vault.yaml

---
apiVersion: helm.toolkit.fluxcd.io/v2beta1
kind: HelmRelease
metadata:
  name: vault
  namespace: kube-system
spec:
  interval: 5m
  chart:
    spec:
      # renovate: registryUrl=https://helm.releases.hashicorp.com
      chart: vault
      version: 0.19.0
      sourceRef:
        kind: HelmRepository
        name: hashicorp-charts
        namespace: flux-system
      interval: 5m
  values:
    server:
      dataStorage:
        enabled: true
        storageClass: "rook-ceph-block"
      extraEnvironmentVars:
        GOOGLE_APPLICATION_CREDENTIALS: /vault/userconfig/kms-vault/account.json
      extraVolumes:
        - type: secret
          name: kms-vault
          path: /vault/userconfig
      tolerations: |
        - key: "arm"
          operator: "Exists"
      annotations:
        backup.velero.io/backup-volumes: data
      resources:
        requests:
          memory: 256Mi
          cpu: 250m
        limits:
          memory: 256Mi
      standalone:
        enabled: false
      ha:
        enabled: true
        replicas: 3
        raft:
          enabled: true
          setNodeId: true
          config: |
            ui = true
            listener "tcp" {
              tls_disable = 1
              address = "[::]:8200"
              cluster_address = "[::]:8201"
            }
            storage "raft" {
              path = "/vault/data"
            }
            seal "gcpckms" {
              project     = "kms-vault"
              region      = "global"
              key_ring    = "vault-unseal"
              crypto_key  = "vault-key"
            }
            service_registration "kubernetes" {}
    ui:
      enabled: true
      serviceType: "ClusterIP"