apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: vault-unseal
  namespace: vault-unseal
spec:
  interval: 5m
  timeout: 15m
  values:
    global:
      namespace: vault-unseal
    autounseal:
      enabled: false
    backup:
      enabled: true
      schedule: "0 19 * * *"
      timeZone: "Europe/Moscow"
      secret:
        name: "vault-unseal-backup-s3"
        endpoint: "https://storage.yandexcloud.net"
        prefix: "vault/yc-infra-prod/unseal-raft-snapshots"
    injector:
      enabled: false
    server:
      includeConfigAnnotation: true
      ha:
        replicas: 3
        raft:
          config: |
            ui = true

            listener "tcp" {
              tls_disable = 1
              address = "[::]:8200"
              cluster_address = "[::]:8201"
            }

            storage "raft" {
              path = "/vault/data"

              retry_join {
                leader_api_addr = "http://{{ template "vault.fullname" . }}-0.{{ template "vault.fullname" . }}-internal:8200"
              }
              retry_join {
                leader_api_addr = "http://{{ template "vault.fullname" . }}-1.{{ template "vault.fullname" . }}-internal:8200"
              }
              retry_join {
                leader_api_addr = "http://{{ template "vault.fullname" . }}-2.{{ template "vault.fullname" . }}-internal:8200"
              }
            }

            {{- if .Values.autounseal.enabled }}
            seal "transit" {
              address         = "{{ .Values.autounseal.transit.address }}"
              token           = "env://VAULT_TOKEN"
              key_name        = "{{ .Values.autounseal.transit.keyName }}"
              mount_path      = "{{ .Values.autounseal.transit.mountPath }}"
              disable_renewal = "{{ .Values.autounseal.transit.disableRenewal }}"
              tls_skip_verify = "{{ .Values.autounseal.transit.tlsSkipVerify }}"
            }
            {{- end }}

            service_registration "kubernetes" {}

            telemetry {
              prometheus_retention_time = "30s"
              disable_hostname = true
            }
      dataStorage:
        size: 10Gi