++ vault unseal sidecar

infrastructure/vault-unseal/vk-infra/vault-unseal.yaml

@@ -36,6 +36,51 @@ spec:
       enabled: false
     server:
       includeConfigAnnotation: true
+      volumes:
+        - name: unseal-keys
+          secret:
+            secretName: vault-unseal-keys
+            optional: true
+            defaultMode: 0440
+      extraContainers:
+        - name: unsealer
+          image: cr.yandex/crp3ccidau046kdj8g9q/vault/vault:1.21.2
+          imagePullPolicy: IfNotPresent
+          env:
+            - name: VAULT_ADDR
+              value: http://127.0.0.1:8200
+          command:
+            - /bin/sh
+            - -c
+            - |
+              while true; do
+                if vault status >/dev/null 2>&1; then
+                  :
+                else
+                  rc=$?
+                  if [ "$rc" -eq 2 ]; then
+                    if [ -s /vault/unseal-keys/key1 ] && [ -s /vault/unseal-keys/key2 ] && [ -s /vault/unseal-keys/key3 ]; then
+                      for k in key1 key2 key3; do
+                        vault operator unseal "$(cat /vault/unseal-keys/$k)" >/dev/null 2>&1 || echo "unseal call failed"
+                      done
+                      if vault status >/dev/null 2>&1; then echo "unsealed"; else echo "still sealed"; fi
+                    else
+                      echo "sealed, keys not mounted"
+                    fi
+                  fi
+                fi
+                sleep 10
+              done
+          volumeMounts:
+            - name: unseal-keys
+              mountPath: /vault/unseal-keys
+              readOnly: true
+          resources:
+            requests:
+              cpu: 10m
+              memory: 16Mi
+            limits:
+              memory: 64Mi
       nodeSelector:
         dedicated: null
         sarex.io/pool: svc