https://setkeh.com/tags/libvirt/Recent content in Libvirt on SETKEHHugoen-AUJames 'SETKEH' GriffisWed, 04 Nov 2026 00:00:00 +1100https://setkeh.com/posts/vtpm-swtpm-kolla-2025-1/Wed, 04 Nov 2026 00:00:00 +1100https://setkeh.com/posts/vtpm-swtpm-kolla-2025-1/<h2 id="why-i-needed-a-tpm-in-a-vm">Why I needed a TPM in a VM<a class="anchor" href="#why-i-needed-a-tpm-in-a-vm" aria-label="Link to this section">#</a></h2> <p>I&rsquo;m standing up OpenBao, the open-source fork of HashiCorp Vault, on my OpenStack cloud. Vault-style servers start <strong>sealed</strong> after every reboot, and something has to unseal them. If that something is me typing in unseal keys, then a two-minute power cut at 3 a.m. leaves every secret-dependent service down until I wake up.</p> <p>The usual fix is auto-unseal from another key store. But a second OpenBao just moves the problem: what unseals <em>that</em> one when the whole rack loses power? The chain has to end at something that comes back on its own. In my case that&rsquo;s the cloud itself. A virtual TPM in the OpenBao VM can hold the unseal material, and the vTPM&rsquo;s own secret lives in Barbican, which has to be up before any VM can start anyway.</p>