8eed94b072
* website maintenance round * improve docs, revert bug workaround as it was fixed * boost memory * remove unnecessary code
126 lines
4.8 KiB
Plaintext
126 lines
4.8 KiB
Plaintext
---
|
|
layout: docs
|
|
page_title: operator init - Command
|
|
sidebar_title: <code>init</code>
|
|
description: |-
|
|
The "operator init" command initializes a Vault server. Initialization is the
|
|
process by which Vault's storage backend is prepared to receive data. Since
|
|
Vault servers share the same storage backend in HA mode, you only need to
|
|
initialize one Vault to initialize the storage backend.
|
|
---
|
|
|
|
# operator init
|
|
|
|
The `operator init` command initializes a Vault server. Initialization is the
|
|
process by which Vault's storage backend is prepared to receive data. Since
|
|
Vault servers share the same storage backend in HA mode, you only need to
|
|
initialize one Vault to initialize the storage backend.
|
|
|
|
During initialization, Vault generates an in-memory master key and applies
|
|
Shamir's secret sharing algorithm to disassemble that master key into a
|
|
configuration number of key shares such that a configurable subset of those key
|
|
shares must come together to regenerate the master key. These keys are often
|
|
called "unseal keys" in Vault's documentation.
|
|
|
|
This command cannot be run against already-initialized Vault cluster.
|
|
|
|
For more information on sealing and unsealing, please the [seal concepts page](/docs/concepts/seal).
|
|
|
|
## Examples
|
|
|
|
Start initialization with the default options:
|
|
|
|
```shell-session
|
|
$ vault operator init
|
|
```
|
|
|
|
Initialize, but encrypt the unseal keys with pgp keys:
|
|
|
|
```shell-session
|
|
$ vault operator init \
|
|
-key-shares=3 \
|
|
-key-threshold=2 \
|
|
-pgp-keys="keybase:hashicorp,keybase:jefferai,keybase:sethvargo"
|
|
```
|
|
|
|
Initialize Auto Unseal, but encrypt the recovery keys with pgp keys:
|
|
|
|
```shell-session
|
|
$ vault operator init \
|
|
-recovery-shares=1 \
|
|
-recovery-threshold=1 \
|
|
-recovery-pgp-keys="keybase:grahamhashicorp"
|
|
```
|
|
|
|
Encrypt the initial root token using a pgp key:
|
|
|
|
```shell-session
|
|
$ vault operator init -root-token-pgp-key="keybase:hashicorp"
|
|
```
|
|
|
|
## Usage
|
|
|
|
The following flags are available in addition to the [standard set of
|
|
flags](/docs/commands) included on all commands.
|
|
|
|
### Output Options
|
|
|
|
- `-format` `(string: "")` - Print the output in the given format. Valid formats
|
|
are "table", "json", or "yaml". The default is table. This can also be
|
|
specified via the `VAULT_FORMAT` environment variable.
|
|
|
|
### Common Options
|
|
|
|
- `-key-shares` `(int: 5)` - Number of key shares to split the generated master
|
|
key into. This is the number of "unseal keys" to generate. This is aliased as
|
|
`-n`.
|
|
|
|
- `-key-threshold` `(int: 3)` - Number of key shares required to reconstruct the
|
|
master key. This must be less than or equal to -key-shares. This is aliased as
|
|
`-t`.
|
|
|
|
- `-pgp-keys` `(string: "...")` - Comma-separated list of paths to files on disk
|
|
containing public GPG keys OR a comma-separated list of Keybase usernames
|
|
using the format `keybase:<username>`. When supplied, the generated unseal
|
|
keys will be encrypted and base64-encoded in the order specified in this list.
|
|
The number of entries must match -key-shares, unless -stored-shares are used.
|
|
|
|
- `-root-token-pgp-key` `(string: "")` - Path to a file on disk containing a
|
|
binary or base64-encoded public GPG key. This can also be specified as a
|
|
Keybase username using the format `keybase:<username>`. When supplied, the
|
|
generated root token will be encrypted and base64-encoded with the given
|
|
public key.
|
|
|
|
- `-status` `(bool": false)` - Print the current initialization status. An exit
|
|
code of 0 means the Vault is already initialized. An exit code of 1 means an
|
|
error occurred. An exit code of 2 means the Vault is not initialized.
|
|
|
|
### Consul Options
|
|
|
|
- `-consul-auto` `(bool: false)` - Perform automatic service discovery using
|
|
Consul in HA mode. When all nodes in a Vault HA cluster are registered with
|
|
Consul, enabling this option will trigger automatic service discovery based on
|
|
the provided -consul-service value. When Consul is Vault's HA backend, this
|
|
functionality is automatically enabled. Ensure the proper Consul environment
|
|
variables are set (CONSUL_HTTP_ADDR, etc). When only one Vault server is
|
|
discovered, it will be initialized automatically. When more than one Vault
|
|
server is discovered, they will each be output for selection. The default is
|
|
false.
|
|
|
|
- `-consul-service` `(string: "vault")` - Name of the service in Consul under
|
|
which the Vault servers are registered.
|
|
|
|
### HSM and KMS Options
|
|
|
|
- `-recovery-pgp-keys` `(string: "...")` - Behaves like `-pgp-keys`, but for the
|
|
recovery key shares. This is only used in HSM mode.
|
|
|
|
- `-recovery-shares` `(int: 5)` - Number of key shares to split the recovery key
|
|
into. This is only used in HSM mode.
|
|
|
|
- `-recovery-threshold` `(int: 3)` - Number of key shares required to
|
|
reconstruct the recovery key. This is only used in HSM mode.
|
|
|
|
- `-stored-shares` `(int: 0)` - Number of unseal keys to store on an HSM. This
|
|
must be equal to `-key-shares`.
|