Install Nitride and securely integrate it into your environment, ensuring that workloads are verifiably trusted before granting access.
Last updated
Was this helpful?
To interact with Nitride you need to install , and
Installing vHSM
Note:
To install vHSM, you need an enterprise license. You also need access to the enclaive repository to download the precompiled binary. Contact support to obtain an enterprise license.
To install vHSM as a production server you need to create a config.json file. For more information, see Configuration.
You can install vHSM using, a Docker image, Helm chart, or by compiling from source.
Check the logs to get the environment variables, unseal key, and root token.
docker logs vhsm-container
Example Output:
WARNING! dev mode is enabled! In this mode, vHSM runs entirely in-memory
and starts unsealed with a single unseal key. The root token is already
authenticated to the CLI, so you can immediately begin using Vault.
You may need to set the following environment variables:
export VAULT_ADDR='http://0.0.0.0:8200'
The unseal key and root token are displayed below in case you want to
seal/unseal the vHSM or re-authenticate.
Unseal Key: pafYkq2uEVve3FW7n7RM6JUK/MWEHzAxvrEdlrb4QD4=
Root Token: hvs.7oXsG8t8L198HEpB865FdpFG
Development mode should NOT be used in production installations!
Set the environment variables for accessing vHSM.
Save the unseal key and root token — you'll need them to access the vHSM UI.
Pulled: harbor.enclaive.cloud/enclaive-dev/vhsm:0.28.1
Digest: sha256:d10c10f013efbff0275c33b5c292dd442017c85406aecebf8dc19a2302bf43af
NAME: vhsm
LAST DEPLOYED: Fri Feb 21 19:11:59 2025
NAMESPACE: default
STATUS: deployed
REVISION: 1
NOTES:
Thank you for installing Enclaive vHSM!
Now that you have deployed vHSM, you should look over the docs on using
Vault with Kubernetes available here:
https://docs.enclaive.cloud/virtual-hsm
Your release is named vhsm. To learn more about the release, try:
helm status vhsm
helm get manifest vhsm
Check if the pods are running.
kubectl get pods
Example Output:
NAME READY STATUS RESTARTS AGE
vhsm-0 0/1 Running 0 78s
Check if the services are running.
kubectl get svc
Example Output:
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
kubernetes ClusterIP 10.96.0.1 <none> 443/TCP 13m
vhsm ClusterIP 10.96.219.177 <none> 8200/TCP,8201/TCP 90s
vhsm-internal ClusterIP None <none> 8200/TCP,8201/TCP 90s
Port forward the service to access vHSM UI.
kubectl port-forward svc/vhsm 8200:8200 8201:8201
Access the vHSM UI.
Note:
The vHSM is not initialized and unsealed by default.
You will be prompted to initialize and unseal it.
To initialize vHSM:
vhsm operator init
To unseal vHSM:
vhsm operator unseal <unseal-key>
Prerequisites
Ensure the following are installed and configured:
