• Logo
    Vault Charms
  • github.com/canonical/vault-k8s-operator
  • More resources
    • Discourse
    • Matrix
    • GitHub
Contents Menu Expand Light mode Dark mode Auto light/dark, in light mode Auto light/dark, in dark mode Skip to content
Vault Charms documentation
Vault Charms documentation
  • Tutorials
    • Getting Started (Kubernetes)
    • Getting Started (Machine)
  • How-to guides
    • Scale (K8s)
    • Scale (Machine)
    • Unseal a sealed unit (K8s)
    • Unseal a sealed unit (Machine)
    • Use Vault behind an Ingress (K8s)
    • Use Vault as an intermediate CA
    • Use Vault as an ACME Server to obtain TLS certificates
    • Integrate with COS (K8s)
    • Integrate with COS (Machine)
    • Configure a Vault for auto-unseal
    • Scale (K8s)
    • Scale (Machine)
    • Create a backup
    • Restore a backup
    • Upgrade Vault
    • Recover a Vault Cluster When Raft Quorum is Lost
  • Reference
    • Storage Backend
    • TLS
    • Unsealing
    • Production blueprint
    • S3 storage for Backup and Restore
    • Key differences between Vault charm version 1.8 and 1.15
    • Relation-based secret engines
    • Charm Policies
  • Explanation
    • High Availability
    • Security
Back to top

UnsealingΒΆ

By default, Vault units are sealed upon Vault initialisation and every time units restart. Users have to manually unseal Vault units in order for them to become active. For more information about this topic, read the following documents:

  • The Vault seal/unseal concept

  • How-to: Unseal a sealed unit (k8s)

  • How-to: Unseal a sealed unit (machine)

Copyright © 2025 CC-BY-SA, Canonical Ltd.
Last updated on Jun 27, 2025
Contents
  • Unsealing