Unsealing

By default, OpenBao units are sealed upon OpenBao initialisation and every time units restart. Users have to manually unseal OpenBao units in order for them to become active. For more information about this topic, read the following documents:

• The OpenBao seal/unseal concept

• How-to: Unseal a sealed unit (k8s)

• How-to: Unseal a sealed unit (machine)

To avoid manual unseal after restarts, the machine charm can auto-unseal with:

• Transit auto-unseal (another OpenBao)

• PKCS#11 HSM auto-unseal (machine charm only)

PKCS#11 auto-unseal is one-way: after it is enabled and OpenBao is initialized, you cannot go back to Shamir by removing the configuration.