mirror of
https://github.com/rubenhensen/k8scd.git
synced 2026-11-15 14:29:09 +01:00
Ruben Hensen
b86942077a
Dropping the anti-affinity wasn't enough: during the rollout the old ReplicaSet kept recreating its pod with the old anti-affinity, which still blocked the new one. Recreate stops the old pod first; nothing uses the injector, so the short gap doesn't matter.
55 lines
1.6 KiB
YAML
55 lines
1.6 KiB
YAML
global:
|
|
enabled: true
|
|
tlsDisable: true
|
|
injector:
|
|
enabled: true
|
|
# The chart's default anti-affinity forbids two injector pods on one
|
|
# node, so on this single node a rolling update can never start the new
|
|
# pod while the old one runs. Recreate removes the old pod first, which
|
|
# also gets past pods that still carry the old anti-affinity.
|
|
affinity: ""
|
|
strategy:
|
|
type: Recreate
|
|
rollingUpdate: null
|
|
server:
|
|
# Pinned to the running version: the chart would otherwise pull its own
|
|
# default on the next pod restart, and with Shamir unsealing a Vault
|
|
# upgrade needs someone with the unseal keys at hand.
|
|
image:
|
|
tag: "1.17.2"
|
|
dataStorage:
|
|
storageClass: longhorn
|
|
standalone:
|
|
enabled: false
|
|
affinity: ""
|
|
ha:
|
|
enabled: true
|
|
replicas: 3
|
|
raft:
|
|
enabled: true
|
|
setNodeId: true
|
|
config: |
|
|
cluster_name = "vault-integrated-storage"
|
|
ui = true
|
|
listener "tcp" {
|
|
tls_disable = 1
|
|
address = "[::]:8200"
|
|
cluster_address = "[::]:8201"
|
|
}
|
|
storage "raft" {
|
|
path = "/vault/data"
|
|
}
|
|
disable_mlock = true
|
|
service_registration "kubernetes" {}
|
|
ingress:
|
|
enabled: true
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: prod-cluster-issuer
|
|
ingressClassName: nginx
|
|
tls:
|
|
- secretName: letsencrypt-prod
|
|
hosts:
|
|
- vault.rubenhensen.nl
|
|
hosts:
|
|
- host: "vault.rubenhensen.nl"
|