1"use strict";(self.webpackChunkwebsite=self.webpackChunkwebsite||[]).push([["11746"],{84756(e,n,o){o.r(n),o.d(n,{metadata:()=>s,default:()=>p,frontMatter:()=>r,contentTitle:()=>l,toc:()=>d,assets:()=>i});var s=JSON.parse('{"id":"commands/operator/unseal","title":"operator unseal","description":"The \\"operator unseal\\" allows the user to provide a portion of the root key\\nto unseal an OpenBao server.","source":"@site/versioned_docs/version-2.7.x/commands/operator/unseal.mdx","sourceDirName":"commands/operator","slug":"/commands/operator/unseal","permalink":"/docs/commands/operator/unseal","draft":false,"unlisted":false,"editUrl":"https://github.com/openbao/openbao/blob/release/2.7.x/website/content/docs/commands/operator/unseal.mdx","tags":[],"version":"2.7.x","frontMatter":{"sidebar_label":"unseal","description":"The \\"operator unseal\\" allows the user to provide a portion of the root key\\nto unseal an OpenBao server."},"sidebar":"docs","previous":{"title":"step-down","permalink":"/docs/commands/operator/step-down"},"next":{"title":"validate-config","permalink":"/docs/commands/operator/validate-config"}}'),a=o(94686),t=o(44812);let r={sidebar_label:"unseal",description:'The "operator unseal" allows the user to provide a portion of the root key\nto unseal an OpenBao server.'},l="operator unseal",i={},d=[{value:"Examples",id:"examples",level:2},{value:"Usage",id:"usage",level:2},{value:"Output options",id:"output-options",level:3},{value:"Command options",id:"command-options",level:3}];function c(e){let n={a:"a",admonition:"admonition",code:"code",h1:"h1",h2:"h2",h3:"h3",header:"header",li:"li",p:"p",pre:"pre",ul:"ul",...(0,t.R)(),...e.components};return(0,a.jsxs)(a.Fragment,{children:[(0,a.jsx)(n.header,{children:(0,a.jsx)(n.h1,{id:"operator-unseal",children:"operator unseal"})}),"\n",(0,a.jsxs)(n.p,{children:["The ",(0,a.jsx)(n.code,{children:"operator unseal"}),' allows the user to provide a portion of the root key to\nunseal an OpenBao server. OpenBao starts in a sealed state. It cannot perform\noperations until it is unsealed. This command accepts a portion of the master\nkey (an "unseal key").']}),"\n",(0,a.jsx)(n.p,{children:"The unseal key can be supplied as an argument to the command, but this is\nnot recommended as the unseal key will be available in your history:"}),"\n",(0,a.jsx)(n.pre,{children:(0,a.jsx)(n.code,{className:"language-shell-session",children:"$ bao operator unseal IXyR0OJnSFobekZMMCKCoVEpT7wI6l+USMzE3IcyDyo=\n"})}),"\n",(0,a.jsx)(n.p,{children:"Instead, run the command with no arguments and it will prompt for the key:"}),"\n",(0,a.jsx)(n.pre,{children:(0,a.jsx)(n.code,{className:"language-shell-session",children:"$ bao operator unseal\nKey (will be hidden): IXyR0OJnSFobekZMMCKCoVEpT7wI6l+USMzE3IcyDyo=\n"})}),"\n",(0,a.jsxs)(n.p,{children:["For more information on sealing and unsealing, please the ",(0,a.jsx)(n.a,{href:"/docs/concepts/seal",children:"seal concepts\npage"}),"."]}),"\n",(0,a.jsx)(n.admonition,{type:"info",children:(0,a.jsxs)(n.p,{children:["Looking to automate manual unseal? Consider using an ",(0,a.jsx)(n.a,{href:"/docs/configuration/seal/",children:"auto-unseal mechanism\ninstead"}),"."]})}),"\n",(0,a.jsx)(n.h2,{id:"examples",children:"Examples"}),"\n",(0,a.jsx)(n.p,{children:"Provide an unseal key:"}),"\n",(0,a.jsx)(n.pre,{children:(0,a.jsx)(n.code,{className:"language-shell-session",children:"$ bao operator unseal\nKey (will be hidden):\nSealed: false\nKey Shares: 1\nKey Threshold: 1\nUnseal Progress: 0\n"})}),"\n",(0,a.jsx)(n.h2,{id:"usage",children:"Usage"}),"\n",(0,a.jsxs)(n.p,{children:["The following flags are available in addition to the ",(0,a.jsx)(n.a,{href:"/docs/commands/",children:"standard set of\nflags"})," included on all commands."]}),"\n",(0,a.jsx)(n.h3,{id:"output-options",children:"Output options"}),"\n",(0,a.jsxs)(n.ul,{children:["\n",(0,a.jsxs)(n.li,{children:[(0,a.jsx)(n.code,{children:"-format"})," ",(0,a.jsx)(n.code,{children:'(string: "table")'}),' - Print the output in the given format. Valid\nformats are "table", "json", or "yaml". This can also be specified via the\n',(0,a.jsx)(n.code,{children:"BAO_FORMAT"})," environment variable."]}),"\n"]}),"\n",(0,a.jsx)(n.h3,{id:"command-options",children:"Command options"}),"\n",(0,a.jsxs)(n.ul,{children:["\n",(0,a.jsxs)(n.li,{children:["\n",(0,a.jsxs)(n.p,{children:[(0,a.jsx)(n.code,{children:"-migrate"})," ",(0,a.jsx)(n.code,{children:"(bool: false)"})," - Indicate that this share is provided with the intent that it is part of a seal migration process."]}),"\n"]}),"\n",(0,a.jsxs)(n.li,{children:["\n",(0,a.jsxs)(n.p,{children:[(0,a.jsx)(n.code,{children:"-reset"})," ",(0,a.jsx)(n.code,{children:"(bool: false)"})," - Discard any previously entered keys to the unseal\nprocess."]}),"\n"]}),"\n"]})]})}function p(e={}){let{wrapper:n}={...(0,t.R)(),...e.components};return n?(0,a.jsx)(n,{...e,children:(0,a.jsx)(c,{...e})}):c(e)}},44812(e,n,o){o.d(n,{R:()=>r,x:()=>l});var s=o(92990);let a={},t=s.createContext(a);function r(e){let n=s.useContext(t);return s.useMemo(function(){return"function"==typeof e?e(n):{...n,...e}},[n,e])}function l(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(a):e.components||a:r(e.components),s.createElement(t.Provider,{value:n},e.children)}}}]);
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.