From d8440a791d98a55540a2af301c66449505b7deb2 Mon Sep 17 00:00:00 2001
From: Ruben Hensen <ruben.hensen@protonmail.com>
Date: Sun, 8 Sep 2024 13:42:42 +0200
Subject: [PATCH] Add helm-vault with values override

---
 vault/helm-vault.yaml | 28 +++++++++++++++++++++++++++
 vault/overrides.yaml  | 44 +++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 72 insertions(+)
 create mode 100644 vault/helm-vault.yaml
 create mode 100644 vault/overrides.yaml

diff --git a/vault/helm-vault.yaml b/vault/helm-vault.yaml
new file mode 100644
index 0000000..165a343
--- /dev/null
+++ b/vault/helm-vault.yaml
@@ -0,0 +1,28 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: helm-vault
+  namespace: argocd
+  finalizers:
+  - resources-finalizer.argocd.argoproj.io
+spec:
+  syncPolicy:
+    syncOptions:
+      - CreateNamespace=true 
+    automated:
+      selfHeal: true
+      prune: true
+  project: default
+  sources:
+    - chart: vault
+      repoURL: https://helm.releases.hashicorp.com
+      targetRevision: 0.28.1
+    - repoURL: https://github.com/rubenhensen/k8scd
+      path: vault
+      targetRevision: HEAD
+      helm:
+        valueFiles:
+          - $values/override.yaml
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: vault-system
\ No newline at end of file
diff --git a/vault/overrides.yaml b/vault/overrides.yaml
new file mode 100644
index 0000000..7ff621d
--- /dev/null
+++ b/vault/overrides.yaml
@@ -0,0 +1,44 @@
+global:
+   enabled: true
+   tlsDisable: false
+injector:
+   enabled: true
+server:
+   extraEnvironmentVars:
+      VAULT_CACERT: /vault/userconfig/vault-ha-tls/vault.ca
+      VAULT_TLSCERT: /vault/userconfig/vault-ha-tls/vault.crt
+      VAULT_TLSKEY: /vault/userconfig/vault-ha-tls/vault.key
+   volumes:
+      - name: userconfig-vault-ha-tls
+        secret:
+         defaultMode: 420
+         secretName: vault-ha-tls
+   volumeMounts:
+      - mountPath: /vault/userconfig/vault-ha-tls
+        name: userconfig-vault-ha-tls
+        readOnly: true
+   standalone:
+      enabled: false
+   affinity: ""
+   ha:
+      enabled: true
+      replicas: 3
+      raft:
+         enabled: true
+         setNodeId: true
+         config: |
+            cluster_name = "vault-integrated-storage"
+            ui = true
+            listener "tcp" {
+               tls_disable = 0
+               address = "[::]:8200"
+               cluster_address = "[::]:8201"
+               tls_cert_file = "/vault/userconfig/vault-ha-tls/vault.crt"
+               tls_key_file  = "/vault/userconfig/vault-ha-tls/vault.key"
+               tls_client_ca_file = "/vault/userconfig/vault-ha-tls/vault.ca"
+            }
+            storage "raft" {
+               path = "/vault/data"
+            }
+            disable_mlock = true
+            service_registration "kubernetes" {}