vault.yaml

apiVersion: v1
kind: Service
metadata:
  name: vault
  labels:
    app: vault
spec:
  clusterIP: None
  ports:
    - name: http
      port: 8200
    - name: server
      port: 8201
  selector:
    app: vault
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: vault
  labels:
    app: vault
spec:
  serviceName: "vault"
  selector:
    matchLabels:
      app: vault
  replicas: 1
  template:
    metadata:
      labels:
        app: vault
    spec:
      # affinity:
      #   podAntiAffinity:
      #     requiredDuringSchedulingIgnoredDuringExecution:
      #       - labelSelector:
      #           matchExpressions:
      #             - key: app
      #               operator: In
      #               values:
      #                 - vault
      #         topologyKey: kubernetes.io/hostname
      initContainers:
        - name: config
          image: busybox
          env:
            - name: NODE_IP
              valueFrom:
                fieldRef:
                  fieldPath: status.hostIP
          command: ["/bin/sh", "-c"]
          args:
            - |
                cat > /etc/vault/config/vault.hcl <<EOF
                listener "tcp" {
                  address = "0.0.0.0:8200"
                  tls_disable = "true"
                }
                storage "consul" {
                  address = "${NODE_IP}:8500"
                  scheme = "http"
                  path = "vault"
                  service_address = ""
                }
                ui = true
                EOF
          volumeMounts:
            - name: vault-config
              mountPath: /etc/vault/config
      containers:
        - name: vault-init
          image: vault-init:latest
          imagePullPolicy: IfNotPresent
        - name: vault
          image: vault
          args:
            - "server"
            - "-config=/etc/vault/config/vault.hcl"
          env:
            - name: "VAULT_API_ADDR"
              value: "http://0.0.0.0:8200"
          ports:
            - name: http
              containerPort: 8200
              protocol: "TCP"
            - name: server
              containerPort: 8201
              protocol: "TCP"
          securityContext:
            capabilities:
              add:
                - IPC_LOCK
          readinessProbe:
            httpGet:
              path: "/v1/sys/health?standbyok=true"
              port: 8200
              scheme: HTTP
            initialDelaySeconds: 5
            periodSeconds: 10
          volumeMounts:
            - name: vault-config
              mountPath: /etc/vault/config
      volumes:
        - name: vault-config
          emptyDir: {}