Kembali ke Beranda
Networking
jsturana9 Juni 2026

Setup Vault dan Certificate Management OpenStack Charm

Tutorial setup Vault untuk certificate management pada OpenStack Charm, mulai dari akses unit Vault, konfigurasi environment VAULT_ADDR, inisialisasi Vault, penyimpanan unseal key dan root token, proses unseal Vault, pembuatan token sementara untuk authorize charm, generate Root CA, reissue certificate, hingga troubleshooting Vault error setelah reboot, outage, atau masalah cluster.

Vault dipakai untuk certificate management pada OpenStack charm deployment.

1. Masuk ke Unit Vault

BASH 
juju ssh vault/0

2. Set Environment Vault

Edit .profile:

BASH 
nano .profile

Tambahkan:

BASH 
export VAULT_ADDR='http://127.0.0.1:8200'

Reload profile:

BASH 
source .profile

3. Init Vault

BASH 
vault operator init -key-shares=5 -key-threshold=3

Output akan menghasilkan 5 unseal key dan 1 initial root token.

Simpan unseal key dan root token di password vault/internal secret manager. Jangan tempel token asli di artikel blog.

4. Set Token dan Unseal Vault

Edit .profile lagi:

BASH 
nano .profile

Tambahkan token:

BASH 
export VAULTTOKEN=<VAULTROOT_TOKEN>

Unseal minimal 3 key:

BASH 
vault operator unseal <UNSEALKEY1>
vault operator unseal <UNSEALKEY2>
vault operator unseal <UNSEALKEY3>

Cek status:

BASH 
vault status

5. Buat Token Sementara untuk Authorize Charm

BASH 
vault token create -ttl=10m

Gunakan token tersebut untuk authorize charm:

BASH 
juju run-action --wait vault/leader authorize-charm token=<VAULT_TOKEN>

6. Generate Root CA

BASH 
juju run-action --wait vault/leader generate-root-ca

Jika perlu reissue certificate:

BASH 
juju run-action vault/0 --wait reissue-certificates

7. Issue Umum: Vault Error Setelah MySQL/Cluster Bermasalah

Biasanya Vault perlu di-unseal ulang setelah reboot atau outage.

BASH 
juju ssh vault/0
export VAULTTOKEN=<VAULTTOKEN>
vault operator unseal <UNSEALKEY1>
vault operator unseal <UNSEALKEY2>
vault operator unseal <UNSEALKEY3>
vault status

Cek leader data:

BASH 
juju run -u vault/0 leader-get
vaultopenstackopenstack charmjujucertificate managementroot catlssslunseal vaultvault tokenauthorize charmreissue certificatecloud securitysecret managementtroubleshootingopenstack deployment