---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: vault
spec:
  chart:
    spec:
      chart: vault
      version: 0.34.1
      sourceRef:
        kind: HelmRepository
        name: hashicorp
  interval: 1h
  maxHistory: 3
  install:
    crds: CreateReplace
    remediation:
      retries: 3
  upgrade:
    crds: CreateReplace
    cleanupOnFail: true
    remediation:
      retries: 3
  values:
    global:
      enabled: true
      tlsDisable: true
    injector:
      enabled: false
    csi:
      enabled: false
    server:
      # standalone + integrated storage (raft) на PVC. После рестарта пода Vault
      # остаётся запечатанным (sealed) — распечатывается вручную ключами из
      # Shamir-схемы (key-shares=5, key-threshold=3).
      # authDelegator нужен для auth-метода kubernetes, через который
      # external-secrets получает токен (TokenReview).
      authDelegator:
        enabled: true
      standalone:
        enabled: true
        config: |
          ui = true

          listener "tcp" {
            address         = "[::]:8200"
            cluster_address = "[::]:8201"
            tls_disable     = 1
          }

          storage "raft" {
            path = "/vault/data"
          }

          service_registration "kubernetes" {}
      dataStorage:
        enabled: true
        size: 5Gi
        storageClass: openebs-hostpath
        accessMode: ReadWriteOnce
      service:
        enabled: true
        type: ClusterIP
      resources:
        requests:
          cpu: 100m
          memory: 256Mi
        limits:
          memory: 512Mi
    ui:
      enabled: true
      serviceType: ClusterIP
      externalPort: 8200
      targetPort: 8200