--- title: Charmhub | Deploy Vault using Charmhub - The Open Operator Collection description: Deploy the latest version of Vault as a Kubernetes Operator on any cloud. url: https://charmhub.io/vault-k8s/libraries/vault_client --- # Vault [Canonical Telco](https://charmhub.io/publisher/telco-charmers "View all packages from Canonical Telco") * [Canonical Telco](https://charmhub.io/publisher/telco-charmers "View all packages from Canonical Telco") Platform: 2.0/stable 590 ``` juju deploy vault-k8s --channel 2.0/stable ``` [Learn to deploy on juju >](https://juju.is/docs/juju/manage-applications) [Toggle side navigation](https://charmhub.io/vault-k8s/libraries/vault_client#drawer) ## charms.vault\_k8s.v0.vault\_client * [*Docstrings*Docstrings](https://charmhub.io/vault-k8s/libraries/vault_client) [*Code*Source code](https://charmhub.io/vault-k8s/libraries/vault_client/source-code) * + Download Fetch library ``` charmcraft fetch-lib charms.vault_k8s.v0.vault_client ``` [Download vault\_client.py](https://charmhub.io/vault-k8s/libraries/vault_client/download) + *Last updated* 19 Feb 2025 + *Revision* Library version 0.26 Library for interacting with a Vault cluster. This library shares operations that interact with Vault through its API. It is intended to be used by charms that need to manage a Vault cluster. --- Index * [class LogAdapter](https://charmhub.io/vault-k8s/libraries/vault_client#logadapter) * + [def process( self, msg, kwargs)](https://charmhub.io/vault-k8s/libraries/vault_client#logadapter-process) * [class Token](https://charmhub.io/vault-k8s/libraries/vault_client#token) * + [def login( self, client)](https://charmhub.io/vault-k8s/libraries/vault_client#token-login) * [class AppRole](https://charmhub.io/vault-k8s/libraries/vault_client#approle) * + [def login( self, client)](https://charmhub.io/vault-k8s/libraries/vault_client#approle-login) * [class AuthMethod](https://charmhub.io/vault-k8s/libraries/vault_client#authmethod) * + [def login( self, client)](https://charmhub.io/vault-k8s/libraries/vault_client#authmethod-login) * [class Certificate](https://charmhub.io/vault-k8s/libraries/vault_client#certificate) * [class AuditDeviceType](https://charmhub.io/vault-k8s/libraries/vault_client#auditdevicetype) * [class SecretsBackend](https://charmhub.io/vault-k8s/libraries/vault_client#secretsbackend) * [class VaultClientError](https://charmhub.io/vault-k8s/libraries/vault_client#vaultclienterror) * [class VaultClient](https://charmhub.io/vault-k8s/libraries/vault_client#vaultclient) * + [def \_\_init\_\_( self, url, ca\_cert\_path)](https://charmhub.io/vault-k8s/libraries/vault_client#vaultclient-__init__) * + [def authenticate( self, auth\_details)](https://charmhub.io/vault-k8s/libraries/vault_client#vaultclient-authenticate) * + [def token( self)](https://charmhub.io/vault-k8s/libraries/vault_client#vaultclient-token) * + [def is\_api\_available( self)](https://charmhub.io/vault-k8s/libraries/vault_client#vaultclient-is_api_available) * + [def is\_initialized( self)](https://charmhub.io/vault-k8s/libraries/vault_client#vaultclient-is_initialized) * + [def is\_sealed( self)](https://charmhub.io/vault-k8s/libraries/vault_client#vaultclient-is_sealed) * + [def is\_available\_initialized\_and\_unsealed( self)](https://charmhub.io/vault-k8s/libraries/vault_client#vaultclient-is_available_initialized_and_unsealed) * + [def read( self, path)](https://charmhub.io/vault-k8s/libraries/vault_client#vaultclient-read) * + [def write( self, path, data)](https://charmhub.io/vault-k8s/libraries/vault_client#vaultclient-write) * + [def list( self, path)](https://charmhub.io/vault-k8s/libraries/vault_client#vaultclient-list) * + [def needs\_migration( self)](https://charmhub.io/vault-k8s/libraries/vault_client#vaultclient-needs_migration) * + [def get\_seal\_type( self)](https://charmhub.io/vault-k8s/libraries/vault_client#vaultclient-get_seal_type) * + [def is\_seal\_type\_transit( self)](https://charmhub.io/vault-k8s/libraries/vault_client#vaultclient-is_seal_type_transit) * + [def is\_active( self)](https://charmhub.io/vault-k8s/libraries/vault_client#vaultclient-is_active) * + [def is\_active\_or\_standby( self)](https://charmhub.io/vault-k8s/libraries/vault_client#vaultclient-is_active_or_standby) * + [def enable\_audit\_device( self, device\_type, path)](https://charmhub.io/vault-k8s/libraries/vault_client#vaultclient-enable_audit_device) * + [def enable\_approle\_auth\_method( self)](https://charmhub.io/vault-k8s/libraries/vault_client#vaultclient-enable_approle_auth_method) * + [def create\_or\_update\_policy\_from\_file( self, name, path)](https://charmhub.io/vault-k8s/libraries/vault_client#vaultclient-create_or_update_policy_from_file) * + [def create\_or\_update\_policy( self, name, content)](https://charmhub.io/vault-k8s/libraries/vault_client#vaultclient-create_or_update_policy) * + [def create\_or\_update\_approle( self, name, token\_ttl, token\_max\_ttl, policies, cidrs, token\_period)](https://charmhub.io/vault-k8s/libraries/vault_client#vaultclient-create_or_update_approle) * + [def generate\_role\_secret\_id( self, name, cidrs)](https://charmhub.io/vault-k8s/libraries/vault_client#vaultclient-generate_role_secret_id) * + [def read\_role\_secret( self, name, id)](https://charmhub.io/vault-k8s/libraries/vault_client#vaultclient-read_role_secret) * + [def enable\_secrets\_engine( self, backend\_type, path)](https://charmhub.io/vault-k8s/libraries/vault_client#vaultclient-enable_secrets_engine) * + [def disable\_secrets\_engine( self, path)](https://charmhub.io/vault-k8s/libraries/vault_client#vaultclient-disable_secrets_engine) * + [def get\_intermediate\_ca( self, mount)](https://charmhub.io/vault-k8s/libraries/vault_client#vaultclient-get_intermediate_ca) * + [def import\_ca\_certificate\_and\_key( self, mount, certificate, private\_key)](https://charmhub.io/vault-k8s/libraries/vault_client#vaultclient-import_ca_certificate_and_key) * + [def sign\_pki\_certificate\_signing\_request( self, mount, role, csr, common\_name, ttl)](https://charmhub.io/vault-k8s/libraries/vault_client#vaultclient-sign_pki_certificate_signing_request) * + [def create\_or\_update\_pki\_charm\_role( self, role, allowed\_domains, max\_ttl, mount)](https://charmhub.io/vault-k8s/libraries/vault_client#vaultclient-create_or_update_pki_charm_role) * + [def is\_pki\_role\_created( self, role, mount)](https://charmhub.io/vault-k8s/libraries/vault_client#vaultclient-is_pki_role_created) * + [def create\_snapshot( self)](https://charmhub.io/vault-k8s/libraries/vault_client#vaultclient-create_snapshot) * + [def restore\_snapshot( self, snapshot)](https://charmhub.io/vault-k8s/libraries/vault_client#vaultclient-restore_snapshot) * + [def get\_raft\_cluster\_state( self)](https://charmhub.io/vault-k8s/libraries/vault_client#vaultclient-get_raft_cluster_state) * + [def is\_raft\_cluster\_healthy( self)](https://charmhub.io/vault-k8s/libraries/vault_client#vaultclient-is_raft_cluster_healthy) * + [def remove\_raft\_node( self, id)](https://charmhub.io/vault-k8s/libraries/vault_client#vaultclient-remove_raft_node) * + [def is\_node\_in\_raft\_peers( self, id)](https://charmhub.io/vault-k8s/libraries/vault_client#vaultclient-is_node_in_raft_peers) * + [def get\_num\_raft\_peers( self)](https://charmhub.io/vault-k8s/libraries/vault_client#vaultclient-get_num_raft_peers) * + [def is\_common\_name\_allowed\_in\_pki\_role( self, role, mount, common\_name)](https://charmhub.io/vault-k8s/libraries/vault_client#vaultclient-is_common_name_allowed_in_pki_role) * + [def get\_role\_max\_ttl( self, role, mount)](https://charmhub.io/vault-k8s/libraries/vault_client#vaultclient-get_role_max_ttl) * + [def list\_pki\_issuers( self, mount)](https://charmhub.io/vault-k8s/libraries/vault_client#vaultclient-list_pki_issuers) * + [def create\_transit\_key( self, mount\_point, key\_name)](https://charmhub.io/vault-k8s/libraries/vault_client#vaultclient-create_transit_key) * + [def delete\_role( self, name)](https://charmhub.io/vault-k8s/libraries/vault_client#vaultclient-delete_role) * + [def delete\_policy( self, name)](https://charmhub.io/vault-k8s/libraries/vault_client#vaultclient-delete_policy) * [def generate\_pem\_bundle( certificate, private\_key )](https://charmhub.io/vault-k8s/libraries/vault_client#generate_pem_bundle) #### class LogAdapter Description Adapter for the logger to prepend a prefix to all log lines. None Methods LogAdapter. process( *self* , msg: str , kwargs: MutableMapping ) Description Decides the format for the prepended text. None #### class Token Class that represents token authentication for vault. Description This method is the most basic and always available method to access vault. Methods Token. login( *self* , client ) Description Authenticate a vault client with a token. None #### class AppRole Class that represents approle authentication for vault. Description This method is primarily used to authenticate automation programs for vault. Methods AppRole. login( *self* , client ) Description Authenticate a vault client with approle details. None #### class AuthMethod Description Classes that implement a login method are auth methods used to log in to Vault. None Methods AuthMethod. login( *self* , client ) Description Log in using the given method. None #### class Certificate Description Class that represents a certificate generated by the PKI secrets engine. None #### class AuditDeviceType Description Class that represents the devices that vault supports as device types for audit. None #### class SecretsBackend Description Class that represents the supported secrets backends by Vault. None #### class VaultClientError Description Base class for exceptions raised by the Vault client. None #### class VaultClient Description Class to interact with Vault through its API. None Methods VaultClient. \_\_init\_\_( *self* , url: str , ca\_cert\_path ) VaultClient. authenticate( *self* , auth\_details: AuthMethod ) Find and use the token related with the given auth method. Returns bool True if the authentication was successful and the token was accepted by vault. VaultClient. token( *self* ) Description Return the token used to authenticate with Vault. None VaultClient. is\_api\_available( *self* ) Description Return whether Vault is available. None VaultClient. is\_initialized( *self* ) Description Return whether Vault is initialized. None VaultClient. is\_sealed( *self* ) Description Return whether Vault is sealed. None VaultClient. is\_available\_initialized\_and\_unsealed( *self* ) Return whether Vault is available, initialized and unsealed. Description In case of a transient error, it will return False. VaultClient. read( *self* , path: str ) Description Read the data at the given path. None VaultClient. write( *self* , path: str , data: dict ) Description Write the data at the given path. None VaultClient. list( *self* , path: str ) Description List the keys at the given path. None VaultClient. needs\_migration( *self* ) Description Return true if the vault needs to be migrated, false otherwise. None VaultClient. get\_seal\_type( *self* ) Description Return the seal type of the Vault. None VaultClient. is\_seal\_type\_transit( *self* ) Description Return whether Vault is sealed by the transit backend. None VaultClient. is\_active( *self* ) Return whether the Vault node is active or not. Returns True if initialized, unsealed and active, False otherwise. VaultClient. is\_active\_or\_standby( *self* ) Return the health status of Vault. Returns True if initialized, unsealed and active or standby, False otherwise. VaultClient. enable\_audit\_device( *self* , device\_type: AuditDeviceType , path: str ) Enable a new audit device at the supplied path if it isn't already enabled. Arguments device\_type One of three available device types path The path that will receive audit logs VaultClient. enable\_approle\_auth\_method( *self* ) Description Enable approle auth method if it isn't already enabled. None VaultClient. create\_or\_update\_policy\_from\_file( *self* , name: str , path: str ) Create/update a policy within vault, using the file contents as the policy. Arguments name Name of the policy to create path The path of the file where the policy is defined, ending with .hcl \*\*formatting\_args Additional arguments to format the policy VaultClient. create\_or\_update\_policy( *self* , name: str , content: str ) Create/update a policy within vault. Arguments name Name of the policy to create content The policy content VaultClient. create\_or\_update\_approle( *self* , name: str , token\_ttl , token\_max\_ttl , policies , cidrs , token\_period ) Create/update a role within vault associating the supplied policies. Arguments name Name of the role to be created or updated policies The attached list of policy names this approle will have access to token\_ttl Incremental lifetime for generated tokens, provided as a duration string such as "5m" token\_max\_ttl Maximum lifetime for generated tokens, provided as a duration string such as "5m" token\_period The period within which the token must be renewed. See Vault documentation for more information. cidrs The list of IP networks that are allowed to authenticate VaultClient. generate\_role\_secret\_id( *self* , name: str , cidrs ) Description Generate a new secret tied to an AppRole. None VaultClient. read\_role\_secret( *self* , name: str , id: str ) Description Get definition of a secret tied to an AppRole. None VaultClient. enable\_secrets\_engine( *self* , backend\_type: SecretsBackend , path: str ) Description Enable given secret engine on the given path. None VaultClient. disable\_secrets\_engine( *self* , path: str ) Description Disable the secret engine at the given path. None VaultClient. get\_intermediate\_ca( *self* , mount: str ) Description Get the intermediate CA for the PKI backend. None VaultClient. import\_ca\_certificate\_and\_key( *self* , mount: str , certificate: str , private\_key: str ) Description Import the CA certificate and private key for the PKI backend. None VaultClient. sign\_pki\_certificate\_signing\_request( *self* , mount: str , role: str , csr: str , common\_name: str , ttl: str ) Sign a certificate signing request for the PKI backend. Arguments mount The PKI mount point. role The role to use for signing the certificate. csr The certificate signing request. common\_name The common name for the certificate. ttl The relative validity for the certificate. Should be a string in the format of a number with a unit such as "120m", "10h" or "90d". Returns Certificate The signed certificate object VaultClient. create\_or\_update\_pki\_charm\_role( *self* , role: str , allowed\_domains: str , max\_ttl: str , mount: str ) Create a role for the PKI backend or update it if it already exists. Arguments role The name of the role to create or update. allowed\_domains The list of allowed domains for the role. max\_ttl The maximum TTL for the role. It is also used by Vault as a maximum validity for the certificates issued by this role. Should be a string in the format of a number with a unit such as "120m", "10h" or "90d". mount The mount point of the PKI backend for which the role will be created. VaultClient. is\_pki\_role\_created( *self* , role: str , mount: str ) Description Check if the role is created for the PKI backend. None VaultClient. create\_snapshot( *self* ) Description Create a snapshot of the Vault data. None VaultClient. restore\_snapshot( *self* , snapshot: IOBase ) Restore a snapshot of the Vault data. Description Uses force\_restore\_raft\_snapshot to restore the snapshot even if the unseal key used at backup time is different from the current one. VaultClient. get\_raft\_cluster\_state( *self* ) Description Get raft cluster state. None VaultClient. is\_raft\_cluster\_healthy( *self* ) Description Check if raft cluster is healthy. None VaultClient. remove\_raft\_node( *self* , id: str ) Description Remove raft peer. None VaultClient. is\_node\_in\_raft\_peers( *self* , id: str ) Description Check if node is in raft peers. None VaultClient. get\_num\_raft\_peers( *self* ) Description Return the number of raft peers. None VaultClient. is\_common\_name\_allowed\_in\_pki\_role( *self* , role: str , mount: str , common\_name: str ) Description Return whether the provided common name is in the list of domains allowed by the specified PKI role. None VaultClient. get\_role\_max\_ttl( *self* , role: str , mount: str ) Description Get the max ttl for the specified PKI role in seconds. None VaultClient. list\_pki\_issuers( *self* , mount: str ) Get the list of issuers for the PKI backend. Arguments mount The mount point of the PKI backend. Returns The list of issuers (i.e. ["issuer1", "issuer2"]). VaultClient. create\_transit\_key( *self* , mount\_point: str , key\_name: str ) Description Create a new key in the transit backend. None VaultClient. delete\_role( *self* , name: str ) Description Delete the approle with the given name. None VaultClient. delete\_policy( *self* , name: str ) Description Delete the policy with the given name. None #### def generate\_pem\_bundle(     certificate: str,     private\_key: str ) Description Generate a PEM bundle from a certificate and private key. None