feat(storage,security): openebs localpv (default StorageClass) + vault

2026-09-16 21:17:09 +00:00
parent 6b1fc54c0d
commit 8c14178bd9
13 changed files with 241 additions and 0 deletions
@@ -0,0 +1,75 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: vault
+spec:
+  chart:
+    spec:
+      chart: vault
+      version: 0.34.1
+      sourceRef:
+        kind: HelmRepository
+        name: hashicorp
+  interval: 1h
+  maxHistory: 3
+  install:
+    crds: CreateReplace
+    remediation:
+      retries: 3
+  upgrade:
+    crds: CreateReplace
+    cleanupOnFail: true
+    remediation:
+      retries: 3
+  values:
+    global:
+      enabled: true
+      tlsDisable: true
+    injector:
+      enabled: false
+    csi:
+      enabled: false
+    server:
+      # standalone + integrated storage (raft) на PVC. После рестарта пода Vault
+      # остаётся запечатанным (sealed) — распечатывается вручную ключами из
+      # Shamir-схемы (key-shares=5, key-threshold=3).
+      # authDelegator нужен для auth-метода kubernetes, через который
+      # external-secrets получает токен (TokenReview).
+      authDelegator:
+        enabled: true
+      standalone:
+        enabled: true
+        config: |
+          ui = true
+
+          listener "tcp" {
+            address         = "[::]:8200"
+            cluster_address = "[::]:8201"
+            tls_disable     = 1
+          }
+
+          storage "raft" {
+            path = "/vault/data"
+          }
+
+          service_registration "kubernetes" {}
+      dataStorage:
+        enabled: true
+        size: 5Gi
+        storageClass: openebs-hostpath
+        accessMode: ReadWriteOnce
+      service:
+        enabled: true
+        type: ClusterIP
+      resources:
+        requests:
+          cpu: 100m
+          memory: 256Mi
+        limits:
+          memory: 512Mi
+    ui:
+      enabled: true
+      serviceType: ClusterIP
+      externalPort: 8200
+      targetPort: 8200