185 lines
5.5 KiB
YAML
185 lines
5.5 KiB
YAML
---
|
|
apiVersion: helm.toolkit.fluxcd.io/v2
|
|
kind: HelmRelease
|
|
metadata:
|
|
name: vault
|
|
namespace: vault
|
|
spec:
|
|
interval: 15m
|
|
releaseName: vault
|
|
targetNamespace: vault
|
|
chart:
|
|
spec:
|
|
chart: vault
|
|
version: "0.34.1"
|
|
sourceRef:
|
|
kind: HelmRepository
|
|
name: hashicorp
|
|
namespace: flux-system
|
|
install:
|
|
createNamespace: true
|
|
remediation:
|
|
retries: 3
|
|
upgrade:
|
|
remediation:
|
|
retries: 3
|
|
# Keep the established named target stable across pod revisions.
|
|
postRenderers:
|
|
- kustomize:
|
|
patches:
|
|
- target:
|
|
kind: StatefulSet
|
|
name: vault
|
|
patch: |-
|
|
- op: replace
|
|
path: /spec/template/spec/containers/0/ports/0/name
|
|
value: https-migration
|
|
- op: replace
|
|
path: /spec/template/spec/containers/0/readinessProbe/exec/command
|
|
value:
|
|
- /bin/sh
|
|
- -ec
|
|
- vault status -address=https://127.0.0.1:8200 -ca-cert=/vault/userconfig/vault-server-tls/ca.crt -tls-server-name=vault-active-direct.vault.svc.cluster.local
|
|
values:
|
|
global:
|
|
enabled: true
|
|
tlsDisable: false
|
|
server:
|
|
image:
|
|
repository: hashicorp/vault
|
|
tag: "2.2.1@sha256:962a92876e168d68eaaa24b0b8b49bbce1cb63024060a67bba95cd158a366fc2"
|
|
annotations:
|
|
certificates.quorate.internal/activation: '{"vault":"native"}'
|
|
volumes:
|
|
- name: vault-server-tls
|
|
secret:
|
|
secretName: vault-server-tls
|
|
defaultMode: 0440
|
|
volumeMounts:
|
|
- name: vault-server-tls
|
|
mountPath: /vault/userconfig/vault-server-tls
|
|
readOnly: true
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 256Mi
|
|
limits:
|
|
memory: 512Mi
|
|
affinity: |
|
|
podAntiAffinity:
|
|
requiredDuringSchedulingIgnoredDuringExecution:
|
|
- labelSelector:
|
|
matchLabels:
|
|
app.kubernetes.io/name: vault
|
|
component: server
|
|
topologyKey: kubernetes.io/hostname
|
|
ha:
|
|
enabled: true
|
|
replicas: 3
|
|
apiAddr: https://$(VAULT_K8S_POD_NAME).vault-internal.vault.svc.cluster.local:8200
|
|
raft:
|
|
enabled: true
|
|
setNodeId: true
|
|
config: |
|
|
ui = true
|
|
|
|
listener "tcp" {
|
|
address = "[::]:8200"
|
|
cluster_address = "[::]:8201"
|
|
tls_cert_file = "/vault/userconfig/vault-server-tls/tls.crt"
|
|
tls_key_file = "/vault/userconfig/vault-server-tls/tls.key"
|
|
tls_reload_interval = "1s"
|
|
tls_min_version = "tls12"
|
|
tls_disable_client_certs = true
|
|
}
|
|
|
|
storage "raft" {
|
|
path = "/vault/data"
|
|
retry_join {
|
|
leader_api_addr = "https://vault-0.vault-internal.vault.svc.cluster.local:8200"
|
|
leader_ca_cert_file = "/vault/userconfig/vault-server-tls/ca.crt"
|
|
leader_tls_servername = "vault-0.vault-internal.vault.svc.cluster.local"
|
|
}
|
|
retry_join {
|
|
leader_api_addr = "https://vault-1.vault-internal.vault.svc.cluster.local:8200"
|
|
leader_ca_cert_file = "/vault/userconfig/vault-server-tls/ca.crt"
|
|
leader_tls_servername = "vault-1.vault-internal.vault.svc.cluster.local"
|
|
}
|
|
retry_join {
|
|
leader_api_addr = "https://vault-2.vault-internal.vault.svc.cluster.local:8200"
|
|
leader_ca_cert_file = "/vault/userconfig/vault-server-tls/ca.crt"
|
|
leader_tls_servername = "vault-2.vault-internal.vault.svc.cluster.local"
|
|
}
|
|
}
|
|
|
|
service_registration "kubernetes" {}
|
|
dataStorage:
|
|
enabled: true
|
|
size: 10Gi
|
|
storageClass: openebs-hostpath
|
|
accessMode: ReadWriteOnce
|
|
auditStorage:
|
|
enabled: true
|
|
size: 5Gi
|
|
storageClass: openebs-hostpath
|
|
accessMode: ReadWriteOnce
|
|
serviceAccount:
|
|
create: true
|
|
podDisruptionBudget:
|
|
maxUnavailable: 1
|
|
statefulSet:
|
|
securityContext:
|
|
container:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
ui:
|
|
enabled: true
|
|
serviceType: ClusterIP
|
|
injector:
|
|
enabled: false
|
|
---
|
|
apiVersion: helm.toolkit.fluxcd.io/v2
|
|
kind: HelmRelease
|
|
metadata:
|
|
name: vault-secrets-operator
|
|
namespace: vault
|
|
spec:
|
|
interval: 15m
|
|
releaseName: vault-secrets-operator
|
|
targetNamespace: vault
|
|
dependsOn:
|
|
- name: vault
|
|
chart:
|
|
spec:
|
|
chart: vault-secrets-operator
|
|
version: "1.6.2"
|
|
sourceRef:
|
|
kind: HelmRepository
|
|
name: hashicorp
|
|
namespace: flux-system
|
|
install:
|
|
remediation:
|
|
retries: 3
|
|
upgrade:
|
|
remediation:
|
|
retries: 3
|
|
values:
|
|
controller:
|
|
replicas: 2
|
|
manager:
|
|
image:
|
|
tag: "1.6.2@sha256:8f77bc42ac47a4a1b2d1bb8b3a398fc53c19b3ce626002824a87ceb6cf91e5ad"
|
|
kubeRbacProxy:
|
|
image:
|
|
tag: "v0.23.1@sha256:c280684dd23793fb2f287d1f4efc84b7800b3e01205d770b98694827bfe514cb"
|
|
securityContext:
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
podDisruptionBudget:
|
|
enabled: true
|
|
minAvailable: 1
|
|
maxUnavailable: ""
|