apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: s3-proxy
  namespace: postgresql
spec:
  interval: 5m
  timeout: 10m
  values:
    s3ProxySecret:
      create: false
    universal-chart:
      services:
        s3proxy:
          serviceAccount:
            name:
              _default: postgresql
            podAutomountServiceAccountToken:
              _default: true
          podAnnotations:
            _default:
              vault.hashicorp.com/agent-init-first: "true"
              vault.hashicorp.com/agent-inject: "true"
              vault.hashicorp.com/agent-pre-populate-only: "true"
              vault.hashicorp.com/auth-path: "auth/kubernetes"
              vault.hashicorp.com/role: "postgresql"
              vault.hashicorp.com/agent-inject-secret-aws-credentials: "secrets/data/postgresql/s3"
              vault.hashicorp.com/agent-inject-template-aws-credentials: |
                {{- with secret "secrets/data/postgresql/s3" -}}
                [default]
                aws_access_key_id={{ .Data.data.access_key }}
                aws_secret_access_key={{ .Data.data.secret_key }}
                {{- end }}
          envs:
            - name: AWS_API_ENDPOINT
              value:
                _default: "https://storage.yandexcloud.net"
            - name: AWS_S3_BUCKET
              value:
                _default: "prod-pg-dumps"
            - name: AWS_REGION
              value:
                _default: "ru-central1"
            - name: AWS_SHARED_CREDENTIALS_FILE
              value:
                _default: "/vault/secrets/aws-credentials"
            - name: AWS_EC2_METADATA_DISABLED
              value:
                _default: "true"
            - name: ACCESS_LOG
              value:
                _default: "true"
            - name: CORS_ALLOW_HEADERS
              value:
                _default: "Content-Type, Accept-Ranges, Content-Range, Content-Encoding"
          secretEnvs: []