Setup Vault dan Certificate Management OpenStack Charm

Tutorial setup Vault untuk certificate management pada OpenStack Charm, mulai dari akses unit Vault, konfigurasi environment VAULT_ADDR, inisialisasi Vault, penyimpanan unseal key dan root token, proses unseal Vault, pembuatan token sementara untuk authorize charm, generate Root CA, reissue certificate, hingga troubleshooting Vault error setelah reboot, outage, atau masalah cluster.

Vault dipakai untuk certificate management pada OpenStack charm deployment.

1. Masuk ke Unit Vault

juju ssh vault/0

2. Set Environment Vault

Edit .profile:

nano .profile

Tambahkan:

export VAULT_ADDR='http://127.0.0.1:8200'

Reload profile:

source .profile

3. Init Vault

vault operator init -key-shares=5 -key-threshold=3

Output akan menghasilkan 5 unseal key dan 1 initial root token.

Simpan unseal key dan root token di password vault/internal secret manager. Jangan tempel token asli di artikel blog.

4. Set Token dan Unseal Vault

Edit .profile lagi:

nano .profile

Tambahkan token:

export VAULT_TOKEN=<VAULT_ROOT_TOKEN>

Unseal minimal 3 key:

vault operator unseal <UNSEAL_KEY_1>
vault operator unseal <UNSEAL_KEY_2>
vault operator unseal <UNSEAL_KEY_3>

Cek status:

vault status

5. Buat Token Sementara untuk Authorize Charm

vault token create -ttl=10m

Gunakan token tersebut untuk authorize charm:

juju run-action --wait vault/leader authorize-charm token=<VAULT_TOKEN>

6. Generate Root CA

juju run-action --wait vault/leader generate-root-ca

Jika perlu reissue certificate:

juju run-action vault/0 --wait reissue-certificates

7. Issue Umum: Vault Error Setelah MySQL/Cluster Bermasalah

Biasanya Vault perlu di-unseal ulang setelah reboot atau outage.

juju ssh vault/0
export VAULT_TOKEN=<VAULT_TOKEN>
vault operator unseal <UNSEAL_KEY_1>
vault operator unseal <UNSEAL_KEY_2>
vault operator unseal <UNSEAL_KEY_3>
vault status

Cek leader data:

juju run -u vault/0 leader-get

vaultopenstackopenstack charmjujucertificate managementroot catlssslunseal vaultvault tokenauthorize charmreissue certificatecloud securitysecret managementtroubleshootingopenstack deployment

Published by Nirantara

Nirantara is an Indonesian Enterprise AI company specializing in Enterprise AI, RAG, Intelligent Search, and AI Automation. Article written by jsturana.