Move file vault

2026-09-17 18:22:54 +02:00 · 2024-09-07 09:26:56 +02:00
parent 0d1e07ed90
commit 477c852bf8
1 changed files with 67 additions and 0 deletions
@@ -0,0 +1,67 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: vault
+  namespace: argocd
+  finalizers:
+  - resources-finalizer.argocd.argoproj.io
+spec:
+  syncPolicy:
+    syncOptions:
+      - CreateNamespace=true 
+  project: default
+  sources:
+    - chart: vault
+      repoURL: https://helm.releases.hashicorp.com
+      targetRevision: 0.28.1
+      helm:
+        valueObject:
+          global:
+            enabled: true
+            tlsDisable: false
+          injector:
+            enabled: true
+          server:
+            extraEnvironmentVars:
+                VAULT_CACERT: /vault/userconfig/vault-ha-tls/vault.ca
+                VAULT_TLSCERT: /vault/userconfig/vault-ha-tls/vault.crt
+                VAULT_TLSKEY: /vault/userconfig/vault-ha-tls/vault.key
+            volumes:
+                - name: userconfig-vault-ha-tls
+                  secret:
+                  defaultMode: 420
+                  secretName: vault-ha-tls
+            volumeMounts:
+                - mountPath: /vault/userconfig/vault-ha-tls
+                  name: userconfig-vault-ha-tls
+                  readOnly: true
+            standalone:
+                enabled: false
+            affinity: {}
+            ha:
+              enabled: true
+              replicas: 3
+              raft:
+                enabled: true
+                setNodeId: true
+                config: |
+                    cluster_name = "vault-integrated-storage"
+                    ui = true
+                    listener "tcp" {
+                      tls_disable = 0
+                      address = "[::]:8200"
+                      cluster_address = "[::]:8201"
+                      tls_cert_file = "/vault/userconfig/vault-ha-tls/vault.crt"
+                      tls_key_file  = "/vault/userconfig/vault-ha-tls/vault.key"
+                      tls_client_ca_file = "/vault/userconfig/vault-ha-tls/vault.ca"
+                    }
+                    storage "raft" {
+                      path = "/vault/data"
+                    }
+                    disable_mlock = true
+                    service_registration "kubernetes" {}
+
+
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: vault