apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: vault-unseal
  namespace: vault-unseal
spec:
  interval: 5m
  timeout: 15m
  chart:
    spec:
      chart: vault-contour
      version: "0.2.3"
      sourceRef:
        kind: HelmRepository
        name: yc-oci-charts
        namespace: flux-system
      interval: 10m
  install:
    disableWait: true
    remediation:
      retries: 3
  upgrade:
    disableWait: true
    remediation:
      retries: 3
  values:
    global:
      namespace: vault-unseal
      imagePullSecrets:
        - name: istio-registry-secret
    autounseal:
      enabled: false
    backup:
      enabled: false
    injector:
      enabled: false
    server:
      includeConfigAnnotation: true
      volumes:
        - name: unseal-keys
          secret:
            secretName: vault-unseal-keys
            optional: true
            defaultMode: 0440
      extraContainers:
        - name: unsealer
          image: cr.yandex/crp3ccidau046kdj8g9q/vault/vault:1.21.2
          imagePullPolicy: IfNotPresent
          env:
            - name: VAULT_ADDR
              value: http://127.0.0.1:8200
          command:
            - /bin/sh
            - -c
            - |
              while true; do
                if vault status >/dev/null 2>&1; then
                  :
                else
                  rc=$?
                  if [ "$rc" -eq 2 ]; then
                    if [ -s /vault/unseal-keys/key1 ] && [ -s /vault/unseal-keys/key2 ] && [ -s /vault/unseal-keys/key3 ]; then
                      for k in key1 key2 key3; do
                        vault operator unseal "$(cat /vault/unseal-keys/$k)" >/dev/null 2>&1 || echo "unseal call failed"
                      done
                      if vault status >/dev/null 2>&1; then echo "unsealed"; else echo "still sealed"; fi
                    else
                      echo "sealed, keys not mounted"
                    fi
                  fi
                fi
                sleep 10
              done
          volumeMounts:
            - name: unseal-keys
              mountPath: /vault/unseal-keys
              readOnly: true
          resources:
            requests:
              cpu: 10m
              memory: 16Mi
            limits:
              memory: 64Mi
      nodeSelector:
        dedicated: null
        sarex.io/pool: svc
      tolerations: []
      affinity: |
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            - labelSelector:
                matchLabels:
                  app.kubernetes.io/name: {{ template "vault.name" . }}
                  app.kubernetes.io/instance: "{{ .Release.Name }}"
                  component: server
              topologyKey: topology.kubernetes.io/zone
      dataStorage:
        size: 10Gi
        storageClass: csi-ceph-ssd-retain
      ha:
        replicas: 3
        raft:
          config: |
            ui = true

            listener "tcp" {
              tls_disable = 1
              address = "[::]:8200"
              cluster_address = "[::]:8201"
            }

            storage "raft" {
              path = "/vault/data"

              retry_join {
                leader_api_addr = "http://{{ template "vault.fullname" . }}-0.{{ template "vault.fullname" . }}-internal:8200"
              }
              retry_join {
                leader_api_addr = "http://{{ template "vault.fullname" . }}-1.{{ template "vault.fullname" . }}-internal:8200"
              }
              retry_join {
                leader_api_addr = "http://{{ template "vault.fullname" . }}-2.{{ template "vault.fullname" . }}-internal:8200"
              }
            }

            {{- if .Values.autounseal.enabled }}
            seal "transit" {
              address         = "{{ .Values.autounseal.transit.address }}"
              token           = "env://VAULT_TOKEN"
              key_name        = "{{ .Values.autounseal.transit.keyName }}"
              mount_path      = "{{ .Values.autounseal.transit.mountPath }}"
              disable_renewal = "{{ .Values.autounseal.transit.disableRenewal }}"
              tls_skip_verify = "{{ .Values.autounseal.transit.tlsSkipVerify }}"
            }
            {{- end }}

            service_registration "kubernetes" {}

            telemetry {
              prometheus_retention_time = "30s"
              disable_hostname = true
            }