107 lines
3.1 KiB
YAML
107 lines
3.1 KiB
YAML
apiVersion: helm.toolkit.fluxcd.io/v2
|
|
kind: HelmRelease
|
|
metadata:
|
|
name: vault
|
|
namespace: vault
|
|
spec:
|
|
interval: 5m
|
|
timeout: 15m
|
|
chart:
|
|
spec:
|
|
chart: vault-contour
|
|
version: "0.2.3"
|
|
sourceRef:
|
|
kind: HelmRepository
|
|
name: yc-oci-charts
|
|
namespace: flux-system
|
|
interval: 10m
|
|
dependsOn:
|
|
- name: vault-unseal
|
|
namespace: vault-unseal
|
|
install:
|
|
disableWait: true
|
|
remediation:
|
|
retries: 3
|
|
upgrade:
|
|
disableWait: true
|
|
remediation:
|
|
retries: 3
|
|
values:
|
|
global:
|
|
namespace: vault
|
|
imagePullSecrets:
|
|
- name: istio-registry-secret
|
|
autounseal:
|
|
enabled: true
|
|
transit:
|
|
address: "http://vault-unseal-vault-contour.vault-unseal.svc:8200"
|
|
keyName: "vault-infra-vk"
|
|
mountPath: "transit/"
|
|
tlsSkipVerify: false
|
|
secret:
|
|
create: false
|
|
name: "vault-transit-autounseal"
|
|
backup:
|
|
enabled: false
|
|
server:
|
|
includeConfigAnnotation: true
|
|
nodeSelector:
|
|
dedicated: null
|
|
sarex.io/pool: svc
|
|
tolerations: []
|
|
affinity: |
|
|
podAntiAffinity:
|
|
requiredDuringSchedulingIgnoredDuringExecution:
|
|
- labelSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: {{ template "vault.name" . }}
|
|
app.kubernetes.io/instance: "{{ .Release.Name }}"
|
|
component: server
|
|
topologyKey: topology.kubernetes.io/zone
|
|
dataStorage:
|
|
size: 20Gi
|
|
storageClass: csi-ceph-ssd-retain
|
|
ha:
|
|
replicas: 3
|
|
raft:
|
|
config: |
|
|
ui = true
|
|
|
|
listener "tcp" {
|
|
tls_disable = 1
|
|
address = "[::]:8200"
|
|
cluster_address = "[::]:8201"
|
|
}
|
|
|
|
storage "raft" {
|
|
path = "/vault/data"
|
|
|
|
retry_join {
|
|
leader_api_addr = "http://{{ template "vault.fullname" . }}-0.{{ template "vault.fullname" . }}-internal:8200"
|
|
}
|
|
retry_join {
|
|
leader_api_addr = "http://{{ template "vault.fullname" . }}-1.{{ template "vault.fullname" . }}-internal:8200"
|
|
}
|
|
retry_join {
|
|
leader_api_addr = "http://{{ template "vault.fullname" . }}-2.{{ template "vault.fullname" . }}-internal:8200"
|
|
}
|
|
}
|
|
|
|
{{- if .Values.autounseal.enabled }}
|
|
seal "transit" {
|
|
address = "{{ .Values.autounseal.transit.address }}"
|
|
token = "env://VAULT_TOKEN"
|
|
key_name = "{{ .Values.autounseal.transit.keyName }}"
|
|
mount_path = "{{ .Values.autounseal.transit.mountPath }}"
|
|
disable_renewal = "{{ .Values.autounseal.transit.disableRenewal }}"
|
|
tls_skip_verify = "{{ .Values.autounseal.transit.tlsSkipVerify }}"
|
|
}
|
|
{{- end }}
|
|
|
|
service_registration "kubernetes" {}
|
|
|
|
telemetry {
|
|
prometheus_retention_time = "30s"
|
|
disable_hostname = true
|
|
}
|