vaultautounsealrequirerrelationcreated) * + [def \_\_init\_\_( self, handle, relation)](https://charmhub.io/vault-k8s/libraries/vault_autounseal#vaultautounsealrequirerrelationcreated-__init__) * + [def snapshot( self)](https://charmhub.io/vault-k8s/libraries/vault_autounseal#vaultautounsealrequirerrelationcreated-snapshot) * + [def restore( self, snapshot)](https://charmhub.io/vault-k8s/libraries/vault_autounseal#vaultautounsealrequirerrelationcreated-restore) * [class VaultAutounsealRequirerRelationBroken](https://charmhub.io/vault-k8s/libraries/vault_autounseal#vaultautounsealrequirerrelationbroken) * + [def \_\_init\_\_( self, handle, relation)](https://charmhub.io/vault-k8s/libraries/vault_autounseal#vaultautounsealrequirerrelationbroken-__init__) * + [def snapshot( self)](https://charmhub.io/vault-k8s/libraries/vault_autounseal#vaultautounsealrequirerrelationbroken-snapshot) * + [def restore( self, snapshot)](https://charmhub.io/vault-k8s/libraries/vault_autounseal#vaultautounsealrequirerrelationbroken-restore) * [class VaultAutounsealProvidesEvents](https://charmhub.io/vault-k8s/libraries/vault_autounseal#vaultautounsealprovidesevents) * [class VaultAutounsealRequireEvents](https://charmhub.io/vault-k8s/libraries/vault_autounseal#vaultautounsealrequireevents) * [class AutounsealDetails](https://charmhub.io/vault-k8s/libraries/vault_autounseal#autounsealdetails) * [class VaultAutounsealProvides](https://charmhub.io/vault-k8s/libraries/vault_autounseal#vaultautounsealprovides) * + [def \_\_init\_\_( self, charm, relation\_name)](https://charmhub.io/vault-k8s/libraries/vault_autounseal#vaultautounsealprovides-__init__) * + [def set\_autounseal\_data( self, relation, vault\_address, mount\_path, key\_name, approle\_role\_id, approle\_secret\_id, ca\_certificate)](https://charmhub.io/vault-k8s/libraries/vault_autounseal#vaultautounsealprovides-set_autounseal_data) * + [def get\_relations\_without\_credentials( self, relation\_id)](https://charmhub.io/vault-k8s/libraries/vault_autounseal#vaultautounsealprovides-get_relations_without_credentials) * [class VaultAutounsealRequires](https://charmhub.io/vault-k8s/libraries/vault_autounseal#vaultautounsealrequires) * + [def \_\_init\_\_( self, charm, relation\_name)](https://charmhub.io/vault-k8s/libraries/vault_autounseal#vaultautounsealrequires-__init__) * + [def get\_details( self)](https://charmhub.io/vault-k8s/libraries/vault_autounseal#vaultautounsealrequires-get_details) #### class LogAdapter Description Adapter for the logger to prepend a prefix to all log lines. None Methods LogAdapter. process( *self* , msg: str , kwargs: MutableMapping ) Description Prepend the prefix to the log message. None #### class VaultAutounsealProviderSchema Description Provider side of the vault-autounseal relation interface. None #### class ProviderSchema Description The schema for the provider side of this interface. None #### class VaultAutounsealDetailsReadyEvent Description Event emitted on the requirer when Vault autounseal details are ready in the databag. None Methods VaultAutounsealDetailsReadyEvent. \_\_init\_\_( *self* , handle: Handle , address: str , mount\_path: str , key\_name: str , role\_id: str , secret\_id: str , ca\_certificate: str ) VaultAutounsealDetailsReadyEvent. Arguments handle ops.Handle address The address of the Vault server to connect to. mount\_path The path to the transit engine mount point where the key is stored. key\_name The name of the transit key to use for autounseal. role\_id Approle role ID. secret\_id Approle secret ID. ca\_certificate The CA certificate to use when validating the Vault server's certificate. VaultAutounsealDetailsReadyEvent. snapshot( *self* ) Description Return snapshot data that should be persisted. None VaultAutounsealDetailsReadyEvent. restore( *self* , snapshot ) Description Restore the event from a snapshot. None #### class VaultAutounsealProviderRemoved Description Event emitted when the vault that provided autounseal capabilities is removed. None #### class VaultAutounsealRequirerRelationCreated Description Event emitted when Vault autounseal should be initialized for a new application. None Methods VaultAutounsealRequirerRelationCreated. \_\_init\_\_( *self* , handle: Handle , relation: Relation ) VaultAutounsealRequirerRelationCreated. snapshot( *self* ) Description Return snapshot data that should be persisted. None VaultAutounsealRequirerRelationCreated. restore( *self* , snapshot ) Description Restore the event from a snapshot. None #### class VaultAutounsealRequirerRelationBroken Description Event emitted on the Provider when a relation to a Requirer is broken. None Methods VaultAutounsealRequirerRelationBroken. \_\_init\_\_( *self* , handle: Handle , relation: Relation ) VaultAutounsealRequirerRelationBroken. snapshot( *self* ) Description Return snapshot data that should be persisted. None VaultAutounsealRequirerRelationBroken. restore( *self* , snapshot ) Description Restore the event from a snapshot. None #### class VaultAutounsealProvidesEvents Description Events raised by the vault-autounseal relation on the provider side. None #### class VaultAutounsealRequireEvents Description Events raised by the vault-autounseal relation on the requirer side. None #### class AutounsealDetails Description The details required to autounseal a vault instance. None #### class VaultAutounsealProvides Description Manages the vault-autounseal relation from the provider side. None Methods VaultAutounsealProvides. \_\_init\_\_( *self* , charm: CharmBase , relation\_name: str ) VaultAutounsealProvides. set\_autounseal\_data( *self* , relation: Relation , vault\_address: str , mount\_path: str , key\_name: str , approle\_role\_id: str , approle\_secret\_id: str , ca\_certificate: str ) Set the autounseal data in the relation databag. Description Args: relation: The Juju relation to set the autounseal data in. vault\_address: The address of the Vault server which will be used for autounseal mount\_path: The path to the transit engine mount point where the key is stored. key\_name: The name of the transit key to use for autounseal. approle\_role\_id: The AppRole Role ID to use when authenticating with the external Vault server. approle\_secret\_id: The AppRole Secret ID to use when authenticating with the external Vault server. ca\_certificate: The CA certificate to use when validating the external Vault server's certificate. Raises: TransientJujuError SecretValidationError ValueError VaultAutounsealProvides. get\_relations\_without\_credentials( *self* , relation\_id ) Description Get the relations which do not have credentials for auto-unseal. None #### class VaultAutounsealRequires Description Manages the vault-autounseal relation from the requirer side. None Methods VaultAutounsealRequires. \_\_init\_\_( *self* , charm: CharmBase , relation\_name: str ) VaultAutounsealRequires. get\_details( *self* ) Return the vault address, role id, secret id and ca certificate from the relation databag. Description Returns: An AutounsealDetails object if the data is valid, None otherwise. Raises: RuntimeError: If the requirer is related to more than one provider. TransientJujuError