111 lines
3.0 KiB
YAML
111 lines
3.0 KiB
YAML
apiVersion: helm.toolkit.fluxcd.io/v2
|
|
kind: HelmRelease
|
|
metadata:
|
|
name: vault
|
|
namespace: vault
|
|
spec:
|
|
interval: 5m
|
|
timeout: 10m
|
|
install:
|
|
disableWait: true
|
|
upgrade:
|
|
disableWait: true
|
|
postRenderers:
|
|
- kustomize:
|
|
patches:
|
|
- target:
|
|
group: apps
|
|
version: v1
|
|
kind: StatefulSet
|
|
namespace: vault
|
|
name: vault-vault-contour
|
|
patch: |-
|
|
- op: replace
|
|
path: /spec/template/spec/nodeSelector
|
|
value:
|
|
dedicated: generic
|
|
- op: replace
|
|
path: /spec/template/spec/tolerations
|
|
value: []
|
|
values:
|
|
global:
|
|
namespace: vault
|
|
imagePullSecrets:
|
|
- name: regcred
|
|
backup:
|
|
enabled: false
|
|
injector:
|
|
nodeSelector:
|
|
dedicated: generic
|
|
tolerations: []
|
|
server:
|
|
includeConfigAnnotation: true
|
|
nodeSelector:
|
|
dedicated: generic
|
|
tolerations: []
|
|
dataStorage:
|
|
size: 10Gi
|
|
storageClass: ${STORAGE_CLASS}
|
|
volumes:
|
|
- name: unseal-keys
|
|
secret:
|
|
secretName: vault-unseal-keys
|
|
optional: true
|
|
defaultMode: 0440
|
|
extraContainers:
|
|
- name: unsealer
|
|
image: cr.yandex/crp3ccidau046kdj8g9q/vault/vault:1.21.2
|
|
imagePullPolicy: IfNotPresent
|
|
env:
|
|
- name: VAULT_ADDR
|
|
value: http://127.0.0.1:8200
|
|
command:
|
|
- /bin/sh
|
|
- -c
|
|
- |
|
|
while true; do
|
|
if vault status >/dev/null 2>&1; then
|
|
:
|
|
else
|
|
rc=$?
|
|
if [ "$rc" -eq 2 ]; then
|
|
if [ -s /vault/unseal-keys/key1 ] && [ -s /vault/unseal-keys/key2 ] && [ -s /vault/unseal-keys/key3 ]; then
|
|
for k in key1 key2 key3; do
|
|
vault operator unseal "$(cat /vault/unseal-keys/$k)" >/dev/null 2>&1 || echo "unseal call failed"
|
|
done
|
|
if vault status >/dev/null 2>&1; then echo "unsealed"; else echo "still sealed"; fi
|
|
else
|
|
echo "sealed, keys not mounted"
|
|
fi
|
|
fi
|
|
fi
|
|
sleep 10
|
|
done
|
|
volumeMounts:
|
|
- name: unseal-keys
|
|
mountPath: /vault/unseal-keys
|
|
readOnly: true
|
|
resources:
|
|
requests:
|
|
cpu: 10m
|
|
memory: 16Mi
|
|
limits:
|
|
memory: 64Mi
|
|
ha:
|
|
replicas: 1
|
|
raft:
|
|
config: |
|
|
ui = true
|
|
|
|
listener "tcp" {
|
|
tls_disable = 1
|
|
address = "[::]:8200"
|
|
cluster_address = "[::]:8201"
|
|
}
|
|
|
|
storage "raft" {
|
|
path = "/vault/data"
|
|
}
|
|
|
|
service_registration "kubernetes" {}
|