apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: vault
  namespace: vault
spec:
  interval: 5m
  timeout: 15m
  chart:
    spec:
      chart: vault-contour
      version: "0.2.3"
      sourceRef:
        kind: HelmRepository
        name: yc-oci-charts
        namespace: flux-system
      interval: 10m
  dependsOn:
    - name: vault-unseal
      namespace: vault-unseal
  install:
    disableWait: true
    remediation:
      retries: 3
  upgrade:
    disableWait: true
    remediation:
      retries: 3
  values:
    global:
      namespace: vault
      imagePullSecrets:
        - name: istio-registry-secret
    autounseal:
      enabled: true
      transit:
        address: "http://vault-unseal-vault-contour.vault-unseal.svc:8200"
        keyName: "vault-infra-vk"
        mountPath: "transit/"
        tlsSkipVerify: false
      secret:
        create: false
        name: "vault-transit-autounseal"
    backup:
      enabled: false
    server:
      includeConfigAnnotation: true
      nodeSelector:
        dedicated: null
        sarex.io/pool: svc
      tolerations: []
      affinity: |
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            - labelSelector:
                matchLabels:
                  app.kubernetes.io/name: {{ template "vault.name" . }}
                  app.kubernetes.io/instance: "{{ .Release.Name }}"
                  component: server
              topologyKey: topology.kubernetes.io/zone
      dataStorage:
        size: 20Gi
        storageClass: csi-ceph-ssd-retain
      ha:
        replicas: 3
        raft:
          config: |
            ui = true

            listener "tcp" {
              tls_disable = 1
              address = "[::]:8200"
              cluster_address = "[::]:8201"
            }

            storage "raft" {
              path = "/vault/data"

              retry_join {
                leader_api_addr = "http://{{ template "vault.fullname" . }}-0.{{ template "vault.fullname" . }}-internal:8200"
              }
              retry_join {
                leader_api_addr = "http://{{ template "vault.fullname" . }}-1.{{ template "vault.fullname" . }}-internal:8200"
              }
              retry_join {
                leader_api_addr = "http://{{ template "vault.fullname" . }}-2.{{ template "vault.fullname" . }}-internal:8200"
              }
            }

            {{- if .Values.autounseal.enabled }}
            seal "transit" {
              address         = "{{ .Values.autounseal.transit.address }}"
              token           = "env://VAULT_TOKEN"
              key_name        = "{{ .Values.autounseal.transit.keyName }}"
              mount_path      = "{{ .Values.autounseal.transit.mountPath }}"
              disable_renewal = "{{ .Values.autounseal.transit.disableRenewal }}"
              tls_skip_verify = "{{ .Values.autounseal.transit.tlsSkipVerify }}"
            }
            {{- end }}

            service_registration "kubernetes" {}

            telemetry {
              prometheus_retention_time = "30s"
              disable_hostname = true
            }