---
title: Charmhub | Deploy Vault using Charmhub - The Open Operator Collection
description: Deploy the latest version of Vault on any cloud.
url: https://charmhub.io/vault/docs/h-enable-vault-autounseal
---

# Vault

[Vault charmers](https://charmhub.io/publisher/vault-charmers "View all packages from Vault charmers")

* [Vault charmers](https://charmhub.io/publisher/vault-charmers "View all packages from Vault charmers")
* [Security](https://charmhub.io/?filter=security)

Platform:

24.04

23.10

23.04

22.10

22.04

20.04

18.04

2.0/stable 710

```
juju deploy vault --channel 2.0/stable
```

[Learn to deploy on juju >](https://juju.is/docs/juju/manage-applications)

---

#### Relevant links

* [Homepage](https://charmhub.io/vault)

---

#### Contacts

* [Submit a bug](https://github.com/canonical/vault-k8s-operator/issues)

---

Share your thoughts on this charm with the community on discourse.

[Join the discussion](https://discourse.charmhub.io/)

# Configure a Vault for auto-unseal

**WARNING: There is currently no way to remove the auto-unseal configuration once it has been set on Charmed Vault. Removing the integration may put Charmed Vault in a bad state which requires manual intervention.**

## [Prerequisites](https://charmhub.io/vault/docs/h-enable-vault-autounseal#p-32007-prerequisites)

1. A Charmed Vault instance you wish to use as the *unsealer*. Deployed, initialized, unsealed, and authorized. See [Tutorial: Getting started with Vault-K8s](https://discourse.charmhub.io/t/tutorial-getting-started-with-vault-k8s/12771) or [Getting Started: Vault (Machine)](https://charmhub.io/vault/docs/h-getting-started) if you’re not there yet.
2. A second Charmed Vault instance you wish to use as the *autounsealed* Vault. This instance may already be initialized, unsealed, and authorized, or you may initialize it as part of this process.

## [1. Integrate the Vault instances](https://charmhub.io/vault/docs/h-enable-vault-autounseal#p-32007-h-1-integrate-the-vault-instances)

Integrate the *autounsealed* Vault instance with the *unsealer* Vault instance.

```
juju integrate vault-unsealer:vault-autounseal-provides vault-autounsealed:vault-autounseal-requires
```

## [2. Configure the Vault CLI to interact with the *autounsealed* Vault.](https://charmhub.io/vault/docs/h-enable-vault-autounseal#p-32007-h-2-configure-the-vault-cli-to-interact-with-the-autounsealed-vault)

```
export VAULT_ADDR="..."
export VAULT_TOKEN="..."
```

Now, either follow 2a for an initialized *autounsealed* Vault instance, or 2b for an uninitialized *autounsealed* Vault instance.

### [2a. Migrate the *autounsealed* Vault instance to auto-unseal](https://charmhub.io/vault/docs/h-enable-vault-autounseal#p-32007-h-2a-migrate-the-autounsealed-vault-instance-to-auto-unseal)

In this step, the Vault instance being migrated needs to be unsealed with the existing *manual unseal keys*, and migrate its data to auto-unseal. To do this, unseal the Vault instance with the `-migrate` flag.

```
vault operator unseal -migrate ${token}
```

### [2b. If not already initialized, initialize and authorize the *autounsealed* Vault instance](https://charmhub.io/vault/docs/h-enable-vault-autounseal#p-32007-h-2b-if-not-already-initialized-initialize-and-authorize-the-autounsealed-vault-instance)

Configure your CLI to interact with the *autounsealed* Vault instance. See the getting started guide for more information on how to do this. In short, you will need to set the `VAULT_ADDR` environment variable to the address of the *autounsealed* Vault instance, and retrieve and set the appropriate CA certificate.

```
vault operator init
```

Use the root token to create a temporary token, and authorize the Vault charm with it.

```
$ vault token create -ttl=10m
Key                  Value
---                  -----
token                hvs.mmMXCLNZ2X7OcqCM38WYDnoX
token_accessor       eXzWoD1ajA5YtNgfopj1DP1r
token_duration       10m
token_renewable      true
token_policies       ["root"]
identity_policies    []
policies             ["root"]
```

Create a secret that contains the token above

```
$ juju add-secret approle_authorization_token token="hvs.mmMXCLNZ2X7OcqCM38WYDnoX"
secret:cqgj49fmp25c7796r0pg
```

Grant the secret to the *autounsealed* vault, and provide the ID of the secret to the `authorize-charm` action.

```
juju grant-secret approle_authorization_token vault-autounsealed
juju run vault-autounsealed/leader authorize-charm secret-id=cqgj49fmp25c7796r0pg
```

---