ce7cb702218693d08ea6d83464d2457c9250027c

vendor/platform/vault/helm-releases.yaml

@@ -0,0 +1,185 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: vault
+  namespace: vault
+spec:
+  interval: 15m
+  releaseName: vault
+  targetNamespace: vault
+  chart:
+    spec:
+      chart: vault
+      version: "0.34.1"
+      sourceRef:
+        kind: HelmRepository
+        name: hashicorp
+        namespace: flux-system
+  install:
+    createNamespace: true
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  # Keep the established named target stable across pod revisions.
+  postRenderers:
+    - kustomize:
+        patches:
+          - target:
+              kind: StatefulSet
+              name: vault
+            patch: |-
+              - op: replace
+                path: /spec/template/spec/containers/0/ports/0/name
+                value: https-migration
+              - op: replace
+                path: /spec/template/spec/containers/0/readinessProbe/exec/command
+                value:
+                  - /bin/sh
+                  - -ec
+                  - vault status -address=https://127.0.0.1:8200 -ca-cert=/vault/userconfig/vault-server-tls/ca.crt -tls-server-name=vault-active-direct.vault.svc.cluster.local
+  values:
+    global:
+      enabled: true
+      tlsDisable: false
+    server:
+      image:
+        repository: hashicorp/vault
+        tag: "2.2.1@sha256:962a92876e168d68eaaa24b0b8b49bbce1cb63024060a67bba95cd158a366fc2"
+      annotations:
+        certificates.quorate.internal/activation: '{"vault":"native"}'
+      volumes:
+        - name: vault-server-tls
+          secret:
+            secretName: vault-server-tls
+            defaultMode: 0440
+      volumeMounts:
+        - name: vault-server-tls
+          mountPath: /vault/userconfig/vault-server-tls
+          readOnly: true
+      resources:
+        requests:
+          cpu: 50m
+          memory: 256Mi
+        limits:
+          memory: 512Mi
+      affinity: |
+        podAntiAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            - labelSelector:
+                matchLabels:
+                  app.kubernetes.io/name: vault
+                  component: server
+              topologyKey: kubernetes.io/hostname
+      ha:
+        enabled: true
+        replicas: 3
+        apiAddr: https://$(VAULT_K8S_POD_NAME).vault-internal.vault.svc.cluster.local:8200
+        raft:
+          enabled: true
+          setNodeId: true
+          config: |
+            ui = true
+
+            listener "tcp" {
+              address                  = "[::]:8200"
+              cluster_address          = "[::]:8201"
+              tls_cert_file            = "/vault/userconfig/vault-server-tls/tls.crt"
+              tls_key_file             = "/vault/userconfig/vault-server-tls/tls.key"
+              tls_reload_interval      = "1s"
+              tls_min_version          = "tls12"
+              tls_disable_client_certs = true
+            }
+
+            storage "raft" {
+              path    = "/vault/data"
+              retry_join {
+                leader_api_addr       = "https://vault-0.vault-internal.vault.svc.cluster.local:8200"
+                leader_ca_cert_file   = "/vault/userconfig/vault-server-tls/ca.crt"
+                leader_tls_servername = "vault-0.vault-internal.vault.svc.cluster.local"
+              }
+              retry_join {
+                leader_api_addr       = "https://vault-1.vault-internal.vault.svc.cluster.local:8200"
+                leader_ca_cert_file   = "/vault/userconfig/vault-server-tls/ca.crt"
+                leader_tls_servername = "vault-1.vault-internal.vault.svc.cluster.local"
+              }
+              retry_join {
+                leader_api_addr       = "https://vault-2.vault-internal.vault.svc.cluster.local:8200"
+                leader_ca_cert_file   = "/vault/userconfig/vault-server-tls/ca.crt"
+                leader_tls_servername = "vault-2.vault-internal.vault.svc.cluster.local"
+              }
+            }
+
+            service_registration "kubernetes" {}
+      dataStorage:
+        enabled: true
+        size: 10Gi
+        storageClass: openebs-hostpath
+        accessMode: ReadWriteOnce
+      auditStorage:
+        enabled: true
+        size: 5Gi
+        storageClass: openebs-hostpath
+        accessMode: ReadWriteOnce
+      serviceAccount:
+        create: true
+      podDisruptionBudget:
+        maxUnavailable: 1
+      statefulSet:
+        securityContext:
+          container:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+    ui:
+      enabled: true
+      serviceType: ClusterIP
+    injector:
+      enabled: false
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: vault-secrets-operator
+  namespace: vault
+spec:
+  interval: 15m
+  releaseName: vault-secrets-operator
+  targetNamespace: vault
+  dependsOn:
+    - name: vault
+  chart:
+    spec:
+      chart: vault-secrets-operator
+      version: "1.6.2"
+      sourceRef:
+        kind: HelmRepository
+        name: hashicorp
+        namespace: flux-system
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    controller:
+      replicas: 2
+      manager:
+        image:
+          tag: "1.6.2@sha256:8f77bc42ac47a4a1b2d1bb8b3a398fc53c19b3ce626002824a87ceb6cf91e5ad"
+      kubeRbacProxy:
+        image:
+          tag: "v0.23.1@sha256:c280684dd23793fb2f287d1f4efc84b7800b3e01205d770b98694827bfe514cb"
+      securityContext:
+        allowPrivilegeEscalation: false
+        capabilities:
+          drop:
+            - ALL
+      podDisruptionBudget:
+        enabled: true
+        minAvailable: 1
+        maxUnavailable: ""