78 lines
2.3 KiB
YAML
78 lines
2.3 KiB
YAML
apiVersion: helm.toolkit.fluxcd.io/v2
|
|
kind: HelmRelease
|
|
metadata:
|
|
name: vault
|
|
namespace: vault
|
|
spec:
|
|
dependsOn:
|
|
- name: vault-unseal
|
|
namespace: vault-unseal
|
|
interval: 5m
|
|
timeout: 15m
|
|
values:
|
|
global:
|
|
namespace: vault
|
|
autounseal:
|
|
enabled: true
|
|
transit:
|
|
address: "http://vault-unseal-vault-contour.vault-unseal.svc:8200"
|
|
keyName: "vault-infra-prod"
|
|
mountPath: "transit/"
|
|
tlsSkipVerify: false
|
|
secret:
|
|
name: "vault-transit-autounseal"
|
|
backup:
|
|
schedule: "0 19 * * *"
|
|
timeZone: "Europe/Moscow"
|
|
secret:
|
|
name: "vault-backup-s3"
|
|
endpoint: "https://storage.yandexcloud.net"
|
|
prefix: "vault/yc-infra-prod/raft-snapshots"
|
|
server:
|
|
includeConfigAnnotation: true
|
|
dataStorage:
|
|
size: 20Gi
|
|
ha:
|
|
replicas: 3
|
|
raft:
|
|
config: |
|
|
ui = true
|
|
|
|
listener "tcp" {
|
|
tls_disable = 1
|
|
address = "[::]:8200"
|
|
cluster_address = "[::]:8201"
|
|
}
|
|
|
|
storage "raft" {
|
|
path = "/vault/data"
|
|
|
|
retry_join {
|
|
leader_api_addr = "http://{{ template "vault.fullname" . }}-0.{{ template "vault.fullname" . }}-internal:8200"
|
|
}
|
|
retry_join {
|
|
leader_api_addr = "http://{{ template "vault.fullname" . }}-1.{{ template "vault.fullname" . }}-internal:8200"
|
|
}
|
|
retry_join {
|
|
leader_api_addr = "http://{{ template "vault.fullname" . }}-2.{{ template "vault.fullname" . }}-internal:8200"
|
|
}
|
|
}
|
|
|
|
{{- if .Values.autounseal.enabled }}
|
|
seal "transit" {
|
|
address = "{{ .Values.autounseal.transit.address }}"
|
|
token = "env://VAULT_TOKEN"
|
|
key_name = "{{ .Values.autounseal.transit.keyName }}"
|
|
mount_path = "{{ .Values.autounseal.transit.mountPath }}"
|
|
disable_renewal = "{{ .Values.autounseal.transit.disableRenewal }}"
|
|
tls_skip_verify = "{{ .Values.autounseal.transit.tlsSkipVerify }}"
|
|
}
|
|
{{- end }}
|
|
|
|
service_registration "kubernetes" {}
|
|
|
|
telemetry {
|
|
prometheus_retention_time = "30s"
|
|
disable_hostname = true
|
|
}
|