apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: vault
  namespace: argocd
  finalizers:
  - resources-finalizer.argocd.argoproj.io
spec:
  syncPolicy:
    syncOptions:
      - CreateNamespace=true 
  project: default
  sources:
    - chart: vault
      repoURL: https://helm.releases.hashicorp.com
      targetRevision: 0.28.1
      helm:
        valueObject:
          global:
            enabled: true
            tlsDisable: false
          injector:
            enabled: true
          server:
            extraEnvironmentVars:
                VAULT_CACERT: /vault/userconfig/vault-ha-tls/vault.ca
                VAULT_TLSCERT: /vault/userconfig/vault-ha-tls/vault.crt
                VAULT_TLSKEY: /vault/userconfig/vault-ha-tls/vault.key
            volumes:
                - name: userconfig-vault-ha-tls
                  secret:
                  defaultMode: 420
                  secretName: vault-ha-tls
            volumeMounts:
                - mountPath: /vault/userconfig/vault-ha-tls
                  name: userconfig-vault-ha-tls
                  readOnly: true
            standalone:
                enabled: false
            affinity: ""
            ha:
              enabled: true
              replicas: "3"
              raft:
                enabled: true
                setNodeId: true
                config: |
                    cluster_name = "vault-integrated-storage"
                    ui = true
                    listener "tcp" {
                      tls_disable = 0
                      address = "[::]:8200"
                      cluster_address = "[::]:8201"
                      tls_cert_file = "/vault/userconfig/vault-ha-tls/vault.crt"
                      tls_key_file  = "/vault/userconfig/vault-ha-tls/vault.key"
                      tls_client_ca_file = "/vault/userconfig/vault-ha-tls/vault.ca"
                    }
                    storage "raft" {
                      path = "/vault/data"
                    }
                    disable_mlock = true
                    service_registration "kubernetes" {}


  destination:
    server: https://kubernetes.default.svc
    namespace: vault