---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: vault
  namespace: vault
spec:
  interval: 15m
  releaseName: vault
  targetNamespace: vault
  chart:
    spec:
      chart: vault
      version: "0.34.1"
      sourceRef:
        kind: HelmRepository
        name: hashicorp
        namespace: flux-system
  install:
    createNamespace: true
    remediation:
      retries: 3
  upgrade:
    remediation:
      retries: 3
  # Keep the established named target stable across pod revisions.
  postRenderers:
    - kustomize:
        patches:
          - target:
              kind: StatefulSet
              name: vault
            patch: |-
              - op: replace
                path: /spec/template/spec/containers/0/ports/0/name
                value: https-migration
              - op: replace
                path: /spec/template/spec/containers/0/readinessProbe/exec/command
                value:
                  - /bin/sh
                  - -ec
                  - vault status -address=https://127.0.0.1:8200 -ca-cert=/vault/userconfig/vault-server-tls/ca.crt -tls-server-name=vault-active-direct.vault.svc.cluster.local
  values:
    global:
      enabled: true
      tlsDisable: false
    server:
      image:
        repository: hashicorp/vault
        tag: "2.2.1@sha256:962a92876e168d68eaaa24b0b8b49bbce1cb63024060a67bba95cd158a366fc2"
      annotations:
        certificates.quorate.internal/activation: '{"vault":"native"}'
      volumes:
        - name: vault-server-tls
          secret:
            secretName: vault-server-tls
            defaultMode: 0440
      volumeMounts:
        - name: vault-server-tls
          mountPath: /vault/userconfig/vault-server-tls
          readOnly: true
      resources:
        requests:
          cpu: 50m
          memory: 256Mi
        limits:
          memory: 512Mi
      affinity: |
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            - labelSelector:
                matchLabels:
                  app.kubernetes.io/name: vault
                  component: server
              topologyKey: kubernetes.io/hostname
      ha:
        enabled: true
        replicas: 3
        apiAddr: https://$(VAULT_K8S_POD_NAME).vault-internal.vault.svc.cluster.local:8200
        raft:
          enabled: true
          setNodeId: true
          config: |
            ui = true

            listener "tcp" {
              address                  = "[::]:8200"
              cluster_address          = "[::]:8201"
              tls_cert_file            = "/vault/userconfig/vault-server-tls/tls.crt"
              tls_key_file             = "/vault/userconfig/vault-server-tls/tls.key"
              tls_reload_interval      = "1s"
              tls_min_version          = "tls12"
              tls_disable_client_certs = true
            }

            storage "raft" {
              path    = "/vault/data"
              retry_join {
                leader_api_addr       = "https://vault-0.vault-internal.vault.svc.cluster.local:8200"
                leader_ca_cert_file   = "/vault/userconfig/vault-server-tls/ca.crt"
                leader_tls_servername = "vault-0.vault-internal.vault.svc.cluster.local"
              }
              retry_join {
                leader_api_addr       = "https://vault-1.vault-internal.vault.svc.cluster.local:8200"
                leader_ca_cert_file   = "/vault/userconfig/vault-server-tls/ca.crt"
                leader_tls_servername = "vault-1.vault-internal.vault.svc.cluster.local"
              }
              retry_join {
                leader_api_addr       = "https://vault-2.vault-internal.vault.svc.cluster.local:8200"
                leader_ca_cert_file   = "/vault/userconfig/vault-server-tls/ca.crt"
                leader_tls_servername = "vault-2.vault-internal.vault.svc.cluster.local"
              }
            }

            service_registration "kubernetes" {}
      dataStorage:
        enabled: true
        size: 10Gi
        storageClass: openebs-hostpath
        accessMode: ReadWriteOnce
      auditStorage:
        enabled: true
        size: 5Gi
        storageClass: openebs-hostpath
        accessMode: ReadWriteOnce
      serviceAccount:
        create: true
      podDisruptionBudget:
        maxUnavailable: 1
      statefulSet:
        securityContext:
          container:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - ALL
    ui:
      enabled: true
      serviceType: ClusterIP
    injector:
      enabled: false
---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: vault-secrets-operator
  namespace: vault
spec:
  interval: 15m
  releaseName: vault-secrets-operator
  targetNamespace: vault
  dependsOn:
    - name: vault
  chart:
    spec:
      chart: vault-secrets-operator
      version: "1.6.2"
      sourceRef:
        kind: HelmRepository
        name: hashicorp
        namespace: flux-system
  install:
    remediation:
      retries: 3
  upgrade:
    remediation:
      retries: 3
  values:
    controller:
      replicas: 2
      manager:
        image:
          tag: "1.6.2@sha256:8f77bc42ac47a4a1b2d1bb8b3a398fc53c19b3ce626002824a87ceb6cf91e5ad"
      kubeRbacProxy:
        image:
          tag: "v0.23.1@sha256:c280684dd23793fb2f287d1f4efc84b7800b3e01205d770b98694827bfe514cb"
      securityContext:
        allowPrivilegeEscalation: false
        capabilities:
          drop:
            - ALL
      podDisruptionBudget:
        enabled: true
        minAvailable: 1
        maxUnavailable: ""