// Module included in the following assemblies:
//
// * security/zero_trust_workload_identity_manageer/zero-trust-manager-oidc-federation.adoc

:_mod-docs-content-type: PROCEDURE
[id="zero-trust-manager-initialize-vault-oidc_{context}"]

= Initializing and unsealing Vault

[role="_abstract"]
To prepare a newly installed Vault server for operation, initialize and unseal it. This process loads the primary encryption key into memory so that Vault can decrypt data and protect other encryption keys.

The steps to initialize a Vault server are:

. Initialize and unseal Vault

. Enable the key-value (KV) secrets engine and store a test secret

. Configure JSON Web Token (JWT) authentication with SPIRE

. Deploy a demonstration application

. Authenticate and retrieve the secret

.Prerequisites

* Ensure that Vault is running.

* Ensure that Vault is not initialized. You can only initialize a Vault server once.

.Procedure

. Open a remote shell into the `vault` pod by running the following command:
+
[source,terminal]
----
$ oc rsh -n vault statefulset/vault
----

. Initialize Vault to get your unseal key and root token by running the following command:
+
[source,terminal]
----
$ vault operator init -key-shares=1 -key-threshold=1 -format=json
----

. Export the unseal key and root token you received from the earlier command by running the following commands:
+
[source,terminal]
----
$ export UNSEAL_KEY=<Your-Unseal-Key>
----
+
[source,terminal]
----
$ export ROOT_TOKEN=<Your-Root-Token>
----

. Unseal Vault using your unseal key by running the following command:
+
[source,terminal]
----
$ vault operator unseal -format=json $UNSEAL_KEY
----

. Exit the pod by entering `exit`.

.Verification

* To verify that the Vault pod is ready, run the following command:
+
[source,terminal]
----
$ oc get pod -n vault
----
+
.Example output
[source, terminal]
----
NAME        READY        STATUS      RESTARTS     AGE
vault-0     1/1          Running     0            65d
----





