apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: vault
  namespace: vault
spec:
  interval: 5m
  timeout: 10m
  install:
    disableWait: true
  upgrade:
    disableWait: true
  postRenderers:
    - kustomize:
        patches:
          - target:
              group: apps
              version: v1
              kind: StatefulSet
              namespace: vault
              name: vault-vault-contour
            patch: |-
              - op: replace
                path: /spec/template/spec/nodeSelector
                value:
                  dedicated: generic
              - op: replace
                path: /spec/template/spec/tolerations
                value: []
  values:
    global:
      namespace: vault
      imagePullSecrets:
        - name: regcred
    backup:
      enabled: false
    injector:
      nodeSelector:
        dedicated: generic
      tolerations: []
    server:
      includeConfigAnnotation: true
      nodeSelector:
        dedicated: generic
      tolerations: []
      dataStorage:
        size: 10Gi
        storageClass: ${STORAGE_CLASS}
      volumes:
        - name: unseal-keys
          secret:
            secretName: vault-unseal-keys
            optional: true
            defaultMode: 0440
      extraContainers:
        - name: unsealer
          image: cr.yandex/crp3ccidau046kdj8g9q/vault/vault:1.21.2
          imagePullPolicy: IfNotPresent
          env:
            - name: VAULT_ADDR
              value: http://127.0.0.1:8200
          command:
            - /bin/sh
            - -c
            - |
              while true; do
                if vault status >/dev/null 2>&1; then
                  :
                else
                  rc=$?
                  if [ "$rc" -eq 2 ]; then
                    if [ -s /vault/unseal-keys/key1 ] && [ -s /vault/unseal-keys/key2 ] && [ -s /vault/unseal-keys/key3 ]; then
                      for k in key1 key2 key3; do
                        vault operator unseal "$(cat /vault/unseal-keys/$k)" >/dev/null 2>&1 || echo "unseal call failed"
                      done
                      if vault status >/dev/null 2>&1; then echo "unsealed"; else echo "still sealed"; fi
                    else
                      echo "sealed, keys not mounted"
                    fi
                  fi
                fi
                sleep 10
              done
          volumeMounts:
            - name: unseal-keys
              mountPath: /vault/unseal-keys
              readOnly: true
          resources:
            requests:
              cpu: 10m
              memory: 16Mi
            limits:
              memory: 64Mi
      ha:
        replicas: 1
        raft:
          config: |
            ui = true

            listener "tcp" {
              tls_disable = 1
              address = "[::]:8200"
              cluster_address = "[::]:8201"
            }

            storage "raft" {
              path = "/vault/data"
            }

            service_registration "kubernetes" {}