Mirrors/vault_unseal
1
0
Fork 0
mirror of https://github.com/jossansone/vault_unseal.git synced 2025-12-11 17:30:06 +01:00
Code Issues Packages Projects Releases Wiki Activity

Update README.md

Browse Source
This commit is contained in:
jossansone
2020-11-11 10:23:26 -05:00
committed by GitHub
parent 1709d0ccac
commit 697fb55efc
1 changed files with 7 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
README.md
View File

@@ -1,10 +1,10 @@
# vault_unseal
shell script to auto-unseal secondary vault (Transit Vault) using keys in production vault
This script fits a very specific need; to automatically unseal a secondary (Transit Vault) if it goes down without needing manual intervention.
Hashicorp does not recommend using a method like this to unseal a production vault for obvious security reasons.
Prerequisites:
Production Vault environment (HA or standalone) properly secured which is using auto-unseal with Transit Engine in a standalone separate Vault instance (Transit Vault).
KV Secrets location which has all unseal keys for the Transit Vault with keys as Key1, Key2, Key3, etc.
A token issued to the server running the Transit Vault which has access to the KV secret location where the unseal keys are stored
Bash script to auto-unseal secondary vault (Transit Vault) using unseal keys in production vault.
This script fits a very specific need; to automatically unseal a secondary (Transit Vault) if it goes down without needing manual intervention. It assumes that the Production Vault or cluster is still available.
## Hashicorp does not recommend using a method like this to unseal a production vault for obvious security reasons.
### Prerequisites:
- Production Vault environment (HA or standalone) properly secured which is using auto-unseal with Transit Engine in a standalone separate Vault instance (Transit Vault).
- KV Secrets location which has all unseal keys for the Transit Vault with keys as Key1, Key2, Key3, etc.
- A token issued to the server running the Transit Vault which has access to the KV secret location where the unseal keys are stored
You can modify this script easily to use fewer unseal keys if your shamir key share is less than 5 (or more)