sarex/iac
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

++ enable vault prometheus metrics

Browse Source
This commit is contained in:
Kochetkov S 2026-07-01 17:10:16 +03:00
parent 547cd4ecf4
commit 6a111ccc18
2 changed files with 84 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

42
clusters/yc-infra-prod/infrastructure/patches/vault-unseal.yaml
View File

@ -22,7 +22,49 @@ spec:
injector:
enabled: false
server:
includeConfigAnnotation: true
ha:
replicas: 3
raft:
config: |
ui = true
listener "tcp" {
tls_disable = 1
address = "[::]:8200"
cluster_address = "[::]:8201"
}
storage "raft" {
path = "/vault/data"
retry_join {
leader_api_addr = "http://{{ template "vault.fullname" . }}-0.{{ template "vault.fullname" . }}-internal:8200"
}
retry_join {
leader_api_addr = "http://{{ template "vault.fullname" . }}-1.{{ template "vault.fullname" . }}-internal:8200"
}
retry_join {
leader_api_addr = "http://{{ template "vault.fullname" . }}-2.{{ template "vault.fullname" . }}-internal:8200"
}
}
{{- if .Values.autounseal.enabled }}
seal "transit" {
address = "{{ .Values.autounseal.transit.address }}"
token = "env://VAULT_TOKEN"
key_name = "{{ .Values.autounseal.transit.keyName }}"
mount_path = "{{ .Values.autounseal.transit.mountPath }}"
disable_renewal = "{{ .Values.autounseal.transit.disableRenewal }}"
tls_skip_verify = "{{ .Values.autounseal.transit.tlsSkipVerify }}"
}
{{- end }}
service_registration "kubernetes" {}
telemetry {
prometheus_retention_time = "30s"
disable_hostname = true
}
dataStorage:
size: 10Gi

42
clusters/yc-infra-prod/infrastructure/patches/vault.yaml
View File

@ -29,7 +29,49 @@ spec:
endpoint: "https://storage.yandexcloud.net"
prefix: "vault/yc-infra-prod/raft-snapshots"
server:
includeConfigAnnotation: true
dataStorage:
size: 20Gi
ha:
replicas: 3
raft:
config: |
ui = true
listener "tcp" {
tls_disable = 1
address = "[::]:8200"
cluster_address = "[::]:8201"
}
storage "raft" {
path = "/vault/data"
retry_join {
leader_api_addr = "http://{{ template "vault.fullname" . }}-0.{{ template "vault.fullname" . }}-internal:8200"
}
retry_join {
leader_api_addr = "http://{{ template "vault.fullname" . }}-1.{{ template "vault.fullname" . }}-internal:8200"
}
retry_join {
leader_api_addr = "http://{{ template "vault.fullname" . }}-2.{{ template "vault.fullname" . }}-internal:8200"
}
}
{{- if .Values.autounseal.enabled }}
seal "transit" {
address = "{{ .Values.autounseal.transit.address }}"
token = "env://VAULT_TOKEN"
key_name = "{{ .Values.autounseal.transit.keyName }}"
mount_path = "{{ .Values.autounseal.transit.mountPath }}"
disable_renewal = "{{ .Values.autounseal.transit.disableRenewal }}"
tls_skip_verify = "{{ .Values.autounseal.transit.tlsSkipVerify }}"
}
{{- end }}
service_registration "kubernetes" {}
telemetry {
prometheus_retention_time = "30s"
disable_hostname = true
}