143 lines
4.3 KiB
YAML
143 lines
4.3 KiB
YAML
apiVersion: helm.toolkit.fluxcd.io/v2
|
|
kind: HelmRelease
|
|
metadata:
|
|
name: vault-unseal
|
|
namespace: vault-unseal
|
|
spec:
|
|
interval: 5m
|
|
timeout: 15m
|
|
chart:
|
|
spec:
|
|
chart: vault-contour
|
|
version: "0.2.3"
|
|
sourceRef:
|
|
kind: HelmRepository
|
|
name: yc-oci-charts
|
|
namespace: flux-system
|
|
interval: 10m
|
|
install:
|
|
disableWait: true
|
|
remediation:
|
|
retries: 3
|
|
upgrade:
|
|
disableWait: true
|
|
remediation:
|
|
retries: 3
|
|
values:
|
|
global:
|
|
namespace: vault-unseal
|
|
imagePullSecrets:
|
|
- name: istio-registry-secret
|
|
autounseal:
|
|
enabled: false
|
|
backup:
|
|
enabled: false
|
|
injector:
|
|
enabled: false
|
|
server:
|
|
includeConfigAnnotation: true
|
|
volumes:
|
|
- name: unseal-keys
|
|
secret:
|
|
secretName: vault-unseal-keys
|
|
optional: true
|
|
defaultMode: 0440
|
|
extraContainers:
|
|
- name: unsealer
|
|
image: cr.yandex/crp3ccidau046kdj8g9q/vault/vault:1.21.2
|
|
imagePullPolicy: IfNotPresent
|
|
env:
|
|
- name: VAULT_ADDR
|
|
value: http://127.0.0.1:8200
|
|
command:
|
|
- /bin/sh
|
|
- -c
|
|
- |
|
|
while true; do
|
|
if vault status >/dev/null 2>&1; then
|
|
:
|
|
else
|
|
rc=$?
|
|
if [ "$rc" -eq 2 ]; then
|
|
if [ -s /vault/unseal-keys/key1 ] && [ -s /vault/unseal-keys/key2 ] && [ -s /vault/unseal-keys/key3 ]; then
|
|
for k in key1 key2 key3; do
|
|
vault operator unseal "$(cat /vault/unseal-keys/$k)" >/dev/null 2>&1 || echo "unseal call failed"
|
|
done
|
|
if vault status >/dev/null 2>&1; then echo "unsealed"; else echo "still sealed"; fi
|
|
else
|
|
echo "sealed, keys not mounted"
|
|
fi
|
|
fi
|
|
fi
|
|
sleep 10
|
|
done
|
|
volumeMounts:
|
|
- name: unseal-keys
|
|
mountPath: /vault/unseal-keys
|
|
readOnly: true
|
|
resources:
|
|
requests:
|
|
cpu: 10m
|
|
memory: 16Mi
|
|
limits:
|
|
memory: 64Mi
|
|
nodeSelector:
|
|
dedicated: null
|
|
sarex.io/pool: svc
|
|
tolerations: []
|
|
affinity: |
|
|
podAntiAffinity:
|
|
requiredDuringSchedulingIgnoredDuringExecution:
|
|
- labelSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: {{ template "vault.name" . }}
|
|
app.kubernetes.io/instance: "{{ .Release.Name }}"
|
|
component: server
|
|
topologyKey: topology.kubernetes.io/zone
|
|
dataStorage:
|
|
size: 10Gi
|
|
storageClass: csi-ceph-ssd-retain
|
|
ha:
|
|
replicas: 3
|
|
raft:
|
|
config: |
|
|
ui = true
|
|
|
|
listener "tcp" {
|
|
tls_disable = 1
|
|
address = "[::]:8200"
|
|
cluster_address = "[::]:8201"
|
|
}
|
|
|
|
storage "raft" {
|
|
path = "/vault/data"
|
|
|
|
retry_join {
|
|
leader_api_addr = "http://{{ template "vault.fullname" . }}-0.{{ template "vault.fullname" . }}-internal:8200"
|
|
}
|
|
retry_join {
|
|
leader_api_addr = "http://{{ template "vault.fullname" . }}-1.{{ template "vault.fullname" . }}-internal:8200"
|
|
}
|
|
retry_join {
|
|
leader_api_addr = "http://{{ template "vault.fullname" . }}-2.{{ template "vault.fullname" . }}-internal:8200"
|
|
}
|
|
}
|
|
|
|
{{- if .Values.autounseal.enabled }}
|
|
seal "transit" {
|
|
address = "{{ .Values.autounseal.transit.address }}"
|
|
token = "env://VAULT_TOKEN"
|
|
key_name = "{{ .Values.autounseal.transit.keyName }}"
|
|
mount_path = "{{ .Values.autounseal.transit.mountPath }}"
|
|
disable_renewal = "{{ .Values.autounseal.transit.disableRenewal }}"
|
|
tls_skip_verify = "{{ .Values.autounseal.transit.tlsSkipVerify }}"
|
|
}
|
|
{{- end }}
|
|
|
|
service_registration "kubernetes" {}
|
|
|
|
telemetry {
|
|
prometheus_retention_time = "30s"
|
|
disable_hostname = true
|
|
}
|