76 lines
1.8 KiB
YAML
76 lines
1.8 KiB
YAML
---
|
|
apiVersion: helm.toolkit.fluxcd.io/v2
|
|
kind: HelmRelease
|
|
metadata:
|
|
name: vault
|
|
spec:
|
|
chart:
|
|
spec:
|
|
chart: vault
|
|
version: 0.34.1
|
|
sourceRef:
|
|
kind: HelmRepository
|
|
name: hashicorp
|
|
interval: 1h
|
|
maxHistory: 3
|
|
install:
|
|
crds: CreateReplace
|
|
remediation:
|
|
retries: 3
|
|
upgrade:
|
|
crds: CreateReplace
|
|
cleanupOnFail: true
|
|
remediation:
|
|
retries: 3
|
|
values:
|
|
global:
|
|
enabled: true
|
|
tlsDisable: true
|
|
injector:
|
|
enabled: false
|
|
csi:
|
|
enabled: false
|
|
server:
|
|
# standalone + integrated storage (raft) на PVC. После рестарта пода Vault
|
|
# остаётся запечатанным (sealed) — распечатывается вручную ключами из
|
|
# Shamir-схемы (key-shares=5, key-threshold=3).
|
|
# authDelegator нужен для auth-метода kubernetes, через который
|
|
# external-secrets получает токен (TokenReview).
|
|
authDelegator:
|
|
enabled: true
|
|
standalone:
|
|
enabled: true
|
|
config: |
|
|
ui = true
|
|
|
|
listener "tcp" {
|
|
address = "[::]:8200"
|
|
cluster_address = "[::]:8201"
|
|
tls_disable = 1
|
|
}
|
|
|
|
storage "raft" {
|
|
path = "/vault/data"
|
|
}
|
|
|
|
service_registration "kubernetes" {}
|
|
dataStorage:
|
|
enabled: true
|
|
size: 5Gi
|
|
storageClass: openebs-hostpath
|
|
accessMode: ReadWriteOnce
|
|
service:
|
|
enabled: true
|
|
type: ClusterIP
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 256Mi
|
|
limits:
|
|
memory: 512Mi
|
|
ui:
|
|
enabled: true
|
|
serviceType: ClusterIP
|
|
externalPort: 8200
|
|
targetPort: 8200
|