Skip to main content

Load files and manage containers

In this step, you will load the container images and application config files from a USB stick onto Primus HSM. You will load, start, and inspect the containers running in the VaultContainers environment.

tip

Full instructions and commands for how to manage containers are provided in Section 14 "VaultContainers Platform" of the Primus HSM User Guide. Please carefully read the User Guide and then proceed here.

info

Make sure that you deploy container images that are compatible. Please see this table of compatible image versions.

Command Overview​

To list details about the containers, images, and application configs, run hsm_diagnostics containers:

>>> hsm_diagnostics containers
VaultContainers platform: running

Containers
securosys-psql, status=running, image=database_v1.0.1, auto_start=enabled, yaml=-
tsb-rest-api, status=running, image=tsb_v2.7.0, port=8080, auto_start=enabled, yaml=application-tsb-hsm_v2.7.0
vault-code-1, status=running, image=vault-code_v2.1.0, port=8081, auto_start=enabled, yaml=application-vault-code-hsm_v2.1.0

Images
vault-code_v2.1.0, ID=sha256:4e666abf1b8f05fbfee001576076435dc60c13bcca9d577956d043f99777eee8
database_v1.0.1, ID=sha256:221f8131a95f92ac3f617cac5eefd95094ee3cb89e48921974714dcccee448e9
tsb_v2.7.0, ID=sha256:856dd630645d23197f5c10f64f0eae06c2234e43831880473d857ca64219272e

YAMLs
application-tsb-hsm_v2.7.0
application-vault-code-hsm_v2.1.0

To list all VaultContainers-related options, run help8:

>>> help8

Container platform commands (Active SO role needed):

Container commands:
  hsm_sec_container_start           - Start a container
  hsm_sec_container_stop            - Stop a container

Container image commands:
  hsm_sec_container_image_load      - Load a container image
  hsm_sec_container_image_update    - Update a loaded container image
  hsm_sec_container_image_delete    - Delete a loaded container image

Container YAML file commands:
  hsm_sec_container_yml_load       - Load a .yml file
  hsm_sec_container_yml_update     - Update a loaded .yml file
  hsm_sec_container_yml_delete     - Delete a loaded .yml file

Step 1: Define the containers​

Define the containers that you will run in the HSM configuration. You can either do this via "XML export, edit, import" or via the Decanus or Console. See section 14.8 "HSM Configuration – VaultContainer Instances" for details the Primus HSM User Guide.

Example snippet from an .sconfig file:

<vault_containers>
  <active>enabled</active>
  <interface>1</interface>
  <container id="database-1" name="securosys-psql" clustering="enabled">
      <image>securosys-psql</image>
      <config/>
      <port/>
      <auto_start>enabled</auto_start>
  </container>
  <container id="tsb-1" name="tsb-rest-api-1">
      <image/>
      <config/>
      <port/>
      <auto_start>disabled</auto_start>
  </container>
  <container id="vault-code-1" name="vault-code-1">
      <image>vault-code</image>
      <config>application-vault-code.yml</config>
      <port>8080</port>
      <auto_start>enabled</auto_start>
  </container>
</vault_containers>
tip

The names that you specify here for <image> and <config> must match the names that you enter when loading/updating the image/config file. The filenames on the USB stick don't matter and can be different.

Step 2: Save the files onto a USB stick​

Download the VaultCode release files. These contain the Securosys-provided container images as .container files.

Copy the following files onto a USB stick:

  • All container images (.container). At least the database and VaultCode. Optionally, also the TSB.
  • The application configuration files (application-vault-code-hsm.yml).

Insert the USB stick into the Primus HSM or the Decanus terminal.

Alternatively, if you have configured WebDAV on your HSM, put them onto the WebDAV share. See Section 4.4.7 "Data Transfer with WebDAV Server" in the Primus HSM User Guide for how to set up WebDAV.

Step 3: Load the Container Images and Config Files​

Load all the container images and the application config files (YAMLs) from the USB stick or WebDAV onto the HSM.

For instructions, please see Section 14.7 "Load Container Image(s) and Application Configuration File(s)" and Section 14.8 "HSM Configuration – VaultContainer Instances" of the Primus HSM User Guide.

Repeat this for the database, VaultCode, and optionally the TSB.

  • System ➜ Vault Containers ➜ Load Image
  • System ➜ Vault Containers ➜ Load YAML
warning

When loading the images/configs you must use the same names as in the .sconfig (<image>, <config>)!

Check that all container, images, and configs are properly loaded:

System ➜ Diagnostics Device ➜ Containers

Step 4: Start the Database Container​

Start the database container, as described in Section 14.9 "Starting and Stopping Container(s)" of the Primus HSM User Guide. If you enabled auto-start, the container may already be running.

System ➜ Vault Containers ➜ Start Container

Using the diagnostics, check that it comes up.

Step 5: Start VaultCode​

Start the VaultCode container in the same way. Using the diagnostics, check that it comes up. Check that it stays up after ~30 seconds: VaultCode does some initialization, which may fail.

You can use curl to check if the landing page of VaultCode is reachable. In the command below, replace the IP address with the address of interface on which the VaultContainers subsystem is listening. Replace the port number with port you assigned to the VaultCode container.

curl -v -L http://10.0.0.10:8080

Troubleshooting​

See Section 14.10 "VaultContainer Troubleshooting" of the Primus HSM User Guide for how to use the container diagnostics.

If the VaultCode container crashes (status=exited(1)), export the security log from the HSM:

System ➜ Diagnostics Security ➜ Export Logs

This will write a ZIP file to USB/WebDAV. Unzip it and inspect the containers.log file. It contains the log output from all containers.

Next Steps​

Proceed to the Tutorials section to learn how to:

Get startedwith CloudHSM.
Other questions?Ask Sales.
Last updated on
Feedback
Need help?