--- title: Charmhub | Deploy Vault using Charmhub - The Open Operator Collection description: Deploy the latest version of Vault as a Kubernetes Operator on any cloud. url: https://charmhub.io/vault-k8s/libraries/vault_tls --- # Vault [Canonical Telco](https://charmhub.io/publisher/telco-charmers "View all packages from Canonical Telco") * [Canonical Telco](https://charmhub.io/publisher/telco-charmers "View all packages from Canonical Telco") Platform: 2.0/stable 565 ``` juju deploy vault-k8s --channel 2.0/stable ``` [Learn to deploy on juju >](https://juju.is/docs/juju/manage-applications) [Toggle side navigation](https://charmhub.io/vault-k8s/libraries/vault_tls#drawer) ## charms.vault\_k8s.v0.vault\_tls * [*Docstrings*Docstrings](https://charmhub.io/vault-k8s/libraries/vault_tls) [*Code*Source code](https://charmhub.io/vault-k8s/libraries/vault_tls/source-code) * + Download Fetch library ``` charmcraft fetch-lib charms.vault_k8s.v0.vault_tls ``` [Download vault\_tls.py](https://charmhub.io/vault-k8s/libraries/vault_tls/download) + *Last updated* 19 Nov 2024 + *Revision* Library version 0.14 This file includes methods to manage TLS certificates within the Vault charms. --- Index * [class LogAdapter](https://charmhub.io/vault-k8s/libraries/vault_tls#logadapter) * + [def process( self, msg, kwargs)](https://charmhub.io/vault-k8s/libraries/vault_tls#logadapter-process) * [class TLSMode](https://charmhub.io/vault-k8s/libraries/vault_tls#tlsmode) * [class WorkloadBase](https://charmhub.io/vault-k8s/libraries/vault_tls#workloadbase) * + [def exists( self, path)](https://charmhub.io/vault-k8s/libraries/vault_tls#workloadbase-exists) * + [def pull( self, path)](https://charmhub.io/vault-k8s/libraries/vault_tls#workloadbase-pull) * + [def push( self, path, source)](https://charmhub.io/vault-k8s/libraries/vault_tls#workloadbase-push) * + [def make\_dir( self, path)](https://charmhub.io/vault-k8s/libraries/vault_tls#workloadbase-make_dir) * + [def remove\_path( self, path, recursive)](https://charmhub.io/vault-k8s/libraries/vault_tls#workloadbase-remove_path) * + [def send\_signal( self, signal, process)](https://charmhub.io/vault-k8s/libraries/vault_tls#workloadbase-send_signal) * + [def restart( self, process)](https://charmhub.io/vault-k8s/libraries/vault_tls#workloadbase-restart) * + [def stop( self, process)](https://charmhub.io/vault-k8s/libraries/vault_tls#workloadbase-stop) * [class VaultCertsError](https://charmhub.io/vault-k8s/libraries/vault_tls#vaultcertserror) * + [def \_\_init\_\_( self, message)](https://charmhub.io/vault-k8s/libraries/vault_tls#vaultcertserror-__init__) * [class File](https://charmhub.io/vault-k8s/libraries/vault_tls#file) * [class VaultTLSManager](https://charmhub.io/vault-k8s/libraries/vault_tls#vaulttlsmanager) * + [def \_\_init\_\_( self, charm, service\_name, tls\_directory\_path, workload, common\_name, sans\_dns, sans\_ip)](https://charmhub.io/vault-k8s/libraries/vault_tls#vaulttlsmanager-__init__) * + [def send\_ca\_cert( self)](https://charmhub.io/vault-k8s/libraries/vault_tls#vaulttlsmanager-send_ca_cert) * + [def get\_tls\_file\_path\_in\_workload( self, file)](https://charmhub.io/vault-k8s/libraries/vault_tls#vaulttlsmanager-get_tls_file_path_in_workload) * + [def get\_tls\_file\_path\_in\_charm( self, file)](https://charmhub.io/vault-k8s/libraries/vault_tls#vaulttlsmanager-get_tls_file_path_in_charm) * + [def tls\_file\_available\_in\_charm( self, file)](https://charmhub.io/vault-k8s/libraries/vault_tls#vaulttlsmanager-tls_file_available_in_charm) * + [def ca\_certificate\_is\_saved( self)](https://charmhub.io/vault-k8s/libraries/vault_tls#vaulttlsmanager-ca_certificate_is_saved) * + [def pull\_tls\_file\_from\_workload( self, file)](https://charmhub.io/vault-k8s/libraries/vault_tls#vaulttlsmanager-pull_tls_file_from_workload) * + [def ca\_certificate\_secret\_exists( self)](https://charmhub.io/vault-k8s/libraries/vault_tls#vaulttlsmanager-ca_certificate_secret_exists) * + [def push\_autounseal\_ca\_cert( self, ca\_cert)](https://charmhub.io/vault-k8s/libraries/vault_tls#vaulttlsmanager-push_autounseal_ca_cert) * + [def tls\_file\_pushed\_to\_workload( self, file)](https://charmhub.io/vault-k8s/libraries/vault_tls#vaulttlsmanager-tls_file_pushed_to_workload) * [def generate\_vault\_ca\_certificate( )](https://charmhub.io/vault-k8s/libraries/vault_tls#generate_vault_ca_certificate) * [def generate\_vault\_unit\_certificate( common\_name, sans\_ip, sans\_dns, ca\_certificate, ca\_private\_key )](https://charmhub.io/vault-k8s/libraries/vault_tls#generate_vault_unit_certificate) * [def existing\_certificate\_is\_self\_signed( ca\_certificate )](https://charmhub.io/vault-k8s/libraries/vault_tls#existing_certificate_is_self_signed) #### class LogAdapter Description Adapter for the logger to prepend a prefix to all log lines. None Methods LogAdapter. process( *self* , msg , kwargs ) Description Decides the format for the prepended text. None #### class TLSMode This class defines the different modes of TLS configuration. Description SELF\_SIGNED: The charm will generate a self signed certificate. TLS\_INTEGRATION: The charm will use the TLS integration relation. #### class WorkloadBase Description Define an interface for the Machine and Container classes. None Methods WorkloadBase. exists( *self* , path: str ) Description Check if a file exists in the workload. None WorkloadBase. pull( *self* , path: str ) Description Read file from the workload. None WorkloadBase. push( *self* , path: str , source: str ) Description Write file to the workload. None WorkloadBase. make\_dir( *self* , path: str ) Description Create directory in the workload. None WorkloadBase. remove\_path( *self* , path: str , recursive: bool ) Description Remove file or directory from the workload. None WorkloadBase. send\_signal( *self* , signal: int , process: str ) Description Send a signal to a process in the workload. None WorkloadBase. restart( *self* , process: str ) Description Restart the workload service. None WorkloadBase. stop( *self* , process: str ) Description Stop a service in the workload. None #### class VaultCertsError Description Exception raised when a vault certificate is not found. None Methods VaultCertsError. \_\_init\_\_( *self* , message: str ) #### class File Description This enum determines which files are expected of the library to read. None #### class VaultTLSManager Description This class configures the certificates within Vault. None Methods VaultTLSManager. \_\_init\_\_( *self* , charm: CharmBase , service\_name: str , tls\_directory\_path: str , workload: WorkloadBase , common\_name: str , sans\_dns , sans\_ip ) Create a new VaultTLSManager object. Arguments charm CharmBase service\_name Name of the container in k8s and name of the process in machine. tls\_directory\_path Path of the directory where certificates should be stored on the workload. workload Either a Container or a Machine. common\_name The common name of the certificate sans\_dns Subject alternative names of the certificate sans\_ip Subject alternative IP addresses of the certificate VaultTLSManager. send\_ca\_cert( *self* ) Description Send the existing CA cert in the workload to all relations. None VaultTLSManager. get\_tls\_file\_path\_in\_workload( *self* , file: File ) Return the requested file's location in the workload. Arguments file a File object that determines which file path to return Returns the path of the file from the workload's perspective VaultTLSManager. get\_tls\_file\_path\_in\_charm( *self* , file: File ) Return the requested file's location in the charm (not in the workload). Arguments file a File object that determines which file path to return Returns str path Description This path would typically be: /var/lib/juju/storage/certs/0/{file}.pem VaultTLSManager. tls\_file\_available\_in\_charm( *self* , file: File ) Return whether the given file is available in the charm. Arguments file a File object that determines which file to check Returns bool True if file exists VaultTLSManager. ca\_certificate\_is\_saved( *self* ) Description Return wether a CA cert and its private key are saved in the charm. None VaultTLSManager. pull\_tls\_file\_from\_workload( *self* , file: File ) Get a file related to certs from the workload. Arguments file a File object that determines which file to read. Returns str The file content without whitespace Or an empty string if the file does not exist. VaultTLSManager. ca\_certificate\_secret\_exists( *self* ) Description Return whether CA certificate is stored in secret. None VaultTLSManager. push\_autounseal\_ca\_cert( *self* , ca\_cert: str ) Push the CA certificate to the workload. Arguments ca\_cert The CA certificate to push to the workload. VaultTLSManager. tls\_file\_pushed\_to\_workload( *self* , file: File ) Return whether tls file is pushed to the workload. Arguments file a File object that determines which file to check. Returns bool True if file exists. #### def generate\_vault\_ca\_certificate() Generate Vault CA certificates valid for 50 years. Returns CA Private key, CA certificate #### def generate\_vault\_unit\_certificate(     common\_name: str,     sans\_ip,     sans\_dns,     ca\_certificate: str,     ca\_private\_key: str ) Generate Vault unit certificates valid for 50 years. Arguments common\_name Common name of the certificate sans\_ip Subject alternative IP addresses of the certificate sans\_dns Subject alternative names of the certificate ca\_certificate CA certificate ca\_private\_key CA private key Returns Private key, Certificate #### def existing\_certificate\_is\_self\_signed(ca\_certificate: Certificate) Description Return whether the certificate is a self signed certificate generated by the Vault charm. None